Keep it Unsupervised: Horizontal Attacks Meet Deep Learning

Guilherme Perin, Łukasz Chmielewski, Lejla Batina, Stjepan Picek

Research output: Contribution to journalArticleScientificpeer-review

28 Citations (Scopus)
111 Downloads (Pure)


To mitigate side-channel attacks, real-world implementations of public-key cryptosystems adopt state-of-the-art countermeasures based on randomization of the private or ephemeral keys. Usually, for each private key operation, a “scalar blinding” is performed using 32 or 64 randomly generated bits. Nevertheless, horizontal attacks based on a single trace still pose serious threats to protected ECC or RSA implementations. If the secrets learned through a single-trace attack contain too many wrong (or noisy) bits, the cryptanalysis methods for recovering remaining bits become impractical due to time and computational constraints. This paper proposes a deep learning-based framework to iteratively correct partially correct private keys resulting from a clustering-based horizontal attack. By testing the trained network on scalar multiplication (or exponentiation) traces, we demonstrate that a deep neural network can significantly reduce the number of wrong bits from randomized scalars (or exponents).
When a simple horizontal attack can recover around 52% of attacked multiple private key bits, the proposed iterative framework improves the private key accuracy to above 90% on average and to 100% for at least one of the attacked keys. Our attack model remains fully unsupervised and excludes the need to know where the error or noisy bits are located in each separate randomized private key.
Original languageEnglish
Pages (from-to)343-372
Number of pages30
JournalIACR Transactions on Cryptographic Hardware and Embedded Systems
Issue number1
Publication statusPublished - 2020


  • Side-channel Analysis
  • Public-key Algorithms
  • Horizontal Attacks
  • Deep Learning


Dive into the research topics of 'Keep it Unsupervised: Horizontal Attacks Meet Deep Learning'. Together they form a unique fingerprint.

Cite this