The Side-channel Metrics Cheat Sheet

Side-channel attacks exploit a physical observable originating from a cryptographic device in order to extract its secrets. Many practically relevant advances in the field of side-channel analysis relate to security evaluations of cryptographic functions and devices. Accordingly, many metrics have been adopted or defined to express and quantify side-channel security. These metrics can relate to one another, but also conflict in terms of effectiveness, assumptions, and security goals. In this work, we review the most commonly used metrics in the field of side-channel analysis. We provide a self-contained presentation of each metric, along with a discussion of its limitations. We practically demonstrate the metrics on examples of relevant implementations of the Advanced Encryption Standard (AES), and make the software implementation of the presented metrics available to the community as open source. This work, being beyond a survey of the current status of metrics, will allow researchers and practitioners to produce a well-informed security evaluation through a better understanding of its supporting and summarizing metrics.

Automated summary

Side-channel attacks exploit physical observables of cryptographic devices to extract secrets. This work reviews commonly used metrics in side-channel analysis, providing a self-contained presentation of each metric and discussing their limitations. The metrics are practically demonstrated on examples of the Advanced Encryption Standard (AES), and the software implementation is made available as open source. This work goes beyond a survey and enables researchers and practitioners to conduct well-informed security evaluations by understanding the supporting and summarizing metrics.