## Summary This is the **foundational power-analysis paper**, Kocher, Jaffe and Jun's *Differential Power Analysis*, presented at CRYPTO '99 by Cryptography Research. The captured PDF is the original 1999 conference paper (≈10 pages, references ending in 1999), not the expanded 2011 *Introduction to DPA* journal version. It introduces and formalizes two attack families that underpin essentially all subsequent side-channel research: **Simple Power Analysis (SPA)**, which reads secrets more or less directly from the shape of a device's power-consumption trace, and **Differential Power Analysis (DPA)**, a statistical method that pulls a key out of traces even when the per-trace signal is buried far below measurement noise. The authors demonstrate both against **DES on smartcard-class hardware** and show that the secret-correlated signal they exploit can be ~40 µA, *below* the trace-to-trace noise standard deviation, yet still fully recoverable by averaging enough traces. Critically, the paper notes they applied these methods across "almost 50 different products," establishing DPA as a broad, practical threat rather than a single-device curiosity. It matters because it reframed cryptographic security: a mathematically sound cipher can leak its key entirely through the *physical* power behavior of the chip running it. ## Technique & setup The bench reality is deliberately cheap, which is part of the paper's point. Power is measured by inserting a small **~50 Ω series resistor** in the device's ground/supply path and sampling the voltage across it with a digital oscilloscope/sampler the authors price at **under $400**, i.e. no specialist lab gear is required to start. - **SPA** reads a single (or a few) traces and exploits operations whose power signature is *key-* or *data-dependent*, e.g. visible differences between DES rounds, key-schedule permutations, or conditional branches (jumps taken vs not taken), and especially multiply/square or table-lookup patterns. Where code branches on secret bits, SPA can read the key straight off the trace. - **DPA** is the statistical workhorse for when SPA is defeated by noise. The attacker collects **many** traces (the paper uses on the order of *m* = 1,000 noisy traces, ~10,000 for noisier setups, and notes a refined/"template"-style variant succeeding in **under ~15 traces**), picks a target intermediate (here a bit of the DES round-16 output), and defines a **selection function** that predicts that bit from the ciphertext under a guessed sub-key. Traces are partitioned by the predicted bit and averaged; the **difference of the two averages** shows a clear spike at the moment the device handles that bit *iff* the key guess was correct, and is flat otherwise. Iterating over sub-key hypotheses recovers the whole key. The paper also sketches the countermeasure landscape it spawned: reducing the signal (balanced/ constant-time code, hardware noise, shielding), decorrelating it (timing randomization, masking of intermediates), and protocol-level "leak-tolerant" designs (frequent key updates, key-use counters), none perfect, all aimed squarely at the SPA/DPA mechanism above. ## Relevance to our work This is the **conceptual bedrock for the entire SCA portion of our roadmap**, every power/EM side-channel entry in this corpus is, directly or indirectly, a descendant of this paper. For embedded/medical-device defense the load-bearing lesson is blunt: *any* device that performs cryptography on an unprotected general-purpose MCU is a DPA target, because the secret leaks through power/EM whether or not the algorithm is sound, and recovery works even when the per-operation signal is below the noise floor. That directly shapes how we threat-model a device doing key operations (signing, key wrap, attestation) on a Cortex-M-class part with no SCA countermeasures. It is best treated as a **must-understand fundamentals reference** rather than a single reproduce target, though it *is* directly reproducible on our planned bench: a ChipWhisperer power-capture DPA lab against AES/DES on a dev board re-runs exactly this attack, making it a natural first SCA exercise once the capture rig exists. See [[power-analysis-101-sca101-chipwhisperer-io-training]] for the hands-on on-ramp. Cost/effort to reproduce the *idea* is low (series resistor + scope + many traces + a selection function); the effort is in the trace alignment and statistics, not the hardware. ## Provenance - **Authors / source:** Paul Kocher, Joshua Jaffe, Benjamin Jun · Cryptography Research (Paul Kocher) - **Curated from:** sweep-2026-06-19-additions ## Key references - <https://paulkocher.com/doc/DifferentialPowerAnalysis.pdf>