It is known that secret keys can be extracted from some USIM cards using Correlation Power Analysis (CPA). In this paper, we demonstrate a more advanced attack on USIMs, based on deep learning. We show that a Convolutional Neural Network (CNN) trained on one USIM can recover the key from another USIM using at most 20 traces (four traces on average). Previous CPA attacks on USIM cards required high-quality oscilloscopes for power trace acquisition, an order of magnitude more traces from the victim card, and expert-level skills from the attacker. Now the attack can be mounted with a $1000 budget and basic skills in side-channel analysis.

Recently, several deep-learning side-channel attacks on cryptographic algorithms were demonstrated. With the help of a trained deep-learning model, the attacker extracts the key from a few power traces captured from a victim device. However, previous works have shown that the inter-chip variation may significantly reduce the attack success probability. In this paper, we quantify the effect of inter-chip variation on the classification accuracy of Multi-Layer Perceptron (MLP) models. We show that, by training on multiple chips, we can increase the probability of recovering the key from a single trace from 39.95% to 86.07% on average. We also evaluate how the printed circuit board diversity affects the classification accuracy.

Deep learning side-channel attacks are an emerging threat to the security of implementations of cryptographic algorithms. The attacker first trains a model on a large set of side-channel traces captured from a chip with a known key. The trained model is then used to recover the unknown key from a few traces captured from a victim chip. The first successful attacks have been demonstrated recently. However, they typically train and test on power traces captured from the same device. In this paper, we show that it is important to train and test on traces captured from different boards. Otherwise, it is easy to overestimate the classification accuracy. For example, if we train and test an MLP model on power traces captured from the same board, we can recover all key byte values with 88.5% accuracy from a single trace. However, the single-trace attack accuracy drops to 13.7% if we test on traces captured from a board different from the one we used for training, even if both boards carry identical chips.