Horizontal and Vertical Side-Channel Attacks against Secure RSA Implementations Aur´ elie Bauer, Eliane Jaulmes, Emmanuel Prouff, and Justine Wild ANSSI, 51, Boulevard de la Tour-Maubourg, 75700 Paris 07 SP, France firstname.name@ssi.gouv.fr Abstract. Since the introduction of side-channel attacks in the nineties, RSA implementations have been a privileged target. A wide variety of countermeasures have been proposed and most of practical attacks are nowadays efficiently defeated by them. However, in a recent work pub- lished at ICICS 2010, Clavier et al. have pointed out that almost all the existing countermeasures were ineffective if the attacks are performed with a modus operandi called Horizontal. Such attacks, originally intro- duced by Colin Walter at CHES 2001, involve a single observation trace contrary to the classical attacks where several ones are required. To de- feat Horizontal attacks, the authors of the ICICS paper have proposed a set of new countermeasures. In this paper, we introduce a general frame- work enabling to model both Horizontal and classical attacks (called Vertical) in a simple way. This framework enables to enlighten the sim- ilarities and the differences of those attack types. From this formalism, we show that even if Clavier et al.’s countermeasures thwart existing attacks, they do not fully solve the leakage issue. Actually, flaws are exhibited in this paper and efficient attacks are devised. We eventually propose a new countermeasure. 1 Introduction Side-Channel Analysis (SCA) is a cryptanalytic technique that consisting in ex- ploiting the side channel leakage (e.g. the power consumption, the electromag- netic emanations) produced during the execution of a cryptographic algorithm embedded on a physical device. It uses the fact that this leakage is statisti- cally dependent on the intermediate variables that are processed. Some of these variables are sensitive in the sense that they are related to secret data, thus reaching information on them enables efficient key recovery attacks [3, 9, 15]. Since the publication of the first attacks, many papers describing either counter- measures or attack improvements have been published (see [3,4,16] for example). Among these improvements, higher-order SCA are of particular interest. They extend the initial concept by considering a set of several instructions instead of a single one and circumvent many countermeasures proposed in the literature (e.g. [4, 10]). Another significant improvement has been proposed initially by Walter [19] and then studied more deeply by Clavier et al. in [5]. Essentially, it consists in a new modus operandi called Horizontal, in which sensitive infor- mation is extracted from a single measurement split into several parts. It differs from the classical Vertical mode where information is obtained from different al- gorithm executions. Horizontal mode applies when the same guessable sub-part of a secret is involved in many internal operations during the overall algorithm