###################################################################
Threat model
###################################################################

This chapter enumerates the side-channel threats that ``arcana`` is
designed to resist, describes how each attack works in principle, and
gives an order-of-magnitude estimate of the attacker effort — in
elapsed time and equipment cost — needed to mount it against an
**unprotected** implementation running on a typical embedded target
(ARM Cortex-M, RISC-V MCU, or entry-level secure element).

The cost estimates are **decision support**, not a precise
evaluation: they let a reader judge which countermeasures are
load-bearing for a given deployment. A lab willing to invest more in
equipment or time can always overcome defences tuned to a weaker
profile; the numbers below correspond to the published
state-of-the-art as of early 2026.

Most of the threat-model machinery (attacker axes, generic SPA / DPA
/ template / timing / DFA cost ranges) is **shared with quantica**
since the underlying physics and economics do not depend on the
algorithm family. The critical differences for the arcana side are
called out in dedicated sub-sections at the end of each threat
chapter ("Where it bites classical primitives").

Attacker model
==============

The overall attacker model has three axes, identical to the quantica
side:

**Access to the device.**
    * level 1 — *Black-box*: the attacker queries the API only.
    * level 2 — *Observational*: adds passive physical measurement
      (power, electromagnetic emanations, timing via a direct probe,
      remote network timing).
    * level 3 — *Intrusive*: adds active fault injection (clock /
      voltage glitches, laser, electromagnetic pulses) or chip-level
      inspection (decapping, FIB probing).

**Number of traces / queries.**
    From a handful (SPA, template matching, single-fault Bellcore on
    RSA-CRT) to millions (DPA on noisy traces, CDPA on HMAC-SHA-2 in
    parallel hardware :cite:`belenky2023_cdpa_hmac_sha2`).

**Knowledge of the key schedule.**
    Some attacks assume the attacker can build a profile on an
    identical open device (template attacks); others rely only on
    statistical assumptions about the secret (DPA, CPA).

``arcana`` targets threat levels **1 and 2 at minimum** for the
intended evaluation. Level 3 (single-fault) coverage is required for
RSA-CRT (Bellcore is a one-fault total break) and for deterministic
ECDSA / EdDSA (one fault → key recovery
:cite:`romailler2017eddsa_fault`, :cite:`cao2020_lattice_fault_det_sig`).

Threat: Simple Power Analysis (SPA)
===================================

Principle
---------

The attacker observes a single (or very few) power or EM traces of a
cryptographic operation and reads the secret off the trace directly,
either because the code path depends on the secret (e.g. a
``if (key_bit) ...`` compiles to a jump visible in the power
profile) or because each secret-dependent basic block has a
distinctive power signature.

Classical publications: :cite:`kocher1996timing`,
:cite:`kocher1999dpa`.

Where it bites classical primitives
-----------------------------------

* **ECDSA / ECDH scalar multiplication** — the textbook SPA target.
  A naive double-and-add reveals the bit pattern of the scalar in
  one trace because "double" and "double + add" have visibly
  different power envelopes :cite:`coron1999dpa_ecc`. Montgomery /
  Joye ladders are the standard answer (see
  :doc:`countermeasures/ecdsa_ecdh`).
* **RSA-CRT decryption** — modular exponentiation has the same
  problem; "square" and "square + multiply" are distinguishable.
  Bare square-and-multiply RSA without windowing or
  square-always-multiply is a one-trace break.
* **AES key schedule and round function** — a single-trace template
  attack on the first round's S-box output recovers the key
  byte-by-byte if the S-box is implemented as a memory lookup with
  data-dependent cache lines.
* **Modular reduction in BigInt** — variable-iteration loops
  (e.g. early-exit comparisons) leak the bit-length of intermediates.

Cost against an unprotected implementation
------------------------------------------

.. list-table::
   :header-rows: 1
   :widths: 20 40 40

   * - Axis
     - Against embedded MCU
     - Against secure element
   * - Equipment
     - Entry-level USB oscilloscope (≥ 250 MSa/s) + EM H-field probe
       + preamp: **~1 500 €** total.
     - Chipwhisperer Husky or Lecroy scope + near-field probe + power
       interposer / decap: **10 000 – 30 000 €**.
   * - Traces
     - 1 – 100 (SPA by definition).
     - 1 – 1 000 (the SE's own jitter + noise may need trace averaging).
   * - Elapsed time (skilled operator)
     - **1 – 5 days** from setup to key recovery against a naive
       double-and-add ECDSA.
     - **2 – 6 weeks** including chip reverse-engineering.

Coverage in ``arcana``
----------------------

* **Constant-time scalar multiplication** in
  ``ecc::curve::scalar_mul_point`` — Montgomery ladder with
  ``ct_swap`` between two accumulator points; ``point_double`` and
  ``point_add_ct`` produce z=0 outputs without explicit branches; the
  release-asm count of secret-dependent branches is **0** (single
  remaining branch is the loop counter).
  See :doc:`countermeasures/ecdsa_ecdh`.
* **AES table-based S-box** — ``cipher::aes`` ships the textbook
  table-based AES today. **This is a known SPA / cache-timing leak
  surface**; replacement by a fixsliced bitsliced AES
  (:cite:`adomnicai2021_fixslicing_aes`) is item ``T1-A`` in the
  hardening roadmap (:doc:`countermeasures/aes`).
* **RSA modular exponentiation** — currently uses
  ``rsa::bigint::pow_mod`` with a left-to-right square-always +
  CT-multiply pattern. Audit pending under item ``T1-E``
  (:doc:`countermeasures/rsa`).

Threat: Differential / Correlation Power Analysis (DPA / CPA)
=============================================================

Principle
---------

The attacker records 10³ – 10⁶ traces with varied public inputs,
forms a hypothesis about an intermediate value depending on a small
chunk of the secret (typically 8 or 16 bits), predicts its Hamming
weight or distance across traces, and statistically correlates the
prediction with the measured power at each time sample. Correct key
hypotheses peak above noise; wrong guesses average down.

Classical publications: :cite:`kocher1999dpa`, :cite:`brier2004cpa`.

Where it bites classical primitives
-----------------------------------

* **AES** — the round-1 SubBytes output is the canonical CPA target;
  even bitsliced AES leaks if the input is processed
  byte-at-a-time before bit-slicing. The ANSSI's reference protected
  AES on ARM Cortex-M was broken end-to-end with deep-learning DPA
  in :cite:`anssi2023_aes_ml_dpa`.
* **HMAC-SHA-2** — the **Carry-based DPA (CDPA)** of
  :cite:`belenky2023_cdpa_hmac_sha2` (TCHES 2023/3) breaks
  *any* implementation of HMAC-SHA-2, even pure parallel hardware,
  in 30 K to 275 K traces. **No deployed unmasked HMAC-SHA-2 is
  safe in a level-2 (observational) threat model.** This is a
  stricter boundary than the literature acknowledged before 2023.
* **RSA / ECC scalar multiplication** — secret-dependent
  intermediates inside the modular operations leak by Hamming
  weight; the Montgomery ladder by itself does not stop CPA on the
  field operations of each iteration.
* **HMAC, CMAC, GMAC** — modular polynomial / GF(2^128)
  multiplications used inside GMAC have a CPA surface analogous to
  AES SubBytes if the multiplier is table-based.

Cost against an unprotected implementation
------------------------------------------

.. list-table::
   :header-rows: 1
   :widths: 20 40 40

   * - Axis
     - Against embedded MCU
     - Against secure element
   * - Equipment
     - Chipwhisperer-Lite or Husky (~**1 000 €**) + laptop + target
       board (~**100 €**).
     - High-end oscilloscope (~**40 000 €**) + EM probe setup
       + chip carrier / depackaging.
   * - Traces
     - 30 K – 1 M depending on the algorithm and which
       intermediate is targeted (CDPA on HMAC-SHA-2 needs as little
       as 30 K). AES first-round CPA: 5 K – 50 K traces.
     - **≥ 10 M** once jitter and shielding are factored in.
   * - Elapsed time (skilled operator)
     - **1 – 4 weeks** of trace acquisition + analysis.
     - **6 – 18 months** end-to-end, often a multi-engineer effort.

Coverage in ``arcana``
----------------------

* **None today.** Boolean / arithmetic masking of the secret-handling
  primitives is on the tier-2 hardening roadmap (item ``T2-D``
  for HMAC-SHA-2, ``T1-A`` for AES via fixslicing — fixslicing is
  not masking but is the prerequisite for any future masked AES).
* The scalar-multiplication path has a Tier-2 plan for
  **scalar blinding** (:cite:`coron1999dpa_ecc`,
  ``T2-B``) and **Z-coordinate randomization**
  (:cite:`brier2002weierstrass_sca`, ``T2-A``) which are the standard
  DPA defences for ECC over Weierstrass curves.

Threat: Template attacks
========================

Principle
---------

The attacker has a clone of the target device and builds a
*template* — a multivariate Gaussian model — of the power/EM
signature of each secret value, then matches a single trace from the
real target against the profile. Template attacks are the strongest
passive side-channel; a single trace can be enough once a good
profile exists. Classical reference: :cite:`chari2002template`.

Where it bites classical primitives
-----------------------------------

* **Curve25519 / X25519** — :cite:`weissbart2021_curve25519_ml_sca`
  shows that machine-learning template attacks on a Cortex-M0
  Curve25519 implementation succeed even against typical countered
  designs (random delays, dummy operations); only a fully masked
  Montgomery ladder resists.
* **AES** — first-round template + multi-task learning is the SOTA
  attack on the ANSSI protected AES :cite:`anssi2023_aes_ml_dpa`.
* **ECDSA** — template attacks on the modular inverse of the nonce
  (computing :math:`k^{-1} \bmod n`) leak partial nonce bits, which
  combined with lattice attacks on the resulting bias breaks the
  scheme :cite:`jancar2020_minerva`.

Cost against an unprotected implementation
------------------------------------------

.. list-table::
   :header-rows: 1
   :widths: 20 40 40

   * - Axis
     - Against embedded MCU
     - Against secure element
   * - Equipment
     - Two identical MCUs (clone + target), same tooling as DPA.
     - Two decapsulated SE + high-end scope + precision positioning.
   * - Traces
     - Profiling: 10 000 – 100 000; attack: **1 – 10 traces** suffice.
     - Profiling: 1 000 000; attack: 10 – 1 000 traces.
   * - Elapsed time
     - **2 – 6 weeks** once the clone profile exists.
     - **3 – 9 months**, dominated by the profiling phase.
   * - Prerequisite
     - Access to an open clone, which is usually realistic for
       commercial-off-the-shelf MCUs and harder for certified SE.
     - Usually requires an internal agreement or reverse-engineered
       debug access.

Coverage in ``arcana``
----------------------

* **None today** beyond the always-on CT primitives. Template
  attacks specifically motivate the tier-2 ``T2-A`` Z-coordinate
  randomization (which destroys profile-trace alignment for ECC) and
  ``T2-D`` HMAC masking. The fixsliced AES (``T1-A``) is itself an
  enabler — once the round function operates on bit-sliced state
  there is no per-byte SubBytes intermediate to template.

Threat: Software timing / cache-timing
======================================

Principle
---------

A software attacker co-resident with the cryptographic process
measures its execution time, the eviction pattern of its cache
lines, or the contention of shared microarchitectural resources,
and correlates these observations with secret inputs. Classical
publication :cite:`kocher1996timing`.

Where it bites classical primitives
-----------------------------------

* **AES table-based S-box** — :cite:`bernstein2005_aes_cache_timing`,
  :cite:`osvik2006cache_aes`. Different cache lines for different
  S-box bytes leak the round-1 key on a co-resident attacker.
* **ECDSA scalar multiplication** — Minerva
  (:cite:`jancar2020_minerva`) shows that even a *bit-length leak*
  on the nonce — let alone the scalar value — recovers the key with
  a few hundred to a few thousand signatures via lattice attack.
  The Minerva class is alive: CVE-2024-23342 (python-ecdsa) and
  CVE-2024-13176 (OpenSSL P-521) were both Minerva-pattern timing
  leaks fixed in 2024.
* **LadderLeak** (:cite:`aranha2020_ladderleak`) takes Minerva
  further: less than one bit of nonce leakage per signature is
  enough for full key recovery, broken on OpenSSL 1.0.2 / 1.1.0.
* **RSA-CRT** — Brumley-Boneh remote timing
  (:cite:`brumley2003remote_timing`) extracted RSA private keys over
  a network from OpenSSL.
* **HMAC tag comparison** — non-CT comparison of the received tag
  vs the computed tag is a textbook bytewise oracle (early
  forgery-detection helpers in OpenSSL/PolarSSL had this leak).

Cost against an unprotected implementation
------------------------------------------

.. list-table::
   :header-rows: 1
   :widths: 20 40 40

   * - Axis
     - Local process attacker
     - Remote network attacker
   * - Equipment
     - None beyond a standard user account on the target host.
     - Depends on the target protocol; often a network capture + a
       latency budget of microseconds.
   * - Queries / observations
     - 10⁴ – 10⁸ depending on the secret entropy and the timing gap
       the attack relies on.
     - 10⁶ – 10⁹ (network jitter dominates).
   * - Elapsed time
     - **Hours to days** for a local attacker (e.g. cache-timing AES,
       Minerva ECDSA).
     - **Weeks to months** for a remote attacker on a bare public
       API.

Coverage in ``arcana``
----------------------

* **Constant-time tag comparison** in ``cipher::*::decrypt``,
  ``mac::ctx::Mac::verify``, ECDSA verify — uses ``silentops::ct_eq``.
* **CT scalar multiplication** in ``ecc::curve::scalar_mul_point``
  — see :doc:`countermeasures/ecdsa_ecdh`. Release-asm verification
  of the post-2026-04-21 hardening: 0 secret-dependent branches in
  the ladder; 0 in ``point_double``; ``field_add`` / ``field_sub`` /
  ``reduce_wide`` use ``core::hint::black_box`` to keep LLVM from
  re-introducing branches over the bit-mask selects.
* **Cache-timing on AES** — **not yet defended**; see ``T1-A`` in
  :doc:`countermeasures/aes`.
* **ctgrind continuous verification** — the workspace ``ctgrind``
  infrastructure (built for quantica) is designed to extend to
  arcana. The harness driver lives in ``quantica_bench/src/bin/
  ctgrind.rs`` today; an ``arcana_bench`` mirror is item ``T3-A``.

Threat: Differential Fault Analysis (DFA), Bellcore, SIFA
=========================================================

Principle
---------

The attacker perturbs the target while it runs the cryptographic
operation — clock glitch, voltage glitch, laser pulse, EM fault
injection — so an instruction is skipped, a value is corrupted, or
a loop count is changed. They compare the faulty output with an
unfaulted one; depending on the algorithm a single useful fault can
leak the whole secret :cite:`boneh1997dfa`.

A more recent variant, Statistical Ineffective Fault Analysis
(SIFA, :cite:`dobraunig2018sifa`) statistically correlates the
fault injection with the operation's *success* (not the faulted
value): it does not need the faulted output, only whether the
operation aborted.

Where it bites classical primitives
-----------------------------------

* **RSA-CRT (Bellcore attack,** :cite:`boneh1997dfa` **)** — a
  single fault on either of the two CRT half-exponentiations
  ``S_p = m^{d_p} mod p`` or ``S_q = m^{d_q} mod q`` produces a
  faulted signature ``S'`` such that ``gcd(N, S - S')`` reveals one
  of the prime factors. **One fault → factorization → total break.**
  The standard countermeasures (Aumüller :cite:`aumuller2002rsa_crt`,
  Vigilant 2008, Joye-Tunstall infective computation) are the
  classical answer; recent formal verification work
  (:cite:`rauzy2013_formal_crt_rsa`,
  :cite:`rauzy2016_algorithmic_crt_rsa`) shows that **most published
  countermeasures are vulnerable to richer fault models** but
  Aumüller's resists *all* single-fault attacks.
* **Deterministic ECDSA / EdDSA** —
  :cite:`romailler2017eddsa_fault` and
  :cite:`cao2020_lattice_fault_det_sig` show that the deterministic
  nonce derivation (RFC 6979 / RFC 8032) makes the schemes fragile
  under fault: signing the same message twice with one of the two
  faulted produces two different signatures with the same nonce,
  enabling lattice-based key recovery. The standard answer is
  *hedged signatures* (:cite:`cfrg_hedged_sigs`) — deterministic
  derivation + 32 bytes of additional randomness mixed in.
* **AES** — DFA on the last AES round is the textbook attack;
  *infective countermeasures* (:cite:`battistello2015fault_aes`) and
  redundancy are the standard answers, but neither is implemented in
  arcana yet.

Cost against an unprotected implementation
------------------------------------------

.. list-table::
   :header-rows: 1
   :widths: 20 40 40

   * - Axis
     - Embedded MCU
     - Secure element
   * - Equipment
     - Chipwhisperer with voltage/clock-glitch board (**~1 000 €**).
       EMFI setup with pulse generator + XY stage: **10 000 – 30 000 €**.
     - Laser bench with precision positioning: **100 000 – 300 000 €**.
       SE decapsulation often required.
   * - Faults needed
     - **One** for Bellcore RSA-CRT. One per signature for
       deterministic ECDSA/EdDSA fault attacks. 1 – 100 for AES last-
       round DFA.
     - Same ballpark but with far more parameter sweeping.
   * - Elapsed time
     - **Days to weeks** for MCU-level targets.
     - **6 – 18 months** for a certified SE.

Coverage in ``arcana``
----------------------

* **None today.** RSA-CRT decrypt path
  (``rsa::rsa::rsa_decrypt_raw``) is unprotected against Bellcore;
  this is item ``T1-C`` and is the **highest-priority** classical-
  side hardening for the evaluation. Aumüller's algorithm and the formally
  verified variants of :cite:`rauzy2013_formal_crt_rsa` are the
  intended approach.
* Deterministic-signature fault recovery is item ``T1-D``: a
  ``hedged`` flavour mirroring the CFRG draft
  :cite:`cfrg_hedged_sigs` will be added behind a feature flag.

Threat: Electromagnetic side-channels (SEMA / DEMA / CEMA)
==========================================================

Principle
---------

Near-field electromagnetic emanations from a working chip carry the
same information as its power trace, with better spatial
resolution. A positioning stage can aim a probe at a specific
cryptographic peripheral or a specific memory bus to bypass the
averaging effect of a shared power supply. EM attacks follow the
same analytical framework as power attacks (SEMA / DEMA / CEMA
mirror SPA / DPA / CPA).

Cost against an unprotected implementation
------------------------------------------

EM attacks trade a higher equipment bill (near-field probe, XY
stage, extra amplification) for fewer traces at equal security
level. An EM attacker typically needs 10× – 100× fewer traces than
a power attacker at equal distance to the secret.

Coverage in ``arcana``
----------------------

Same as for power attacks — at the software level there is no
physical distinction. Hardware shielding of a deployed product is
an integrator responsibility; the arcana code is the same against
SEMA and SPA, against DEMA and DPA.

Summary table
=============

.. list-table:: Threats vs. ``arcana`` coverage (as of 2026-04-21)
   :header-rows: 1
   :widths: 25 40 35

   * - Threat
     - Typical entry-level cost (MCU / SE)
     - Coverage in ``arcana``
   * - SPA / SEMA on ECDSA scalar mul
     - 1 500 € / 10 – 30 k€
     - **Implemented** — CT Montgomery ladder, branchless point_add_ct,
       commit ``76191c1``.
   * - SPA on AES key recovery
     - 1 500 € / 10 – 30 k€
     - **Vulnerable** — table-based S-box. Plan ``T1-A``: fixsliced
       AES port (:cite:`adomnicai2021_fixslicing_aes`).
   * - DPA / DEMA / CDPA on HMAC-SHA-2
     - 1 100 € / ~40 k€
     - **Vulnerable** — :cite:`belenky2023_cdpa_hmac_sha2` breaks
       any HMAC-SHA-2 in 30 K – 275 K traces. Plan ``T2-D``.
   * - DPA / CPA on AES, ECDSA scalar mul intermediates
     - 1 100 € / ~40 k€
     - **Vulnerable** — no masking on classical side. Plans ``T2-A``,
       ``T2-B``, ``T2-D``.
   * - Template attacks on ECDSA modular inverse / Curve25519 ladder
     - ~2 500 € / chip-revered SE
     - **Vulnerable**. Plan ``T2-A`` (Z-rerand) destroys alignment;
       hedged signatures (``T1-D``) reduce template applicability.
   * - Software / remote timing on ECDSA, RSA, MAC compare
     - none / network access
     - ECDSA scalar mul **CT-verified at release-asm level**.
       MAC compare uses ``silentops::ct_eq``. RSA bigint ``T1-E``
       audit pending.
   * - Bellcore single-fault on RSA-CRT
     - 1 k€ / up to 300 k€
     - **Vulnerable** — no CRT countermeasure. **Highest-priority
       gap**: ``T1-C``.
   * - Single-fault on deterministic ECDSA / EdDSA
     - 1 k€ / up to 300 k€
     - **Vulnerable** — pure RFC 6979 / RFC 8032 deterministic. Plan
       ``T1-D``: optional hedged mode.

Cost numbers are indicative and quickly dated; see the cited
literature for the full table of published attacks and their
parameters. The roadmap items (``T1-*`` / ``T2-*`` / ``T3-*`` /
``T4-*``) are detailed in the per-algorithm chapters that follow.
