When you perform CPA against AES, you'll attack either the first or the last round depending on the data you've got at hand. Both attacks are of the same complexity, roughly.
If you know the plaintext $p$, then you'll exploit the very first AddRoundKey
and attack the first SubBytes
routine, which will allow you to recover directly the master key, by doing CPA on assumptions about the value of $k_0\oplus p$ as input to the operation SubBytes
.
Now, if you know only the ciphertext, you'll want to attack the last SubBytes
routine of the whole AES process, to recover the last round key through the last AddRoundKey
operation, and once you have a round key, you can recover the master key since the key schedule is invertible.
In the last round the operations done by AES are:
SubBytes
, ShiftRows
, AddRoundKey
.
So you will want to do CPA on the SubBytes
operation, just like you did in the first round case, except that you'll have to deal with the ShiftRows
operation, which is hopefully invertible.
You will have assumptions on the input value of your SubBytes
method, which is $\mathtt{SubBytes}^{-1}[\mathtt{ShiftRows}^{-1}[k_{10}\oplus c]]$, for $c$ a known ciphertext. Those are all reversible operation, thus it is possible to compute the assumed input.
Thus the differences with the first round case are:
- you are using a known ciphertext instead of a known plaintext,
- you will end up with the last round key $k_{10}$ instead of the actual key $k_0$ ,
- you'll have to deal with the
ShiftRows
operation.
Maybe you can read this, although it's not going really into the practical implementation steps.
You can also read this question and its answer to get why why want to target the SubBytes
routine, as well as that one.