What is the difference between perfoming Correlation Power Analysis (CPA) in the first AES round and doing it in the last round?

Question

I have a script that helps me to make to make a Correlation Power Analysis (CPA) attack. I am trying to attack the first round. As input, I put:

• my traces
• my plaintexts
• my key

The steps to make the attack are:

1. Reading the data, which consists of the analog waveform (trace) and input text sent to the encryption core.
2. Making the power leakage model, where it takes a known input text along with a guess of the key byte.
3. Implementing the correlation equation, and then looping through all the traces.
4. Ranking the output of the correlation equation to determine the most likely key.

What must I change if I want to attack the last round please?

Answer 1

When you perform CPA against AES, you'll attack either the first or the last round depending on the data you've got at hand. Both attacks are of the same complexity, roughly.

If you know the plaintext $p$, then you'll exploit the very first AddRoundKey and attack the first SubBytes routine, which will allow you to recover directly the master key, by doing CPA on assumptions about the value of $k_0\oplus p$ as input to the operation SubBytes.

Now, if you know only the ciphertext, you'll want to attack the last SubBytes routine of the whole AES process, to recover the last round key through the last AddRoundKey operation, and once you have a round key, you can recover the master key since the key schedule is invertible.

In the last round the operations done by AES are: SubBytes, ShiftRows, AddRoundKey.

So you will want to do CPA on the SubBytes operation, just like you did in the first round case, except that you'll have to deal with the ShiftRows operation, which is hopefully invertible. You will have assumptions on the input value of your SubBytes method, which is $\mathtt{SubBytes}^{-1}[\mathtt{ShiftRows}^{-1}[k_{10}\oplus c]]$, for $c$ a known ciphertext. Those are all reversible operation, thus it is possible to compute the assumed input.

Thus the differences with the first round case are:

• you are using a known ciphertext instead of a known plaintext,
• you will end up with the last round key $k_{10}$ instead of the actual key $k_0$ ,
• you'll have to deal with the ShiftRows operation.

Maybe you can read this, although it's not going really into the practical implementation steps.

You can also read this question and its answer to get why why want to target the SubBytes routine, as well as that one.