I have started doing some reading about power analysis (SPA, DPA), and it is not clear to me in what Scenario one would have to fear such an attack. It appears to me that a typical situation is
- Scenario A: A key is stored in plain text on a smart card, the analysis is conducted while encryption/decryption request are sent to the card and in effect the key is obtained.
However I am more interested in
- Scenario B: A key is stored encrypted on a device (smart card?). During normal operation one would send the passphrase (required for decrypting the key) together with an encryption/decryption request to be performed by the decrypted key. Now the assumption is that an attacker does not posses the passphrase.
Would it still be possible to obtain the passphrase by power analysis? (From my imagination the only thing one could do is feeding wrong passphrases.) From my understanding scenario B is not susceptible to power analysis, or am I wrong?