The SCA power attack described in 2016 article called "Power Side Channels in Security ICs: Hardware Countermeasures", depends on the measurement of power consumption fluctuations during AES-128 execution, for either known plain text, or known cipher text. In addition, the attacker has the ability to change the cipher text (CPA attack). Nevertheless only one of them, either the plain text or the cipher text need to be known to the attacker.

Suppose one avoids exposing both of them, for instance by using secret internal key AND secret internal counter for counter (CTR) mode encryption. In that case the AES-128 block cipher encrypts a counter that is not known with a key that is not known.

Additionally the cipher text is located in an external Flash. And finally, the attacker cannot change the cipher text, as described in the article.

Is such a scheme still exposed to side channel attacks?