How many interesting points should be used in a template attack?

• We evaluate the optimal number of interesting points in TA.
• We obtain an empirical formula on the optimal number of interesting points.
• Profiling trace and the SNR level influence the optimal number of interesting points.
• We practically verify the correctness and usefulness of the empirical formula.

Considering that one can fully characterize and exploit the power leakages of the reference device in the process of recovering the secret key used by the target device, template attack (TA) is broadly accepted as the strongest power analysis attack from the perspective of information theory. In order to fully exploit the power leakages of the reference device, one usually has to concern the power leakages at different interesting points. Then, a natural question is how many interesting points should be used in a TA? We note that the number of interesting points one uses directly decides the profiling efficiency of TA. In light of this, we evaluate the optimal number of interesting points in simulated scenarios, and the evaluation results bring us an empirically useful formula. Then, in order to validate the empirical formula, we perform TA using power traces provided by DPA Contest v4.1. In the real scenario, the correlation method is used to select the interesting points, and the S-Box output of the 1st round AES encryption is chosen as the target intermediate value. Evaluation results show that the empirical formula is indeed correct and can be useful in practice.