Each simulated encryption leaks power proportional to the Hamming weight of an internal S-box output — real CMOS logic draws current roughly proportional to the number of bits that switch, exactly this model:
intermediate = SBOX[ plaintext XOR keyByte ]
leakage(t) = HammingWeight(intermediate) + noise(σ)
For every one of the 256 key-byte hypotheses k, the attack predicts x_k = HW(SBOX[plaintext ⊕ k]) and correlates that prediction against the measured leakage y across all collected traces using Pearson's coefficient:
r_k = Σ(x_k−x̄_k)(y−ȳ) / √( Σ(x_k−x̄_k)² · Σ(y−ȳ)² )
Only the correct key hypothesis predicts the real leakage on every trace, so its |rk| bar grows taller than the rest as traces accumulate — this is the actual mechanism behind Kocher's 1999 Differential Power Analysis attack, still why smart-cards and secure microcontrollers ship constant-power logic and masking.
- Boolean masking XORs a fresh random mask into the intermediate value before it leaks (
SBOX[p⊕k] ⊕ mask). Since the attacker's model never includes the unknown mask, every hypothesis decorrelates to ≈0 — the textbook first-order side-channel countermeasure.
- Device noise σ adds Gaussian measurement noise; more noise means more traces are needed before the correct-key bar separates from the crowd (SNR trade-off real chip designers exploit deliberately).
- Confidence margin is the gap between the best and second-best |rk| — once it is large and stable, the key byte is considered recovered.
This lab is entirely self-contained (synthetic key, synthetic traces, no real hardware or cryptographic library involved) — it exists to show why side-channel-resistant hardware design matters, not to attack anything.