
338 Communication Architectures for SoC
Although we have seen a selection function D for one instant and one data
bit, multiple bits and multiple instants can be used in order to increase the
difference between the correct key guess and the incorrect ones. For instance,
Messerges et al. [80] use d-bit data and two sets, and they assign those with
greater Hamming Weight to S
1
(H(V
ij
≥ d/2) and the rest to S
0
(H(V
ij
<
d/2). In [9] Bevan improves the DPA attack using 4-bit D function. Instead of
deciding the key value when the four selection functions agree, they sum the
four differences of means to reach a solution faster. This solution is possible
because