How many interesting points should be used in a template attack?

Considering that one can fully characterize and exploit the power leakages of the reference device in the process of recovering the secret key used by the target device, template attack (TA) is broadly accepted as the strongest power analysis attack from the perspective of information theory. In order to fully exploit the power leakages of the reference device, one usually has to concern the power leakages at different interesting points. Then, a natural question is how many interesting points should be used in a TA? We note that the number of interesting points one uses directly decides the profiling efficiency of TA. In light of this, we evaluate the optimal number of interesting points in simulated scenarios, and the evaluation results bring us an empirically useful formula. Then, in order to validate the empirical formula, we perform TA using power traces provided by DPA Contest v4.1. In the real scenario, the correlation method is used to select the interesting points, and the S-Box output of the 1st round AES encryption is chosen as the target intermediate value. Evaluation results show that the empirical formula is indeed correct and can be useful in practice. (C) 2016 Elsevier Inc. All rights reserved.