As a prominent category of side-channel attacks (SCAs), plaintext-checking (PC) oracle-based SCAs offer the advantages of generality and operational simplicity on a targeted device. At TCHES 2023, Rajendran et al. and Tanaka et al. independently proposed the multiple-valued (MV) PC oracle, significantly reducing the required number of queries (a.k.a., traces) in the PC oracle. However, in practice, when dealing with environmental noise or inaccuracies in the waveform classifier, they still rely on majority voting or the other technique that usually results in three times the number of queries compared to the ideal case. In this paper, we propose an improved method to further reduce the number of queries of the MV-PC oracle, particularly in scenarios where the oracle is imperfect. Compared to the state-of-the-art at TCHES 2023, our proposed method reduces the number of queries for a full key recovery by more than 42.5%. The method involves three rounds. Our key observation is that coefficients recovered in the first round can be regarded as prior information to significantly aid in retrieving coefficients in the second round. This improvement is achieved through a newly designed grafted tree. Notably, the proposed method is generic and can be applied to both the NIST key encapsulation mechanism (KEM) standard Kyber and other significant candidates, such as Saber and Frodo. We have conducted extensive software simulations against Kyber-512, Kyber-768, Kyber-1024, FireSaber, and Frodo-1344 to validate the efficiency of the proposed method. An electromagnetic attack conducted on real-world implementations, using an STM32F407G board equipped with an ARM Cortex-M4 microcontroller and Kyber implementation from the public library pqm4, aligns well with our simulations.

The probe can directly contact the microcontroller in a typical EM side-channel attack (SCA) targeting cryptographic implementations. However, in a more practical setting such as security level 2 of FIPS 140-3 or ISO/IEC 19790 standards, the microcontroller is required to be safeguarded by an opaque anti-tampering cover. This raises an interesting problem: Can we still launch EM attacks against microcontrollers running cryptographic implementations even when equipped with the cover? This paper proposes an improved deep-learning-based profiled attack against NIST KEM standard Kyber. Our key observation is that the distance between the probe and the microcontroller results in attenuation of signal strength. Moreover, the cover restricts the proximity of the probe, thereby limiting the signal-to-noise ratio. We propose an Adaptive Slimmed Pyramid Network (ASPN) model to instantiate a distinguisher in a plaintext-checking oracle-based SCA, which is generic and easy to implement. The proposed ASPN approach significantly enhances the feature extraction process by employing a pyramid network structure, while simultaneously avoiding the inclusion of excessive parameters. Real-world experiments demonstrate that our proposed distinguishers achieve an accuracy above$99\%$with an$18$mm cover and higher than$89\%$accuracy even with a$24$mm cover.