SC172J - Smart Card Side-Channel Analysis Tool

A high-performance side-channel analysis tool for extracting cryptographic keys from smart cards through timing analysis.

Features

• Timing Side-Channel Attack: Measures execution time differences during cryptographic operations to infer key bits
• Multiple Command Support: EMM (Entitlement Management Message), ECM (Entitlement Control Message), CHK (Key Check)
• Parallel Brute-Force: OpenMP-accelerated 32-bit key space search
• Advanced Statistical Methods:
  • K-Means clustering
  • Otsu's threshold method
  • Adaptive threshold combining multiple algorithms
  • Signal-to-noise ratio analysis
• Noise Filtering:
  • Median filter for spike noise removal
  • Moving average smoothing
  • High/low cutoff filter
• Cross-Platform: Windows, macOS (Intel & Apple Silicon), Linux

Requirements

Build Dependencies

• CMake 3.5+
• C++17 compatible compiler
• OpenMP (optional, for parallel processing)
• PC/SC library:
  • Windows: WinSCard (included in Windows SDK)
  • macOS: PCSC.framework (built-in)
  • Linux: libpcsclite-dev

Hardware

• PC/SC compatible smart card reader
• Target smart card

Building

macOS / Linux

mkdir build && cd build
cmake .. -DCMAKE_BUILD_TYPE=Release
make -j$(nproc)

Windows (Visual Studio)

mkdir build && cd build
cmake .. -G "Visual Studio 17 2022" -A x64
cmake --build . --config Release

Or open sc.sln directly in Visual Studio.

Usage

sc [options] [subkey1 [subkey2 [subkey3 [subkey4]]]]

Options

Option	Description
-C N	Specify R-test command. 0=EMM 1=ECM 2=CHK (default=0)
-w XXYY	Specify work key (Kw) for ECM/CHK. XX:Business ID, YY:Key ID (hex)
-p N	Specify protocol number (hex)
-n N	Commands per test (default=1)
-b N	Cipher blocks per command
-m N	Measurement method. 0=Individual 1=Continuous (default=0)
-c	Output samples to STDOUT (no screen output)
-I FILE	Reload samples from file (use - for STDIN)
-t NUM	Score threshold to end sampling (default=2.0)
-x N	Sample count limit (0=unlimited)
-1	Execute only round 1
-l	Skip brute-force extraction
-v FLAG	Display flags: [a]ll [p]rogress [f]ingerprint [g]raph
-e	Enable early detection of problematic fingerprints
-f	Enable high/low cutoff filter
-g	Use gnuplot for visualization
-E	Extract subkey from fingerprint code
-K	Transfer key schedule from command line key
-i N	Specify Group ID (1-7, default=0)
-Z FILE	Same operation as fpsqueeze.pl
-h	Show help message

Examples

# Basic EMM analysis
./sc

# ECM analysis with specific work key
./sc -C1 -w0102

# Extract subkey from fingerprint code
./sc -E 1a2b3c

# Analyze with progress display
./sc -va

Output Files

• *.txt - Log files with analysis results
• *.dat - Raw sample data
• *.png - Graphs (when using -g option)
• fpcash.txt - Fingerprint-to-key cache

Performance

Optimizations implemented:

• macOS: Uses mach_absolute_time() for lowest-overhead timing
• Parallel Processing: OpenMP for multi-core brute-force search
• Early Exit: Atomic operations for fast candidate detection
• Adaptive Thresholding: Combines K-Means, Otsu, and S-max methods

� NVIDIA CUDA GPU Acceleration

For systems with NVIDIA GPUs, CUDA-accelerated brute force search is available:

Feature	Description
CUDA Compute	Massive parallelism using CUDA cores
Multi-GPU	Automatic support for multiple NVIDIA GPUs
Performance	~10B+ keys/sec on RTX 30/40 series GPUs

Building with CUDA

Requires NVIDIA CUDA Toolkit 11.0+:

cmake .. -DCMAKE_BUILD_TYPE=Release -DENABLE_CUDA=ON
make -j$(nproc)

Supported architectures: Volta (70), Turing (75), Ampere (80, 86), Ada (89), Hopper (90)

🍎 Apple Silicon Optimizations

Special optimizations for Apple M-series chips:

Feature	Description
Metal GPU Compute	GPU-accelerated brute force (~7B keys/sec)
Neural Engine (ANE/NPU)	Hardware ML acceleration via Core ML
Accelerate Framework	Hardware-accelerated vector math using vDSP
NEON SIMD	Process 4 keys simultaneously with ARM SIMD instructions
AI Quality Predictor	Neural network (33→16→1) for fingerprint quality assessment
Ensemble Threshold	Weighted combination of K-Means, Otsu, S-max with SNR-based adjustment
Adaptive Sampling	Uncertainty-based priority sampling strategy
Key Space Pruning	Confidence-based bit ordering to reduce search space

Architecture

GPU Acceleration Layer
├── gpu_unified.h (Backend Selection)
│   ├── CUDA Backend (cuda_brute_force.cu)
│   └── Metal Backend (metal_brute_force.mm)
│
apple_optimizations.h
├── Accelerate Wrappers (vDSP)
│   ├── normalize_accelerate()
│   └── dotproduct_accelerate()
├── NEON SIMD
│   └── check_keys_neon_x4()
├── AI Components
│   ├── FingerprintQualityPredictor (Neural Network)
│   ├── AdaptiveSampler
│   └── KeySpacePruner
└── Ensemble Methods
    └── EnsembleThreshold

npu_neural_engine.h
└── Core ML Integration
    ├── NPUQualityPredictor (ANE-accelerated)
    └── FallbackQualityPredictor (CPU)

Benchmark Results

Typical performance:

Platform	Simple FP	Complex FP	Keys/sec
Apple M1 (Metal)	~0.3s	~1.5s	~7B
RTX 3080 (CUDA)	~0.2s	~0.8s	~12B
RTX 4090 (CUDA)	~0.1s	~0.5s	~20B
CPU only (8-core)	~2.0s	~10s	~400M

License

This software is provided for educational and research purposes only.

Acknowledgments

• Original SC series developers
• B-CAS research community

---

Translations: 中文 | 日本語