[REVIEW]: SCALib: A Side-Channel Analysis Library

[editorialbot]

Submitting author: @cassiersg (Gaëtan Cassiers)
Repository: https://github.com/simple-crypto/SCALib
Branch with paper.md (empty if default branch):
Version: v0.5.5
Editor: @Nikoleta-v3
Reviewers: @nicolaimueller, @JannikZeitschner
Archive: 10.5281/zenodo.7985686

Status

Status badge code:

HTML: <a href="https://joss.theoj.org/papers/2b1257e8ca9563dcd0b1457a546345ef"><img src="https://joss.theoj.org/papers/2b1257e8ca9563dcd0b1457a546345ef/status.svg"></a>
Markdown: [![status](https://joss.theoj.org/papers/2b1257e8ca9563dcd0b1457a546345ef/status.svg)](https://joss.theoj.org/papers/2b1257e8ca9563dcd0b1457a546345ef)

Reviewers and authors:

Please avoid lengthy details of difficulties in the review thread. Instead, please create a new issue in the target repository and link to those issues (especially acceptance-blockers) by leaving comments in the review thread below. (For completists: if the target issue tracker is also on GitHub, linking the review thread in the issue or vice versa will create corresponding breadcrumb trails in the link target.)

Reviewer instructions & questions

@nicolaimueller & @JannikZeitschner, your review will be checklist based. Each of you will have a separate checklist that you should update when carrying out your review.
First of all you need to run this command in a separate comment to create the checklist:

@editorialbot generate my checklist

The reviewer guidelines are available here: https://joss.readthedocs.io/en/latest/reviewer_guidelines.html. Any questions/concerns please let @Nikoleta-v3 know.

✨ Please start on your review when you are able, and be sure to complete your review in the next six weeks, at the very latest ✨

Checklists

📝 Checklist for @JannikZeitschner

📝 Checklist for @nicolaimueller

[editorialbot]

Hello humans, I'm @editorialbot, a robot that can help you with some common editorial tasks.

For a list of things I can do to help you, just type:

@editorialbot commands

For example, to regenerate the paper pdf after making changes in the paper's md or bib files, type:

@editorialbot generate pdf

[editorialbot]

Software report:

github.com/AlDanial/cloc v 1.88  T=0.51 s (868.3 files/s, 286401.0 lines/s)
-------------------------------------------------------------------------------
Language                     files          blank        comment           code
-------------------------------------------------------------------------------
C/C++ Header                   332          15034          25006          85019
Rust                            39            423            819           9896
Python                          27            775           1391           2355
C++                             14            971            239           2000
reStructuredText                11            209            116            397
TeX                              1             12              0            224
TOML                             7             45              7            190
YAML                             2             14             49            185
Markdown                         3             38              0            174
INI                              1              8              0             62
make                             2             15              7             45
DOS Batch                        1              8              1             26
CMake                            1              5              0             14
Bourne Shell                     1              2              0              2
-------------------------------------------------------------------------------
SUM:                           442          17559          27635         100589
-------------------------------------------------------------------------------


gitinspector failed to run statistical information for the repository

[editorialbot]

Wordcount for paper.md is 940

[editorialbot]

Reference check summary (note 'MISSING' DOIs are suggestions that need verification):

OK DOIs

- 10.46586/tches.v2022.i4.693-717 is OK
- 10.46586/tches.v2021.i3.202-234 is OK
- 10.1007/978-3-662-45611-8_15 is OK
- 10.1007/978-3-540-85053-3_26 is OK
- 10.1007/978-3-662-48324-4_25 is OK
- 10.1007/978-3-662-53140-2_4 is OK
- 10.1007/3-540-36400-5_3 is OK
- 10.1007/978-3-642-01001-9_26 is OK
- 10.1038/s41586-020-2649-2 is OK

MISSING DOIs

- None

INVALID DOIs

- None

[editorialbot]

👉📄 Download article proof 📄 View article proof on GitHub 📄 👈

[Nikoleta-v3]

👋🏼 @cassiersg , @nicolaimueller, @JannikZeitschner this is the review thread for the paper. All of our communications will happen here from now on.

As a reviewer, the first step is to create a checklist for your review by entering

@editorialbot generate my checklist

as the top of a new comment in this thread.

These checklists contain the JOSS requirements ✅ As you go over the submission, please check any items that you feel have been satisfied. The first comment in this thread also contains links to the JOSS reviewer guidelines.

The JOSS review is different from most other journals. Our goal is to work with the authors to help them meet our criteria instead of merely passing judgment on the submission. As such, the reviewers are encouraged to submit issues and pull requests on the software repository. When doing so, please mention #5196 so that a link is created to this thread (and I can keep an eye on what is happening). Please also feel free to comment and ask questions on this thread. In my experience, it is better to post comments/questions/suggestions as you come across them instead of waiting until you've reviewed the entire package.

We aim for reviews to be completed within about 2-4 weeks. Please let me know if any of you require some more time. We can also use EditorialBot (our bot) to set automatic reminders if you know you'll be away for a known period of time.

Please feel free to ping me (@Nikoleta-v3) if you have any questions/concerns. 😄 🙋🏻

[JannikZeitschner]

Review checklist for @JannikZeitschner

Conflict of interest

• I confirm that I have read the JOSS conflict of interest (COI) policy and that: I have no COIs with reviewing this work or that any perceived COIs have been waived by JOSS for the purpose of this review.

Code of Conduct

• I confirm that I read and will adhere to the JOSS code of conduct.

General checks

• Repository: Is the source code for this software available at the https://github.com/simple-crypto/SCALib?
• License: Does the repository contain a plain-text LICENSE file with the contents of an OSI approved software license?
• Contribution and authorship: Has the submitting author (@cassiersg) made major contributions to the software? Does the full list of paper authors seem appropriate and complete?
• Substantial scholarly effort: Does this submission meet the scope eligibility described in the JOSS guidelines
• Data sharing: If the paper contains original data, data are accessible to the reviewers. If the paper contains no original data, please check this item.
• Reproducibility: If the paper contains original results, results are entirely reproducible by reviewers. If the paper contains no original results, please check this item.
• Human and animal research: If the paper contains original data research on humans subjects or animals, does it comply with JOSS's human participants research policy and/or animal research policy? If the paper contains no such data, please check this item.

Functionality

• Installation: Does installation proceed as outlined in the documentation?
• Functionality: Have the functional claims of the software been confirmed?
• Performance: If there are any performance claims of the software, have they been confirmed? (If there are no claims, please check off this item.)

Documentation

• A statement of need: Do the authors clearly state what problems the software is designed to solve and who the target audience is?
• Installation instructions: Is there a clearly-stated list of dependencies? Ideally these should be handled with an automated package management solution.
• Example usage: Do the authors include examples of how to use the software (ideally to solve real-world analysis problems).
• Functionality documentation: Is the core functionality of the software documented to a satisfactory level (e.g., API method documentation)?
• Automated tests: Are there automated tests or manual steps described so that the functionality of the software can be verified?
• Community guidelines: Are there clear guidelines for third parties wishing to 1) Contribute to the software 2) Report issues or problems with the software 3) Seek support

Software paper

• Summary: Has a clear description of the high-level functionality and purpose of the software for a diverse, non-specialist audience been provided?
• A statement of need: Does the paper have a section titled 'Statement of need' that clearly states what problems the software is designed to solve, who the target audience is, and its relation to other work?
• State of the field: Do the authors describe how this software compares to other commonly-used packages?
• Quality of writing: Is the paper well written (i.e., it does not require editing for structure, language, or writing quality)?
• References: Is the list of references complete, and is everything cited appropriately that should be cited (e.g., papers, datasets, software)? Do references in the text use the proper citation syntax?

[Nikoleta-v3]

👋🏻 @nicolaimueller & @JannikZeitschner any updates on your reviews? 😄

[nicolaimueller]

Review checklist for @nicolaimueller

Conflict of interest

• I confirm that I have read the JOSS conflict of interest (COI) policy and that: I have no COIs with reviewing this work or that any perceived COIs have been waived by JOSS for the purpose of this review.

Code of Conduct

• I confirm that I read and will adhere to the JOSS code of conduct.

General checks

• Repository: Is the source code for this software available at the https://github.com/simple-crypto/SCALib?
• License: Does the repository contain a plain-text LICENSE file with the contents of an OSI approved software license?
• Contribution and authorship: Has the submitting author (@cassiersg) made major contributions to the software? Does the full list of paper authors seem appropriate and complete?
• Substantial scholarly effort: Does this submission meet the scope eligibility described in the JOSS guidelines
• Data sharing: If the paper contains original data, data are accessible to the reviewers. If the paper contains no original data, please check this item.
• Reproducibility: If the paper contains original results, results are entirely reproducible by reviewers. If the paper contains no original results, please check this item.
• Human and animal research: If the paper contains original data research on humans subjects or animals, does it comply with JOSS's human participants research policy and/or animal research policy? If the paper contains no such data, please check this item.

Functionality

• Installation: Does installation proceed as outlined in the documentation?
• Functionality: Have the functional claims of the software been confirmed?
• Performance: If there are any performance claims of the software, have they been confirmed? (If there are no claims, please check off this item.)

Documentation

• A statement of need: Do the authors clearly state what problems the software is designed to solve and who the target audience is?
• Installation instructions: Is there a clearly-stated list of dependencies? Ideally these should be handled with an automated package management solution.
• Example usage: Do the authors include examples of how to use the software (ideally to solve real-world analysis problems).
• Functionality documentation: Is the core functionality of the software documented to a satisfactory level (e.g., API method documentation)?
• Automated tests: Are there automated tests or manual steps described so that the functionality of the software can be verified?
• Community guidelines: Are there clear guidelines for third parties wishing to 1) Contribute to the software 2) Report issues or problems with the software 3) Seek support

Software paper

• Summary: Has a clear description of the high-level functionality and purpose of the software for a diverse, non-specialist audience been provided?
• A statement of need: Does the paper have a section titled 'Statement of need' that clearly states what problems the software is designed to solve, who the target audience is, and its relation to other work?
• State of the field: Do the authors describe how this software compares to other commonly-used packages?
• Quality of writing: Is the paper well written (i.e., it does not require editing for structure, language, or writing quality)?
• References: Is the list of references complete, and is everything cited appropriately that should be cited (e.g., papers, datasets, software)? Do references in the text use the proper citation syntax?

[nicolaimueller]

Hi all and sorry for the delay. I had some problems with my setup but will finalize my report by end of this week.

[nicolaimueller]

Hi all, I am done with my review. The checklist can be found above. Additionally, I want to give some more detailed comments:

I recently had the opportunity to test SCALib on a Ubuntu 22.10 subsystem and I am delighted to report that I did not encounter any issues related to the use of a subsystem, which is not always the case. Overall, my experience with the library was very positive, and I found it to be both well-designed and well-documented.

The installation process was straightforward, and I successfully installed SCALib using pip without any issues. The readme also provided valuable information about potential pitfalls, such as outdated versions of pip, which I found helpful.

During the testing of the provided example, I encountered no problems. The library's textual feedback was clear and well-formatted, making it easy to understand what was happening at each step.

One aspect of SCALib that particularly intrigued me was the benchmark results. Although I understand that these results can be highly dependent on the setup, I was still curious to try to reproduce them. Unfortunately, I encountered an issue where the link to scabench was no longer working, and I was prompted for authentication when I attempted to clone it. It would be helpful if the authors could clarify how to reproduce the benchmark results or fix the missing link if possible.

Although I could not find a specific "statement of need" section, I did not find it to be a major issue, as I felt that all of the necessary information was still provided in the readme.

Overall, I believe that SCALib is a well-designed and well-documented library. The authors have taken care to address all of the JOSS requirements, and the documentation is both comprehensive and nicely formatted. Although I encountered a few minor issues during my testing, they did not detract from my overall positive impression of the library.

As this is my first review for JOSS, please let me know if there is anything missing or if a more detailed answer to any particular point is required.

[cassiersg]

Thanks @nicolaimueller for your comments.

Does this link work ? https://github.com/cassiersg/SCABench

If so, can you tell me where is the broken link ?

[JannikZeitschner]

Hey everyone, please excuse my late response. My plan is to finish the review by the end of this week.

[JannikZeitschner]

Hi everyone! Once again please excuse the time it took for me to review! I am done now with my finished checklist above. I also would like to give some additional notes:

I tested SCALib in WSL2 with Ubuntu 20.04 running. The installation was extremely easy as the authors made a good job to point out possible pitfalls and ensuring that almost everything regarding installation is handled internally. The documentation is well written and easy to understand, while always providing compact examples for a quick understanding how to use certain functionality.

As Nico already pointed out there is no "statement of need" section in the documentation (at least I could not finde one), but I also agree that this is not a major issue due to the overall effort of providing very good explanations and descriptions even for non-specialists.

At first I encountered the same error as Nico when trying to execute the benchmarking results, but managed to "fix" the problem I think, which would probably also answer the question by @cassiersg:
The link https://github.com/cassiersg/SCABench works fine, but running git clone https://github.com/simple-crypto/scabench from this repository returns an error as it can not find the "scabench" repository in "simple-crypto". However, changing the command to git clone https://github.com/cassiersg/SCABench worked for me, i.e., I think just the owner of the repository changed. After running cd SCABench followed by make I could execute the benchmarks without a problem. I would like to highlight the simplicity of executing the benchmarks. As it compares the functionality with two other libraries the benchmark takes care of potential dependencies and interaction with the other libraries.

Just a very minor remark: I did find two typos in the readme:
In

SCALib should be useful for any side-channel practitionner

I think it should be "practitioner" and under the chapter "Versioning policy" I think it is "semantic versioning".

Overall I think SCALib is a very useful library that can help improve many tasks in the field of side-channel analysis. The authors address common challenges (among others size of processed data and speed-up thanks to parallelization), while providing an easy to use interface both regarding the documentation and practical use. In my opinion all JOSS requirements were taken into account.

As this is my first JOSS review as well, please let me know if anything is missing or you need further information.

[cassiersg]

Thanks @JannikZeitschner for the review. I fixed the link in the README of https://github.com/cassiersg/SCABench, and the typos in the README.

[cassiersg]

Answering to @nicolaimueller review:

• The link in the SCABench README is now fixed, following the instructions there should work. (https://github.com/cassiersg/SCABench#usage)
• Could you check the software paper generated by the bot here ? There is a "statement of need" section.

Answering to @JannikZeitschner review:

• There is no explicit "statement of need" section in the documentation, but this content appears in the readme (https://github.com/simple-crypto/SCALib) and on the homepage of the documentation (https://scalib.readthedocs.io/en/stable/).
• The typos are fixed.

[nicolaimueller]

Thanks @cassiersg for the updates. I have reviewed the benchmarks and everything works as expected. However, I did encounter an initial error message that was somewhat cryptic, and it took me a few minutes to realize that the issue was related to insufficient RAM. Once I switched to a machine with more RAM, the problem was resolved. Additionally, I have read the paper and agree with your "statement of need" section. As a result, I adjusted my review accordingly.

[JannikZeitschner]

Hi @cassiersg also from my side thanks for the update and for the clarification regarding the "statement of need". I agree with your explanation. I also adjusted my review in that sense.

[cassiersg]

Thanks @nicolaimueller and @JannikZeitschner for the quick replies.

@Nikoleta-v3 I think we can move to the next step.

[Nikoleta-v3]

Thank you all for your work for this submission🙏🏻 🚀 !

@cassiersg apologies for the delay in my reply. I have been away for the past few weeks.

I will go over the review and review the manuscript myself as well and get back to you as soon as possible 👍🏻

[cassiersg]

@Nikoleta-v3 no problem. Thanks for the update.

[Nikoleta-v3]

@editorialbot generate pdf

[editorialbot]

👉📄 Download article proof 📄 View article proof on GitHub 📄 👈

[danielskatz]

Hi - I'm the track editor for this paper, now responsible for the last steps. I've suggested some small changes in simple-crypto/SCALib#112 - please merge this, or let me know what you disagree with, then we can continue and complete the publication process.

[cassiersg]

Hi @danielskatz ! Thanks for the PR, I just merged it.

[danielskatz]

@editorialbot recommend-accept

[editorialbot]

Attempting dry run of processing paper acceptance...

[editorialbot]

Reference check summary (note 'MISSING' DOIs are suggestions that need verification):

OK DOIs

- 10.46586/tches.v2022.i4.693-717 is OK
- 10.46586/tches.v2021.i3.202-234 is OK
- 10.1007/978-3-540-85053-3_26 is OK
- 10.1007/978-3-662-48324-4_25 is OK
- 10.1007/978-3-662-53140-2_4 is OK
- 10.1007/3-540-36400-5_3 is OK
- 10.1038/s41586-020-2649-2 is OK

MISSING DOIs

- 10.1007/978-3-642-01001-9_26 may be a valid DOI for title: A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks

INVALID DOIs

- None

[danielskatz]

@cassiersg - can you add the DOI mentioned above ☝️

[editorialbot]

👋 @openjournals/csism-eics, this paper is ready to be accepted and published.

Check final proof 👉📄 Download article

If the paper PDF and the deposit XML files look good in openjournals/joss-papers#4278, then you can now move forward with accepting the submission by compiling again with the command @editorialbot accept

[cassiersg]

@danielskatz

The current DOI https://doi.org/10.1007/978-3-642-01001-9_26 links to the correct paper, but there is a comment

The original version of this chapter was revised: The copyright line was incorrect. This has been corrected. The Erratum to this chapter is available at DOI: 10.1007/978-3-642-01001-9_35

The latter DOI does not seem to exist.

[danielskatz]

@editorialbot check references

[editorialbot]

Reference check summary (note 'MISSING' DOIs are suggestions that need verification):

OK DOIs

- 10.46586/tches.v2022.i4.693-717 is OK
- 10.46586/tches.v2021.i3.202-234 is OK
- 10.1007/978-3-540-85053-3_26 is OK
- 10.1007/978-3-662-48324-4_25 is OK
- 10.1007/978-3-662-53140-2_4 is OK
- 10.1007/3-540-36400-5_3 is OK
- 10.1038/s41586-020-2649-2 is OK

MISSING DOIs

- 10.1007/978-3-642-01001-9_26 may be a valid DOI for title: A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks

INVALID DOIs

- None

[danielskatz]

@cassiersg - the missing DOI was due to an error in my PR, which I've fixed in simple-crypto/SCALib#113. Re the DOI for the errratum, if you want to report it to the journal or to crossref (as indicated in the page you get for the DOI failure), please go ahead, but since this DOI is not directly referred to in the JOSS paper, I'm going to ignore it for the purpose of completing the JOSS paper.

[cassiersg]

@editorialbot check references

[editorialbot]

Reference check summary (note 'MISSING' DOIs are suggestions that need verification):

OK DOIs

- 10.46586/tches.v2022.i4.693-717 is OK
- 10.46586/tches.v2021.i3.202-234 is OK
- 10.1007/978-3-540-85053-3_26 is OK
- 10.1007/978-3-662-48324-4_25 is OK
- 10.1007/978-3-662-53140-2_4 is OK
- 10.1007/3-540-36400-5_3 is OK
- 10.1007/978-3-642-01001-9_26 is OK
- 10.1038/s41586-020-2649-2 is OK

MISSING DOIs

- None

INVALID DOIs

- None

[cassiersg]

@danielskatz I merged your PR and it looks ok. Thanks for the fix, I thought the error was due to the "revised" status.

[danielskatz]

@editorialbot recommend-accept

[editorialbot]

Attempting dry run of processing paper acceptance...

[editorialbot]

Reference check summary (note 'MISSING' DOIs are suggestions that need verification):

OK DOIs

- 10.46586/tches.v2022.i4.693-717 is OK
- 10.46586/tches.v2021.i3.202-234 is OK
- 10.1007/978-3-540-85053-3_26 is OK
- 10.1007/978-3-662-48324-4_25 is OK
- 10.1007/978-3-662-53140-2_4 is OK
- 10.1007/3-540-36400-5_3 is OK
- 10.1007/978-3-642-01001-9_26 is OK
- 10.1038/s41586-020-2649-2 is OK

MISSING DOIs

- None

INVALID DOIs

- None

[editorialbot]

👋 @openjournals/csism-eics, this paper is ready to be accepted and published.

Check final proof 👉📄 Download article

If the paper PDF and the deposit XML files look good in openjournals/joss-papers#4282, then you can now move forward with accepting the submission by compiling again with the command @editorialbot accept

[danielskatz]

@editorialbot accept

[editorialbot]

Doing it live! Attempting automated processing of paper acceptance...

[editorialbot]

Ensure proper citation by uploading a plain text CITATION.cff file to the default branch of your repository.

If using GitHub, a Cite this repository menu will appear in the About section, containing both APA and BibTeX formats. When exported to Zotero using a browser plugin, Zotero will automatically create an entry using the information contained in the .cff file.

You can copy the contents for your CITATION.cff file here:

CITATION.cff

cff-version: "1.2.0"
authors:
- family-names: Cassiers
  given-names: Gaëtan
  orcid: "https://orcid.org/0000-0001-5426-9345"
- family-names: Bronchain
  given-names: Olivier
  orcid: "https://orcid.org/0000-0001-7595-718X"
contact:
- family-names: Cassiers
  given-names: Gaëtan
  orcid: "https://orcid.org/0000-0001-5426-9345"
doi: 10.5281/zenodo.7985686
message: If you use this software, please cite our article in the
  Journal of Open Source Software.
preferred-citation:
  authors:
  - family-names: Cassiers
    given-names: Gaëtan
    orcid: "https://orcid.org/0000-0001-5426-9345"
  - family-names: Bronchain
    given-names: Olivier
    orcid: "https://orcid.org/0000-0001-7595-718X"
  date-published: 2023-06-01
  doi: 10.21105/joss.05196
  issn: 2475-9066
  issue: 86
  journal: Journal of Open Source Software
  publisher:
    name: Open Journals
  start: 5196
  title: "SCALib: A Side-Channel Analysis Library"
  type: article
  url: "https://joss.theoj.org/papers/10.21105/joss.05196"
  volume: 8
title: "SCALib: A Side-Channel Analysis Library"

If the repository is not hosted on GitHub, a .cff file can still be uploaded to set your preferred citation. Users will be able to manually copy and paste the citation.

Find more information on .cff files here and here.

[editorialbot]

🐦🐦🐦 👉 Tweet for this paper 👈 🐦🐦🐦

[editorialbot]

🐘🐘🐘 👉 Toot for this paper 👈 🐘🐘🐘

[editorialbot]

🚨🚨🚨 THIS IS NOT A DRILL, YOU HAVE JUST ACCEPTED A PAPER INTO JOSS! 🚨🚨🚨

Here's what you must now do:

0. Check final PDF and Crossref metadata that was deposited 👉 Creating pull request for 10.21105.joss.05196 joss-papers#4283
1. Wait a couple of minutes, then verify that the paper DOI resolves https://doi.org/10.21105/joss.05196
2. If everything looks good, then close this review issue.
3. Party like you just published a paper! 🎉🌈🦄💃👻🤘

Any issues? Notify your editorial technical team...

[danielskatz]

Congratulations to @cassiersg (Gaëtan Cassiers) and co-author!!

And thanks to @nicolaimueller and @JannikZeitschner for reviewing, and to @Nikoleta-v3 for editing!
We couldn't do this with your voluntary help!

[editorialbot]

🎉🎉🎉 Congratulations on your paper acceptance! 🎉🎉🎉

If you would like to include a link to your paper from your README use the following code snippets:

Markdown:
[![DOI](https://joss.theoj.org/papers/10.21105/joss.05196/status.svg)](https://doi.org/10.21105/joss.05196)

HTML:
<a style="border-width:0" href="https://doi.org/10.21105/joss.05196">
  <img src="https://joss.theoj.org/papers/10.21105/joss.05196/status.svg" alt="DOI badge" >
</a>

reStructuredText:
.. image:: https://joss.theoj.org/papers/10.21105/joss.05196/status.svg
   :target: https://doi.org/10.21105/joss.05196

This is how it will look in your documentation:

We need your help!

The Journal of Open Source Software is a community-run journal and relies upon volunteer effort. If you'd like to support us please consider doing either one (or both) of the the following:

• Volunteering to review for us sometime in the future. You can add your name to the reviewer list here: https://reviewers.joss.theoj.org/join
• Making a small donation to support our running costs here: https://numfocus.org/donate-to-joss

[cassiersg]

Thanks again @nicolaimueller @JannikZeitschner @Nikoleta-v3 @danielskatz !

cc @obronchain