2.1 Di?erential Power Analysis Di?erential Power Analysis (DPA) was introduced by Kocher, Ja?e and Jun in 1998 13] and published in 1999 14]. The basic idea is to make use of potential correlations between the data handled by the micro-controller and the electric consumption measured values. Since these correlations are often very low, s- tistical methods must be applied to deduce su?cient information from them. Theprinciple ofDPAattacksconsistsincomparingconsumptionvalues m- suredonthe real physical device (for instance a GSM chip or a smart card)with values computed in an hypothetical model of this device (the hypotheses being made among others on the nature of the implementation, and chie?y on a part of the secret key). By comparing these two sets of values, the attacker tries to recover all or part of the secret key. The initial target of DPA attacks was limited to symmetric algorithms. V- nerability of DES - ?rst shown by Kocher, Ja?e and Jun 13, 14]-wasfurther studied by Goubin and Patarin 11, 12], Messerges, Dabbish, Sloan 16]and Akkar, B evan, Dischamp, Moyart 2]. Applications of these attacks were also largely taken into account during the AES selection process, notably by Biham, Shamir 4], Chari, Jutla, Rao, Rohatgi 5] and Daemen, Rijmen 8].