Scenario for applying power analysis I have started doing some reading about power analysis (SPA, DPA), and it is not clear to me in what Scenario one would have to fear such an attack.  It appears to me that a typical situation is


Scenario A: A key is stored in plain text on a smart card, the analysis is conducted while encryption/decryption request are sent to the card and in effect the key is obtained.


However I am more interested in


Scenario B: A key is stored encrypted on a device (smart card?). During normal operation one would send the passphrase (required for decrypting the key) together with an encryption/decryption request to be performed by the decrypted key. Now the assumption is that an attacker does not posses the passphrase.


Would it still be possible to obtain the passphrase by power analysis?
(From my imagination the only thing one could do is feeding wrong passphrases.) From my understanding scenario B is not susceptible to power analysis, or am I wrong?
This seems to be correct.

I do see one possible attack vector where repetition of the request could be used for DPA attacks on the decryption key. It is basically the plaintext when looking at the decryption using the passphrase. It is also the encryption / decryption key for the subsequent operation using the key. But that's a scenario that is less likely than an attacker holding the smart card and trying to use DPA to retrieve an encryption key.

If you send the password in plaintext then you should of course consider the security of the password before it actually reaches the smart card. DPA attacks are not interesting if the adversary can simply eavesdrop on an unprotected password.