✦ ❯ python lascar_check.py --config config/efr32_hwaes_2kavg_unknown.json --leakage-model invsbox_hw --ac-couple --dataset-path datasets/200K_2KAVG_UNKNOWN/ --analysis-window 115,169,192,194,220,222 --blind-verify --brute-complete 3
Loading train split from datasets/200K_2KAVG_UNKNOWN// ...
  200000 traces, 300 samples each
  analysis window: 6 span(s) [115,116), [169,170), [192,193), [194,195), [220,221), [222,223) → 6 samples
  preprocessing: ac-couple (per-trace mean subtracted)
Running Lascar CPA: mode=decrypt, model=invsbox_hw, values='plaintext' = chip's ciphertext (decrypt input)
2026-09-18 21:29:25,169 - lascar.session - INFO - Session Session: 200000 traces, 18 engines, batch_size=50, leakage_shape=(6,)
INFO:lascar.session:Session Session: 200000 traces, 18 engines, batch_size=50, leakage_shape=(6,)
Session |100%|####################################################################################|200000 trc/200000 | (18 engines, batch_size=50, leakage_shape=(6,)) |Time:  0:00:07

byte  PGE   top1 |corr|   top2 |corr|   true
----  ---   ----  ----    ----  ----    ----
  0    23   80  0.0201    9F  0.0199    D9
  1     0   AD  0.0834    8E  0.0263    AD  <- correct top guess
  2     0   92  0.0238    9F  0.0203    92  <- correct top guess
  3     0   69  0.0843    E4  0.0262    69  <- correct top guess
  4     0   54  0.0378    36  0.0342    54  <- correct top guess
  5     0   B6  0.0902    01  0.0473    B6  <- correct top guess
  6     0   41  0.0493    85  0.0362    41  <- correct top guess
  7     0   9B  0.0750    5B  0.0589    9B  <- correct top guess
  8     0   00  0.0266    64  0.0132    00  <- correct top guess
  9     0   9A  0.1405    2D  0.0570    9A  <- correct top guess
 10     0   EF  0.0232    BD  0.0116    EF  <- correct top guess
 11     0   99  0.0286    61  0.0168    99  <- correct top guess
 12     0   BA  0.0329    1D  0.0279    BA  <- correct top guess
 13     0   CC  0.1156    7B  0.0470    CC  <- correct top guess
 14     0   3A  0.0306    74  0.0139    3A  <- correct top guess
 15     0   10  0.0462    9D  0.0176    10  <- correct top guess

15/16 bytes correct (round-10 key)
recovered: 80ad926954b6419b009aef99bacc3a10
true:      d9ad926954b6419b009aef99bacc3a10
master (from recovered rk10): 064998c1cf200fbb78d7d99af8bd105d

Blind master-key verification (no stored key used) —
  ENC(master, e51763c0e15076246a6a059fc0cecf06) = 9b5ff1bbda00d6444753d62c99439c1e  != captured 3b51de2c787a32d04e1c40a67959aae9  ✗
  ENC(master, ae966ac78be21a53f7c3e7844990efa9) = bc6aa4a058ce63f64e96409d41fcd850  != captured e51763c0e15076246a6a059fc0cecf06  ✗
  ENC(master, 4472b7d065906dd0e718d1eceef05774) = c15e50ab91406bc9fa3bca69f9d36c68  != captured ae966ac78be21a53f7c3e7844990efa9  ✗
  ENC(master, b2ebb88a8f56c330f9c35136b2b653b6) = 773bbb628a04e74a1cf62bd6ec36f2ad  != captured 4472b7d065906dd0e718d1eceef05774  ✗
direct check failed; escalating a blind brute-force (budget: up to 3 weakest byte(s), PT/CT-validated) —
  escalate k=1: brute-force weakest 1 byte(s) [0] (≤256 combos, PT/CT-validated)...
BLIND KEY RECOVERY COMPLETED ✓  1 byte(s) actually wrong: [0]
  round-10 key = d9ad926954b6419b009aef99bacc3a10
  master       = 5f82c2d9cfeb0fa321d7d982f8bd1045