The wide trial strategy is composed of several linear and non-linear transformations that ensures the dependency of output bits on input bits in a complex manner [@daemen1995cipher]. The input and output correlation of this strategy is very large if the linear approximation is done for even one round. Also the transformation is kept uniform which treats every bit in a similar manner and provides opposition to differential attacks.

Security Analysis of *ExTru* {#attacks}
============================

Assuming that the attacker can monitor the side-channel information of the chips during normal operations (based on power/current traces), and the possibility of having access to the scan chain to apply any form of scan-based attack, in this section we evaluate the resiliency of *ExTru* against different physical attacks, such as side-channel, the scan-based SAT, and algebraic attack. An Attack objective may be (1) extracting the secret key, or (2) extracting CSTN configuration (TRNs), or (3) eavesdropping on messages exchanged between the devices.

\

**Side-Channel Attack (SCA)**
-----------------------------

The objective of SCA on *ExTru* is to extract either the secret key used by AEAD (ACORN) or the TRN used by CSTN. Extracting a secret key is sufficient to break the communication. By extracting the secret key, 