Abstract: Previous first-order differential power analysis (DPA) attacks have depended on knowledge of the target algorithm’s input or output. This paper describes a first-order DPA attack against AES in counter mode, in which the initial counter and output values are all unknown.