Mixing Additive and Multiplicative Masking for Probing Secure Polynomial Evaluation Methods
Masking is a sound countermeasure to protect implementations of block- cipher algorithms against Side Channel Analysis (SCA). Currently, the most efficient masking schemes use Lagrange’s Interpolation Theorem in order to represent any S- box by a polynomial function over a binary finite field. Maski...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2018-02-01
|
| Series: | Transactions on Cryptographic Hardware and Embedded Systems |
| Subjects: | |
| Online Access: | https://tches.iacr.org/index.php/TCHES/article/view/837 |
| _version_ | 1828867964886056960 |
|---|---|
| author | Axel Mathieu-Mahias Michaël Quisquater |
| author_facet | Axel Mathieu-Mahias Michaël Quisquater |
| author_sort | Axel Mathieu-Mahias |
| collection | DOAJ |
| description | Masking is a sound countermeasure to protect implementations of block- cipher algorithms against Side Channel Analysis (SCA). Currently, the most efficient masking schemes use Lagrange’s Interpolation Theorem in order to represent any S- box by a polynomial function over a binary finite field. Masking the processing of an S-box is then achieved by masking every operation involved in the evaluation of its polynomial representation. While the common approach requires to use the well- known Ishai-Sahai-Wagner (ISW) scheme in order to secure this processing, there exist alternatives. In the particular case of power functions, Genelle, Prouff and Quisquater proposed an efficient masking scheme (GPQ). However, no generalization has been suggested for polynomial functions so far. In this paper, we solve the open problem of extending GPQ for polynomials, and we also solve the open problem of proving that both the original scheme and its variants for polynomials satisfy the t-SNI security definition. Our approach to extend GPQ is based on the cyclotomic method and results in an alternate cyclotomic method which is three times faster in practice than the original proposal in almost all scenarios we address. The best- known method for polynomial evaluation is currently CRV which requires to use the cyclotomic method for one of its step. We also show how to plug our alternate cyclo- tomic approach into CRV and again provide an alternate approach that outperforms the original in almost all scenarios. We consider the masking of n-bit S-boxes for n ∈ [4;8] and we get in practice 35% improvement of efficiency for S-boxes with dimension n ∈ {5,7,8} and 25% for 6-bit S-boxes. |
| first_indexed | 2024-12-13T05:21:45Z |
| format | Article |
| id | doaj.art-4ac46b3259e6419ca253cbaf4b34a0e5 |
| institution | Directory Open Access Journal |
| issn | 2569-2925 |
| language | English |
| last_indexed | 2024-12-13T05:21:45Z |
| publishDate | 2018-02-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | Transactions on Cryptographic Hardware and Embedded Systems |
| spelling | doaj.art-4ac46b3259e6419ca253cbaf4b34a0e52022-12-21T23:58:18ZengRuhr-Universität BochumTransactions on Cryptographic Hardware and Embedded Systems2569-29252018-02-012018110.13154/tches.v2018.i1.175-208Mixing Additive and Multiplicative Masking for Probing Secure Polynomial Evaluation MethodsAxel Mathieu-Mahias0Michaël Quisquater1University of Versailles-St-Quentin-en-YvelinesUniversity of Versailles-St-Quentin-en-YvelinesMasking is a sound countermeasure to protect implementations of block- cipher algorithms against Side Channel Analysis (SCA). Currently, the most efficient masking schemes use Lagrange’s Interpolation Theorem in order to represent any S- box by a polynomial function over a binary finite field. Masking the processing of an S-box is then achieved by masking every operation involved in the evaluation of its polynomial representation. While the common approach requires to use the well- known Ishai-Sahai-Wagner (ISW) scheme in order to secure this processing, there exist alternatives. In the particular case of power functions, Genelle, Prouff and Quisquater proposed an efficient masking scheme (GPQ). However, no generalization has been suggested for polynomial functions so far. In this paper, we solve the open problem of extending GPQ for polynomials, and we also solve the open problem of proving that both the original scheme and its variants for polynomials satisfy the t-SNI security definition. Our approach to extend GPQ is based on the cyclotomic method and results in an alternate cyclotomic method which is three times faster in practice than the original proposal in almost all scenarios we address. The best- known method for polynomial evaluation is currently CRV which requires to use the cyclotomic method for one of its step. We also show how to plug our alternate cyclo- tomic approach into CRV and again provide an alternate approach that outperforms the original in almost all scenarios. We consider the masking of n-bit S-boxes for n ∈ [4;8] and we get in practice 35% improvement of efficiency for S-boxes with dimension n ∈ {5,7,8} and 25% for 6-bit S-boxes.https://tches.iacr.org/index.php/TCHES/article/view/837Side-channel countermeasureMaskingPolynomial evaluationProbing securityBlock cipherAuthenticated encryption |
| spellingShingle | Axel Mathieu-Mahias Michaël Quisquater Mixing Additive and Multiplicative Masking for Probing Secure Polynomial Evaluation Methods Transactions on Cryptographic Hardware and Embedded Systems Side-channel countermeasure Masking Polynomial evaluation Probing security Block cipher Authenticated encryption |
| title | Mixing Additive and Multiplicative Masking for Probing Secure Polynomial Evaluation Methods |
| title_full | Mixing Additive and Multiplicative Masking for Probing Secure Polynomial Evaluation Methods |
| title_fullStr | Mixing Additive and Multiplicative Masking for Probing Secure Polynomial Evaluation Methods |
| title_full_unstemmed | Mixing Additive and Multiplicative Masking for Probing Secure Polynomial Evaluation Methods |
| title_short | Mixing Additive and Multiplicative Masking for Probing Secure Polynomial Evaluation Methods |
| title_sort | mixing additive and multiplicative masking for probing secure polynomial evaluation methods |
| topic | Side-channel countermeasure Masking Polynomial evaluation Probing security Block cipher Authenticated encryption |
| url | https://tches.iacr.org/index.php/TCHES/article/view/837 |
| work_keys_str_mv | AT axelmathieumahias mixingadditiveandmultiplicativemaskingforprobingsecurepolynomialevaluationmethods AT michaelquisquater mixingadditiveandmultiplicativemaskingforprobingsecurepolynomialevaluationmethods |