Side-Channel Masking with Common Shares
To counter side-channel attacks, a masking scheme randomly encodes keydependent variables into several shares, and transforms operations into the masked correspondence (called gadget) operating on shares. This provably achieves the de facto standard notion of probing security. We continue the long...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2022-06-01
|
| Series: | Transactions on Cryptographic Hardware and Embedded Systems |
| Subjects: | |
| Online Access: | https://tches.iacr.org/index.php/TCHES/article/view/9703 |
| _version_ | 1818471115520999424 |
|---|---|
| author | Weijia Wang Chun Guo Yu Yu Fanjie Ji Yang Su |
| author_facet | Weijia Wang Chun Guo Yu Yu Fanjie Ji Yang Su |
| author_sort | Weijia Wang |
| collection | DOAJ |
| description |
To counter side-channel attacks, a masking scheme randomly encodes keydependent variables into several shares, and transforms operations into the masked correspondence (called gadget) operating on shares. This provably achieves the de facto standard notion of probing security.
We continue the long line of works seeking to reduce the overhead of masking. Our main contribution is a new masking scheme over finite fields in which shares of different variables have a part in common. This enables the reuse of randomness / variables across different gadgets, and reduces the total cost of masked implementation. For security order d and circuit size l, the randomness requirement and computational complexity of our scheme are Õ(d2) and Õ(ld2) respectively, strictly improving upon the state-of-the-art Õ(d2) and Õ(ld3) of Coron et al. at Eurocrypt 2020.
A notable feature of our scheme is that it enables a new paradigm in which many intermediates can be precomputed before executing the masked function. The precomputation consumes Õ(ld2) and produces Õ(ld) variables to be stored in RAM. The cost of subsequent (online) computation is reduced to Õ(ld), effectively speeding up e.g., challenge-response authentication protocols. We showcase our method on the AES on ARM Cortex M architecture and perform a T-test evaluation. Our results show a speed-up during the online phase compared with state-of-the-art implementations, at the cost of acceptable RAM consumption and precomputation time.
To prove security for our scheme, we propose a new security notion intrinsically supporting randomness / variables reusing across gadgets, and bridging the security of parallel compositions of gadgets to general compositions, which may be of independent interest.
|
| first_indexed | 2024-04-13T21:47:23Z |
| format | Article |
| id | doaj.art-a8208a3aef7e4075b8a666f2e738a91b |
| institution | Directory Open Access Journal |
| issn | 2569-2925 |
| language | English |
| last_indexed | 2024-04-13T21:47:23Z |
| publishDate | 2022-06-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | Transactions on Cryptographic Hardware and Embedded Systems |
| spelling | doaj.art-a8208a3aef7e4075b8a666f2e738a91b2022-12-22T02:28:32ZengRuhr-Universität BochumTransactions on Cryptographic Hardware and Embedded Systems2569-29252022-06-012022310.46586/tches.v2022.i3.290-329Side-Channel Masking with Common SharesWeijia Wang0Chun Guo1Yu Yu2Fanjie Ji3Yang Su4School of Cyber Science and Technology, Shandong University, Qingdao, China; Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Qingdao, China; Quan Cheng Shandong Laboratory, Jinan, China School of Cyber Science and Technology, Shandong University, Qingdao, China; Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Qingdao, China; Shandong Research Institute of Industrial Technology, Jinan, China Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, China; Shanghai Qi Zhi Institute, Shanghai, China; Shanghai Key Laboratory of Privacy-Preserving Computation, Shanghai, ChinaSchool of Cyber Science and Technology, Shandong University, Qingdao, ChinaSchool of Cyber Science and Technology, Shandong University, Qingdao, China To counter side-channel attacks, a masking scheme randomly encodes keydependent variables into several shares, and transforms operations into the masked correspondence (called gadget) operating on shares. This provably achieves the de facto standard notion of probing security. We continue the long line of works seeking to reduce the overhead of masking. Our main contribution is a new masking scheme over finite fields in which shares of different variables have a part in common. This enables the reuse of randomness / variables across different gadgets, and reduces the total cost of masked implementation. For security order d and circuit size l, the randomness requirement and computational complexity of our scheme are Õ(d2) and Õ(ld2) respectively, strictly improving upon the state-of-the-art Õ(d2) and Õ(ld3) of Coron et al. at Eurocrypt 2020. A notable feature of our scheme is that it enables a new paradigm in which many intermediates can be precomputed before executing the masked function. The precomputation consumes Õ(ld2) and produces Õ(ld) variables to be stored in RAM. The cost of subsequent (online) computation is reduced to Õ(ld), effectively speeding up e.g., challenge-response authentication protocols. We showcase our method on the AES on ARM Cortex M architecture and perform a T-test evaluation. Our results show a speed-up during the online phase compared with state-of-the-art implementations, at the cost of acceptable RAM consumption and precomputation time. To prove security for our scheme, we propose a new security notion intrinsically supporting randomness / variables reusing across gadgets, and bridging the security of parallel compositions of gadgets to general compositions, which may be of independent interest. https://tches.iacr.org/index.php/TCHES/article/view/9703Side-Channel AttackMaskingCost AmortizationPrecomputation |
| spellingShingle | Weijia Wang Chun Guo Yu Yu Fanjie Ji Yang Su Side-Channel Masking with Common Shares Transactions on Cryptographic Hardware and Embedded Systems Side-Channel Attack Masking Cost Amortization Precomputation |
| title | Side-Channel Masking with Common Shares |
| title_full | Side-Channel Masking with Common Shares |
| title_fullStr | Side-Channel Masking with Common Shares |
| title_full_unstemmed | Side-Channel Masking with Common Shares |
| title_short | Side-Channel Masking with Common Shares |
| title_sort | side channel masking with common shares |
| topic | Side-Channel Attack Masking Cost Amortization Precomputation |
| url | https://tches.iacr.org/index.php/TCHES/article/view/9703 |
| work_keys_str_mv | AT weijiawang sidechannelmaskingwithcommonshares AT chunguo sidechannelmaskingwithcommonshares AT yuyu sidechannelmaskingwithcommonshares AT fanjieji sidechannelmaskingwithcommonshares AT yangsu sidechannelmaskingwithcommonshares |