High Order Masking of Look-up Tables with Common Shares J-S.Coron, - - PowerPoint PPT Presentation

▶
high order masking of look up tables with common shares
SMART_READER_LITE
LIVE PREVIEW

High Order Masking of Look-up Tables with Common Shares J-S.Coron, - - PowerPoint PPT Presentation

Feb 08, 2024 38 likes •393 views

High Order Masking of Look-up Tables with Common Shares J-S.Coron, F.Rondepierre, R.Zeitoun 12th September 2018 Outline Outline 1 Introduction 1st Order Solution Higher Order Masking of Look-Up Tables 2 Higher Order: Optimizations 12th

slide-1
SLIDE 1

High Order Masking of Look-up Tables with Common Shares

J-S.Coron, F.Rondepierre, R.Zeitoun

12th September 2018

slide-2
SLIDE 2

Outline

1 Introduction

1st Order Solution Higher Order Masking of Look-Up Tables

2 Higher Order: Optimizations 3 Conclusion

2 12th September 2018

Outline

slide-3
SLIDE 3

Table of Contents

1 Introduction

1st Order Solution Higher Order Masking of Look-Up Tables

2 Higher Order: Optimizations 3 Conclusion

3 12th September 2018

Introduction

slide-4
SLIDE 4

SCA Countermeasure Sharing Principle

  • Given a sensitive data x
  • Given t random values x1, . . . , xt
  • Let x0 be such that:

x =

t

  • i=0

xi

  • (x0, . . . , xt) is a sharing of x secure at order t

4 12th September 2018

Introduction

slide-5
SLIDE 5

SBox Evaluation The problematic

  • Given sensitive data x
  • Given a known table S
  • How to compute securely :

x → S(x)

5 12th September 2018

Introduction

slide-6
SLIDE 6

SBox Evaluation The problematic

  • Given sensitive data x
  • Given a known table S
  • How to compute securely for ℓ evaluations:

x(ℓ) → S(x(ℓ))

5 12th September 2018

Introduction

slide-7
SLIDE 7

1st Order Secure at 1st Order

The ℓ-th evaluation of S is: x(ℓ) = (x(ℓ)

0 , m) → S(x(ℓ)) = (y (ℓ) 0 , m) 6 12th September 2018

Introduction

slide-8
SLIDE 8

1st Order Masked SBox Construction

T =      S(0 ⊕ m) ⊕ m . . . S((2k − 1) ⊕ m) ⊕ m     

Masked SBox Evaluation

S(x) = (T(x0), m)

7 12th September 2018

Introduction

slide-9
SLIDE 9

Higher Order Secure at Higher Order (Coron EUROCRYPT’14)

The ℓ-th evaluation of S is: x(ℓ) = (x(ℓ)

0 , x(ℓ) 1 , . . . , x(ℓ) 2t ) → S(x(ℓ)) = (y (ℓ) 0 , y (ℓ) 1 , . . . , y (ℓ) 2t ) 8 12th September 2018

Introduction

slide-10
SLIDE 10

Higher Order Example at 3rd Order

x = 2 = (0, 1, 1, 2)        S(0) S(1) S(2) S(3)       

9 12th September 2018

Introduction

slide-11
SLIDE 11

Higher Order Example at 3rd Order

x = 2 = (0, 1, 1, 2)        S(2) S(3) S(0) S(1)       

9 12th September 2018

Introduction

slide-12
SLIDE 12

Higher Order Example at 3rd Order

x = 2 = (0, 1, 1, 2)        S(2) ⊕ 3 1 2 S(3) ⊕ 1 1 S(0) ⊕ 0 2 3 1 S(1) ⊕ 0       

9 12th September 2018

Introduction

slide-13
SLIDE 13

Higher Order Example at 3rd Order

x = 2 = (0, 1, 1, 2)        S(2) ⊕ 3 1 2 S(3) ⊕ 1 1 S(0) ⊕ 0 2 3 1 S(1) ⊕ 0        = ⇒        S(3) ⊕ 1 1 S(2) ⊕ 3 1 2 S(1) ⊕ 0 S(0) ⊕ 0 2 3 1       

9 12th September 2018

Introduction

slide-14
SLIDE 14

Higher Order Example at 3rd Order

x = 2 = (0, 1, 1, 2)        S(3) ⊕ 1 1 2 2 S(2) ⊕ 1 2 3 S(1) ⊕ 3 2 1 S(0) ⊕ 0 1 1       

9 12th September 2018

Introduction

slide-15
SLIDE 15

Higher Order Example at 3rd Order

x = 2 = (0, 1, 1, 2)        S(2) ⊕ 1 2 3 S(3) ⊕ 1 1 2 2 S(0) ⊕ 0 1 1 S(1) ⊕ 3 2 1       

9 12th September 2018

Introduction

slide-16
SLIDE 16

Higher Order Example at 3rd Order

x = 2 = (0, 1, 1, 2)        S(2) ⊕ 2 2 2 2 S(3) ⊕ 1 1 2 2 S(0) ⊕ 1 1 1 1 S(1) ⊕ 3 3 3 3       

9 12th September 2018

Introduction

slide-17
SLIDE 17

Higher Order Example at 3rd Order

x = 2 = (0, 1, 1, 2) S(2) ⊕ 2 2 2 2

9 12th September 2018

Introduction

slide-18
SLIDE 18

Higher Order Example at 3rd Order

x = 2 = (0, 1, 1, 2) S(2) ⊕ 0 1 2 3

9 12th September 2018

Introduction

slide-19
SLIDE 19

Higher Order Masked SBox Construction (Coron EUROCRYPT’14)

T (0) =      sharing of S(0) . . . sharing of S(2k − 1)     

10 12th September 2018

Introduction

slide-20
SLIDE 20

Higher Order Masked SBox Construction (Coron EUROCRYPT’14)

T (1) =      new sharing of T (0)(0 ⊕ x2t) . . . new sharing of T (0)((2k − 1) ⊕ x2t)     

10 12th September 2018

Introduction

slide-21
SLIDE 21

Higher Order Masked SBox Construction (Coron EUROCRYPT’14)

T (2) =      new sharing of T (1)(0 ⊕ x2t−1) . . . new sharing of T (1)((2k − 1) ⊕ x2t−1)     

10 12th September 2018

Introduction

slide-22
SLIDE 22

Higher Order Masked SBox Construction (Coron EUROCRYPT’14)

T (2t) =      new sharing of T (2t−1)(0 ⊕ x1) . . . new sharing of T (2t−1)((2k − 1) ⊕ x1)     

10 12th September 2018

Introduction

slide-23
SLIDE 23

Higher Order Masked SBox Construction (Coron EUROCRYPT’14)

T (2t) =      new sharing of T (2t−1)(0 ⊕ x1) . . . new sharing of T (2t−1)((2k − 1) ⊕ x1)     

Masked SBox Evaluation

S(x) = new sharing of T (t)(x0)

10 12th September 2018

Introduction

slide-24
SLIDE 24

Table of Contents

1 Introduction

1st Order Solution Higher Order Masking of Look-Up Tables

2 Higher Order: Optimizations 3 Conclusion

11 12th September 2018

Higher Order: Optimizations

slide-25
SLIDE 25

Contributions Our Contributions

  • Security proof at order t with n = t + 1 shares instead of n = 2t + 1 shares (t-sni

formalism)

  • Saves a factor 4 (running time)
  • A variant with increasing number of output shares
  • Saves a factor 2 (running time)
  • Adapt the common shares technique for multiple SBox evaluations
  • Saves a factor 2 (running time)

12 12th September 2018

Higher Order: Optimizations

slide-26
SLIDE 26

Common Shares Common Shares (CGPZ CHES16)

Two values a and b may be securely shared such that at most half of the shares are common: (a0, . . . , a t

2 ,m0, . . . m t−1 2 )

(b0, . . . , b t

2 ,m0, . . . m t−1 2 )

13 12th September 2018

Higher Order: Optimizations

slide-27
SLIDE 27

Look-Up Tables with Common Shares Secure at Higher Order

The ℓ-th evaluation of S is: (x(ℓ)

0 , x(ℓ) 1 , . . . , x(ℓ)

t 2 , m0, . . . , m t−1 2 ) → S(x(ℓ)) = (y (ℓ)

0 , y (ℓ) 1 , . . . , y (ℓ) t

)

14 12th September 2018

Higher Order: Optimizations

slide-28
SLIDE 28

Look-Up Tables with Common Shares Masked SBox Construction (Common Table)

T (0) =      sharing of S(0) . . . sharing of S(2k − 1)     

15 12th September 2018

Higher Order: Optimizations

slide-29
SLIDE 29

Look-Up Tables with Common Shares Masked SBox Construction (Common Table)

T (1) =      new sharing of T (0)(0 ⊕ m0) . . . new sharing of T (0)((2k − 1) ⊕ m0)     

15 12th September 2018

Higher Order: Optimizations

slide-30
SLIDE 30

Look-Up Tables with Common Shares Masked SBox Construction (Common Table)

T (2) =      new sharing of T (1)(0 ⊕ m1) . . . new sharing of T (1)((2k − 1) ⊕ m1)     

15 12th September 2018

Higher Order: Optimizations

slide-31
SLIDE 31

Look-Up Tables with Common Shares Masked SBox Construction (Common Table)

T ( t+1

2 ) =

       new sharing of T ( t−1

2 )(0 ⊕ m t−1 2 )

. . . new sharing of T ( t−1

2 )((2k − 1) ⊕ m t−1 2 )

      

15 12th September 2018

Higher Order: Optimizations

slide-32
SLIDE 32

Look-Up Tables with Common Shares Masked SBox Construction (Common Table)

T ( t+1

2 ) =

       new sharing of T ( t−1

2 )(0 ⊕ m t−1 2 )

. . . new sharing of T ( t−1

2 )((2k − 1) ⊕ m t−1 2 )

      

Masked SBox Evaluation

1 Compute tables T ( t+3

2 ), . . . T (t) using shares x1, . . . , x t 2

2 Evaluate using table T (t):

S(x) = new sharing of T (t)(x0)

15 12th September 2018

Higher Order: Optimizations

slide-33
SLIDE 33

Performances AES

SBox Implementation 2 3 6 [RP10] 119 185 485 [Cor14] 2104 4413 17136 All optimizations 463 771 2767

Table: Software AES implementation, in thousand of clock cycles

DES

SBox Implementation 2 3 6 [CGP+12]+[CRV14] 219 290 602 [Cor14] 491 907 3075 All optimizations 203 308 764

Table: Software DES implementation, in thousand of clock cycles

16 12th September 2018

Higher Order: Optimizations

slide-34
SLIDE 34

Table of Contents

1 Introduction

1st Order Solution Higher Order Masking of Look-Up Tables

2 Higher Order: Optimizations 3 Conclusion

17 12th September 2018

Conclusion

slide-35
SLIDE 35

Conclusion Conclusion

  • Generalization of SBox recomputation, proven secure at any order
  • Reduce the running time of common table by a factor of 2
  • Reduce the running time by a factor of 8 (from Coron’14)
  • Remaining task: build a proof to generalize common shares in outputs

(x(ℓ)

0 , x(ℓ) 1 , . . . , x(ℓ)

t 2 , m0, . . . , m t−1 2 ) → S(x(ℓ)) = (y (ℓ)

0 , y (ℓ) 1 , . . . , y (ℓ)

t 2 , m0, . . . , m t−1 2 )

  • Correct solution for generic small SBox (e.g. DES)

18 12th September 2018

Conclusion