Higher-Order Masking Schemes for S-boxes Matthieu Rivain Joint work with C. Carlet, L. Goubin, E. Prouff and M. Quisquater FSE 2012 Washington DC, 21st March 2012 Higher-Order Masking Schemes for S-boxes
Outline 1 � Introduction 2 � Higher-Order Masking of any S-box � General Method � Optimal Masking of Power Functions � Efficient Heuristics for Random S-Boxes 3 � Implementation Results 4 � Open Issues Higher-Order Masking Schemes for S-boxes
Higher-Order Masking � Countermeasure to side-channel attacks Higher-Order Masking Schemes for S-boxes
Higher-Order Masking � Countermeasure to side-channel attacks � Every key-dependent variable x is shared into d + 1 variables: x = x 0 + x 1 + · · · + x d Higher-Order Masking Schemes for S-boxes
Higher-Order Masking � Countermeasure to side-channel attacks � Every key-dependent variable x is shared into d + 1 variables: x = x 0 + x 1 + · · · + x d � In this work, + is the bitwise addition Higher-Order Masking Schemes for S-boxes
Higher-Order Masking � Countermeasure to side-channel attacks � Every key-dependent variable x is shared into d + 1 variables: x = x 0 + x 1 + · · · + x d � In this work, + is the bitwise addition � Attack complexity increases exponentially with d Higher-Order Masking Schemes for S-boxes
Higher-Order Masking Schemes � Consider a block cipher: c ← E( m, k ) Higher-Order Masking Schemes for S-boxes
Higher-Order Masking Schemes � Consider a block cipher: c ← E( m, k ) � A d th-order masking scheme for E is an algorithm: ( c 0 , c 1 , . . . , c d ) ← E ′ � � ( m 0 , m 1 , . . . , m d ) , ( k 0 , k 1 , . . . , k d ) Higher-Order Masking Schemes for S-boxes
Higher-Order Masking Schemes � Consider a block cipher: c ← E( m, k ) � A d th-order masking scheme for E is an algorithm: ( c 0 , c 1 , . . . , c d ) ← E ′ � � ( m 0 , m 1 , . . . , m d ) , ( k 0 , k 1 , . . . , k d ) � d th-order security : ∀ ( iv 1 , iv 2 , . . . , iv d ) ∈ { intermediate var. of E ′ } d : � � MI ( iv 1 , iv 2 , . . . , iv d ) , ( m, k ) = 0 Higher-Order Masking Schemes for S-boxes
Higher-Order Masking Schemes � Consider a block cipher: c ← E( m, k ) � A d th-order masking scheme for E is an algorithm: ( c 0 , c 1 , . . . , c d ) ← E ′ � � ( m 0 , m 1 , . . . , m d ) , ( k 0 , k 1 , . . . , k d ) � d th-order security : ∀ ( iv 1 , iv 2 , . . . , iv d ) ∈ { intermediate var. of E ′ } d : � � MI ( iv 1 , iv 2 , . . . , iv d ) , ( m, k ) = 0 � The main issue is masking the S-box Higher-Order Masking Schemes for S-boxes
Literature � Software masking schemes: d = 1 d = 2 any d AES Many works x [RP10,KHL11,GPQ11] any s-box Many works [SP06,RDP08] This work [SP06] = [Schramm-Paar CT-RSA’06] [RPD08] = [Rivain-Dottax-Prouff FSE’08] [RP10] = [Rivain-Prouff CHES’10] [KHL11] = [Kim-Hong-Lim CHES’11] [GPQ11] = [Genelle-Prouff-Quisquater CHES’11] Higher-Order Masking Schemes for S-boxes
Literature � Software masking schemes: d = 1 d = 2 any d AES Many works x [RP10,KHL11,GPQ11] any s-box Many works [SP06,RDP08] This work [SP06] = [Schramm-Paar CT-RSA’06] [RPD08] = [Rivain-Dottax-Prouff FSE’08] [RP10] = [Rivain-Prouff CHES’10] [KHL11] = [Kim-Hong-Lim CHES’11] [GPQ11] = [Genelle-Prouff-Quisquater CHES’11] � Hardware masking schemes: ◮ d = 1 ⇒ many works Higher-Order Masking Schemes for S-boxes
Literature � Software masking schemes: d = 1 d = 2 any d AES Many works x [RP10,KHL11,GPQ11] any s-box Many works [SP06,RDP08] This work [SP06] = [Schramm-Paar CT-RSA’06] [RPD08] = [Rivain-Dottax-Prouff FSE’08] [RP10] = [Rivain-Prouff CHES’10] [KHL11] = [Kim-Hong-Lim CHES’11] [GPQ11] = [Genelle-Prouff-Quisquater CHES’11] � Hardware masking schemes: ◮ d = 1 ⇒ many works ◮ [Ishai-Sahai-Wagner CRYPTO’03] � any circuit, any order d Higher-Order Masking Schemes for S-boxes
Literature � Software masking schemes: d = 1 d = 2 any d AES Many works x [RP10,KHL11,GPQ11] any s-box Many works [SP06,RDP08] This work [SP06] = [Schramm-Paar CT-RSA’06] [RPD08] = [Rivain-Dottax-Prouff FSE’08] [RP10] = [Rivain-Prouff CHES’10] [KHL11] = [Kim-Hong-Lim CHES’11] [GPQ11] = [Genelle-Prouff-Quisquater CHES’11] � Hardware masking schemes: ◮ d = 1 ⇒ many works ◮ [Ishai-Sahai-Wagner CRYPTO’03] � any circuit, any order d ◮ [Faust et al. EUROCRYPT’10] � generalization to further security models Higher-Order Masking Schemes for S-boxes
Ishai-Sahai-Wagner (ISW) Scheme � Probing model: intermediate variable = wire � Any circuits composed of NOT and AND gates Higher-Order Masking Schemes for S-boxes
Ishai-Sahai-Wagner (ISW) Scheme � Probing model: intermediate variable = wire � Any circuits composed of NOT and AND gates � NOT gate encoding: NOT( x ) = NOT( x 0 ) ⊕ x 1 · · · ⊕ x d Higher-Order Masking Schemes for S-boxes
Ishai-Sahai-Wagner (ISW) Scheme � Probing model: intermediate variable = wire � Any circuits composed of NOT and AND gates � NOT gate encoding: NOT( x ) = NOT( x 0 ) ⊕ x 1 · · · ⊕ x d � AND gate encoding: �� ��� � AND( x, y ) = xy = i x i j y j � � = i,j x i y j = i z i Higher-Order Masking Schemes for S-boxes
Ishai-Sahai-Wagner (ISW) Scheme � Probing model: intermediate variable = wire � Any circuits composed of NOT and AND gates � NOT gate encoding: NOT( x ) = NOT( x 0 ) ⊕ x 1 · · · ⊕ x d � AND gate encoding: �� ��� � AND( x, y ) = xy = i x i j y j � � = i,j x i y j = i z i ◮ ( d + 1) 2 ANDs + 2 d ( d + 1) XORs + d ( d + 1) / 2 random bits Higher-Order Masking Schemes for S-boxes
Application to AES in Software � [Rivain-Prouff CHES 2010] Higher-Order Masking Schemes for S-boxes
Application to AES in Software � [Rivain-Prouff CHES 2010] � AES S-box: S = Exp ◦ Af ◮ Af: affine transformation over GF(2) 8 ◮ Exp : x �→ x 254 over GF(2 8 ) Higher-Order Masking Schemes for S-boxes
Application to AES in Software � [Rivain-Prouff CHES 2010] � AES S-box: S = Exp ◦ Af ◮ Af: affine transformation over GF(2) 8 ◮ Exp : x �→ x 254 over GF(2 8 ) � Masking Af is efficient: Af ( x ) = Af ( x 0 ) + Af ( x 1 ) + · · · + Af ( x d ) (+ 0x63 iff d is odd ) Higher-Order Masking Schemes for S-boxes
Application to AES in Software � [Rivain-Prouff CHES 2010] � AES S-box: S = Exp ◦ Af ◮ Af: affine transformation over GF(2) 8 ◮ Exp : x �→ x 254 over GF(2 8 ) � Masking Af is efficient: Af ( x ) = Af ( x 0 ) + Af ( x 1 ) + · · · + Af ( x d ) (+ 0x63 iff d is odd ) � Masking Exp ◮ masked square: x 2 0 + x 2 1 + · · · + x 2 d = x 2 Higher-Order Masking Schemes for S-boxes
Application to AES in Software � [Rivain-Prouff CHES 2010] � AES S-box: S = Exp ◦ Af ◮ Af: affine transformation over GF(2) 8 ◮ Exp : x �→ x 254 over GF(2 8 ) � Masking Af is efficient: Af ( x ) = Af ( x 0 ) + Af ( x 1 ) + · · · + Af ( x d ) (+ 0x63 iff d is odd ) � Masking Exp ◮ masked square: x 2 0 + x 2 1 + · · · + x 2 d = x 2 ◮ masked multiplications : ISW on GF(2 8 ) Higher-Order Masking Schemes for S-boxes
Application to AES in Software � [Rivain-Prouff CHES 2010] � AES S-box: S = Exp ◦ Af ◮ Af: affine transformation over GF(2) 8 ◮ Exp : x �→ x 254 over GF(2 8 ) � Masking Af is efficient: Af ( x ) = Af ( x 0 ) + Af ( x 1 ) + · · · + Af ( x d ) (+ 0x63 iff d is odd ) � Masking Exp ◮ masked square: x 2 0 + x 2 1 + · · · + x 2 d = x 2 ◮ masked multiplications : ISW on GF(2 8 ) ◮ addition chain for 254 with only 4 multiplications (and 7 squares) Higher-Order Masking Schemes for S-boxes
Outline 1 � Introduction 2 � Higher-Order Masking of any S-box � General Method � Optimal Masking of Power Functions � Efficient Heuristics for Random S-Boxes 3 � Implementation Results 4 � Open Issues Higher-Order Masking Schemes for S-boxes
General Method � Generalization of Rivain-Prouff scheme Higher-Order Masking Schemes for S-boxes
General Method � Generalization of Rivain-Prouff scheme � We consider an s-box S : { 0 , 1 } n → { 0 , 1 } m as a polynomial function over GF(2 n ) : S( x ) = a 0 + a 1 x + a 2 x 2 + · · · + a 2 n − 1 x 2 n − 1 Higher-Order Masking Schemes for S-boxes
General Method � Generalization of Rivain-Prouff scheme � We consider an s-box S : { 0 , 1 } n → { 0 , 1 } m as a polynomial function over GF(2 n ) : S( x ) = a 0 + a 1 x + a 2 x 2 + · · · + a 2 n − 1 x 2 n − 1 � We evaluate this polynomial on the shared input ( x i ) i Higher-Order Masking Schemes for S-boxes
General Method � Four kinds of operations over GF(2 n ) : 1 . additions 2 . scalar multiplications ( i.e. by constants) 3 . squares 4 . regular multiplications Higher-Order Masking Schemes for S-boxes
General Method � Four kinds of operations over GF(2 n ) : 1 . additions 2 . scalar multiplications ( i.e. by constants) 3 . squares 4 . regular multiplications � Masking is efficient for the 3 first kinds Higher-Order Masking Schemes for S-boxes
General Method � Four kinds of operations over GF(2 n ) : 1 . additions 2 . scalar multiplications ( i.e. by constants) 3 . squares 4 . regular multiplications � Masking is efficient for the 3 first kinds ◮ ( x + y ) = ( x 0 + y 0 ) + ( x 1 + y 1 ) + · · · + ( x d + y d ) Higher-Order Masking Schemes for S-boxes
Recommend
More recommend
