[PPT] - Higher-Order Masking Schemes for S-boxes Matthieu Rivain Joint PowerPoint Presentation

SLIDE 1

Higher-Order Masking Schemes for S-boxes

Matthieu Rivain

Joint work with

C. Carlet, L. Goubin, E. Prouff and M. Quisquater

FSE 2012 Washington DC, 21st March 2012

Higher-Order Masking Schemes for S-boxes

SLIDE 2

Outline 1 Introduction 2 Higher-Order Masking of any S-box

General Method Optimal Masking of Power Functions Efficient Heuristics for Random S-Boxes

3 Implementation Results 4 Open Issues

Higher-Order Masking Schemes for S-boxes

SLIDE 3

Higher-Order Masking

Countermeasure to side-channel attacks

Higher-Order Masking Schemes for S-boxes

SLIDE 4

Higher-Order Masking

Countermeasure to side-channel attacks Every key-dependent variable x is shared into d + 1 variables:

x = x0 + x1 + · · · + xd

Higher-Order Masking Schemes for S-boxes

SLIDE 5

Higher-Order Masking

Countermeasure to side-channel attacks Every key-dependent variable x is shared into d + 1 variables:

x = x0 + x1 + · · · + xd

In this work, + is the bitwise addition

Higher-Order Masking Schemes for S-boxes

SLIDE 6

Higher-Order Masking

Countermeasure to side-channel attacks Every key-dependent variable x is shared into d + 1 variables:

x = x0 + x1 + · · · + xd

In this work, + is the bitwise addition Attack complexity increases exponentially with d

Higher-Order Masking Schemes for S-boxes

SLIDE 7

Higher-Order Masking Schemes

Consider a block cipher:

c ← E(m, k)

Higher-Order Masking Schemes for S-boxes

SLIDE 8

Higher-Order Masking Schemes

Consider a block cipher:

c ← E(m, k)

A dth-order masking scheme for E is an algorithm:

(c0, c1, . . . , cd) ← E′ (m0, m1, . . . , md), (k0, k1, . . . , kd)

Higher-Order Masking Schemes for S-boxes

SLIDE 9

Higher-Order Masking Schemes

Consider a block cipher:

c ← E(m, k)

A dth-order masking scheme for E is an algorithm:

(c0, c1, . . . , cd) ← E′ (m0, m1, . . . , md), (k0, k1, . . . , kd)

dth-order security :

∀(iv1, iv2, . . . , ivd) ∈ {intermediate var. of E′}d : MI

(iv1, iv2, . . . , ivd), (m, k)
= 0

Higher-Order Masking Schemes for S-boxes

SLIDE 10

Higher-Order Masking Schemes

Consider a block cipher:

c ← E(m, k)

A dth-order masking scheme for E is an algorithm:

(c0, c1, . . . , cd) ← E′ (m0, m1, . . . , md), (k0, k1, . . . , kd)

dth-order security :

∀(iv1, iv2, . . . , ivd) ∈ {intermediate var. of E′}d : MI

(iv1, iv2, . . . , ivd), (m, k)
= 0

The main issue is masking the S-box

Higher-Order Masking Schemes for S-boxes

SLIDE 11

Literature

Software masking schemes:

d = 1 d = 2 any d AES Many works x [RP10,KHL11,GPQ11] any s-box Many works [SP06,RDP08] This work

[SP06] = [Schramm-Paar CT-RSA’06] [RPD08] = [Rivain-Dottax-Prouff FSE’08] [RP10] = [Rivain-Prouff CHES’10] [KHL11] = [Kim-Hong-Lim CHES’11] [GPQ11] = [Genelle-Prouff-Quisquater CHES’11]

Higher-Order Masking Schemes for S-boxes

SLIDE 12

Literature

Software masking schemes:

d = 1 d = 2 any d AES Many works x [RP10,KHL11,GPQ11] any s-box Many works [SP06,RDP08] This work

[SP06] = [Schramm-Paar CT-RSA’06] [RPD08] = [Rivain-Dottax-Prouff FSE’08] [RP10] = [Rivain-Prouff CHES’10] [KHL11] = [Kim-Hong-Lim CHES’11] [GPQ11] = [Genelle-Prouff-Quisquater CHES’11] Hardware masking schemes: ◮ d = 1 ⇒ many works

Higher-Order Masking Schemes for S-boxes

SLIDE 13

Literature

Software masking schemes:

d = 1 d = 2 any d AES Many works x [RP10,KHL11,GPQ11] any s-box Many works [SP06,RDP08] This work

[SP06] = [Schramm-Paar CT-RSA’06] [RPD08] = [Rivain-Dottax-Prouff FSE’08] [RP10] = [Rivain-Prouff CHES’10] [KHL11] = [Kim-Hong-Lim CHES’11] [GPQ11] = [Genelle-Prouff-Quisquater CHES’11] Hardware masking schemes: ◮ d = 1 ⇒ many works ◮ [Ishai-Sahai-Wagner CRYPTO’03]

any circuit, any order d

Higher-Order Masking Schemes for S-boxes

SLIDE 14

Literature

Software masking schemes:

d = 1 d = 2 any d AES Many works x [RP10,KHL11,GPQ11] any s-box Many works [SP06,RDP08] This work

[SP06] = [Schramm-Paar CT-RSA’06] [RPD08] = [Rivain-Dottax-Prouff FSE’08] [RP10] = [Rivain-Prouff CHES’10] [KHL11] = [Kim-Hong-Lim CHES’11] [GPQ11] = [Genelle-Prouff-Quisquater CHES’11] Hardware masking schemes: ◮ d = 1 ⇒ many works ◮ [Ishai-Sahai-Wagner CRYPTO’03]

any circuit, any order d

◮ [Faust et al. EUROCRYPT’10]

generalization to further security models

Higher-Order Masking Schemes for S-boxes

SLIDE 15

Ishai-Sahai-Wagner (ISW) Scheme

Probing model: intermediate variable = wire Any circuits composed of NOT and AND gates

Higher-Order Masking Schemes for S-boxes

SLIDE 16

Ishai-Sahai-Wagner (ISW) Scheme

Probing model: intermediate variable = wire Any circuits composed of NOT and AND gates NOT gate encoding:

NOT(x) = NOT(x0) ⊕ x1 · · · ⊕ xd

Higher-Order Masking Schemes for S-boxes

SLIDE 17

Ishai-Sahai-Wagner (ISW) Scheme

Probing model: intermediate variable = wire Any circuits composed of NOT and AND gates NOT gate encoding:

NOT(x) = NOT(x0) ⊕ x1 · · · ⊕ xd

AND gate encoding:

AND(x, y) = xy =

ixi
jyj
=
i,jxiyj =
izi

Higher-Order Masking Schemes for S-boxes

SLIDE 18

Ishai-Sahai-Wagner (ISW) Scheme

Probing model: intermediate variable = wire Any circuits composed of NOT and AND gates NOT gate encoding:

NOT(x) = NOT(x0) ⊕ x1 · · · ⊕ xd

AND gate encoding:

AND(x, y) = xy =

ixi
jyj
=
i,jxiyj =
izi

◮ (d + 1)2 ANDs + 2d(d + 1) XORs

+ d(d + 1)/2 random bits

Higher-Order Masking Schemes for S-boxes

SLIDE 19

Application to AES in Software

[Rivain-Prouff CHES 2010]

Higher-Order Masking Schemes for S-boxes

SLIDE 20

Application to AES in Software

[Rivain-Prouff CHES 2010] AES S-box: S = Exp ◦ Af ◮ Af: affine transformation over GF(2)8 ◮ Exp : x → x254 over GF(28)

Higher-Order Masking Schemes for S-boxes

SLIDE 21

Application to AES in Software

[Rivain-Prouff CHES 2010] AES S-box: S = Exp ◦ Af ◮ Af: affine transformation over GF(2)8 ◮ Exp : x → x254 over GF(28) Masking Af is efficient:

Af(x) = Af(x0) + Af(x1) + · · · + Af(xd) (+0x63 iff d is odd)

Higher-Order Masking Schemes for S-boxes

SLIDE 22

Application to AES in Software

[Rivain-Prouff CHES 2010] AES S-box: S = Exp ◦ Af ◮ Af: affine transformation over GF(2)8 ◮ Exp : x → x254 over GF(28) Masking Af is efficient:

Af(x) = Af(x0) + Af(x1) + · · · + Af(xd) (+0x63 iff d is odd)

Masking Exp ◮ masked square: x2

0 + x2 1 + · · · + x2 d = x2 Higher-Order Masking Schemes for S-boxes

SLIDE 23

Application to AES in Software

[Rivain-Prouff CHES 2010] AES S-box: S = Exp ◦ Af ◮ Af: affine transformation over GF(2)8 ◮ Exp : x → x254 over GF(28) Masking Af is efficient:

Af(x) = Af(x0) + Af(x1) + · · · + Af(xd) (+0x63 iff d is odd)

Masking Exp ◮ masked square: x2

0 + x2 1 + · · · + x2 d = x2

◮ masked multiplications : ISW on GF(28)

Higher-Order Masking Schemes for S-boxes

SLIDE 24

Application to AES in Software

[Rivain-Prouff CHES 2010] AES S-box: S = Exp ◦ Af ◮ Af: affine transformation over GF(2)8 ◮ Exp : x → x254 over GF(28) Masking Af is efficient:

Af(x) = Af(x0) + Af(x1) + · · · + Af(xd) (+0x63 iff d is odd)

Masking Exp ◮ masked square: x2

0 + x2 1 + · · · + x2 d = x2

◮ masked multiplications : ISW on GF(28) ◮ addition chain for 254 with only 4 multiplications (and 7

squares)

Higher-Order Masking Schemes for S-boxes

SLIDE 25

Outline 1 Introduction 2 Higher-Order Masking of any S-box

General Method Optimal Masking of Power Functions Efficient Heuristics for Random S-Boxes

3 Implementation Results 4 Open Issues

Higher-Order Masking Schemes for S-boxes

SLIDE 26

General Method

Generalization of Rivain-Prouff scheme

Higher-Order Masking Schemes for S-boxes

SLIDE 27

General Method

Generalization of Rivain-Prouff scheme We consider an s-box S : {0, 1}n → {0, 1}m as a polynomial

function over GF(2n): S(x) = a0 + a1x + a2x2 + · · · + a2n−1x2n−1

Higher-Order Masking Schemes for S-boxes

SLIDE 28

General Method

Generalization of Rivain-Prouff scheme We consider an s-box S : {0, 1}n → {0, 1}m as a polynomial

function over GF(2n): S(x) = a0 + a1x + a2x2 + · · · + a2n−1x2n−1

We evaluate this polynomial on the shared input (xi)i

Higher-Order Masking Schemes for S-boxes

SLIDE 29

General Method

Four kinds of operations over GF(2n):

1. additions
2. scalar multiplications (i.e. by constants)
3. squares
4. regular multiplications

Higher-Order Masking Schemes for S-boxes

SLIDE 30

General Method

Four kinds of operations over GF(2n):

1. additions
2. scalar multiplications (i.e. by constants)
3. squares
4. regular multiplications

Masking is efficient for the 3 first kinds

Higher-Order Masking Schemes for S-boxes

SLIDE 31

General Method

Four kinds of operations over GF(2n):

1. additions
2. scalar multiplications (i.e. by constants)
3. squares
4. regular multiplications

Masking is efficient for the 3 first kinds ◮ (x + y) = (x0 + y0) + (x1 + y1) + · · · + (xd + yd)

Higher-Order Masking Schemes for S-boxes

SLIDE 32

General Method

Four kinds of operations over GF(2n):

1. additions
2. scalar multiplications (i.e. by constants)
3. squares
4. regular multiplications

Masking is efficient for the 3 first kinds ◮ (x + y) = (x0 + y0) + (x1 + y1) + · · · + (xd + yd) ◮ x2 = x2

0 + x2 1 + · · · + x2 d Higher-Order Masking Schemes for S-boxes

SLIDE 33

General Method

Four kinds of operations over GF(2n):

1. additions
2. scalar multiplications (i.e. by constants)
3. squares
4. regular multiplications

Masking is efficient for the 3 first kinds ◮ (x + y) = (x0 + y0) + (x1 + y1) + · · · + (xd + yd) ◮ x2 = x2

0 + x2 1 + · · · + x2 d

◮ a · x = a · x0 + a · x1 + · · · + a · xd

Higher-Order Masking Schemes for S-boxes

SLIDE 34

General Method

Four kinds of operations over GF(2n):

1. additions
2. scalar multiplications (i.e. by constants)
3. squares
4. regular multiplications ⇒ nonlinear multiplications

Masking is efficient for the 3 first kinds ◮ (x + y) = (x0 + y0) + (x1 + y1) + · · · + (xd + yd) ◮ x2 = x2

0 + x2 1 + · · · + x2 d

◮ a · x = a · x0 + a · x1 + · · · + a · xd

Higher-Order Masking Schemes for S-boxes

SLIDE 35

General Method

Four kinds of operations over GF(2n):

1. additions
2. scalar multiplications (i.e. by constants)
3. squares
4. regular multiplications ⇒ nonlinear multiplications

Masking is efficient for the 3 first kinds ◮ (x + y) = (x0 + y0) + (x1 + y1) + · · · + (xd + yd) ◮ x2 = x2

0 + x2 1 + · · · + x2 d

◮ a · x = a · x0 + a · x1 + · · · + a · xd nonlinear multiplication masked with ISW scheme

Higher-Order Masking Schemes for S-boxes

SLIDE 36

Masking Complexity

Masking an operation ∈ {addition, square, scalar mult.}

⇒ d + 1 operations

Masking a nonlinear multiplication

⇒ (d + 1)2 mult. + 2d(d + 1) add. + nd(d + 1)/2 random bits

Higher-Order Masking Schemes for S-boxes

SLIDE 37

Masking Complexity

Masking an operation ∈ {addition, square, scalar mult.}

⇒ d + 1 operations

Masking a nonlinear multiplication

⇒ (d + 1)2 mult. + 2d(d + 1) add. + nd(d + 1)/2 random bits

Definition The masking complexity of a (n, m) s-box is the minimal number

f nonlinear multiplications required to evaluate its polynomial

representation over GF(2n).

Higher-Order Masking Schemes for S-boxes

SLIDE 38

Straightforward schemes

Goal: evaluate S(x) = a0 + a1x + a2x2 + · · · + a2n−1x2n−1 first solution : ◮ compute S(x) = a0 + x(a1 + x(a2 + x(· · · ))) ◮ ⇒ 2n − 2 nonlinear multiplications

Higher-Order Masking Schemes for S-boxes

SLIDE 39

Straightforward schemes

Goal: evaluate S(x) = a0 + a1x + a2x2 + · · · + a2n−1x2n−1 first solution : ◮ compute S(x) = a0 + x(a1 + x(a2 + x(· · · ))) ◮ ⇒ 2n − 2 nonlinear multiplications second solution : ◮ first compute x2, x3, x4, .... then evaluate S(x) ◮ xj ← (xj/2)2 when j even, xj ← x · xj−1 when j odd ◮ ⇒ 2n−1 − 1 nonlinear multiplications

Higher-Order Masking Schemes for S-boxes

SLIDE 40

Straightforward schemes

Goal: evaluate S(x) = a0 + a1x + a2x2 + · · · + a2n−1x2n−1 first solution : ◮ compute S(x) = a0 + x(a1 + x(a2 + x(· · · ))) ◮ ⇒ 2n − 2 nonlinear multiplications second solution : ◮ first compute x2, x3, x4, .... then evaluate S(x) ◮ xj ← (xj/2)2 when j even, xj ← x · xj−1 when j odd ◮ ⇒ 2n−1 − 1 nonlinear multiplications Can we do better ?

Higher-Order Masking Schemes for S-boxes

SLIDE 41

Straightforward schemes

Goal: evaluate S(x) = a0 + a1x + a2x2 + · · · + a2n−1x2n−1 first solution : ◮ compute S(x) = a0 + x(a1 + x(a2 + x(· · · ))) ◮ ⇒ 2n − 2 nonlinear multiplications second solution : ◮ first compute x2, x3, x4, .... then evaluate S(x) ◮ xj ← (xj/2)2 when j even, xj ← x · xj−1 when j odd ◮ ⇒ 2n−1 − 1 nonlinear multiplications Can we do better ? YES, WE CAN !

Higher-Order Masking Schemes for S-boxes

SLIDE 42

Straightforward schemes

Goal: evaluate S(x) = a0 + a1x + a2x2 + · · · + a2n−1x2n−1 first solution : ◮ compute S(x) = a0 + x(a1 + x(a2 + x(· · · ))) ◮ ⇒ 2n − 2 nonlinear multiplications second solution : ◮ first compute x2, x3, x4, .... then evaluate S(x) ◮ xj ← (xj/2)2 when j even, xj ← x · xj−1 when j odd ◮ ⇒ 2n−1 − 1 nonlinear multiplications Can we do better ? YES, WE CAN ! ◮ Optimal methods for power functions ◮ Efficient heuristic for the general case

Higher-Order Masking Schemes for S-boxes

SLIDE 43

Outline 1 Introduction 2 Higher-Order Masking of any S-box

General Method Optimal Masking of Power Functions Efficient Heuristics for Random S-Boxes

3 Implementation Results 4 Open Issues

Higher-Order Masking Schemes for S-boxes

SLIDE 44

Optimal Masking of Power Functions

Problem For a given α ∈ [1; 2n − 1] compute xα with the least number of nonlinear multiplications.

Higher-Order Masking Schemes for S-boxes

SLIDE 45

Optimal Masking of Power Functions

Problem For a given α ∈ [1; 2n − 1] compute xα with the least number of nonlinear multiplications.

⇔

Problem Find the shortest 2-addition chain for α (modulo 2n − 1).

Higher-Order Masking Schemes for S-boxes

SLIDE 46

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n}

Higher-Order Masking Schemes for S-boxes

SLIDE 47

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα)

Higher-Order Masking Schemes for S-boxes

SLIDE 48

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα) ◮ xα can be computed from xβ with 0 nonlinear multiplication

Higher-Order Masking Schemes for S-boxes

SLIDE 49

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα) ◮ xα can be computed from xβ with 0 nonlinear multiplication ◮ xα and xβ have the same masking complexity

Higher-Order Masking Schemes for S-boxes

SLIDE 50

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα) ◮ xα can be computed from xβ with 0 nonlinear multiplication ◮ xα and xβ have the same masking complexity Exhaustive search for best 2-addition chains

Higher-Order Masking Schemes for S-boxes

SLIDE 51

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα) ◮ xα can be computed from xβ with 0 nonlinear multiplication ◮ xα and xβ have the same masking complexity Exhaustive search for best 2-addition chains ◮ x → x2, x4, x8, ... (0 nonlinear multiplications)

Higher-Order Masking Schemes for S-boxes

SLIDE 52

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα) ◮ xα can be computed from xβ with 0 nonlinear multiplication ◮ xα and xβ have the same masking complexity Exhaustive search for best 2-addition chains ◮ x → x2, x4, x8, ... (0 nonlinear multiplications) ◮ with 1 nonlinear multiplication

x3 = x · x2

Higher-Order Masking Schemes for S-boxes

SLIDE 53

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα) ◮ xα can be computed from xβ with 0 nonlinear multiplication ◮ xα and xβ have the same masking complexity Exhaustive search for best 2-addition chains ◮ x → x2, x4, x8, ... (0 nonlinear multiplications) ◮ with 1 nonlinear multiplication

x3 = x · x2 → x6, x12, x24, ...

Higher-Order Masking Schemes for S-boxes

SLIDE 54

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα) ◮ xα can be computed from xβ with 0 nonlinear multiplication ◮ xα and xβ have the same masking complexity Exhaustive search for best 2-addition chains ◮ x → x2, x4, x8, ... (0 nonlinear multiplications) ◮ with 1 nonlinear multiplication

x3 = x · x2 → x6, x12, x24, ... x5 = x · x4

Higher-Order Masking Schemes for S-boxes

SLIDE 55

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα) ◮ xα can be computed from xβ with 0 nonlinear multiplication ◮ xα and xβ have the same masking complexity Exhaustive search for best 2-addition chains ◮ x → x2, x4, x8, ... (0 nonlinear multiplications) ◮ with 1 nonlinear multiplication

x3 = x · x2 → x6, x12, x24, ... x5 = x · x4 → x10, x20, x40, ...

Higher-Order Masking Schemes for S-boxes

SLIDE 56

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα) ◮ xα can be computed from xβ with 0 nonlinear multiplication ◮ xα and xβ have the same masking complexity Exhaustive search for best 2-addition chains ◮ x → x2, x4, x8, ... (0 nonlinear multiplications) ◮ with 1 nonlinear multiplication

x3 = x · x2 → x6, x12, x24, ... x5 = x · x4 → x10, x20, x40, ... etc.

Higher-Order Masking Schemes for S-boxes

SLIDE 57

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα) ◮ xα can be computed from xβ with 0 nonlinear multiplication ◮ xα and xβ have the same masking complexity Exhaustive search for best 2-addition chains ◮ x → x2, x4, x8, ... (0 nonlinear multiplications) ◮ with 1 nonlinear multiplication

x3 = x · x2 → x6, x12, x24, ... x5 = x · x4 → x10, x20, x40, ... etc.

◮ with 2 nonlinear multiplications

x7 = x3 · x4

Higher-Order Masking Schemes for S-boxes

SLIDE 58

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα) ◮ xα can be computed from xβ with 0 nonlinear multiplication ◮ xα and xβ have the same masking complexity Exhaustive search for best 2-addition chains ◮ x → x2, x4, x8, ... (0 nonlinear multiplications) ◮ with 1 nonlinear multiplication

x3 = x · x2 → x6, x12, x24, ... x5 = x · x4 → x10, x20, x40, ... etc.

◮ with 2 nonlinear multiplications

x7 = x3 · x4 → x14, x28, ...

Higher-Order Masking Schemes for S-boxes

SLIDE 59

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα) ◮ xα can be computed from xβ with 0 nonlinear multiplication ◮ xα and xβ have the same masking complexity Exhaustive search for best 2-addition chains ◮ x → x2, x4, x8, ... (0 nonlinear multiplications) ◮ with 1 nonlinear multiplication

x3 = x · x2 → x6, x12, x24, ... x5 = x · x4 → x10, x20, x40, ... etc.

◮ with 2 nonlinear multiplications

x7 = x3 · x4 → x14, x28, ... x11 = x3 · x8

Higher-Order Masking Schemes for S-boxes

SLIDE 60

Optimal Masking of Power Functions

Cyclotomic class of α : Cα = {α · 2j mod (2n − 1); j ≤ n} If β ∈ Cα (⇔ Cβ = Cα) ◮ xα can be computed from xβ with 0 nonlinear multiplication ◮ xα and xβ have the same masking complexity Exhaustive search for best 2-addition chains ◮ x → x2, x4, x8, ... (0 nonlinear multiplications) ◮ with 1 nonlinear multiplication

x3 = x · x2 → x6, x12, x24, ... x5 = x · x4 → x10, x20, x40, ... etc.

◮ with 2 nonlinear multiplications

x7 = x3 · x4 → x14, x28, ... x11 = x3 · x8 → x22, x44, ... etc.

Higher-Order Masking Schemes for S-boxes

SLIDE 61

k Cyclotomic classes in Mn

k

n = 4 C0 = {0}, C1 = {1, 2, 4, 8} 1 C3 = {3, 6, 12, 9}, C5 = {5, 10} 2 C7 = {7, 14, 13, 11} n = 6 C0 = {0}, C1 = {1, 2, 4, 8, 16, 32} 1 C3 = {3, 6, 12, 24, 48, 33}, C5 = {5, 10, 20, 40, 17, 34}, C9 = {9, 18, 36} 2 C7 = {7, 14, 28, 56, 49, 35}, C11 = {11, 22, 44, 25, 50, 37}, C13 = {13, 26, 52, 41, 19, 38}, C15 = {15, 30, 29, 27, 23}, C21 = {21, 42}, C27 = {27, 54, 45} 3 C23 = {23, 46, 29, 58, 53, 43}, C31 = {31, 62, 61, 59, 55, 47} n = 8 C0 = {0}, C1 = {1, 2, 4, 8, 16, 32, 64, 128} 1 C3 = {3, 6, 12, 24, 48, 96, 192, 129}, C5 = {5, 10, 20, 40, 80, 160, 65, 130}, C9 = {9, 18, 36, 72, 144, 33, 66, 132}, C17 = {17, 34, 68, 136} 2 C7 = {7, 14, 28, 56, 112, 224, 193, 131}, C11 = {11, 22, 44, 88, 176, 97, 194, 133}, C13 = {13, 26, 52, 104, 208, 161, 67, 134}, C15 = {15, 30, 60, 120, 240, 225, 195, 135}, C19 = {19, 38, 76, 152, 49, 98, 196, 137}, C21 = {21, 42, 84, 168, 81, 162, 69, 138}, C25 = {25, 50, 100, 200, 145, 35, 70, 140}, C27 = {27, 54, 108, 216, 177, 99, 198, 141}, C37 = {37, 74, 148, 41, 82, 164, 73, 146}, C45 = {45, 90, 180, 105, 210, 165, 75, 150}, C51 = {51, 102, 204, 153}, C85 = {85, 170} 3 C23 = {23, 46, 92, 184, 113, 226, 197, 139}, C29 = {29, 58, 116, 232, 209, 163, 71, 142}, C31 = {31, 62, 124, 248, 241, 227, 199, 143}, C39 = {39, 78, 156, 57, 114, 228, 201, 147}, C43 = {43, 86, 172, 89, 178, 101, 202, 149}, C47 = {47, 94, 188, 121, 242, 229, 203, 151}, C53 = {53, 106, 212, 169, 83, 166, 77, 154}, C55 = {55, 110, 220, 185, 115, 230, 205, 155}, C59 = {59, 118, 236, 217, 179, 103, 206, 157}, C61 = {61, 122, 244, 233, 211, 167, 79, 158}, C63 = {63, 126, 252, 249, 243, 231, 207, 159}, C87 = {87, 174, 93, 186, 117, 234, 213, 171}, C91 = {91, 182, 109, 218, 181, 107, 214, 173}, C95 = {95, 190, 125, 250, 245, 235, 215, 175}, C111 = {111, 222, 189, 123, 246, 237, 219, 183}, C119 = {119, 238, 221, 187} 4 C127 = {127, 254, 253, 251, 247, 239, 223, 191}

Higher-Order Masking Schemes for S-boxes

SLIDE 62

Outline 1 Introduction 2 Higher-Order Masking of any S-box

General Method Optimal Masking of Power Functions Efficient Heuristics for Random S-Boxes

3 Implementation Results 4 Open Issues

Higher-Order Masking Schemes for S-boxes

SLIDE 63

Cyclotomic Method

S(x) = a0 + a1x + a2x2 + a3x3 + a4x4 + a5x5 + a6x6 + a7x7 + a8x8 + a9x9 + a10x10 + a11x11 + a12x12 + . . .

Higher-Order Masking Schemes for S-boxes

SLIDE 64

Cyclotomic Method

S(x) = a0 + a1x + a2x2 + a3x3 + a4x4 + a5x5 + a6x6 + a7x7 + a8x8 + a9x9 + a10x10 + a11x11 + a12x12 + . . .

Higher-Order Masking Schemes for S-boxes

SLIDE 65

Cyclotomic Method

S(x) = a0 + a1x + a2x2 + a3x3 + a4x4 + a5x5 + a6x6 + a7x7 + a8x8 + a9x9 + a10x10 + a11x11 + a12x12 + . . .

Higher-Order Masking Schemes for S-boxes

SLIDE 66

Cyclotomic Method

S(x) = a0 + a1x + a2x2 + a3x3 + a4x4 + a5x5 + a6x6 + a7x7 + a8x8 + a9x9 + a10x10 + a11x11 + a12x12 + . . .

Higher-Order Masking Schemes for S-boxes

SLIDE 67

Cyclotomic Method

S(x) = a0 + a1x + a2x2 + a3x3 + a4x4 + a5x5 + a6x6 + a7x7 + a8x8 + a9x9 + a10x10 + a11x11 + a12x12 + . . . = a0 + a1x + a2x2 + a4x4 + a8x8 + . . . + a3x3 + a6x6 + a12x12 + a24x24 + . . . + a5x5 + a10x10 + a20x20 + a40x40 + . . . + . . .

Higher-Order Masking Schemes for S-boxes

SLIDE 68

Cyclotomic Method

S(x) = a0 + a1x + a2x2 + a3x3 + a4x4 + a5x5 + a6x6 + a7x7 + a8x8 + a9x9 + a10x10 + a11x11 + a12x12 + . . . = a0 + a1x + a2x2 + a4x4 + a8x8 + . . . + a3x3 + a6(x3)2 + a12(x3)4 + a24(x3)8 + . . . + a5x5 + a10(x5)2 + a20(x5)4 + a40(x5)8 + . . . + . . .

Higher-Order Masking Schemes for S-boxes

SLIDE 69

Cyclotomic Method

S(x) = a0 + a1x + a2x2 + a3x3 + a4x4 + a5x5 + a6x6 + a7x7 + a8x8 + a9x9 + a10x10 + a11x11 + a12x12 + . . . = a0 + a1x + a2x2 + a4x4 + a8x8 + . . . + a3x3 + a6(x3)2 + a12(x3)4 + a24(x3)8 + . . . + a5x5 + a10(x5)2 + a20(x5)4 + a40(x5)8 + . . . + . . . = a0 + L1(x) + L3(x3) + L5(x5) + . . . where

◮ L1(X) = a1X + a2X2 + a4X4 + a8X8 + . . . ◮ L3(X) = a3X + a6X2 + a12X4 + a24X8 + . . . ◮ L5(X) = a5X + a10X2 + a20X4 + a40X8 + . . . ◮ ...

Higher-Order Masking Schemes for S-boxes

SLIDE 70

Cyclotomic Method

1. Compute one power per cyclotomic class x, x3, x5, x7, ...

Higher-Order Masking Schemes for S-boxes

SLIDE 71

Cyclotomic Method

1. Compute one power per cyclotomic class x, x3, x5, x7, ...
2. Evaluate the corresponding linearized polynomials L1(x),

L3(x3), L5(x5), L7(x7), ...

Higher-Order Masking Schemes for S-boxes

SLIDE 72

Cyclotomic Method

1. Compute one power per cyclotomic class x, x3, x5, x7, ...
2. Evaluate the corresponding linearized polynomials L1(x),

L3(x3), L5(x5), L7(x7), ...

3. Compute the sum

S(x) = a0 + L1(x) + L3(x3) + L5(x5) + L7(x7) + . . .

Higher-Order Masking Schemes for S-boxes

SLIDE 73

Cyclotomic Method

1. Compute one power per cyclotomic class x, x3, x5, x7, ...
2. Evaluate the corresponding linearized polynomials L1(x),

L3(x3), L5(x5), L7(x7), ...

3. Compute the sum

S(x) = a0 + L1(x) + L3(x3) + L5(x5) + L7(x7) + . . . Number of nonlinear multiplication = #{cyclotomic classes}\(C0 ∪ C1)

Higher-Order Masking Schemes for S-boxes

SLIDE 74

Cyclotomic Method

1. Compute one power per cyclotomic class x, x3, x5, x7, ...
2. Evaluate the corresponding linearized polynomials L1(x),

L3(x3), L5(x5), L7(x7), ...

3. Compute the sum

S(x) = a0 + L1(x) + L3(x3) + L5(x5) + L7(x7) + . . . Number of nonlinear multiplication = #{cyclotomic classes}\(C0 ∪ C1)

n 3 4 5 6 7 8 9 10 # nlm 1 3 5 11 17 33 53 105

Higher-Order Masking Schemes for S-boxes

SLIDE 75

Parity-Split Method

S(x) = a0 + a1x + a2x2 + a3x3 + a4x4 + a5x5 + a6x6 + a7x7 + a8x8 + a9x9 + a10x10 + a11x11 + a12x12 + . . .

Higher-Order Masking Schemes for S-boxes

SLIDE 76

Parity-Split Method

S(x) = a0 + a1x + a2x2 + a3x3 + a4x4 + a5x5 + a6x6 + a7x7 + a8x8 + a9x9 + a10x10 + a11x11 + a12x12 + . . .

Higher-Order Masking Schemes for S-boxes

SLIDE 77

Parity-Split Method

S(x) = a0 + a2x2 + a4x4 + a6x6 + a8x8 + . . . a1x + a3x3 + a5x5 + a7x7 + a9x9 + . . .

Higher-Order Masking Schemes for S-boxes

SLIDE 78

Parity-Split Method

S(x) = a0 + a2x2 + a4x4 + a6x6 + a8x8 + . . . (a1 + a3x2 + a5x4 + a7x6 + a9x8 + . . .) · x

Nonlinear mult. : 1

Higher-Order Masking Schemes for S-boxes

SLIDE 79

Parity-Split Method

S(x) = a0 + a2x2 + a4x4 + a6x6 + a8x8 + . . . (a1 + a3x2 + a5x4 + a7x6 + a9x8 + . . .) · x

Nonlinear mult. : 1

Higher-Order Masking Schemes for S-boxes

SLIDE 80

Parity-Split Method

S(x) = a0 + a2X + a4X2 + a6X3 + a8X4 + . . . (a1 + a3X + a5X2 + a7X3 + a9X4 + . . .) · x where X = x2

Nonlinear mult. : 1

Higher-Order Masking Schemes for S-boxes

SLIDE 81

Parity-Split Method

S(x) = a0 + a2X + a4X2 + a6X3 + a8X4 + . . . (a1 + a3X + a5X2 + a7X3 + a9X4 + . . .) · x where X = x2

Nonlinear mult. : 1

Higher-Order Masking Schemes for S-boxes

SLIDE 82

Parity-Split Method

S(x) = a0 + a4X2 + a8X4 + . . . + a2X + a6X3 + . . . (a1 + a5X2 + a9X4 + . . . + a3x2 + a7X3 + . . .) · x where X = x2

Nonlinear mult. : 1

Higher-Order Masking Schemes for S-boxes

SLIDE 83

Parity-Split Method

S(x) = a0 + a4X2 + a8X4 + . . . + (a2 + a6X2 + . . .) · X + (a1 + a5X2 + a9X4 + . . . + (a3 + a7X2 + . . .) · X) · x where X = x2

Nonlinear mult. : 1+2

Higher-Order Masking Schemes for S-boxes

SLIDE 84

Parity-Split Method

S(x) = a0 + a4x4 + a8x8 + . . . + (a2 + a6x4 + . . .) · x2 + (a1 + a5x4 + a9x8 + . . . + (a3 + a7x4 + . . .) · x2) · x

Nonlinear mult. : 1+2

Higher-Order Masking Schemes for S-boxes

SLIDE 85

Parity-Split Method

S(x) = a0 + a4X + a8X2 + . . . + (a2 + a6X + . . .) · x2 + (a1 + a5X + a9X2 + . . . + (a3 + a7X + . . .) · x2) · x where X = x4

Nonlinear mult. : 1+2

Higher-Order Masking Schemes for S-boxes

SLIDE 86

Parity-Split Method

S(x) = a0 + a4X + a8X2 + . . . + (a2 + a6X + . . .) · x2 + (a1 + a5X + a9X2 + . . . + (a3 + a7X + . . .) · x2) · x where X = x4

Nonlinear mult. : 1+2+ · · · + 2r−1 = 2r − 1

Higher-Order Masking Schemes for S-boxes

SLIDE 87

Parity-Split Method

S(x) = a0 + a4X + a8X2 + . . . + (a2 + a6X + . . .) · x2 + (a1 + a5X + a9X2 + . . . + (a3 + a7X + . . .) · x2) · x where X = x4

Nonlinear mult. : 1+2+ · · · + 2r−1 = 2r − 1 and the evaluation of 2r+1 polynomials in X = x2r

Higher-Order Masking Schemes for S-boxes

SLIDE 88

Parity-Split Method

S(x) = a0 + a4X + a8X2 + . . . + (a2 + a6X + . . .) · x2 + (a1 + a5X + a9X2 + . . . + (a3 + a7X + . . .) · x2) · x where X = x4

Nonlinear mult. : 1+2+ · · · + 2r−1 = 2r − 1 and the evaluation of 2r+1 polynomials in X = x2r ◮ we derive Xj for j < 2n−r

Higher-Order Masking Schemes for S-boxes

SLIDE 89

Parity-Split Method

S(x) = a0 + a4X + a8X2 + . . . + (a2 + a6X + . . .) · x2 + (a1 + a5X + a9X2 + . . . + (a3 + a7X + . . .) · x2) · x where X = x4

Nonlinear mult. : 1+2+ · · · + 2r−1 = 2r − 1 and the evaluation of 2r+1 polynomials in X = x2r ◮ we derive Xj for j < 2n−r ◮ 2n−r−1 − 1 nonlinear mult.

Higher-Order Masking Schemes for S-boxes

SLIDE 90

Parity-Split Method

S(x) = a0 + a4X + a8X2 + . . . + (a2 + a6X + . . .) · x2 + (a1 + a5X + a9X2 + . . . + (a3 + a7X + . . .) · x2) · x where X = x4

Nonlinear mult. : 1+2+ · · · + 2r−1 = 2r − 1 and the evaluation of 2r+1 polynomials in X = x2r ◮ we derive Xj for j < 2n−r ◮ 2n−r−1 − 1 nonlinear mult.

⇒ 2n−r−1 + 2r − 2 nonlinear mult.

Higher-Order Masking Schemes for S-boxes

SLIDE 91

Comparison

Number of nonlinear multiplications w.r.t. the evaluation method

Method \ n 3 4 5 6 7 8 9 10 Cyclotomic 1 3 5 11 17 33 53 105 Parity-Split 2 4 6 10 14 22 30 46

Higher-Order Masking Schemes for S-boxes

SLIDE 92

Comparison

Number of nonlinear multiplications w.r.t. the evaluation method

Method \ n 3 4 5 6 7 8 9 10 Cyclotomic 1 3 5 11 17 33 53 105 Parity-Split 2 4 6 10 14 22 30 46

For PRESENT (n = 4), we shall prefer the cyclotomic method For DES (n = 6), we shall prefer the parity-split method

Higher-Order Masking Schemes for S-boxes

SLIDE 93

Implementation Results

Method Reference cycles RAM (bytes) Second Order Masking 1. AES s-box [RP10] 832 18 2. AES s-box [KHL11] 594 24 3. DES s-box Simple version in [RDP08] 1045 69 4. DES s-box Improved version in [RDP08] 652 39 5. DES s-box new scheme 7000 78 6. PRESENT s-box Simple Version [RDP08] 277 21 7. PRESENT s-box Improved Version [RDP08] 284 15 8. PRESENT s-box new scheme 400 31 Third Order Masking 1. AES s-box [RP10] 1905 28 2. AES s-box [KHL11] 965 38 3. DES s-box new scheme 10500 108 4. PRESENT s-box new scheme 630 44

Higher-Order Masking Schemes for S-boxes

SLIDE 94

Open Issues

Find more efficient methods for random s-boxes

Higher-Order Masking Schemes for S-boxes

SLIDE 95

Open Issues

Find more efficient methods for random s-boxes Find faster scheme for specific s-boxes ◮ e.g. DES s-boxes

Higher-Order Masking Schemes for S-boxes

SLIDE 96

Open Issues

Find more efficient methods for random s-boxes Find faster scheme for specific s-boxes ◮ e.g. DES s-boxes Extend the approach to smaller fields ◮ Mult. on GF(24) more efficient than on GF(28) in software ◮ Hardware masking complexity related to mult. on GF(2)

Higher-Order Masking Schemes for S-boxes

SLIDE 97

Open Issues

Find more efficient methods for random s-boxes Find faster scheme for specific s-boxes ◮ e.g. DES s-boxes Extend the approach to smaller fields ◮ Mult. on GF(24) more efficient than on GF(28) in software ◮ Hardware masking complexity related to mult. on GF(2)

Higher-Order Masking Schemes for S-boxes

SLIDE 98

Open Issues

Find more efficient methods for random s-boxes Find faster scheme for specific s-boxes ◮ e.g. DES s-boxes Extend the approach to smaller fields ◮ Mult. on GF(24) more efficient than on GF(28) in software ◮ Hardware masking complexity related to mult. on GF(2) Find families of s-boxes with good cryptographic criteria and

small masking complexity

Higher-Order Masking Schemes for S-boxes