Mixing Additive and Multiplicative Masking for Probing Secure - PowerPoint PPT Presentation

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion Mixing Additive and Multiplicative Masking for Probing Secure Polynomial Evaluation Methods Axel Mathieu-Mahias and Michaël Quisquater University of Versailles (UVSQ) CHES’18 September . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The Concept of Masking Side-channel analysis Information leak through physical leakages Data and physical leakages are dependent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2/16 2 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The Concept of Masking Side-channel analysis Information leak through physical leakages Data and physical leakages are dependent The masking countermeasure Randomly split every variable into several shares 1 Secure the processing through internal operations 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2/16 3 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The Concept of Masking Side-channel analysis Information leak through physical leakages Data and physical leakages are dependent The masking countermeasure Randomly split every variable into several shares 1 Secure the processing through internal operations 2 Higher-order masking More than 2 shares Sound countermeasure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2/16 4 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion About security The Probing Model [ISW03] ( x 1 , . . . , x d ) ( y 1 , . . . , y d ) Adversary observations Inputs Sec- Op 1 Ω = ( I 1 , I 2 , . . . I t ) Sec-Op 2 Internals Sec-Op 3 Probe Outputs ( z 1 , . . . , z d ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3/16 5 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion About security The Probing Model [ISW03] ( x 1 , . . . , x d ) ( y 1 , . . . , y d ) Adversary observations Inputs Sec- Op 1 Ω = ( I 1 , I 2 , . . . I t ) Sec-Op 2 Internals t -probing security Sec-Op 3 Probe Is any set of t observations Outputs independent of sensitive variables ? ( z 1 , . . . , z d ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3/16 6 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion About security The Probing Model [ISW03] ( x 1 , . . . , x d ) ( y 1 , . . . , y d ) Adversary observations Inputs Sec- Op 1 Ω = ( I 1 , I 2 , . . . I t ) Sec-Op 2 Internals t -probing security Sec-Op 3 Probe Is any set of t observations Outputs independent of sensitive variables ? ( z 1 , . . . , z d ) Two security notions : t-NI and t-SNI [BBDFG15] → t-SNI transformations can be composed safely ֒ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3/16 7 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion State of the Art of Masking S-boxes (Additive Masking) Split every variable x into d = t + 1 shares such that x 1 ⊕ x 2 ⊕ . . . ⊕ x d = x Processing of linear transformations : very efficient Processing of multiplications : much more expensive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4/16 8 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion State of the Art of Masking S-boxes (Additive Masking) Split every variable x into d = t + 1 shares such that x 1 ⊕ x 2 ⊕ . . . ⊕ x d = x Processing of linear transformations : very efficient Processing of multiplications : much more expensive AES : [RP10] S AES ( x ) : x �→ x 254 over F 2 8 Generic case : [CGPQR12] 2 n − 1 a i x i over F 2 n ∑ S ( x ) : x �→ i = 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4/16 9 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion State of the Art of Masking S-boxes Masking schemes in additive encoding FSE’12 : Carlet et al. CHES’13 : Roy and Vivek CHES’14 : Coron et al. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5/16 10 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion State of the Art of Masking S-boxes Masking schemes in additive encoding FSE’12 : Carlet et al. CHES’13 : Roy and Vivek CHES’14 : Coron et al. Masking schemes in other encodings CHES’11 : Prouff and Roche CRYPTO’15 : Carlet et al. EUROCRYPT’14 : Coron EUROCRYPT’15 : Balasch et al. CHES’16 : Goudarzi and Rivain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5/16 11 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The use of several encodings simultaneously GPQ : masking scheme for power functions [GPQ11] Mixes additive and multiplicative masking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6/16 12 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The use of several encodings simultaneously GPQ : masking scheme for power functions [GPQ11] Mixes additive and multiplicative masking The idea Linear transformations : efficient in additive masking Multiplications : efficient in multiplicative masking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6/16 13 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The use of several encodings simultaneously GPQ : masking scheme for power functions [GPQ11] Mixes additive and multiplicative masking The idea Linear transformations : efficient in additive masking Multiplications : efficient in multiplicative masking The scheme Secure processing of a Dirac function ( Secure-dirac ) Transformations to switch from additive into multiplicative masking ( AMtoMM ) and conversely ( MMtoAM ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6/16 14 / 36

b Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion GPQ : Masking Scheme for Power Functions x Sec-dirac ⊕ AMtoMM ( x + δ ( x )) α x α ⊕ MMtoAM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7/16 15 / 36

b Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion GPQ : Masking Scheme for Power Functions x Sec-dirac ⊕ AMtoMM ( x + δ ( x )) α x α ⊕ MMtoAM Our first contribution GPQ t-NI → GPQ t-SNI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7/16 16 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion Our approach and results Our Issue and Our Proposals How to extend GPQ to evaluate polynomials ? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8/16 17 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion Our approach and results Our Issue and Our Proposals How to extend GPQ to evaluate polynomials ? Our issues Adding monomials : not efficient in multiplicative masking Converting every monomials back in additive masking before adding them : not efficient . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8/16 18 / 36

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion Our approach and results Our Issue and Our Proposals How to extend GPQ to evaluate polynomials ? Our issues Adding monomials : not efficient in multiplicative masking Converting every monomials back in additive masking before adding them : not efficient Our t-SNI proposals One method based on the cyclotomic method [CGPQR12] 1 One method based on our first proposal and the CRV 2 method [CRV14] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8/16 19 / 36