Analysis and Improvement of the Generic Higher-Order Masking Scheme of FSE 2012

Abstract

Abstract. Masking is a well-known technique used to prevent block cipher implementations from side-channel attacks. Higher-order side channel attacks (e.g. higher-order DPA attack) on widely used block cipher like AES have motivated the design of ecient higher-order masking schemes. Indeed, it is known that as the masking order increases, the diculty of side-channel attack increases exponentially. However, the main problem in higher-order masking is to design an ecient and secure technique for S-box computations in block cipher implementations. At FSE 2012, Carlet et al. proposed a generic masking scheme that can be applied to any S-box at any order. This is the rst generic scheme for ecient software implementations. Analysis of the running time, or masking complexity, of this scheme is related to a variant of the well-known problem of ecient exponentiation (addition chain ), and evaluation of polynomials. In this paper we investigate optimal methods for exponentiation in F2n by studying a variant of addition chain, which we call cyclotomic-class addition chain, or CC-addition chain. Among several interesting properties, we prove lower bounds on min-length CC-addition chains. We dene the notion of F2n -polynomial chain, and use it to count the number of non-linear multiplications required while evaluating polynomials over F2n . We also give a lower bound on the length of such a chain for any polynomial. As a consequence, we show that a lower bound for the masking complexity of DES S-boxes is three, and that of PRESENT S-box is two. We disprove a claim previously made by Carlet et al. regarding min-length CC-addition chains. Finally, we give a polynomial evaluation method, which results into an improved masking scheme (compared to the technique of Carlet et al.) for DES S-boxes. As an illustration we apply this method to several other S-boxes and show signicant improvement for them.

Fast Evaluation of Polynomials over Binary Finite Fields and Application to Side-Channel Countermeasures

“…Table 4 gives the corresponding polynomials for the PRESENT S-box. The polynomial corresponding to the PRESENT S-box has degree 14 and hence, from Proposition 1, its masking complexity is at least 2 [RV13]. This implies that our evaluation method achieves optimal complexity for the PRESENT S-box.…”

“…In [RV13], the monomials x, x 2 , x 3 , x 4 , x 5 , x 6 , x 7 , x 8 , x 9 , x 18 , x 36 are first evaluated using 4 non-linear multiplications. Namely a non-linear multiplication is required for each of the monomials x 3 , x 5 , x 7 and x 9 ; the rest of the monomials can be evaluated using linear squarings only.…”

“…To sum up, the basic idea behind the above technique is to precompute a set of monomials, and then obtain a decomposition of the required polynomial in terms of polynomials having their monomials only from the precomputed set. Note that the said decomposition is obtained in a "fixed" way that depends only on the degree of the polynomial, which is required to be of the form k (2 p − 1)±c, for some parameters k, p and c; we refer to [RV13] for more details.…”

“…DES, CLEFIA, PRESENT, etc., our method reduces the number of multiplications compared to the previously known methods [CGP + 12,RV13]. In particular, using our method PRESENT can be masked with 2 multiplications (instead of 3), and DES with 4 multiplications (instead of 7), see Table 1.…”

“…[ [RV13], Definition 4] An F 2 n -polynomial chain S for a polynomial P (x) ∈ F 2 n [x] is defined as…”