High-order Table-based Conversion Algorithms and Masking Lattice-based Encryption

Abstract

Masking is the main countermeasure against side-channel attacks on embedded devices. For cryptographic algorithms that combine Boolean and arithmetic masking, one must therefore convert between the two types of masking, without leaking additional information to the attacker. In this paper we describe a new high-order conversion algorithm between Boolean and arithmetic masking, based on table recomputation, and provably secure in the ISW probing model. We show that our technique is particularly efficient for masking structured LWE encryption schemes such as Kyber and Saber. In particular, for Kyber IND-CPA decryption, we obtain an order of magnitude improvement compared to existing techniques.

Revisiting Higher-Order Masked Comparison for Lattice-Based Cryptography: Algorithms and Bit-Sliced Implementations

“…Instead of working with arithmetic multiplications modulo some big power-of-two, we propose to work in a Galois field, which saves us a conversion from the Boolean to the arithmetic masking domain and significantly reduces the cost of the comparison operation. We also develop a streamlined version of the Kyber-specific compression of Coron et al [2]. Both our algorithms outperform the comparisons they are based on.…”

“…Coron et al [2] introduce a hybrid method to perform the comparison. They first build several subfunctions and combine them into one comparison algorithm aimed at prime moduli q, as used in Kyber.…”

“…

Masked comparison is one of the most expensive operations in side-channel secure implementations of lattice-based post-quantum cryptography, especially for higher masking orders. First, we introduce two new masked comparison algorithms, which improve the arithmetic comparison of D'Anvers et al [1] and the hybrid comparison method of Coron et al [2] respectively. We then look into implementation-specific optimizations, and show that small specific adaptations can have a significant impact on the overall performance.

…”

“…Masked implementations of encryption standardization candidates were presented for Saber by Van Beirendonck et al [22] for first order, and later by Coron et al [2] for higher masking orders. A masked Kyber implementation for generic masking orders was introduced by Bos et al [23].…”

“…Removing the compression here comes at a cost of two (cheaper) checks per coefficient. Coron et al [2] introduced several new ideas to more efficiently perform this range check.…”