Optimal First-Order Boolean Masking for Embedded IoT Devices

Biryukov, Alex; Dinu, Dumitru-Daniel; Corre, Y.; Udovenko, Aleksei

doi:10.1007/978-3-319-75208-2_2

Cited by 19 publications

(42 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There also exist realizations of a masked AND gate that do not require any fresh randomness. As an example, we consider the following equations from Biryukov et al [BDCU17] where ∨ is the OR operation:…”

Section: Application To Nonlinear Gatesmentioning

confidence: 99%

First-Order Masking with Only Two Random Bits

Groß

Stoffelen

Meyer

et al. 2019

Proceedings of ACM Workshop on Theory of Implementation Security Workshop

View full text Add to dashboard Cite

Masking is the best-researched countermeasure against side-channel analysis attacks. Even though masking was introduced almost 20 years ago, its efficient implementation continues to be an active research topic. Many of the existing works focus on the reduction of randomness requirements since the production of fresh random bits with high entropy is very costly in practice. Most of these works rely on the assumption that only so-called online randomness results in additional costs. In practice, however, it shows that the distinction between randomness costs to produce the initial masking and the randomness to maintain security during computation (online) is not meaningful. In this work, we thus study the question of minimum randomness requirements for first-order Boolean masking when taking the costs for initial randomness into account. We demonstrate that first-order masking can in theory always be performed by just using two fresh random bits and without requiring online randomness. We first show that two random bits are enough to mask linear transformations and then discuss prerequisites under which nonlinear transformations are securely performed likewise. Subsequently, we introduce a new masked AND gate that fulfills these requirements and which forms the basis for our synthesis tool that automatically transforms an unmasked implementation into a first-order secure masked implementation. We demonstrate the feasibility of this approach by implementing AES in software with only two bits of randomness, including the initial masking. Finally, we use these results to discuss the gap between theory and practice and the need for more accurate adversary models.

show abstract

Section: Application To Nonlinear Gatesmentioning

confidence: 99%

First-Order Masking with Only Two Random Bits

Groß

Stoffelen

Meyer

et al. 2019

Proceedings of ACM Workshop on Theory of Implementation Security Workshop

View full text Add to dashboard Cite

show abstract

“…In CARDIS 2017, Biryukov et al [3] improved the Coron et al's masked addition. They searched optimal subroutines called in the Coron et al's masked addition in the formal manner and applied them to construct an improved masked addition algorithm.…”

Section: First-order Boolean and Arithmetic Maskingsmentioning

confidence: 99%

“…Biryukov et al [3] took a comprehensive approach to search optimal algorithms of subroutines which securely execute operations of AND and OR. They then applied these subroutines to Algorithm 2 Kogge-Stone Arithmetic-to-Boolean Conversion [5] Input: A, r ∈ {0, 1} k and n = max( log 2…”

Section: Biryukov Et Al's Masked Addition Algorithm [3]mentioning

confidence: 99%

“…Algorithm 3 shows the improved masked addition algorithm from Ref. [3]. This algorithm calls the improved SecAnd labeled as SecAnd2, and two other subroutines labeled as SecShift2 and SecXor2.…”

Section: Biryukov Et Al's Masked Addition Algorithm [3]mentioning

confidence: 99%

“…In Ref. [3], Biryukov et al gave, not an arithmetic-to-Boolean algorithm, but the masked addition and subtraction algorithms. From their masked addition algorithm, we can derive an arithmetic-to-Boolean conversion algorithm, which we call the Biryukov et al's conversion algorithm.…”

Section: Comparison With Previous Algorithmsmentioning

confidence: 99%

See 2 more Smart Citations

Integrative Acceleration of First-order Boolean Masking for Embedded IoT Devices

Komano

Shimizu

2019

Journal of Information Processing

View full text Add to dashboard Cite

Physical attacks, especially side-channel attacks, are threats to IoT devices which are located everywhere in the field; and therefore, protecting such devices against side-channel attacks is one of our emerging issues. Toward that, Coron et al. gave an efficient arithmetic-to-Boolean mask conversion algorithm which enables us to protect cryptographic algorithms including arithmetic operations, such as hash functions, from the attacks. Recently, Biryukov et al. improved it by locally optimizing subroutines of the conversion algorithm. In this paper, we revisit the algorithm. Unlike Biryukov et al., we improve the Coron et al.'s algorithm with integrative optimizations over the subroutines. The gains against these algorithms are about 22.6% and 7.0% in the general setting. We also apply our algorithm to HMAC-SHA-1 and have an experiment to show that the implementation on a test vehicle smartcard leaks no sensitive information, i.e., secure against the first-order side-channel attack, with the ISO/IEC17825 test.

show abstract