Random Probing Security: Verification, Composition, Expansion and New Constructions

Abstract

The masking countermeasure is among the most powerful countermeasures to counteract side-channel attacks. Leakage models have been exhibited to theoretically reason on the security of such masked implementations. So far, the most widely used leakage model is the probing model defined by Ishai, Sahai, and Wagner at (CRYPTO 2003). While it is advantageously convenient for security proofs, it does not capture an adversary exploiting full leakage traces as, e.g., in horizontal attacks. Those attacks target the multiple manipulations of the same share to reduce noise and recover the corresponding value. To capture a wider class of attacks another model was introduced and is referred to as the random probing model. From a leakage parameter p, each wire of the circuit leaks its value with probability p. While this model much better reflects the physical reality of side channels, it requires more complex security proofs and does not yet come with practical constructions. In this paper, we define the first framework dedicated to the random probing model. We provide an automatic tool, called VRAPS, to quantify the random probing security of a circuit from its leakage probability. We also formalize a composition property for secure random probing gadgets and exhibit its relation to the strong non-interference (SNI) notion used in the context of probing security. We then revisit the expansion idea proposed by Ananth, Ishai, and Sahai (CRYPTO 2018) and introduce a compiler that builds a random probing secure circuit from small base gadgets achieving a random probing expandability property. We instantiate this compiler with small gadgets for which we verify the expected properties directly from our automatic tool. Our construction can tolerate a leakage probability up to 2 −8 , against 2 −25 for the previous construction, with a better asymptotic complexity.

Prouff and Rivain’s Formal Security Proof of Masking, Revisited

“…Notice that the dependency of the noise requirement in d is tight, since it depicts the potential ability of an adversary to increase its success of recovering each share through horizontal attacks, as argued by Battistello et al [7] and Grosso and Standaert [33]. Nevertheless, it is still possible to relax this dependency by using other multiplication gadgets [1,3,2,8,30,31].…”

“…This direct approach has gained the reputation of being "not convenient" [8,10] to work with, up to the point that most masking security proofs are now established in much simpler yet unrealistic threat models [34,6,8,9,17], relying on a non-tight reduction from the noisy leakage model to such simpler threat models [25]. As a result, only three previous works tackled masking security proofs through this direct way so far.…”

“…Let L : Y → L be a random function denoting a leakage, and let Y be uniformly distributed over Y. Then, there exists a constant α such that for all random variables G arbitrarily distributed over Y, the following inequality holds true: Theorem 2 introduces an overhead scaling with |Y|, which could decrease the final security level by one or several orders of magnitude (e.g., for the AES, |Y| = 2 8 ). Note that Equation 3 is nearly tight in the general case, in the sense that the range of α is narrow.…”

Circuit Masking: From Theory to Standardization, A Comprehensive Survey for Hardware Security Researchers and Practitioners

“…VRAPS, an automatic framework algorithm from [23], is a security verification tool that considers the random probing model for the sake of capturing horizontal attacks which exploit full leakage traces. However, this tool only works on small circuits, i.e., proving the security of gadgets.…”