[PPT] - Mixing Additive and Multiplicative Masking for Probing Secure PowerPoint Presentation

SLIDE 1

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

Mixing Additive and Multiplicative Masking for Probing Secure Polynomial Evaluation Methods

Axel Mathieu-Mahias and Michaël Quisquater

University of Versailles (UVSQ)

CHES’18 September

1 / 36

SLIDE 2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

The Concept of Masking

Side-channel analysis

Information leak through physical leakages Data and physical leakages are dependent

2/16 2 / 36

SLIDE 3

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

The Concept of Masking

Side-channel analysis

Information leak through physical leakages Data and physical leakages are dependent

The masking countermeasure

1

Randomly split every variable into several shares

2

Secure the processing through internal operations

2/16 3 / 36

SLIDE 4

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

The Concept of Masking

Side-channel analysis

Information leak through physical leakages Data and physical leakages are dependent

The masking countermeasure

1

Randomly split every variable into several shares

2

Secure the processing through internal operations

Higher-order masking

More than 2 shares Sound countermeasure

2/16 4 / 36

SLIDE 5

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion About security

The Probing Model [ISW03]

(y1, . . . , yd) (x1, . . . , xd) Inputs Internals Outputs Sec-Op1 Sec-Op2 Sec-Op3 (z1, . . . , zd)

Ω = (I1, I2, . . . It)

Probe Adversary observations

3/16 5 / 36

SLIDE 6

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion About security

The Probing Model [ISW03]

Is any set of t observations (y1, . . . , yd) (x1, . . . , xd) Inputs Internals Outputs Sec-Op1 Sec-Op2 Sec-Op3 (z1, . . . , zd)

Ω = (I1, I2, . . . It)

Probe independent of sensitive variables ? Adversary observations t-probing security

3/16 6 / 36

SLIDE 7

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion About security

The Probing Model [ISW03]

Is any set of t observations (y1, . . . , yd) (x1, . . . , xd) Inputs Internals Outputs Sec-Op1 Sec-Op2 Sec-Op3 (z1, . . . , zd)

Ω = (I1, I2, . . . It)

Probe independent of sensitive variables ? Adversary observations t-probing security

Two security notions : t-NI and t-SNI [BBDFG15] ֒ → t-SNI transformations can be composed safely

3/16 7 / 36

SLIDE 8

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

State of the Art of Masking S-boxes (Additive Masking)

Split every variable x into d = t + 1 shares such that x1 ⊕ x2 ⊕ . . . ⊕ xd = x Processing of linear transformations : very efficient Processing of multiplications : much more expensive

4/16 8 / 36

SLIDE 9

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

State of the Art of Masking S-boxes (Additive Masking)

Split every variable x into d = t + 1 shares such that x1 ⊕ x2 ⊕ . . . ⊕ xd = x Processing of linear transformations : very efficient Processing of multiplications : much more expensive AES : [RP10] SAES(x) : x → x254 over F28 Generic case : [CGPQR12] S(x) : x →

2n−1

∑

i=0

aixi over F2n

4/16 9 / 36

SLIDE 10

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

State of the Art of Masking S-boxes

Masking schemes in additive encoding FSE’12 : Carlet et al. CHES’13 : Roy and Vivek CHES’14 : Coron et al.

5/16 10 / 36

SLIDE 11

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

State of the Art of Masking S-boxes

Masking schemes in additive encoding FSE’12 : Carlet et al. CHES’13 : Roy and Vivek CHES’14 : Coron et al. Masking schemes in other encodings CHES’11 : Prouff and Roche CRYPTO’15 : Carlet et al. EUROCRYPT’14 : Coron EUROCRYPT’15 : Balasch et al. CHES’16 : Goudarzi and Rivain

5/16 11 / 36

SLIDE 12

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

The use of several encodings simultaneously

GPQ : masking scheme for power functions [GPQ11] Mixes additive and multiplicative masking

6/16 12 / 36

SLIDE 13

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

The use of several encodings simultaneously

GPQ : masking scheme for power functions [GPQ11] Mixes additive and multiplicative masking The idea Linear transformations : efficient in additive masking Multiplications : efficient in multiplicative masking

6/16 13 / 36

SLIDE 14

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

The use of several encodings simultaneously

GPQ : masking scheme for power functions [GPQ11] Mixes additive and multiplicative masking The idea Linear transformations : efficient in additive masking Multiplications : efficient in multiplicative masking The scheme Secure processing of a Dirac function (Secure-dirac) Transformations to switch from additive into multiplicative masking (AMtoMM) and conversely (MMtoAM)

6/16 14 / 36

SLIDE 15

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

GPQ : Masking Scheme for Power Functions

MMtoAM AMtoMM x xα

(x + δ(x))α

⊕

b

⊕ Sec-dirac

7/16 15 / 36

SLIDE 16

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

GPQ : Masking Scheme for Power Functions

MMtoAM AMtoMM x xα

(x + δ(x))α

⊕

b

⊕ Sec-dirac

Our first contribution GPQ t-NI → GPQ t-SNI

7/16 16 / 36

SLIDE 17

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion Our approach and results

Our Issue and Our Proposals

How to extend GPQ to evaluate polynomials ?

8/16 17 / 36

SLIDE 18

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion Our approach and results

Our Issue and Our Proposals

How to extend GPQ to evaluate polynomials ?

Our issues Adding monomials : not efficient in multiplicative masking Converting every monomials back in additive masking before adding them : not efficient

8/16 18 / 36

SLIDE 19

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion Our approach and results

Our Issue and Our Proposals

How to extend GPQ to evaluate polynomials ?

Our issues Adding monomials : not efficient in multiplicative masking Converting every monomials back in additive masking before adding them : not efficient Our t-SNI proposals

1

One method based on the cyclotomic method [CGPQR12]

2

One method based on our first proposal and the CRV method [CRV14]

8/16 19 / 36

SLIDE 20

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The cyclotomic method

Our First Proposal : The Alternate Cyclotomic Method

Reminder of the Cyclotomic Method [CGPQR12] The cyclotomic class of α : Cα = {α · 2j mod 2n − 1; j < n}

9/16 20 / 36

SLIDE 21

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The cyclotomic method

Our First Proposal : The Alternate Cyclotomic Method

Reminder of the Cyclotomic Method [CGPQR12] The cyclotomic class of α : Cα = {α · 2j mod 2n − 1; j < n} Any n-bit S-box can be expressed as S(x) = a0 + ( q ∑

i=1

Li(xαi) ) + a2n−1x2n−1 where Li(x) = ∑

j ai,jx2j and q is the number of distinct

cyclotomic classes

9/16 21 / 36

SLIDE 22

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The cyclotomic method

Our First Proposal : The Alternate Cyclotomic Method

Reminder of the Cyclotomic Method [CGPQR12] The cyclotomic class of α : Cα = {α · 2j mod 2n − 1; j < n} Any n-bit S-box can be expressed as S(x) = a0 + ( q ∑

i=1

Li(xαi) ) + a2n−1x2n−1 where Li(x) = ∑

j ai,jx2j and q is the number of distinct

cyclotomic classes Deriving the xαi’s requires multiplications : expensive in additive masking.

9/16 22 / 36

SLIDE 23

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The Alternate Cyclotomic Method

Our First Proposal : The Alternate Cyclotomic Method

AMtoMM x S(x) Sec-dirac

(x + δ(x))α1

⊕

b

MMtoAM

(x + δ(x))αq

b b b b b b

L1((x + δ(x))α1) Lq((x + δ(x))αq)

b b b

Linear Processing

MMtoAM

: In multiplicative masking

10/16 23 / 36

SLIDE 24

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The Alternate Cyclotomic Method

Our First Proposal : The Alternate Cyclotomic Method

AMtoMM x S(x) Sec-dirac

(x + δ(x))α1

⊕

b

MMtoAM

(x + δ(x))αq

b b b b b b

L1((x + δ(x))α1) Lq((x + δ(x))αq)

b b b

Linear Processing

MMtoAM

: In multiplicative masking

The alternate cyclotomic method is t-SNI

10/16 24 / 36

SLIDE 25

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The cyclotomic method vs The alternate cyclotomic method

Assembly Language Performances : 8-bit Architecture

Costs (in clock cycles) of evaluating S-boxes of size 4 ≤ n ≤ 8 with the cyclotomic method and our proposal

n Method Order 4 5 6 7 8 Our proposal 1 83 246 553 860 1677 Original 132 780 1716 2652 5148 Our proposal 2 276 585 1362 2138 4205 Original 174 1770 3894 6018 11682 Our proposal 3 477 1036 2445 3854 7603 Original 293 3160 6952 10744 20856

11/16 25 / 36

SLIDE 26

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The original CRV method

Our Second Proposal : The Alternate CRV Method

Reminder of the original CRV Method [CRV14] Express any n-bit S-box as S(x) =

k−1

∑

i=1

pi(x) · qi(x) + pk(x) where monomials of pi(x), qi(x) belong to xL with L ←

l

∪

i=1

Cαi

12/16 26 / 36

SLIDE 27

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The original CRV method

Our Second Proposal : The Alternate CRV Method

Reminder of the original CRV Method [CRV14] Express any n-bit S-box as S(x) =

k−1

∑

i=1

pi(x) · qi(x) + pk(x) where monomials of pi(x), qi(x) belong to xL with L ←

l

∪

i=1

Cαi Evaluation in two steps

1

Evaluating qi(x), pi(x) requires l − 2 multiplications

2

Evaluating S(x) requires k − 1 multiplications

12/16 27 / 36

SLIDE 28

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The original CRV method

Our Second Proposal : The Alternate CRV Method

Reminder of the original CRV Method [CRV14] Express any n-bit S-box as S(x) =

k−1

∑

i=1

pi(x) · qi(x) + pk(x) where monomials of pi(x), qi(x) belong to xL with L ←

l

∪

i=1

Cαi Evaluation in two steps

1

Evaluating qi(x), pi(x) requires l − 2 multiplications

2

Evaluating S(x) requires k − 1 multiplications

Remark : trade-off between l and k

12/16 28 / 36

SLIDE 29

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion Our alternate approach

Our Second Proposal : The Alternate CRV Method

S(x) =

k−1

∑

i=1

pi(x) · qi(x) + pk(x) Our evaluation method

1

Evaluating qi(x), pi(x) with our t-SNI alternate cyclotomic method

2

Evaluating S(x) in additive masking (unchanged)

13/16 29 / 36

SLIDE 30

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion Our alternate approach

Our Second Proposal : The Alternate CRV Method

S(x) =

k−1

∑

i=1

pi(x) · qi(x) + pk(x) Our evaluation method

1

Evaluating qi(x), pi(x) with our t-SNI alternate cyclotomic method

2

Evaluating S(x) in additive masking (unchanged) Remarks More choices of cyclotomic classes to build xL Larger sets L ←

l

∪

i=1

Cαi can be considered The alternate CRV method is t-SNI

13/16 30 / 36

SLIDE 31

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion The CRV method vs The Alternate CRV method

Assembly Language Performances : 8-bit Architecture

Costs (in clock cycles) of evaluating S-boxes of size 4 ≤ n ≤ 8 with the CRV method and our alternate proposal

n Method Order 4 5 6 7 8 Our proposal 1 127 402 559 713 972 Original CRV 88 624 780 1092 1560 Our proposal 2 276 939 1296 1685 2300 Original CRV 204 1416 1770 2478 3540 Our proposal 3 477 1668 2305 3012 4117 Original CRV 368 2528 3160 4424 6320

14/16 31 / 36

SLIDE 32

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

Conclusion

1

GPQ t-NI → GPQ t-SNI

15/16 32 / 36

SLIDE 33

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

Conclusion

1

GPQ t-NI → GPQ t-SNI

2

The Alternate cyclotomic method

Extends GPQ to polynomial evaluations Three times faster than the original method Satisfies the t-SNI property

15/16 33 / 36

SLIDE 34

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

Conclusion

1

GPQ t-NI → GPQ t-SNI

2

The Alternate cyclotomic method

Extends GPQ to polynomial evaluations Three times faster than the original method Satisfies the t-SNI property

3

The Alternate CRV method

Uses Alternate cyclotomic for one evaluation step New sets of parameters can be derived Outperforms the original method in most scenarios Satisfies the t-SNI property

15/16 34 / 36

SLIDE 35

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction GPQ t-NI → GPQ t-SNI Alternate Cyclotomic Method Alternate CRV Method Conclusion

Thanks for your attention!

16/16 35 / 36