Boolean and Arithmetic masking

1
Boolean and Arithmetic masking

• IST Seminar
• Arjan Blom

2
Contents

• Problem
• Boolean and Arithmetic masking.
• Research.
• Questions

3
Basic problem

• AES algorithm is secure
• Implementations of the algorithm are easier to
  attack.
• Smartcards are limited devices

4
(AES / DES / SHA) Problems

• Power consumption can leak the Hamming weight of
  the data (SPA Attack). 1
• Leakage of Round 0 keys (DPA Attack)
• Leakage of inner rounds (IPA Attack)

1 Eli Biham, Adi Shamir, PowerAnalysisoftheKeySch
edulingoftheAESCandidates, Second Advanced
Encryption Standard (AES) Candidate Conference,
http//csrc.nist.gov/encryption/aes/round1/conf2/a
es2conf.htm, March 1999
5
Fundamental hypothesis

• There exists an intermediate variable, that
  appears during the computation of the algorithm,
  such that knowing a few key bits (in practice
  less than 32 bits) allows us to decide whether
  two inputs (respectively two outputs) give or not
  the same value for this variable. 1

1 Jean-Sebastien Coron and Louis Goubin, On
Boolean and Arithmetic Masking against
Di?erential Power Analysis, Proceedings of CHES
2000, LNCS 1965, pp. 231-237, Springer
6
Solution
7
Boolean and Arithmetic masking

• Boolean masking x' x ? r
• Arithmetic masking A x - r mod 2 K
• t0 2?
• ?k 0, tk1 2tk ? (A ? r) ? ?,

8
BooleanToArithmetic algorithm

• Require (x' , r) such that x x' ? r
• Ensure (A, r) such that x A r
• Initialize G to a random value ?
• T ? x' ? G
• T ? T - G
• T ? T ? x'
• G ? G ? r
• A ? x' ? G
• A ? A - G
• A ? A ? T

9
BooleanToArithmetic algorithm proof

• Works against a single bit DPA attack
• V0 ?
• V1 ? ? r
• V2 x' ? ?
• V3 (x' ? ? ) - ?
• V4 (x' ? ? ) - ? ? x'
• V5 x' ? ? ? r
• V6 (x' ? ? ? r) - (? ? r)

10
BooleanToArithmetic proof
FAILS with a 2 selected bits attack

• Jean-Sebastien Coron and Louis Goubin, On
  Boolean and Arithmetic Masking against
  Differential Power Analysis", Lecture Notes in
  Computer Science, 1965,"231--??,"2001",citeseer.i
  st.psu.edu/article/coron00boolean.html

11
ArithmeticToBoolean algorithm (1)

• Require (A, r) such that x A r
• Ensure (x' , r) such that x x' ? r
• Initialize G to a random value ?
• T ? 2G x' ? G ? r
• ? ? G ? x'
• x' ? T ? A
• G ? G ? x'
• G ? G ? r
• ? ? ? ? G
• G ? T ? A
• ? ? ? ? G

12
ArithmeticToBoolean algorithm (2)

• for k 1 to K - 1 do
• G ? T ? r
• G ? G ?
• ? T ? T ? A G ? G ? T
• T ? 2G
• end for
• x' ? x' ? T

13
ArithmeticToBoolean algorithm proof

• W0 ?
• W1 2?
• W2 ? ? r
• W3 ? ? ? ? r
• W4 2? ? A
• W5 ? ? 2? ? A
• W6 (? ? 2? ? A) ? r
• W7 ? ? (2? ) ? r ? A ? r
• W8 (2? ) ? A
• W9 ? ? (2? ) ? (A ? r) ? A ? r ?

14
ArithmeticToBoolean algorithm proof

• for k 1 to K - 1
• W5k5 (2? ? uk-1 ) ? r
• W5k6 ? ? (2? ) ? A ? uk-1 ? r ? A ? r
• W5k7 (2? ? uk-1 ) ? A
• W5k8 ? ? uk-1 ?(A ?r) ?A ?r
• W5k9 2? ? uk

15
Research

• Louis Goubin, A Sound Method for Switching
  between Boolean and Arithmetic Masking,
  proceedings of CHES 2001, LNCS 2162,pp. 3-15,
  Springer.
• Thomas S. Messerges, Securing the AES Finalists
  Against Power Analysis At- tacks, in
  Proceedings of Fast Software Encryption Workshop
  2000 , Springer- Verlag, April 2000.
• Jean-Sebastien Coron and Louis Goubin, On
  Boolean and Arithmetic Masking against
  Di?erential Power Analysis, in Proceedings of
  Workshop on Cryptographic Hardware and Embedded
  Systems , Springer-Verlag, August 2000.

16
Questions

• ?