Analysis of Software Implemented Low Entropy Masking Schemes

Dan Li,Xiaoyun Wang,Jiazhe Chen,An Wang

doi:10.1155/2018/7206835

Abstract

Low Entropy Masking Schemes (LEMS) are countermeasure techniques to mitigate the high performance overhead of masked hardware and software implementations of symmetric block ciphers by reducing the entropy of the mask sets. The security of LEMS depends on the choice of the mask sets. Previous research mainly focused on searching balanced mask sets for hardware implementations. In this paper, we find that those balanced mask sets may have vulnerabilities in terms of absolute difference when applied in software implemented LEMS. The experiments verify that such vulnerabilities certainly make the software LEMS implementations insecure. To fix the vulnerabilities, we present a selection criterion to choose the mask sets. When some feasible mask sets are already picked out by certain searching algorithms, our selection criterion could be a reference factor to help decide on a more secure one for software LEMS.

Highlights

First introduced by Kocher [1], side channel attacks (SCA) can be used to evaluate the implementation security of cryptographic ciphers by analyzing the time, the electromagnetic radiation, the power consumption, and so on [2,3,4,5,6].To resist SCA, several valid countermeasures have been proposed [7,8,9,10]
We study the unbalance in terms of absolute difference on software Low Entropy Masking Schemes (LEMS) implementations and make selection criterion for their mask sets
(i) We find that the mask sets selected according to selection criteria in [11, 18] have the vulnerabilities based on the absolute difference measurements on software LEMS

Summary

Introduction

First introduced by Kocher [1], side channel attacks (SCA) can be used to evaluate the implementation security of cryptographic ciphers by analyzing the time, the electromagnetic radiation, the power consumption, and so on [2,3,4,5,6]. The second one is that the deterministic part of the leakage function lZ⊕M is linear in the bits of masked variable Z ⊕ M, such as Hamming weight function Under those two conditions, the main goal of selecting mask sets for LEMS is to find balanced mask sets resistant to high order univariate CPA (following the definition of [20], the attack combining n different time instances is called n-variate attack and the nth order attack statistical moments). Independent of intermediate Z is the selection criterion of the mask sets for the designer of the hardware countermeasures We find it is not enough for software implemented LEMS. We study the unbalance in terms of absolute difference on software Low Entropy Masking Schemes (LEMS) implementations and make selection criterion for their mask sets.

Preliminaries

Vulnerabilities on Software LEMS

Selection of Balanced Mask Sets

Conclusion

Results of Experiments