Further Improving Efficiency of Higher Order Masking Schemes by Decreasing Randomness Complexity

Abstract

Most cryptographic implementations are vulnerable to side-channel attacks. Among the countermeasures, masking is the most popular one. In the field of provable secure masking schemes, it is a tough task to design a masking scheme for the multiplication with related multiplicands. Among all the corresponding solutions, the one proposed by Coron et al. in FSE 2013 achieves the best efficiency. Furthermore, in CRYPTO 2015, we claim that this scheme can be extended to secure any quadratic functions and therefore enables secure evaluation of S-box, which significantly outperforms any other methods. In this paper, we further promote the efficiency of Coron’s scheme by decreasing the random generations according to two observations. First, by modifying each pair of intermediate values on two sides of a diagonal line, half of all the required random values can be removed. Second, some randomness can be reused. All random values in one out of two lines can be replaced with the same random value. According to these two observations, we propose two new schemes. The first proposal improves the original scheme with a 50% randomness reduction and satisfies a stronger compositional security notion ${d}$ -SNI, while the second proposal improves the original scheme with a 50%–75% randomness reduction and satisfies a weaker compositional security notion ${d}$ -TNI. We give the security proof for both schemes. Moreover, we give an example of the masked Advanced Encryption Standard (AES) inversion circuits where both the first and second proposals are applied, significantly outperforming the original AES inversion with a 43%–57% saving of random generations. This indicates that our proposals can be used to build secure and efficient implementations of cryptographic algorithms.