Composable Masking Schemes in the Presence of Physical Defaults & the Robust Probing Model

Abstract

Composability and robustness against physical defaults (e.g., glitches) are two highly desirable properties for secure implementations of masking schemes. While tools exist to guarantee them separately, no current formalism enables their joint investigation. In this paper, we solve this issue by introducing a new model, the robust probing model, that is naturally suited to capture the combination of these properties. We first motivate this formalism by analyzing the excellent robustness and low randomness requirements of first-order threshold implementations, and highlighting the difficulty to extend them to higher orders. Next, and most importantly, we use our theory to design and prove the first higher-order secure, robust and composable multiplication gadgets. While admittedly inspired by existing approaches to masking (e.g., Ishai-Sahai-Wagner-like, threshold, domain-oriented), these gadgets exhibit subtle implementation differences with these state-of-the-art solutions (none of which being provably composable and robust). Hence, our results illustrate how sound theoretical models can guide practically-relevant implementations.

Let’s Tessellate: Tiling for Security Against Advanced Probe and Fault Adversaries

“…This section considers known physical effects which affect the probing security of an implementation and invalidate the separate wire leakage assumption. These effects were already discussed considering the circuit model in the work by Faust et al [14]. However, this section adopts their arguments and discusses the physical effects in the tile probing model instead.…”

“…It is shown that the model captures the effects of area-extended faults as well as faults targeting a specific resource throughout the computation. Moreover, to the best of our knowledge, the model is currently the only one capable of capturing all the physical effects described by Faust et al [14]. Finally, recent introduced attacks such as Statistical Ineffective Fault Attacks (SIFA) and combined attacks, combining both side-channel analysis and fault analysis, are also covered by the model.…”

“…When these effects occur, the adversary can mount side-channel attacks at a lower cost than estimated by the probing security of the implementation, e.g., see the work by Moos et al [20]. As a reaction to these effects, Faust et al [14] proposed extensions of the probing model (called the robust probing model) such that hardware effects can be captured. The authors also describe how to protect smaller components in the primitive's circuit against these effects using the non-interference models.…”

Threshold Implementations in the Robust Probing Model

“…To give security proofs, we need to have a security model. Since we are interested in the security of hardware implementations, we make use of the glitch-robust probing model from [10]. A probing adversary chooses up to a threshold number of wires of the algorithm's circuit representation to read the value from (probing).…”

“…When considering the effect of glitches, with each probe the adversary can read all the input values which flow to that wire until a register is reached. The interested reader is encouraged to learn more about this model in [10], a comparison of the probing model with other leakage models is given in [13], and the proof of the reduction of the noisy leakage model to the probing model is found in [9]. In threshold circuits, the glitch-robust adversary transforms into an adversary reading the circuit's component functions due to the component functions being walled-off by registers.…”