Linear Repairing Codes and Side-Channel Attacks

Abstract

To strengthen the resistance of countermeasures based on secret sharing,several works have suggested to use the scheme introduced by Shamir in 1978, which proposes to use the evaluation of a random d-degree polynomial into n ≥ d + 1 public points to share the sensitive data. Applying the same principles used against the classical Boolean sharing, all these works have assumed that the most efficient attack strategy was to exploit the minimum number of shares required to rebuild the sensitive value; which is d + 1 if the reconstruction is made with Lagrange’s interpolation. In this paper, we highlight first an important difference between Boolean and Shamir’s sharings which implies that, for some signal-to-noise ratio, it is more advantageous for the adversary to observe strictly more than d + 1 shares. We argue that this difference is related to the existence of so-called linear exact repairing codes, which themselves come with reconstruction formulae that need (much) less information (counted in bits) than Lagrange’s interpolation. In particular, this result implies that the choice of the public points in Shamir’s sharing has an impact on the countermeasure strength, which confirms previous observations made by Wang et al. at CARDIS 2016 for the so-called inner product sharing which is a generalization of Shamir’s scheme. As another contribution, we exhibit a positive impact of the existence of linear exact repairing schemes; we indeed propose to use them to improve the state-of-the-art multiplication algorithms dedicated to Shamir’s sharing. We argue that the improvement can be effective when the multiplication operation in the sub-fields is at least two times smaller than that of the base field.

Information Leakages in Code-based Masking: A Unified Quantification Approach

“…For the first time, we quantify the impact of combining different public points in SSS-based masking in the context of side-channel analysis and show that more shares leak more information (given a specific t). In particular, our coding-theoretic approach can exactly depict the observations made in [CMP18]. Using MI, we present the quantitative results of information leakages in SSS-based masking, which again validate our unified approach.…”

“…As observed in [CMP18], the public points in SSS play a significant role in the sidechannel resistance of SSS-based masking schemes. In fact, this problem of public points is inherent in the SSS scheme and can be dated back to Massey [Mas93] who claimed that SSS scheme "can be attacked with the well-developed tools of algebraic coding theory".…”

“…We recall the (n, t)-SSS scheme by mainly referring to [CMP18,CRZ13]. Let X ∈ K again be the secret and can be split into n shares such that no tuple of shares with cardinality lower than t depends on X.…”

“…Definition 8 (Reed-Solomon Code [CMP18]). The Reed-Solomon code RS(S, t + 1) ⊂ K n of dimension t + 1 over a finite field K and with evaluation subset S = {α 0 , α 1 , .…”

On Efficient and Secure Code-based Masking: A Pragmatic Evaluation

“…Byte transitions can be taken into consideration if, for instance, 256 2 = 65536 templates are profiled on the pair of (initial, final) values. During the attack phase, we leverage an adaption of the Gaussian mixture model as in [CMP18,CS21] by using real measurements. We choose one Point of Interest (POI) for each share and the selection strategy is to designate the one which has the largest and most consistent Signal-to-Noise Ratio (SNR), which is defined for each share as in [DFS15].…”