Removing the Field Size Loss from Duc et al.’s Conjectured Bound for Masked Encodings

Abstract

At Eurocrypt 2015, Duc et al. conjectured that the success rate of a side-channel attack targeting an intermediate computation encoded in a linear secret-sharing, a.k.a. masking with d+1 shares, could be inferred by measuring the mutual information between the leakage and each share separately. This way, security bounds can be derived without having to mount the complete attack. So far, the best proven bounds for masked encodings were nearly tight with the conjecture, up to a constant factor overhead equal to the field size, which may still give loose security guarantees compared to actual attacks. In this paper, we improve upon the state-of-the-art bounds by removing the field size loss, in the cases of Boolean masking and arithmetic masking modulo a power of two. As an example, when masking in the AES field, our new bound outperforms the former ones by a factor 256. Moreover, we provide theoretical hints that similar results could hold for masking in other fields as well.

Improved Alpha-Information Bounds for Higher-Order Masked Cryptographic Implementations

“…Similar improved bounds (removing the field size loss) can also be obtained in the cases of Boolean masking and arithmetic masking modulo a power of two, using "Mrs. Gerber's lemma", see [2]. Extending this work to α-information is left for future work.…”