On Boolean and Arithmetic Masking against Differential Power Analysis

  • Authors:
  • Jean-Sébastien Coron;Louis Goubin

  • Affiliations:
  • -;-

  • Venue:
  • CHES '00 Proceedings of the Second International Workshop on Cryptographic Hardware and Embedded Systems
  • Year:
  • 2000

Quantified Score

Hi-index 0.00

Visualization

Abstract

Since the announcement of the Differential Power Analysis (DPA) by Paul Kocher and al., several countermeasures were proposed in order to protect software implementations of cryptographic algorithms. In an attempt to reduce the resulting memory and execution time overhead, Thomas Messerges recently proposed a general method that "masks" all the intermediate data. This masking strategy is possible if all the fundamental operations used in a given algorithm can be rewritten with masked input data, giving masked output data. This is easily seen to be the case in classical algorithms such as DES or RSA. However, for algorithms that combine Boolean and arithmetic functions, such as IDEA or several of the AES candidates, two different kinds of masking have to be used. There is thus a need for a method to convert back and forth between Boolean masking and arithmetic masking. In the present paper, we show that the `BooleanToArithmetic' algorithm proposed by T. Messerges is not sufficient to prevent Differential Power Analysis. In a similar way, the 'ArithmeticToBoolean' algorithm is not secure either.