Protection against side-channel attacks of a cryptographic algorithm using a substitution table

Description

Domaine technique

[0001] The present invention relates to the field of cryptography. More particularly, the invention relates to a method for protecting a cryptographic algorithm against side-channel attacks when the algorithm uses a substitution table. The invention also relates to an electronic device implementing such a method. Etat de la technique antérieure

[0002] Today, there are many electronic devices that include a processor configured to execute a cryptographic algorithm. Such an electronic device corresponds, for example, to a smart card, a microcontroller-type integrated circuit, or an electronic device containing a cryptographic component (computer, mobile phone, payment card, electronic signature creation device, etc.).

[0003] The cryptographic algorithms considered in this application use a secret key to calculate output information from input information. This could be, for example, an encryption, decryption, authentication, signing, or signature verification procedure.

[0004] AES encryption (an acronym for "Advanced Encryption Standard") is an example of a symmetric cryptographic algorithm. It is now considered relatively secure and is used in many applications (for example, in encrypting certain communication applications or in encrypting the contents of a hard drive).

[0005] Cryptographic algorithms are constructed in such a way that it is practically impossible to discover the secret key solely from the input and output information.

[0006] The operations performed by the electronic device's processor to implement the cryptographic algorithm generate variations in certain physical quantities, such as power consumption, electromagnetic radiation, temperature, acoustic intensity, and execution time. These variations depend on the data used in the different operations. More specifically, since some operations of the algorithm involve the secret key, the observed variations may correlate with the value of the secret key. A malicious actor could then measure one or more physical quantities and subsequently exploit these measurements through statistical analysis to obtain information about the secret key used by the algorithm.

[0007] This type of attack is known as a "side-channel attack" (SCA). Several types of side-channel attacks are known, for example, DPA (differential power analysis), template attack, or CPA (correlation power analysis).

[0008] The order of a side-channel attack is generally defined by the number of variables the attacker seeks to determine from the observed measurements. For example, in a first-order attack, the attacker is only interested in the value of one variable at a given time. In a second-order attack, the attacker is interested in the values ​​of two different variables at two potentially different times. It is generally accepted that the difficulty of implementing a side-channel attack increases exponentially with the order of the attack.

[0009] It is known to protect an electronic device against side-channel attacks by masking the secret variables used by the cryptographic algorithm and by modifying the operations performed on these secret variables (or on intermediate variables calculated from the secret variables) so that the operations are performed on masked representations of these variables and no longer directly on the variables themselves. This requires modifying the algorithm's operations to adapt them to the masking technique used.

[0010] There are various masking techniques. The general principle of masking is to divide a secret variable into several parts (called "shares"). The algorithm's operations are then performed on the different parts of the secret variable, rather than directly on the secret variable itself. It is then possible, by knowing the values ​​of the parts into which the secret variable was initially divided, to determine an output value of the algorithm based on the final result of the algorithm's operations performed on those parts. The different masking techniques share this principle but use different ways of decomposing a secret variable.

[0011] It is known, for example, to use Boolean masking, multiplicative masking, or affine masking (affine masking is a combination of Boolean and multiplicative masking). However, these different masking techniques are not directly compatible with the use of a substitution table (or S-Box) associated with a non-linear function, as is the case, for example, in the AES algorithm.

[0012] The paper "Affine Masking against Higher-Order Side Channel Analysis," by G. Fumaroli et al., describes an application of affine masking to the AES S-Box. The S-Box is managed using a pre-computed S-Box' substitution table such that Sub' ( m.x + b ) = m.Sub ( x ) + b', Or Sub is the function associated with the AES S-Box, Sub' is the function associated with the S-Box substitution table, and m, b And b' are randomly determined masking variables. The S-Box table must then be recalculated each time the masking variables are changed, which can significantly impact the algorithm's performance. The operations "." and "+" here correspond to finite field multiplication and addition, respectively.

[0013] The paper "Formal Analysis of the Entropy / Security Trade-Off in First-Order Masking Countermeasures against Side-Channel Attacks," by Nassar et al., describes an application of Boolean masking to the AES S-Box. It proposes restricting the set of values ​​that can be taken by the masking variable and precomputing an S-Box substitution table for each of these values. However, this solution is not well-suited to affine masking because affine masking involves using two masking variables, resulting in a large number of possible values ​​for the pair formed by the two variables. Affine masking, on the other hand, offers better resistance to side-channel attacks.

[0014] The paper "Secure Multiplicative Masking of Power Functions" by L. Genelle et al. describes a method for evaluating the S-Box of AES in a masked manner. The S-Box is decomposed into a power function and an affine function. The authors present how to evaluate the S-Box by performing the power function with multiplicative masking and performing the rest of the AES (including the affine function) with Boolean masking. However, this method requires conversions between multiplicative and Boolean masking, which negatively impacts the algorithm's performance. Furthermore, unlike affine masking, Boolean and multiplicative masking are used separately here, not in combination.

[0015] EP2296307B1 also discloses the protection of a cryptographic data processing method such as AES against side-channel scanning attacks.

[0016] It is therefore necessary to find new solutions for protection against side-channel attacks in order to achieve a good compromise between performance and security. Exposé de l'invention

[0017] The present invention aims to remedy all or part of the drawbacks of the prior art.

[0018] To this end, and according to a first aspect, the present invention proposes a method for protecting an electronic device against a side-channel attack. The electronic device comprises a processor configured to execute a cryptographic algorithm manipulating variables belonging to a finite field E and involving at least one substitution function. Sub non-linear function applied to a secret variable s to be protected. Sub includes a power-up function k and an affine function Aff such as Sub(s) = Aff ( s k< ) = Lin ( s k< ) + c , where c is a constant and Lin is a linear function with respect to an addition operation of the finite field E. The process is implemented by the processor of the electronic device. The process includes: masking the secret variable s using a masking function M such as M ( s ) = m . s + b, each of the variables m And b being chosen randomly from the elements of E or from a subset de E, the variable m being chosen non-zero; an application to M(s), as a function of b, from a first substitution table T pow corresponding to the power-up function k and whose elements have been previously calculated for the different values ​​that can be taken by M(s) And b, the calculation of an element of T pow including a calculation of (M ( s ) - b ) k< + b', Or b' is a variable determined as a function of M(s) and / or b an application to the result r 1 obtained from the output of the first substitution table T pow , depending on m, from a second substitution table T aff corresponding to the affine function Aff and whose elements have been previously calculated for the different values ​​that can be taken by r 1 and m , the calculation of an element of T aff including a calculation of m.Aff ( m -k< . r 1).

[0019] By the expression "the first substitution table" T pow corresponds to the power-up function k "We understand that the function associated with the substitution table" T pow includes a power-up stage k (in other words, the associated function) à T pow is not necessarily limited to a power increase k ) . Similarly, by the expression "the second substitution table" T aff corresponds to the affine function Aff "We understand that the function associated with the substitution table" T aff includes a step of applying the affine function Aff (in other words, the function associated with T pow is not necessarily limited to the affine function Aff ).

[0020] It should be noted that the function Aff is not necessarily affine over the finite field E on the other hand the function Lin is linear with respect to a finite field addition operation E In particular, in the case of AES, the function Aff is affine on GF ( 2 ) And Lin is linear with respect to the "exclusive or" in E = GF (2 8< ).

[0021] Affine masking secures the use of the secret variable s. The use of the two tables T pow And T aff makes it easier to take masking into account when applying the substitution function Sub à the secret variable s Indeed, the two tables T pow And T aff are pre-calculated and used in such a way that the output is obtained T aff a result that corresponds to a masked representation (with an affine masking presenting the same multiplicative mask) m ) of the result that would have been obtained if the function had been applied Sub à the secret variable s. The use of the two tables T pow And T aff is particularly robust against side-channel attacks because only a strict subset of the shares obtained through masking is used to evaluate each table. The use of the two tables T pow And T aff It also helps to limit the impact of masking on the memory footprint.

[0022] In particular embodiments, the invention may further comprise one or more of the following features, taken individually or in all technically possible combinations.

[0023] In specific implementation methods, the process includes: an application to variables m And b' of a third substitution table T cor whose elements have been previously calculated for the different values ​​that can be taken by m and b', the calculation of an element of T cor including a calculation of m.Lin ( m -k< .b ') - b", Or b " is a variable determined according to m and / or b '; a subtraction from the result r 2 obtained from the output of the second substitution table T aff of the result r3 obtained from the output of the third substitution table T cor to obtain a result r 4 in the form r 4 = r 2 - r 3 = m.Sub ( s ) + b".

[0024] Such arrangements allow us to retrieve the Boolean mask of the masked representation obtained from the table output. T aff in a specific set. This simplifies the processing of the masked representation obtained from the output of T aff .

[0025] The invention can also be applied to a combination of affine masking with square masking, or to a combination of Boolean masking with square masking. Thus, the present invention also relates to a method for protecting an electronic device against a side-channel attack. The electronic device includes a processor configured to execute a cryptographic algorithm manipulating variables belonging to a finite binary field. E and involving at least one substitution function Sub non-linear function applied to a secret variable s to be protected. Sub includes a power-up function k and an affine function Aff such as Sub ( s ) = Aff ( s k< ) = Lin ( s k< ) + c, Or c is a constant and Lin is a linear function with respect to a binary finite field addition operationE. The process is implemented by the processor of the electronic device. The process includes: a masking of the secret variable s by a masking function M such as M(s) = m . s 2p< + b each of the variables m, b And p being chosen randomly from the elements of E or from a subset of E, each of the variables m and p being chosen to be non-zero; an application to M(s), depending on b, of a first substitution table T pow corresponding to the power-raising function k and whose elements have been previously calculated for the different values ​​that can be taken by M(s) And b, the calculation of an element of T pow including a calculation of ( M ( s ) - b ) k< + b', Or b' is a variable determined as a function of M(s) and / or b; an application to the result r 1 obtained from the output of the first substitution table T pow , depending on m And p, of a second substitution table T aff corresponding to the affine function Aff and whose elements have been previously calculated for the different values ​​that can be taken by r 1, m et p, the calculation of an element of T aff including a calculation of m . Aff m − k . r 1 2 − p 2 p .

[0026] In specific implementation methods, the process includes: an application to variables m, p and b' of a third substitution table T cor whose elements have been previously calculated for the different values ​​that can be taken by m , p And b', the calculation of an element of T cor including a calculation of m . lin m − k .2 − p . b ′ 2 − p 2 p − b " , Or b"is a variable determined according to one or more elements among m, b' And p ; a subtraction from the result r 2 obtained from the output of the second substitution table T aff of the result r 3 obtained from the output of the third substitution table T cor to obtain a result r 4 in the form r 4 = r 2 - r 3 = m.Sub ( s ) 2p< + b".

[0027] In specific implementation modes, the variable b is chosen from a subset E b strict de E, each of the values ​​that can be taken by the variable b is associated with an index, and the application of the first substitution table T pow is performed based on the index associated with the variable b.

[0028] In certain implementation modes, the variable m is chosen from a subset E m strict E, Each of the values ​​that can be taken by the variable m is associated with an index, and the application of the second substitution table T aff is performed based on the index associated with the variable m.

[0029] In specific implementation modes, the variable p is chosen from a smaller set E p of natural numbers defined such that, for every natural number k 'not belonging to E p , there is a value k belonging to E p such that, for any variable x belonging to E, x 2k'< is equal to x 2k< .

[0030] For example, if we consider the binary finite field E = GF (256) , the whole E p can correspond to the set {0, 1, 2, ..., 7}. Only values ​​belonging to E p are taken into account when constructing the substitution table T aff The whole E p could also correspond to {1, 2, 3, ..., 8}, or to {2, 3, 4, ..., 9}, etc.

[0031] The variable p can also advantageously be chosen from a strict subset of the set E p (to further limit the number of possible values ​​that can be taken by p, and thus limit the size of the table T aff ).

[0032] In specific implementation modes, each of the values ​​that can be taken by the variable p is associated with an index, and the application of the second substitution table T aff is performed based on the index associated with the variable p.

[0033] Using an index associated with the boolean mask, affine mask, or multiplicative mask (rather than directly using the mask value) helps to strengthen security against side-channel attacks and to limit the impact of masking on the memory footprint.

[0034] In specific implementation modes, the subset E m and the subset E b are different and chosen so as to obtain a constant Hamming weight for all values ​​that can be taken by a concatenation of M ( s ) with the index corresponding to m Or b.

[0035] Such arrangements help to limit transition leakage. Transition leakage is defined as leakage resulting from the use of the same material resource by two variables one after the other; the leakage then depends simultaneously on the values ​​of both variables. Transition leakage is typically modeled by a Hamming distance between the two variables.

[0036] In specific implementation modes, the cryptographic algorithm is the "Advanced Encryption Standard" algorithm, also known by the acronym AES.

[0037] According to a second aspect, the present invention relates to a computer program product for executing a cryptographic algorithm. The program comprises code instructions which, when executed by a processor of an electronic device, configure said processor to perform a process according to any one of the preceding implementation modes.

[0038] According to a third aspect, the present invention relates to an electronic device comprising a memory storing such a computer program product, and a processor configured to execute it. Brève description des dessins

[0039] Other features and advantages of the invention will become apparent upon reading a preferred embodiment of the invention, described with reference to the accompanying figures, among which: Fig.1 [ ] schematically represents an electronic device configured to execute a cryptographic algorithm. Fig 2 ] schematically illustrates the implementation of a function Sub non-linear applied to a secret variable s to be protected. Fig.3 ] schematically illustrates the masking of the secret variable s by affine masking and the application of a function Sub' to the masked variable to obtain as output a masked representation of the result of applying the function Sub à the secret variable s. [ Fig 4 [ ] schematically represents the main steps of a method according to the invention for protecting a cryptographic algorithm against side-channel attacks, in the case of affine masking. ] Fig 5 [ ] schematically represents the main steps of a method according to the invention for protecting a cryptographic algorithm against side-channel attacks. ] Fig 6 ] schematically illustrates the masking of the secret variable s by a combination of affine masking and square masking, and the application of a function Sub' to the masked variable to obtain as output a masked representation of the result of applying the function Sub à the secret variable s. [ Fig 7 ] schematically represents the main steps of a method according to the invention to protect a cryptographic algorithm against side-channel attacks, in the case of affine masking combined with square masking. Exposé détaillé de modes de réalisation particuliers

[0040] There figure 1 This schematically describes an electronic device 10 comprising a processor 11 configured to execute a cryptographic algorithm. The processor 11 is configured by code instructions 13 stored in a memory 12 of the electronic device 10. The code instructions 13 form a computer program that implements the cryptographic algorithm.

[0041] The electronic device 10 corresponds for example to a smart card, a cryptographic component (for example a microcontroller-type integrated circuit), or an electronic device containing a cryptographic component (computer, mobile phone, payment card, electronic signature creation device, etc.).

[0042] The cryptographic algorithm manipulates variables belonging to a finite field E. It can be a binary finite field, and in that case the operation of adding the binary finite field E corresponds to the "exclusive OR" (XOR) operation. However, it can also be a finite non-binary field, and in that case, the operation is the addition of the finite field. E corresponds to a modular addition.

[0043] We consider the case where the cryptographic algorithm involves at least one substitution function. Sub non-linear applied to a secret variable s that needs to be protected. figure 2 schematically illustrates the application of the function Sub non-linear with a secret variable s to be protected. We also consider the case where the function Sub includes a power-up function k and an affine function Aff such as Sub(s) = Aff ( s k< ) = Lin ( s k< ) + c, Or c is a constant and Lin is a linear function with respect to the addition operation of E.

[0044] As a non-limiting example, the cryptographic algorithm in question may correspond to all or part of a symmetric cryptographic algorithm such as AES. The function Sub This can indeed correspond to the function associated with the substitution table (S-Box) of the AES algorithm. The AES S-Box is composed of an inversion and an affine function in the binary finite field. GF (2 8< ).

[0045] There figure 5 schematically represents the main steps of a process to protect such a cryptographic algorithm against side-channel attacks.

[0046] As illustrated on the figure 5 The method 100 involves masking 101 the secret variable s by a masking function. In particular implementation modes, this may be an affine masking. The figures 3 And 4 describe the steps of process 100 in the case where we consider a fine masking.

[0047] In specific implementations, it may also involve a combination of affine masking with square masking, or a combination of Boolean masking with square masking. The case of affine masking combined with square masking will be described later with reference to figures 6 And 7 . Mise en œuvre avec un masquage affine :

[0048] THE figures 3 And 4illustrate the case where affine masking is used. As illustrated in these figures, the masking step 101 of the secret variable s involves a random draw ("rand") of a value for a variable m corresponding to a multiplicative mask, and a random draw of a value for a variable b corresponding to a Boolean mask (or an "arithmetic" mask if placed in a finite non-binary field). The masking function can then be written in the form M ( s ) = m.s + b. Each of the variables m And b is chosen randomly from the elements of E or from a subset of E. The variable m is chosen to be non-zero. M(s), m And b then correspond to the three parts (“shares”) of the masking of the secret variable s.

[0049] As illustrated on the figure 3 To account for masking 101, it would be possible to determine an S-Box' substitution table whose associated substitution function Sub' is such that Sub '( m.s + b ) = m.Sub ( s ) + b In other words, this solution would amount to determining an S-Box' substitution table such that the output of the S-Box' substitution table is a masked representation (with an affine masking exhibiting the same multiplicative mask). m ) of the result that would have been obtained applying the S-Box substitution table to the secret variable s.However, this solution would require recalculating the S-Box table each time the masking variables m and b are changed, which would significantly impact the algorithm's performance. It would also be possible to precalculate all possible values ​​for the S-Box table based on all the values ​​that can be taken by the pair of variables ( m, b ), but this would significantly impact the required memory size.

[0050] The invention advantageously relies on a decomposition of the S-Box' table into at least two substitution tables, exploiting on the one hand the properties of multiplicative masking with respect to the power-raising function k , and on the other hand the properties of Boolean masking with respect to the affine function Aff.

[0051] Thus, and as illustrated on the figures 4 And 5, process 100 includes an application 102 of a first substitution table T pow to the masked performance M(s) of the secret variable. This first substitution table T pow corresponds to the power-up stage k of the non-linear function Sub. Indeed, the substitution function associated with T pow includes a calculation of a power increase k applied to M ( s ).

[0052] Advantageously, all the elements of the table T pow are pre-calculated for the different values ​​that can be taken by M ( s ) And b.

[0053] In the example shown on the figure 4 the substitution table T pow takes as a starter M(s) and b and outputs the result r 1 = ( M ( s ) - b ) k< + b', where b' is a variable determined as a function of M(s) and / or b. The variable b' presents a distribution independent of the secret variable s. It is possible, for example, to take b ' = b. However, it is advantageous to choose a value for b' different from the value of b because this helps reduce the impact of a leak during the transition between the input and output of this table. The variable b' may possibly be chosen from a different set than the set used to choose the variable b. Preferably, the variable b' is chosen to take non-zero values ​​at least for some values ​​of M ( s ) And b.

[0054] It is important to note that the table T pow is evaluated based on M ( s ) And b but without using the variable m.

[0055] The result r 1 at the table output T pow can then be written in the form: r 1 = M s − b k + b ′ = m k . s k + b ′

[0056] As illustrated on the figures 4 And 5 , process 100 includes an application 103 of a second substitution table T aff the result r 1 obtained from the output of the first substitution table T pow . This second substitution table T aff corresponds to the affine step Aff of the non-linear function Sub. Indeed, the substitution function associated with T aff includes a calculation of the affine function Aff applied (indirectly) to r 1. For example, and as illustrated on the figure 4 the affine function Aff is applied to ( m -k< .r 1 )).

[0057] Advantageously, all the elements of the table T aff are calculated beforehand for the different values ​​that can be taken by r1 and m.

[0058] It is important to note that the table T aff is evaluated based on r 1 and m but without using the variable b.

[0059] As illustrated on the figure 4 the substitution table T aff takes as a starter r 1 and m and provides the output result r 2 = m.Aff ( m -k< .r 1). The result r 2 at the table output T aff can then be written (using the linearity of the function) Lin ) : r 2 = m . Aff m − k . r 1 = m . Lin m − k . m k . s k + b ′ + m . c = m . Lin s k + m . Lin m − k . b ′ + m . c = m . Aff s k + m . Lin m − k . b ′ = m . Sub s + m . Lin m − k . b ′ = M Sub s − b + m . Lin m − k . b ′

[0060] This gives us the output of the substitution table T aff a masked representation of Sub ( s ) with an affine masking of the same multiplicative mask m.

[0061] Optionally, and as illustrated on the figures 4 And 5 The process 100 may include two additional steps 104 and 105 to avoid the term m.Lin ( m -k< .b' ) obtained from the output of the substitution table T aff .

[0062] To this end, process 100 includes an application 104 of a third substitution table T cor to the variables m and b '. Advantageously, all the elements of the table T cor are calculated beforehand for the different values ​​that can be taken by b ' and Mr.

[0063] It is important to note that the table T cor is evaluated based on b' and m but without using M ( s ).

[0064] As illustrated on the figure 4 the substitution table T cor takes as a starter b' and m and outputs the result r 3 = m.Lin ( m -k< .b ') - b". The variable b" is a variable determined as a function of m and / or b '. The variable b"presents a distribution independent of the secret variable s. It is possible, for example, to take b " = b'. However, it is advantageous to choose a value for b' different from the value of b because this helps to reduce the impact of a leak during the transition between the table output T pow and the exit from the table T cor . The variable b" may possibly be chosen from a different set than the set used to choose the variable b Preferably, the variable b" is chosen to take non-zero values ​​at least for some values ​​of m and b'.

[0065] The process 100 then involves a subtraction 105 from the result r 2 obtained from the output of the second substitution table T aff of the result r 3 obtained from the output of the third substitution table T cor to obtain a result r4 in the form: r 4 = r 2 − r 3 = m . Sub s + b "

[0066] This results in a masked representation of Sub(s) with an affine masking of multiplicative mask m and boolean mask b "It can be noted that by choosing b" = b' = b, The output is a masked representation of Sub(s) with exactly the same masking as that applied to the secret variable s.

[0067] The subtraction step 105 could also be optional. The substitution table T cor could indeed directly provide the value of the Boolean part of the result r 2 obtained from the table output T aff . In this case, the table T cor takes as a starter b' And m and calculate m.Lin ( m -k< .b ') .

[0068] The memory impact of process 100 depends on the size of the sets from which the variables are chosen b , b' And mAs mentioned previously, these variables can each be chosen from a subset of E. Note C E the cardinal of the whole E, C b And C b' the cardinalities of the sets from which the variables are chosen b And b' respectively (sets of Boolean masks), and C m the cardinality of the set in which the variable m is chosen (set of multiplicative masks). Then, the number of elements in the table T pow is equal to C E × C b ; the number of elements in the table T aff is equal to C E × C m and the number of elements in the table T cor is equal to C b' × C m .

[0069] By comparison, if we used a single S-Box substitution table corresponding to the function Sub' described with reference to the figure 3 , then the S-Box table would need to contain a number of elements equal to C E × C b × C m .

[0070] To limit the memory impact of process 100, it is advantageous to choose restricted sets for variables b and m, such that the sum of the sizes (in number of elements) of the tables T pow , T aff And T cor remains small compared to the size of the S-Box table, that is to say, so that: C E × C b + C E × C m + C b ′ × C m ≪ C E × C b × C m

[0071] For example if C E = 256 and C b = C b' = C m = 16, so the sum of the table sizes T pow , T aff And T cor is equal to 8448 while the size of the S-Box table is equal to 65536.

[0072] However, more C b And C m The larger the memory footprint, the better the security level. Therefore, there is a trade-off between memory footprint and security.

[0073] On the other hand, the 100 process improves the level of security because each evaluation is compared with one of the substitution tables T pow , T aff And T cor is performed by manipulating a strict subset of the parts ("shares") obtained by masking, and this makes a side-channel attack more difficult.

[0074] Finally, process 100 offers good performance in terms of execution speed. Indeed, each evaluation with one of the surrogate tables T pow , T aff And T cor It is quick to perform because the tables are pre-calculated.

[0075] When a restricted set is used for the choice of the multiplicative mask m and / or the Boolean masks b And b ', it is possible to associate an index with each mask. For example if E is the set GF (256), and if C b = 16, we then have sixteen possible Boolean masks whose values ​​are between 0 and 255 inclusive. We can then associate with each possible value of the Boolean mask bA different index with a value between 0 and 15. This combination offers several advantages. Using an index instead of a mask avoids manipulating the mask value, thus reducing the impact of leakage during transitions. Furthermore, using an index instead of a mask limits the amount of memory needed to build the substitution table (without the index, the input values ​​would be between 0 and 255 instead of 0 and 15).

[0076] Substitution tables T pow , T aff And T cor Each table takes two variables as input. It is possible to implement them using two-input tables, or using tables whose single input is a combination of the two variables in question (for example, for the substitution table). T pow , we can concatenate M ( s ) with the index of the Boolean mask b ).

[0077] Advantageously, the subset E m and the subset E b can be different and chosen in such a way that the concatenation of M(s) with the index finger of the mask m Or b has a constant Hamming weight regardless of the value of s, or even such that the Hamming distance between a mask and this concatenation is also constant. Such arrangements prevent value leakage and further limit transition leakage.

[0078] It should be noted that, for the example described above with reference to the figures 3 And 4We considered the case of a finite binary field. Affine masking is then the combination of multiplicative masking with Boolean masking, and the addition operation for the finite binary field corresponds to an exclusive OR (XOR). However, nothing prevents us from considering the case of a finite non-binary field. In this case, affine masking is the combination of multiplicative masking with arithmetic masking, and the addition operation for the finite non-binary field corresponds to modular addition (and in this case, the term "Boolean" used above in the description of the figures 3 And 4(which can be replaced by the term "arithmetic"), and multiplication is the modular multiplication operation. In this case, the multiplicative masks must be chosen from the set of prime numbers with the modulo (for example, from the set of odd numbers in the case of a finite field having a cardinality that can be written in the form of a power of two). Mise en œuvre avec une combinaison d'un masquage affine et d'un masquage carré :

[0079] THE figures 6 And 7 illustrate the case where process 100 described in the figure 5 relies on a combination of affine masking with square masking (instead of simple affine masking as in the case described above with reference to figures 3 And 4 ). In the case where a square mask is used, the finished body E must be a finite binary field.

[0080] The "square" masking of a secret variable is described in patent application FR 2203809 filed on April 25, 2022. The square masking involves determining a random variable p and raising it to the power of 2. p< of the secret variable. Square masking is based on the linearity of the power-raising operation of a power of two with respect to binary finite field addition (exclusive OR): ∀ a , b ∈ GF 2 n , a + b 2 p = a 2 p + b 2 p

[0081] Square masking is particularly effective for addition, multiplication, and exponentiation operations as binary finite-field operations due to the linear behavior of these operations with respect to raising to a power of two. Furthermore, square masking is particularly robust against transition leakage.

[0082] As illustrated on the figures 6 And 7, the masking step 101 of the secret variable s then involves a random draw ("rand") of a value for a variable m corresponding to a multiplicative mask, a random draw of a value for a variable b corresponding to a boolean mask, and a random draw of a value for a variable p corresponding to square masking.

[0083] As illustrated on the figures 6 And 7 The masking function can then be written in the form M ( s ) = m . s 2p< + b each of the variables m, p And b being non-zero and chosen randomly from the elements of E or from a subset de E. It should be noted that the case where the variable p is zero corresponds to the case of affine masking described above with reference to figures 3 And 4 The case where the variable mis chosen from the set {1} corresponds to the case of a combination of a square masking with a boolean masking. M ( s ) , m, b And p then correspond to the four parts (“shares”) of the masking of the secret variable s.

[0084] As illustrated on the figure 6 To account for masking 101, it would be possible to determine an S-Box' substitution table whose associated substitution function Sub' is such that Sub' ( m.s 2p< + b ) = m.Sub ( s ) 2p< + b". In other words, this solution would amount to determining an S-Box' substitution table such that the output of the S-Box' substitution table is a masked representation (with the same multiplicative mask). mand the same square mask p) of the result that would have been obtained by applying the S-Box substitution table to the secret variable s. However, this solution would require recalculating the S-Box table each time the masking variables m, b And p are changed, which would significantly impact the performance of the algorithm. It would also be possible to precalculate all possible values ​​for the S-Box table based on all the values ​​that can be taken by the triplet of variables ( m, b, p ) , but this would significantly impact the amount of memory required.

[0085] To address these issues, the S-Box table is decomposed into at least two surrogate tables. Thus, and as illustrated on the figure 7 , process 100 includes an application 102 of a first substitution table T pow to the masked performance M(s) of the secret variable. This first substitution table T pow corresponds to the power-up stage k of the non-linear function Sub. Indeed, the substitution function associated with T pow includes a calculation of a power increase k applied to M ( s ).

[0086] Advantageously, all the elements of the table T pow are calculated beforehand for the different values ​​that can be taken by M(s) And b.

[0087] In the example shown on the figure 7 the substitution table T pow takes as a starter M(s) And b and outputs the result r 1 = ( M ( s ) - b) k< + b', where b' is a variable determined as a function of M(s) and / or b. The variable b' presents a distribution independent of the secret variable s.It is possible, for example, to take b ' = b. However, it is advantageous to choose a value for b' different from the value of b because this helps reduce the impact of a leak during the transition between the input and output of this table. The variable b' may possibly be chosen from a different set than the set used to choose the variable b. Preferably, the variable b' is chosen to take non-zero values ​​at least for some values ​​of M(s) And b.

[0088] It is important to note that the table T pow is evaluated based on M(s) And b but without using variables m And p.

[0089] The result r 1 at the table output T pow can then be written in the form: r 1 = M s − b k + b ′ = m k . s k .2 p + b ′

[0090] As illustrated on the figure 7 , process 100 includes an application 103 of a second substitution table T aff the result r 1 obtained from the output of the first substitution table T pow . This second substitution table T aff corresponds to the affine step Aff of the non-linear function Sub. Indeed, the substitution function associated with T aff includes a calculation of the affine function Aff applied (indirectly) to r 1. For example, and as illustrated on the figure 7 the affine function Aff is applied to ( m -k< .r 1) 2-p< ).

[0091] Advantageously, all the elements of the table T aff are calculated beforehand for the different values ​​that can be taken by r 1, m And p.

[0092] It is important to note that the table T aff is evaluated based on r 1, m And pbut without using the variable b.

[0093] As illustrated on the figure 7 the substitution table T aff takes as a starter r 1, m and p and provides the output result r 2 = m . Aff m − k . r 1 2 − p 2 p The result r 2 at the table output T aff can then be written (using the linearity of the function) Lin and the linearity of the raising to a power of a power of two): r 2 = m . Aff m − k . r 1 2 − p 2 p = m . Lin m − k . m k . s k .2 p + b ′ 2 − p 2 p + m . c 2 p = m . Lin s k .2 p + m − k . b ′ 2 − p 2 p + m . c 2 p = m . Lin s k + m − k .2 − p . b ′ 2 − p 2 p + m . c 2 p = m . Lin s k 2 p + m . lin m − k .2 − p . b ′ 2 − p 2 p + m . c 2 p = m . Aff s k 2 p + m . lin m − k .2 − p . b ′ 2 − p 2 p = m . Sub s 2 p + m . lin m − k .2 − p . b ′ 2 − p 2 p = M Sub s − b + m . lin m − k .2 − p . b ′ 2 − p 2 p

[0094] This gives us the output of the substitution table T aff a masked representation of Sub(s) with the same multiplicative mask m and the same square mask p .

[0095] Optionally, and as illustrated on the figure 7 The process 100 may include two additional steps 104 and 105 to avoid the term m . lin m − k .2 − p . b ′ 2 − p 2 p obtained from the output of the substitution table T aff .

[0096] To this end, process 100 includes an application 104 of a third substitution table T cor variables b ', m And p. Advantageously, all the elements of the table T cor are calculated beforehand for the different values ​​that can be taken by b, m And p.

[0097] It is important to note that the table T cor is evaluated based on b', m and p but without using M(s) .

[0098] As illustrated on the figure 7 the substitution table T cor takes as a starter b',m And p and outputs the result r 3 = m . lin m − k .2 − p . b ′ 2 − p 2 p − b " The variable b" is a variable determined according to one or more elements among m, b' And p The variable b" presents a distribution independent of the secret variable s. It is possible, for example, to take b " = b'. However, it is advantageous to choose a value for b" different from the value of b' because this helps to reduce the impact of a leak during the transition between the table output T pow and the exit from the table T cor . The variable b" may possibly be chosen from a different set than the set used to choose the variable b Preferably, the variable b" is chosen to take non-zero values ​​at least for some values ​​of m, b' et p .

[0099] The process 100 then involves a subtraction 105 from the result r 2 obtained from the output of the second substitution table T aff of the result r 3 obtained from the output of the third substitution table T cor to obtain a result r 4 in the form: r 4 = r 2 − r 3 = m . Sub s 2 p + b "

[0100] This results in a masked representation of Sub(s) with a combination of fine masking and square masking, with a multiplicative mask m, a square mask p and a Boolean mask b "It can be noted that by choosing b " = b, The output is a masked representation of Sub(s) with exactly the same masking as that applied to the secret variable s.

[0101] The subtraction step 105 could also be optional. The substitution table T cor could indeed directly provide the value of the Boolean part of the result r 2 obtained from the table output T aff In this case, the table T aff takes as a starter b ', m and p and calculate m . Lin m − k .2 − p . b ′ 2 − p 2 p .

[0102] The advantages of the 100 method mentioned previously for the case of affine masking are also valid for the case of combining affine masking with boolean masking (speed of execution because the tables are pre-calculated, limited memory impact by the use of two or three substitution tables instead of one, enhanced security by using for each substitution table only a strict subset of the parts ("shares") obtained by masking the secret variable s).

[0103] In addition, using square masking in addition to fine masking can improve the safety level of process 100, particularly to limit leaks during transition.

[0104] If we note C c the cardinality of the set in which the variable is chosen p (set of square masks). Then, the number of elements in the table T pow is equal to C E × C b ; the number of elements in the table T aff is equal to C E × C m × C c and the number of elements in the table T cor is equal to C b' × C m × C c .

[0105] By comparison, if we used a single S-Box substitution table corresponding to the function Sub' described with reference to the figure 6 , then the S-Box table would need to contain a number of elements equal to C E × C b × C m × C c .

[0106] To limit the memory impact of process 100, it is advantageous to choose restricted sets for the variables b, m And p, such that the sum of the sizes of the tables T pow , T aff And T cor remains small compared to the size of the S-Box table, that is to say, so that: C E × C b + C E × C m × C c + C b ′ × C m × C c ≪ C E × C b × C m × C c

[0107] Here again, it is possible to use an index instead of the square mask. pduring access to the substitution tables T aff And T cor (to reduce the memory size of these tables).

[0108] Substitution tables T pow , T aff And T cor Each table takes two or three variables as input. It is possible to implement them using tables with two or three inputs, or using tables whose single input is a combination of the two or three variables in question (for example, for the substitution table). T aff , we can concatenate r 1 with the index of the Boolean mask m and with the index of the square mask p ) . Exemple d'application à la S-Box de l'AES :

[0109] An implementation of the invention was evaluated in terms of performance and security by applying affine masking to a secret variable input to the AES S-Box. This places us within the binary finite field. E = GF (256) = GF (2 8< ).

[0110] In the case of AES, the function Lin is defined on GF (2) and it is linear with respect to the "exclusive or" in the finite field E.

[0111] The Boolean mask b and the multiplicative mask m Each value is chosen from a subset of sixteen possible values. The values ​​of the Boolean mask subset and the multiplicative mask subset were chosen to theoretically minimize Hamming weight and Hamming distance leakage of the variables manipulated during the calculations. In this implementation example, single-entry tables are used, with the two input variables concatenated to access the tables.

[0112] An STM32F7 microcontroller was used for this evaluation. Running a masked AES using Method 100 according to the invention for evaluating the S-Box takes 7061 clock cycles. For reference, a direct implementation of the unsecured AES standard takes 7145 clock cycles. Both implementations are compiled with compiler optimizations enabled at their highest level (-O3). An AES implementation with first-order Boolean masking using recalculated tables for the S-Box takes 10831 cycles.

[0113] The implementation according to the invention is therefore more efficient than an implementation by boolean masking, and it exhibits very good performance in terms of execution speed (approximately as fast as a basic non-secure implementation).

[0114] Compared to insecure but more optimized implementations, the implementation according to the invention has an execution time two to four times longer, but much better than the '1' order boolean masking implementation which has an execution time three to six times longer.

[0115] From a security standpoint, the implementation according to the invention shows no leakage following a non-specific t-test involving 400,000 electromagnetic measurements (measured t-value of 4.24, below the t-test detection limit of 4.5). By comparison, an unprotected implementation shows t-value peaks exceeding 300 (again compared to the limit of 4.5), and the Boolean masking implementation shows peaks exceeding 40 (primarily due to uncontrolled effects such as transition leakage, which is better handled by affine masking).

[0116] The solution proposed by the invention therefore makes it possible to obtain a very good compromise between safety and performance.

[0117] The preceding description clearly illustrates that, through its various features and their advantages, the present invention achieves the stated objectives. In particular, the invention makes it possible to optimize (in terms of computation time and memory footprint) the handling of affine masking, possibly combined with square masking, when applying a substitution function. Sub non-linear with one secret variable s.

[0118] It should be noted that the implementation and realization methods considered above have been described as non-limiting examples, and that other variants are therefore conceivable.

[0119] In particular, nothing would prevent adding identical constants (or even expressions depending on m) to the tables T cor And T aff , since the results of these two tables can be subtracted from each other. Nothing would prevent modifying the output results of the tables using injective functions. It is sufficient to modify the following table to compensate for the effect of this injective function. For example, the table T pow could calculate 3 × ( m k< .s k< + b') (instead of calculating m k< .s k< + b ') , and the table T aff It could be taken into account that its first input is multiplied by three and that it must be divided by three before use. Such modifications represent only variants of the invention.

Claims

1. Method (100) for protecting an electronic device (10) against a side-channel attack, said electronic device (10) comprising a processor (11) configured to execute a cryptographic algorithm manipulating variables belonging to a finite field E and involving at least one non-linear substitution function Sub applied to a secret variable s to be protected, said function Sub comprising an exponentiation function to a power k and an affine function Aff such as Sub(s) = Aff (sk) = Lin (sk) + c, where c is a constant and Lin is a linear function with respect to an addition operation of the finite field E, the method being implemented by the processor (11) of the electronic device (10), said method (100) comprising: - masking (101) the secret variable s by a masking function M such that M (s) = m.s + b, each of the variables m and b being selected randomly from the elements of E or from a subset of E, the variable m being selected non-zero; - applying (102) to M(s), according to b, a first substitution table Tpow corresponding to the exponentiation function to the power k and the elements of which have been calculated before for the different values that could be taken on by M(s) and b, calculating an element of Tpow comprising a calculation of (M(s ) - b)k + b', where b' is a variable determined as a function of M(s) and / or b; - applying (103) to the result r1 obtained at the output of the first substitution table Tpow, as a function of m, a second substitution table Taff corresponding to the affine function Aff and the elements of which have been calculated before for the different values that could be taken on by r1 and m, calculating an element of Taff comprising a calculation of m.Aff (m-k.r1).

2. Method (100) according to claim 1, comprising: - applying (104) to the variables m and b' a third substitution table Tcor the elements of which have been calculated before for the different values that could be taken on by m and b', the calculation of an element of Tcor comprising a calculation of m. Lin (m-k.b') - b", where b" is a variable determined as a function of m and / or b'; - subtracting (105) from the result r2 obtained at the output of the second substitution table Taff the result r3 obtained at the output of the third substitution table Tcor to obtain a result r4 in the form r4= r2 - r3 = m.Sub(s) + b".

3. Method (100) for protecting an electronic device (10) against a side-channel attack, said electronic device (10) comprising a processor (11) configured to execute a cryptographic algorithm manipulating variables belonging to a finite field E = GF(2") and involving at least one non-linear substitution function Sub applied to a secret variable s to be protected, said function Sub comprising an exponentiation function to a power k and an affine function Aff such that Sub(s) = Aff(sk) = Lin(sk) + c, where c is a constant and Lin is a linear function with respect to an addition operation of the finite field E, the method being implemented by the processor (11) of the electronic device (10), said method (100) comprising: - masking (101) the secret variable s by a masking function M such as M(s) = m.s2p + b, each of the variables m, b and p being selected randomly from the elements of E or from a subset of E, each of the variables m and p being selected non-zero; - applying (102) to M(s), according to b, a first substitution table Tpow corresponding to the exponentiation function to the power k and the elements of which have been calculated before for the different values that could be taken on by M(s) and b, calculating an element of Tpow comprising a calculation of (M(s ) - b)k + b', where b' is a variable determined as a function of M(s) and / or b; - applying (103) to the result r1 obtained at the output of the first substitution table Tpow, as a function of m and p, a second substitution table T aff corresponding to the affine function Aff and the elements of which have been calculated before for the different values that could be taken on by r1, m and p, calculating an element of Taff comprising a calculation of m . Aff m − k . r 1 2 − p 2 p .

4. Method (100) according to claim 3, comprising: - applying (104) to the variables m, p and b' a third substitution table Tcor the elements of which have been calculated before for the different values that could be taken on by m, p and b', the calculation of an element of Tcor comprising a calculation of m . lin m − k .2 − p . b ′ 2 − p 2 p − b ", where b" is a variable determined according to one or more element(s) among m, b' and p; - subtracting (105) from the result r2 obtained at the output of the second substitution table Taff the result r3 obtained at the output of the third substitution table Tcor to obtain a result r4 in the form r4 = r2 - r3 = m.Sub(s)2p + b".

5. Method (100) according to any one of claims 1 to 4, wherein the variable b is selected from a strict subset Eb of E, each of the values that could be taken on by the variable b is associated with an index, and the application (102) of the first substitution table Tpow is performed according to the index associated with the variable b.

6. Method (100) according to any one of claims 1 to 5, wherein the variable m is selected from a strict subset Em of E, each of the values that could be taken on by the variable m is associated with an index, and the application (103) of the second substitution table Taff is performed according to the index associated with the variable m.

7. Method (100) according to a combination of claims 5 and 6, wherein the subset Em and the subset Eb are different and selected so as to obtain a constant Hamming weight for all of the values that could be taken on by a concatenation of M(s) with the index corresponding to m or b.

8. Method (100) according to any one of claims 4 to 7 in combination with claim 3, wherein the variable p is selected from a smaller set Ep of natural integers, or from a strict subset of the set Ep, the set Ep being defined such that, for any natural integer k' not belonging to Ep, there is a value k belonging to Ep such that, for any variable x belonging to E, x2k' equals x2k.

9. Method (100) according to claim 8, wherein each of the values that could be taken on by the variable p is associated with an index, and the application (103) of the second substitution table Taff is performed according to the index associated with the variable p.

10. Method (100) according to any one of claims 1 to 9, wherein the cryptographic algorithm is the "Advanced Encryption Standard" algorithm, also known by the acronym AES, and where E=GF(28).

11. Computer program product for executing a cryptographic algorithm, said program comprising code instructions (13) which, when executed by a processor (11) of an electronic device (10), configure said processor (11) to execute a method (100) according to any one of claims 1 to 10.

12. Electronic device (10) comprising a processor (11) and a memory (13) storing a computer program product according to claim 11, said processor (11) being configured to execute said computer program.