Protection against side-channel attacks of a cryptographic algorithm involving a surrogate table

Abstract

The present invention relates to a method (100) for protecting an electronic device against side-channel attacks. The electronic device is configured to execute a cryptographic algorithm manipulating variables belonging to a finite field and involving at least one nonlinear function applied to a secret variable to be protected. The function comprises a power-raising function and an affine function such that . The method includes masking (101) the secret variable in the form or in the form , as well as the use (102, 103) of two substitution tables and . The elements of and are pre-calculated for the different values ​​that can be taken by the variables , and . Access to each of these two static tables is performed by a strict subset of the variables , and optionally used to form . Figure 5

Description

Title of the invention: Protection against side-channel attacks of a cryptographic algorithm involving a surrogate table technical field

[0001] The present invention relates to the field of cryptography. More particularly, the invention relates to a method for protecting a cryptographic algorithm against side-channel attacks when the algorithm uses a substitution table. The invention also relates to an electronic device implementing such a method. Prior art

[0002] Today, there are many electronic devices that include a processor configured to execute a cryptographic algorithm. Such an electronic device corresponds, for example, to a smart card, a microcontroller-type integrated circuit, or an electronic device containing a cryptographic component (computer, mobile phone, payment card, electronic signature creation device, etc.).

[0003] The cryptographic algorithms considered in this application use a secret key to calculate output information from input information. This may be, for example, an encryption, decryption, authentication, signing, or signature verification procedure.

[0004] AES encryption (an acronym for "Advanced Encryption Standard") is an example of a symmetric cryptographic algorithm. It is now considered relatively secure and is used in many applications (for example, in the encryption of certain communication applications or in the encryption of the contents of a hard drive).

[0005] Cryptographic algorithms are constructed in such a way that it is not practically possible to discover the secret key solely from the input information and the output information.

[0006] The operations performed by the processor of the electronic device to implement the cryptographic algorithm generate variations in certain physical quantities such as power consumption, electromagnetic radiation, temperature, acoustic intensity, or execution time. These variations depend on the data used in the different operations. More specifically, since some operations of the algorithm involve the secret key, the observed variations may be correlated with the value of the secret key. A malicious person can then take measurements of one or more physical quantities, and then exploit these measurements through statistical analysis in order to obtain information about the secret key used by the algorithm.

[0007] This type of attack is known as a "side-channel attack" (SCA). Several types of side-channel attacks are known, for example, DPA (differential power analysis), template attack, or CPA (correlation power analysis).

[0008] The order of a side-channel attack is generally defined as a function of the number of variables the attacker seeks to determine from the observed measurements. For example, in a first-order attack, the attacker is only interested in the value of one variable at a given time. In a second-order attack, the attacker is interested in the values ​​of two different variables at two potentially different given times. It is generally accepted that the difficulty of implementing a side-channel attack increases exponentially with the order of the attack.

[0009] It is known to protect an electronic device against side-channel attacks by masking the secret variables used by the cryptographic algorithm and by modifying the operations performed on these secret variables (or on intermediate variables calculated from the secret variables) so that the operations are performed on masked representations of these variables and no longer directly on the variables themselves. This requires modifying the algorithm's operations to adapt them to the masking technique used.

[0010] There are various masking techniques. The general principle of masking is to divide a secret variable into several parts (called "shares"). The algorithm's operations are then performed on the different parts of the secret variable, rather than directly on the secret variable itself. It is then possible, by knowing the values ​​of the parts into which the secret variable was initially divided, to determine an output value of the algorithm from the final result of the algorithm's operations performed on those parts. The different masking techniques share this principle but use different types of decomposition of a secret variable.

[0011] It is known, for example, to use Boolean masking, multiplicative masking, or affine masking (affine masking is a combination of Boolean and multiplicative masking). However, these different masking techniques are not directly compatible with the use of a substitution table (or S-Box for "Substitution Box") associated with a non-linear function. as is the case, for example, in the AES algorithm.

[0012] The paper "Affine Masking against Higher-Order Side Charnel Analysis" by G. Fumaroli et al. describes an application of affine masking to the S-Box of AES. The S-Box is managed using a precomputed S-Box' substitution table such that Sub(mjc + b) → m.Sub(x) + b', where Sub is the function associated with the AES S-Box, Sub' is the function associated with the S-Box' substitution table, and m, b, and b' are randomly determined masking variables. The S-Box' table must then be recomputed each time the masking variables are changed, which can significantly impact the algorithm's performance. The "." and "+" operations here correspond to finite field multiplication and addition, respectively.

[0013] The document "Formal Analysis of the Entropy / Security Trade-Offin First-Order Masking Countermeasures against Side-Channel Attacks," by M. Nassar et al., describes an application of Boolean masking to the AES S-Box. It proposes restricting the set of values ​​that can be taken by the masking variable and pre-computing an S-Box' substitution table for each of these values. However, this solution is not well suited to affine masking because affine masking involves using two masking variables, resulting in a large number of possible values ​​for the pair formed by the two variables. Affine masking, however, offers better resistance to side-channel attacks.

[0014] The paper "Secure Multiplicative Masking of Power Functions," by L. Genelle et al., describes a method for evaluating the S-Box of the AES in a masked manner. The S-Box is decomposed into a power function and an affine function. The authors present how to evaluate the S-Box by performing the power function with multiplicative masking, and by performing the rest of the AES (including the affine function) with Boolean masking. This method, however, requires conversions from multiplicative masking to Boolean masking and vice versa, which negatively impacts the algorithm's performance. Furthermore, unlike affine masking, Boolean and multiplicative masking are used separately here, not in combination.

[0015] It is therefore necessary to find new solutions for protection against side-channel attacks in order to obtain an interesting compromise between performance and security. Description of the invention

[0016] The present invention aims to remedy all or part of the drawbacks of the prior art.

[0017] To this end, and according to a first aspect, the present invention proposes a method for protecting an electronic device against an attack by side channel. The electronic device includes a processor configured to execute a cryptographic algorithm manipulating variables belonging to a finite field E and involving at least one nonlinear substitution function Sub applied to a secret variable ■' to be protected. The function Sub includes a power-raising function k and an affine function Af / such that Sub(s) — Af(s) = Lin(sk) + c, where c is a constant and Lin is a linear function with respect to an addition operation of the finite field E. The process is implemented by the processor of the electronic device. The process includes: - a masking of the secret variable ■' by a masking function M such that M(s) — ms + b, each of the variables m and b being chosen randomly from the elements of E or from a subset of E, the variable m being chosen non-zero; - an application to M(s), as a function of b, of a first substitution table TpOW corresponding to the power-raising function k and whose elements have been previously calculated for the different values ​​that can be taken by M(s) and b; - an application to the result ri obtained from the output of the first substitution table Tpow, as a function of m, of a second substitution table T'ff corresponding to the affine function Af f and whose elements have been previously calculated for the different values ​​that can be taken by 7 i et m.

[0018] By the expression "the first substitution table Tpow corresponds to the function raising to the power k" it is understood that the function associated with the substitution table Tpow includes a step of raising to the power k (in other words, the function associated with Tpow is not necessarily limited to raising to the power k). Similarly, by the expression "the second substitution table Ea ff corresponds to the affine function Aff" it is understood that the function associated with the substitution table Taff includes a step of applying the affine function Aff (in other words, the function associated with Tpow is not necessarily limited to the affine function Af f).

[0019] Affine masking makes it possible to secure the use of the secret variable s. The use of the two tables Tpow and Taff facilitates the consideration of masking when applying the substitution function Sub to the secret variable 5; indeed, the two tables Tpow and Taff are pre-calculated and used in such a way that the output of Taff corresponds to a masked representation (with affine masking having the same multiplicative mask m) of the result that would have been obtained if the function Sub had been applied to the secret variable \ The use of the two tables Tpow and Taff is particularly robust against the Side-channel attacks are possible because only a strict subset of the shares obtained through masking is used to evaluate each table. Furthermore, using both TpOw and Taff tables helps to limit the impact of masking on the memory footprint.

[0020] In particular embodiments, the invention may further comprise one or more of the following features, taken individually or in all technically possible combinations.

[0021] In particular embodiments, the result11 can be written in the form r _ _yŸ f' where b' is a variable determined as a function of M(s) and / or b, and the process comprises: - an application to the variables m and b' of a third substitution table Tcor whose elements have been previously calculated for the different values ​​that can be taken by m and b'; - a subtraction of the result z2 obtained from the output of the second substitution table Taff from the result r? obtained from the output of the third substitution table Tcor to obtain a result r4 in the form - r? = m.Sub( s ) + b” , where b” is a variable determined as a function of m and / or b'.

[0022] Such arrangements make it possible to reduce the Boolean mask of the masked representation obtained from the output of the ?aff table to a specific set. This simplifies the processing of the masked representation obtained from the output of Tajf.

[0023] The invention can also be applied to a combination of affine masking with square masking, or to a combination of Boolean masking with square masking. Thus, the present invention also relates to a method for protecting an electronic device against a side-channel attack. The electronic device includes a processor configured to execute a cryptographic algorithm manipulating variables belonging to a binary finite field E and involving at least one nonlinear substitution function Sub applied to a secret variable s to be protected. The function Sub includes a power-raise function k and an affine function A / / such that Sub($) = Aff(sk) = Lm(sk) + c, where c is a constant and Lin is a linear function with respect to an addition operation of the binary finite field E. The method is implemented by the processor of the electronic device. The method includes: - a masking of the secret variable 5 by a masking function M such that M(s) = + b - , each of the variables m, b and P being chosen randomly selection among the elements of E or among a subset of E, each of the variables m and P being chosen to be non-zero; - an application to M(s), as a function of b, of a first substitution table Tpaw corresponding to the power-raising function k and whose elements have been previously calculated for the different values ​​that can be taken by M(s) and b; - an application to the result11 obtained from the output of the first substitution table TPow, as a function of m and P, of a second substitution table Taff corresponding to the affine function Af / and whose elements have been previously calculated for the different values ​​that can be taken by ri, m and P.

[0024] In particular embodiments, the result ri can be written in the form ~ + where b' is a variable determined as a function of M(s) and / or b, and the process comprises: - an application to the variables m, P and b' of a third substitution table Tcor whose elements have been previously calculated for the different values ​​that can be taken by m, P and b'; - a subtraction of the result r- obtained from the output of the second sub- table

[0025] stitut Taff au resultz 3 obtained from the output of the third substitution table Tœr to obtain a result z4 in the form r r--r2 — mSub{ v)2 + b” ' °where is a variable determined as a function of one or more elements among m, b' and P. In particular modes of implementation, the variable b is chosen from a strict subset Eb of E, each of the values ​​that can be taken by the variable b is associated with an index, and the application of the first substitution table Tpow is carried out according to the index associated with the variable b.

[0026] In particular embodiments, the variable m is chosen from a strict subset Em of E. Each of the values ​​that can be taken by the variable m is associated with an index, and the application of the second substitution table ?aff is carried out according to the index associated with the variable m.

[0027] In particular embodiments, the variable P is chosen from a smallest set Ep of natural numbers defined such that, for every natural number k' not belonging to E^ there exists a value k belonging to Ep such that, for every variable x belonging to E, x2k is equal to x^.

[0028] For example, if we consider the binary finite field E = GF(256), the set Ep can correspond to the set {0, 1, 2, ..., 7}. Only the values ​​belonging to Ep are taken into account to construct the substitution table Taff. The set Ep could also correspond to {1, 2, 3, ..., 8], or to {2, 3, 4, ..., 9], etc.

[0029] The variable P can also advantageously be chosen from a strict subset of the set Ep (to further limit the number of possible values ​​that can be taken by P, and thus limit the size of the Taffy table)

[0030] In particular modes of implementation, each of the values ​​that can be taken by the variable P is associated with an index, and the application of the second substitution table Taff is carried out according to the index associated with the variable P.

[0031] Using an index associated with the boolean mask, the affine mask or the multiplicative mask (rather than directly using the value of the mask) makes it possible to strengthen security against a side-channel attack and to limit the impact of masking on the memory footprint.

[0032] In particular embodiments, the subset Em and the subset Eh are different and chosen so as to obtain a constant Hamming weight for all values ​​that can be taken by a concatenation of M(s) with the index corresponding to m or b.

[0033] Such arrangements make it possible to limit transition leakage. Transition leakage is defined as leakage resulting from the use of the same material resource by two variables one after the other; the leakage then depends simultaneously on the values ​​of the two variables. Transition leakage is typically modeled by a Hamming distance between the two variables.

[0034] In particular modes of implementation, the cryptographic algorithm is the "Advanced Encryption Standard" algorithm, also known by the acronym AES.

[0035] According to a second aspect, the present invention relates to a computer program product for executing a cryptographic algorithm. The program comprises code instructions which, when executed by a processor of an electronic device, configure said processor to execute a process according to any one of the preceding implementation modes.

[0036] According to a third aspect, the present invention relates to an electronic device comprising a memory storing such a computer program product, and a processor configured to execute it. Brief description of the drawings

[0037] Other features and advantages of the invention will become apparent upon reading a preferred embodiment of the invention, described with reference to the accompanying figures, among which:

[0038] [Fig.1]] schematically represents an electronic device configured to execute a cryptographic algorithm.

[0039] [Fig.2] schematically illustrates the implementation of a non-linear Sub function applied to a secret variable s to be protected.

[0040] [Fig.3] schematically illustrates a masking of the secret variable 5 by affine masking and the application of a Sub function to the masked variable to obtain as output a masked representation of the result of applying the Sub function to the secret variable

[0041] [Fig.4] schematically represents the main steps of a method according to the invention to protect a cryptographic algorithm against side-channel attacks, in the case of affine masking.

[0042] [Fig.5] schematically represents the main steps of a method according to the invention for protecting a cryptographic algorithm against side-channel attacks.

[0043] [Fig.6] schematically illustrates a masking of the secret variable by a combination of an affine masking and a square masking, and the application of a function Sub' to the masked variable to obtain in output a masked representation of the result of the application of the function Sub to the secret variable '.

[0044] [Fig.7] schematically represents the main steps of a method according to the invention for protecting a cryptographic algorithm against side-channel attacks, in the case of affine masking combined with square masking.

[0045] Detailed description of particular embodiments

[0046] Figure 1 schematically describes an electronic device 10 comprising a A processor 11 is configured to execute a cryptographic algorithm. The processor 11 is configured by code instructions 13 stored in a memory 12 of the electronic device 10. The code instructions 13 form a computer program (or computer program) that implements the cryptographic algorithm.

[0047] The electronic device 10 corresponds for example to a smart card, a cryptographic component (for example a microcontroller-type integrated circuit), or an electronic device comprising a cryptographic component (computer, mobile phone, payment card, electronic signature creation device, etc.).

[0048] The cryptographic algorithm manipulates variables belonging to a finite field E. This may be a binary finite field, in which case the addition operation of the binary finite field E corresponds to "exclusive OR" (XOR). However, it may also be a non-binary finite field, in which case the addition operation of the finite field E corresponds to modular addition.

[0049] We consider the case where the cryptographic algorithm involves at least one non-linear substitution function Sub applied to a secret variable ■' that must be protected. Figure 2 schematically illustrates the application of the non-linear function Sub to a secret variable to be protected. We further consider the case where the function Sub includes a power-raising function k and a function affine Aff such that Sub ( 5 ) = A ff ( sk ) = Lif^s^ + C, where c is a constant and Lin is a linear function with respect to the addition operation of E.

[0050] By way of non-limiting example, the cryptographic algorithm under consideration may correspond to all or part of a symmetric cryptographic algorithm such as AES. The Sub function may indeed correspond to the function associated with the substitution table (S-Box) of the AES algorithm. The AES S-Box is composed of an inversion and an affine function in the binary finite field

[0051] Figure 5 schematically represents the main steps of a method for protecting such a cryptographic algorithm against side-channel attacks.

[0052] As illustrated in Figure 5, the method 100 includes a masking 101 of the secret variable 5 by a masking function. In particular embodiments, this may be an affine masking. Figures 3 and 4 describe the steps of the method 100 in the case where an affine masking is considered.

[0053] In particular embodiments, this may also involve a combination of affine masking with square masking, or a combination of Boolean masking with square masking. The case of affine masking combined with square masking will be described later with reference to Figures 6 and 7. Implementation with fine masking:

[0054] Figures 3 and 4 illustrate the case where affine masking is used. As illustrated in these figures, the masking step 101 of the secret variable J involves a random draw ("rand") of a value for a variable m corresponding to a multiplicative mask, and a random draw of a value for a variable b corresponding to a Boolean mask (or an "arithmetic" mask if placed in a finite non-binary field). The masking function can then be written in the form M(s) = ms 4 - b. Each of the variables m and b is chosen randomly from the elements of E or from a subset of E. The variable m is chosen to be non-zero. M(s), m, and b then correspond to the three parts ("shares") of the masking of the secret variable s

[0055] As illustrated in Figure 3, to take into account masking 101, it would be possible to determine a substitution table S-Box' whose associated substitution function Sub is such that Sub \ms + b} = mSub(s} +b"- In other words, this solution would amount to determining a substitution table S-Box' such that the output of the substitution table S-Box' is a masked representation (with affine masking having the same multiplicative mask m) of the result that would have been obtained applying the substitution table S-Box to the secret variable. However, this solution would require recalculating the S-Box' table each time the variables of If masking is changed, m and b would significantly impact the algorithm's performance. It would also be possible to precalculate all possible values ​​for the S-Box table based on all the values ​​that can be taken by the variable pair (m, b), but this would significantly increase the required memory size.

[0056] The invention advantageously relies on a decomposition of the S-Box' table into at least two substitution tables, exploiting on the one hand the properties of multiplicative masking with respect to the power-raising function k, and on the other hand the properties of Boolean masking with respect to the affine function AJ f.

[0057] Thus, and as illustrated in Figures 4 and 5, the process 100 comprises an application 102 of a first substitution table Tpow to the masked representation M(s) of the secret variable. This first substitution table Tpow corresponds to the step of raising to the power k of the non-linear function Sub. Indeed, the substitution function associated with Tpow includes a calculation of raising to the power k applied to M(s).

[0058] Advantageously, all the elements of the Tpow table are pre-calculated for the different values ​​that can be taken by M(s) and b.

[0059] In the example illustrated in Figure 4, the substitution table Tpow takes M(s) and b as input and provides the output -b^ + b1' °where b' is a variable determined as a function of M(s) and / or b. The variable b' has a distribution independent of the secret variable. It is possible, for example, to take b = h. However, it is advantageous to choose a value for b' different from the value of b because this reduces the impact of leakage during the transition between the input and output of this table. The variable b can optionally be chosen from a different set than the set used to choose the variable b.

[0060] It is important to note that the Tpow table is evaluated as a function of M(s) and b but without using the variable m.

[0061] The result ri output from the Tpow table can then be written in the form:

[0062] r^—^M^s^-bŸ + b- mKs k + b '

[0063] As illustrated in Figures 4 and 5, the process 100 includes an application 103 of a second substitution table Taff to the result r\ obtained from the output of the first substitution table Tpow. This second substitution table Taff corresponds to the affine step Af f of the non-linear function Sub. Indeed, the substitution function associated with Taff includes a calculation of the affine function Af f applied (indirectly) to rk. For example, and as illustrated in Figure 4, the affine function Aff is applied to ( / «-VJ ).

[0064] Advantageously, all the elements of the Taff table are pre-calculated for the different values ​​that can be taken by ri andm.

[0065] It is important to note that the table T aff is evaluated as a function of 11 etm but without using the variable b.

[0066] As illustrated in Figure 4, the substitution table T«ff takes ri etm as input and provides the output result r2 = mAffim-fr^- The output result r2 of the table Taff can then be written (using the linearity of the Lin function);

[0067] r2 — mAf f (nrk.r]) = mlÀn (nAfnk.sk + b)) + nie

[0068] — m.Lin (sk} + m.Linfn-kb) + mc

[0069] — mAff ( + mLinfn-kb )

[0070] = mS ub( s) + mLiï^nrkb ) [0071 ] — M(Sub(sj) - b + mLinfn-kb )

[0072] We thus obtain at the output of the substitution table T aff a masked representation of Subfs) with an affine masking of the same multiplicative mask m.

[0073] Optionally, and as illustrated in Figures 4 and 5, the process 100 may include two additional steps 104 and 105 to eliminate the term mbinf n-kb} obtained from the output of the substitution table Ta[f.

[0074] To this end, the method 100 includes an application 104 of a third substitution table Tcor to the variables m and b'. Advantageously, all the elements of the table Tcor are pre-calculated for the different values ​​that can be taken by b' and m.

[0075] It is important to note that the Tcor table is evaluated as a function of b' etm but without using M(s).

[0076] As illustrated in Figure 4, the substitution table Tcor takes b' and m as input and provides the output — m.Lin (m~kb} -b''- The variable b" is a variable determined as a function of m and / or b'. The variable b" has a distribution independent of the secret variable. It is possible, for example, to take b" = D'. However, it is advantageous to choose a value for b' different from the value of b because this reduces the impact of leakage in the transition between the output of the TpoW table and the output of the Tcor table. The variable b can optionally be chosen from a different set than the set used to choose the variable b'.

[0077] The process 100 then involves a subtraction 105 of the result r2 obtained from the output of the second substitution table ?aff from the result O obtained from the output of the third substitution table Tcor to obtain a result r4 in the form:

[0078] r4 = r3 -r2 = m.Sub(s) +b"

[0079] This yields a masked representation of Sub(s) with an affine masking of multiplicative mask m and boolean mask b”. Note that by choosing b” — b= b^ we obtain as output a masked representation of Sub(s) with exactly the same masking as that applied to the secret variable \

[0080] The subtraction step 105 could also be optional. The substitution table T(:or) could indeed directly provide the value of the Boolean part of the result r2 obtained as output from the table Taff. In this case, the table Taff takes b' etm as input and calculates "EUn (m-Kb)"

[0081] The memory impact of method 100 depends on the size of the sets from which the variables b, b', and m are chosen. As previously stated, these variables can each be chosen from a subset of E. Let CE be the cardinality of the set E, Cb and Cb' the cardinalities of the sets from which the variables b and b' are chosen respectively (sets of Boolean masks), and Cm the cardinality of the set from which the variable m is chosen (set of multiplicative masks). Then, the number of elements in the table Tpow is equal to CE x Cb; the number of elements in the table Taff is equal to CE x Cm; and the number of elements in the table Ta)r is equal to Cb x Cm.

[0082] By comparison, if a single substitution table S-Box' corresponding to the Sub function described with reference to Figure 3 were used, then the S-Box' table would have to contain a number of elements equal to CE x Ch x Cn!.

[0083] To limit the memory impact of process 100, it is advantageous to choose restricted sets for the variables b and m, such that the sum of the sizes (in number of elements) of the TTaff and Tcor tables remains small compared to the size of the S-Box' table, i.e., so that:

[0084] Ee x C b + CE x L + E bx Cfn CE x Cb x Cfn

[0085] For example, if CE — 256 and Cb = Cb- = Cm = 16, then the sum of the sizes of the The size of the TPow, Taff and Tcor tables is equal to 8448 while the size of the S-Box table is equal to 65536.

[0086] However, the larger Cb and Cm are, the better the level of security. Therefore, there is a trade-off between memory impact and security.

[0087] On the other hand, method 100 improves the level of security because each evaluation with one of the Tpow, Taff and Tcor substitution tables is performed by manipulating a strict subset of the parts ("shares") obtained by masking, and this makes a side-channel attack more difficult.

[0088] Finally, method 100 offers good performance in terms of execution speed. Indeed, each evaluation with one of the substitution tables Tpow, Ec,ff and Tcor is quick to perform because the tables are pre-calculated.

[0089] When a restricted set is used for the selection of the multiplicative mask m and / or Given Boolean masks b and b', it is possible to associate an index with each mask. For example, if E is the set GF(256), and if Cb = 16, then there are sixteen possible Boolean masks whose values ​​range from 0 to 255 inclusive. We can then associate a different index, ranging from 0 to 15, with each possible value of the Boolean mask b. This association offers several advantages. Using an index instead of the mask avoids manipulating the mask value and thus reduces the impact of leakage during transitions. Furthermore, using an index instead of the mask limits the amount of memory needed to build the substitution table (without the index, the input values ​​would range from 0 to 255 instead of 0 to 15).

[0090] The substitution tables TpOw, Taff and Tcor each take two variables as input. It is possible to implement them using two-input tables, or using tables whose single input is a combination of the two variables concerned (for example, for the substitution table Tpow, M(s) can be concatenated with the index of the boolean mask b).

[0091] Advantageously, the subsets Em and Eh can be different and chosen such that the concatenation of M(s) with the index of the mask m or b has a constant Hamming weight regardless of the value of s, or even such that the Hamming distance between a mask and this concatenation is also constant. Such arrangements prevent leakage in values ​​and further limit leakage in transitions.

[0092] It should be noted that, for the example described above with reference to Figures 3 and 4, we have considered the case of a binary finite field. The affine masking is then the combination of a multiplicative masking with a Boolean masking, and the addition operation of the binary finite field corresponds to an exclusive OR (XOR). However, there is nothing preventing us from considering the case of a non-binary finite field. In this case, the affine masking is the combination of a multiplicative masking with an arithmetic masking, and the addition operation of the non-binary finite field corresponds to a modular addition (and in this case the term "Boolean" used above in the description of Figures 3 and 4 can be replaced by the term "arithmetic"), and the multiplication is the modular multiplication operation.In this case, the multiplicative masks must be chosen from the set of prime numbers with the modulo (for example, from the set of odd numbers in the case of a finite field having a cardinality that can be written in the form of a power of two).

[0093] Implementation with a combination of affine masking and square masking:

[0094] Figures 6 and 7 illustrate the case where the process 100 described in Figure 5 is based on a combination of an affine masking with a square masking (instead of a simple affine masking as in the case described above with reference to figures 3 and 4). In the case where a square masking is used, the finite field E must be a binary finite field.

[0095] The "square" masking of a secret variable is described in French patent application FR 2203809 filed on April 25, 2022. The square masking involves determining a random variable P and raising the secret variable to the power of 2P. The square masking is based on the linearity of the power-raising operation with respect to binary finite field addition (exclusive OR):

[0096] y (a^b^GF^1) ), (a + b)2 =aF' + b2'

[0097] Square masking is particularly efficient for addition, multiplication, and exponentiation operations as binary finite field operations due to the linear behavior of these operations with respect to raising to a power of two. Furthermore, square masking is particularly robust against transition leakage.

[0098] As illustrated in Figures 6 and 7, the masking step 101 of the secret variable s then involves a random draw (“rand”) of a value for a variable m corresponding to a multiplicative mask, a random draw of a value for a variable b corresponding to a boolean mask, and a random draw of a value for a variable P corresponding to the square masking.

[0099] As illustrated in Figures 6 and 7, the masking function can then be written in the form = m.sE +b, each of the variables m, P and b being non-zero and chosen randomly from among the elements of E or from a subset of E. It should be noted that the case where the variable P is zero corresponds to the affine masking case described above with reference to Figures 3 and 4. The case where the variable m is chosen from the set {1} corresponds to the case of a combination of square masking with Boolean masking. M(s), m, b, and P then correspond to the four shares of the masking of the secret variable.

[0100] As illustrated in Figure 6, to take into account the masking 101, it would be possible to determine a substitution table S-Box' whose associated substitution function Sub is such that S2P + b) = m Sub(s)2 + b”' In other words, this solution would amount to determining a substitution table S-Box' such that the output of the substitution table S-Box' is a masked representation (with the same multiplicative mask m and the same square mask P) of the result that would have been obtained by applying the substitution table S-Box to the secret variable. However, this solution would require recalculating the S-Box' table each time the masking variables m, b and P are changed, which would significantly impact the performance of the algorithm.It would also be possible to precalculate all possible values ​​for the S-Box table based on all the values ​​that can be taken by the triplet of variables (m, b, P\ but this would significantly impact the . memory size required.

[0101] To overcome these problems, the S-Box table is decomposed into at least two substitution tables. Thus, and as illustrated in Figure 7, the process 100 includes an application 102 of a first substitution table Tpmv to the masked representation M(s) of the secret variable. This first substitution table Tpmv corresponds to the step of raising to the power k of the nonlinear function Sub. Indeed, the substitution function associated with Tpow includes a calculation of raising to the power k applied to M(s).

[0102] Advantageously, all the elements of the Tpaw table are pre-calculated for the different values ​​that can be taken by M(s) and b.

[0103] In the example illustrated in Figure 7, the substitution table Tpow takes M(s) and b as input and provides the output -b)k + b'' °where is a variable determined as a function of M(s) and / or b. The variable b' has a distribution independent of the secret variable. It is possible, for example, to take b = b. However, it is advantageous to choose a value for b' different from the value of b because this reduces the impact of leakage during the transition between the input and output of this table. The variable b can optionally be chosen from a different set than the set used to choose the variable b.

[0104] It is important to note that the Tpow table is evaluated as a function of M(s) and b but without using the variables m and P.

[0105] The result; 1 at the output of the Tpow table can then be written in the form:

[0106] _ (Myy -b) k + b = + b'

[0107] As illustrated in Figure 7, the process 100 includes an application 103 of a second substitution table Taff to the result ri obtained from the output of the first substitution table Tpow. This second substitution table Taff corresponds to the affine step Af f of the nonlinear function Sub. Indeed, the substitution function associated with Taff includes a calculation of the affine function Aff applied (indirectly) to ri. For example, and as illustrated in Figure 7, the affine function Af f is applied to (mArj)2 )•

[0108] Advantageously, all the elements of the table T aff are pre-calculated for the different values ​​that can be taken by 11, m and P.

[0109] It is important to note that the T aff table is evaluated as a function of 71, m and P but without using the variable b.

[0110] As illustrated in Figure 7, the substitution table Taff takes ri, m, and P as input and provides the output / . 2'". The output result C of the r^mAff^mA.r^ J The table Taff can then be written (using the linearity of the Lin function and the linearity [YES]

[0112]

[0113]

[0114]

[0115]

[0116]

[0117]

[0118]

[0119]

[0120]

[0121]

[0122]

[0123] (of raising to a power of a power of two): - 2P / / . , r2 = mAff ( mLr i ) ) = mLin ( lmL(m+ b )) j + mc^ = mLin ( + m~kb ) j + m.cL = mLin ( s k + m-kLL 2 j + mc^' = mLin(s k y + m.lin(tn- k -P p .b' 2 J + m.cP = mAff(s k )~ + m.lm\ mLPJL j = mSub ( s) 2 + mJin ( mLiLb' 2 ' 2 = MI Sua s I j - b + m.lin m-kz .b 2 j The output of the substitution table ^aff is thus a masked representation of Sub(s) with the same multiplicative mask m and the same square mask P. Optionally, and as illustrated in Figure 7, process 100 can include two additional steps 104 and 105 to eliminate the term , / \ obtained from the output of the substitution table Taf+ mJin[m- k Lb 2 ) To this end, method 100 includes an application 104 of a third substitution table Tcm. to the variables b', m and P. Advantageously, all the elements of table 7 n>r are previously calculated for the different values ​​that can be taken by b', m and P. It is important to note that the Twf table is evaluated as a function of b', m and P but without using M(s). As illustrated in Figure 7, the substitution table Tcof takes b', m, and P as input and outputs the result / 2 / J. The variable b" is a r3 = mlinun-kz .b I -b The variable b" is determined based on one or more elements among m, b', and P. The variable b" has a distribution independent of the secret variable. For example, it is possible to take b = y. However, it is advantageous to choose a value for b" different from the value of b' because this reduces the impact of leakage during the transition between the output of the Tpow table and the output of the Tcor table. The variable b' can optionally be chosen from a different set than the set used to choose the variable b'. The process 100 then involves a subtraction 105 of the result obtained from the output of the second substitution table 7 aff from the result z3 obtained from the output of the third substitution table Tci}r to obtain a result r4 in the form:

[0124] r4—r3-r2 — m.Sub(s)2+b''

[0125] This yields a masked representation of Sub(s) with a combination of affine and square masking, with a multiplicative mask m, a square mask P, and a Boolean mask b”. It can be noted that by choosing b = b, the output is a masked representation of Sub(s) with exactly the same masking as that applied to the secret variable

[0126] The subtraction step 105 could also be optional. The substitution table Tcor could directly provide the value of the Boolean part of the result E obtained from the output of the table Taff. In this case, the table Taff takes as input b\ m and P and calculates / \ mLm .b I

[0127] The advantages of method 100 mentioned above for the case of affine masking are also valid for the case of combining affine masking with boolean masking (speed of execution because the tables are pre-calculated, limited memory impact by the use of two or three substitution tables instead of one, enhanced security by using for each substitution table only a strict subset of the parts (“shares”) obtained by masking the secret variable ').

[0128] In addition, using square masking in addition to fine masking can improve the safety level of process 100, in particular to limit leakage during transition.

[0129] If we denote Cc the cardinality of the set in which the variable P is chosen (set of square masks). Then, the number of elements in the Test table is equal to CE x Ch; the number of elements in the Taff table is equal to CE x Cm x Ct. and the number of elements in the Tci>r table is equal to Cb. x Cm x Cc.

[0130] By comparison, if a single substitution table S-Box' corresponding to the Sub function described with reference to Figure 6 were used, then the S-Box' table would have to contain a number of elements equal to Ce x Ch x Cm x Cc.

[0131] To limit the memory impact of process 100, it is advantageous to choose restricted sets for the variables b, m and P, such that the sum of the sizes of the tables Tpow^ Taff and Tcor remains small compared to the size of the table S-Box', that is to say so that:

[0132] CE X + EX Cm

[0133] Here again, it is possible to use an index instead of the square mask P during accesses to the substitution tables Taff and Tn)r (to reduce the memory size of these tables).

[0134] The substitution tables T pow, Taff, and Tcor each take two or three variables as input. It is possible to implement them using tables with two or three entries, or by using tables whose single entry is a combination of the two or three variables concerned (for example for the substitution table Taff, we can concatenate ri with the index of the boolean mask m and with the index of the square mask?). Example of application to the AES S-Box:

[0135] An implementation of the invention has been evaluated in terms of performance and security by applying affine masking to a secret variable input to the AES S-Box. This is done within the binary finite field GF(256). The Boolean mask b and the multiplicative mask m are each chosen from a subset of sixteen possible values. The values ​​of the subset of Boolean masks and the subset of multiplicative masks were chosen so as to theoretically minimize Hamming weight and Hamming distance leakage of the variables manipulated during the computations. In this example implementation, single-entry tables are used, with the two input variables concatenated to access the tables.

[0136] An STM32F7 microcontroller was used for this evaluation. Executing a masked AES using method 100 according to the invention for evaluating the S-Box takes 7061 clock cycles. For reference, a direct implementation of the unsecured AES standard takes 7145 clock cycles. Both implementations are compiled with compiler optimizations enabled at their highest level (-03). An AES implementation with first-order Boolean masking using recalculated tables for the S-Box takes 10831 cycles.

[0137] The implementation according to the invention is therefore more efficient than an implementation by boolean masking, and it exhibits very good performance in terms of execution speed (approximately as fast as a basic non-secure implementation).

[0138] Compared to non-secure but more optimized implementations, the implementation according to the invention has an execution time two to four times longer, but much better than the '1' order boolean masking implementation which has an execution time three to six times longer.

[0139] From a security standpoint, the implementation according to the invention shows no leakage following a non-specific t-test involving 400,000 electromagnetic measurements (measured t-value of 4.24, below the t-test detection limit of 4.5). By comparison, an unprotected implementation shows t-value peaks above 300 (again compared to the limit set at 4.5), and the Boolean masking implementation shows peaks above 40 (notably due to uncontrolled effects such as transition leakage, which is better handled by affine masking).

[0140] The solution proposed by the invention therefore makes it possible to obtain a very good compromise between safety and performance.

[0141] The above description clearly illustrates that, through its various features and their advantages, the present invention achieves the stated objectives. In particular, the invention makes it possible to optimize (in terms of computation time and memory footprint) the consideration of affine masking possibly combined with square masking when applying a nonlinear Sub substitution function to a secret variable ç.

[0142] It should be noted that the implementation and realization methods considered above have been described as non-limiting examples, and that other variants are therefore conceivable.

[0143] In particular, nothing would prevent adding identical constants (or even expressions depending on m) to the Tmr and Taff tables, since the results of these two tables can be subtracted from one another. Nor would anything prevent modifying the output results of the tables using injective functions. It suffices to modify the following table to compensate for the effect of this injective function. For example, the Tpow table could calculate 3 x (mKsk + b') (instead of calculating mkJSk + b'), and the Taff table could take into account that its first entry is multiplied by three and must be divided by three before use. Such modifications represent only variants of the invention.

Claims

Demands

1. A method (100) for protecting an electronic device (10) against a side-channel attack, said electronic device (10) comprising a processor (11) configured to execute a cryptographic algorithm manipulating variables belonging to a finite field E and involving at least one nonlinear substitution function Sub applied to a secret variable s to be protected, said function Sub comprising a power-raising function k and an affine function Aff such that Sub(s) = Aff(sk) = Lm(sk) + c, where c is a constant and Lin is a linear function with respect to an addition operation of the finite field E, the method being implemented by the processor (11) of the electronic device (10), said method (100) being characterized in that it comprises: - a masking (101) of the secret variable s by a masking function M such that M(5) — ms + b, each of the variables m and b being chosen randomly from the elements of E or from a subset of E, the variable m being chosen non-zero; - an application (102) to M(s), as a function of b, of a first substitution table Tpow corresponding to the power-raising function k and whose elements have been previously calculated for the different values ​​that can be taken by M(s) and b, the calculation of an element of Tpmv comprising a calculation of (y) -b )k + b'' °where b' is a variable determined as a function of M(s) and / or b; - an application (103) to the result ri obtained at the output of the first substitution table Tpow^ as a function of m, of a second substitution table Taff corresponding to the affine function Aff and whose elements have been previously calculated for the different values ​​that can be taken by ri etm, the calculation of an element of Eaff including a calculation of mAfftyiErf.

2. A method (100) according to claim 1 comprising: - an application (104) to the variables m and b' of a third substitution table Tcor whose elements have been pre-

3. calculated for the different values ​​that can be taken by m and b', the calculation of an element of Tcor involving a calculation of mEin{nrk.b )-b", °ù b” is a variable determined as a function of m and / or è'; - a subtraction (105) of the result r2 obtained from the output of the second substitution table ?aff from the result obtained from the output of the third substitution table Tcor to obtain a result r4 in the form = r3 - r2 = m.Sub(s) + b"- A method (100) for protecting an electronic device (10) against a side-channel attack, said electronic device (10) comprising a processor (11) configured to execute a cryptographic algorithm manipulating variables belonging to a finite binary field E and involving at least one nonlinear substitution function Sub applied to a secret variable 4 to be protected, said function Sub comprising a power-raising function k and an affine function Aff such that Sub(s) - Aff(sk) - Lin(sk) + C, where e is a constant and Lin is a linear function with respect to an addition operation of the finite binary field E, the method being implemented by the processor (11) of the electronic device (10), said method (100) being characterized in that it comprises: - a masking (101) of the secret variable 5 by a masking function M such that M(s) = + b, each of the variables m, h and P being chosen randomly from the elements of E or from a subset of E, each of the variables m and P being chosen non-zero; - an application (102) to M(s) as a function of b, from a first substitution table Tp(w) corresponding to the power-raising function k and whose elements have been previously calculated for the different values ​​that can be taken by M(s) and b, the calculation of an element of Tpow involving a calculation of (k + '), where b' is a variable determined as a function of M(s) and / or b; - an application (103) to the result ri obtained from the output of the first substitution table Ten as a function of m and P, of a second substitution table Taff corresponding to the affine function Aff whose elements have been previously calculated for the different values ​​that can be taken by 11, m and P, the calculation of an element of Taff involving a calculation of / \ 2 , mAff\(mA.riy i

4. A method (100) according to claim 3 comprising: - an application (104) to the variables m, P, and b' of a third substitution table Tcor whose elements have been previously calculated for the different values ​​that can be taken by m, P, and b', the calculation of an element of Tcor comprising a calculation of . / , np \ 27' , where b" is a variable m.lin(m-k2\b2 ) -b" determined as a function of one or more elements among m, b', and P; - a subtraction (105) of the result r2 obtained from the output of the second substitution table Taff from the result obtained from the output of the third substitution table Tmr to obtain a result E in the form = m,Sub(s)2P + b"-

5. A method (100) according to any one of claims 1 to 4 wherein the variable b is chosen from a strict subset Eb of E, each of the values ​​that can be taken by the variable b is associated with an index, and the application (102) of the first Test substitution table is performed as a function of the index associated with the variable b.

6. Method (100) according to any one of claims 1 to 5 wherein the variable m is chosen from a strict subset Em of E. Each of the values ​​that can be taken by the variable m is associated with an index, and the application (103) of the second substitution table Taff is carried out according to the index associated with the variable m.

7. Method (100) according to a combination of claims 5 and 6, wherein subset Em and subset Eb are different and chosen so as to obtain a constant Hamming weight for all values ​​that can be taken by a concatenation of M(s) with the index corresponding to m or b.

8. A method (100) according to any one of claims 4 to 7 in combination with claim 3, wherein the variable P is chosen in a smaller set Ep of natural numbers, or in a strict subset of the set Ep, the set Ep being defined such that, for every natural number k' not belonging to Ep, there exists a value k belonging to Ep such that, for every variable x belonging to E, is equal to ■

9. Method (100) according to claim 8 wherein each of the values ​​that can be taken by the variable P is associated with an index, and the application (103) of the second substitution table Taff is carried out according to the index associated with the variable P.

10. Method (100) according to any one of claims 1 to 9 wherein the cryptographic algorithm is the "Advanced En-cryption Standard" algorithm, also known by the acronym AES.

11. Product computer program for the execution of a cryptographic algorithm, said program comprising code instructions (13) which, when executed by a processor (11) of an electronic device (10), configure said processor (11) to execute a method (100) according to any one of claims 1 to 10.

12. Electronic device (10) comprising a processor (11) and a memory (13) storing a computer program product according to claim 11, said processor (11) being configured to execute said computer program.

Images