Methds for converting a Boolean share to an arithmetic share

Abstract

A method for converting a Boolean share x’ of a data value x of length k bits into arithmetic mask shares z1 and z2, where x’ has been obtained by a XOR operation with a value r, and where x may be recovered by an arithmetic operation on the arithmetic mask shares, comprises: determining initial shares a1 to a4 (line 1); determining bits of an intermediate arithmetic masked share z1i (lines 2 to 13); determining the arithmetic masked shares (lines 11 to 15). Also provided is a method for converting Boolean shares x’ of a data value x of length k bits into arithmetic mask shares z1, z2, and z3 (Figure 5). Masking provides a countermeasure against side-channel attacks. The methods are 1-PINI and 2-PINI (Probe-Isolating Non-Interference) secure respectively: they remain secure against probing of one or two share domains respectively.

Description

The present invention relates to methods performed by an information processing apparatus for converting Boolean shares of a data value into Arithmetic mask shares. An information processing apparatus and a program are also provided. Background Side-channel attacks attempt to extract secret information from a hardware system, such as a processor. During such attacks, an attacker measures or analyses physical parameters for the system, such as supplied current, execution time, electromagnetic radiation etc. to try to obtain information from the system. For example, an attacker may attempt to measure power consumption by attaching probes to the system. A countermeasure against side-channel attacks is masking. In a masking scheme a sensitive variable is split into several shares, whose recombination results in the same original (unshared) value. The shares need to be ‘correct’ for a function, / to be applied, which is true if the combination of the output shares for a function f equals the value of / applied to the combination of input shares. The shares should also be independent (uniform) such that knowledge of all the shares is required before information about the sensitive variable can be gained. The application of masking in cryptographic operations varies based on the type of operations performed. Logical operations like XOR and shifts are safeguarded using Boolean masking, while additions, subtractions, and multiplications may be implemented more efficiently using arithmetic and multiplicative masking, respectively. However, cryptographic algorithms often involve a combination of these operations, necessitating the conversion of masks between Boolean and arithmetic forms to get correct results or use of modified operations. Typical examples are symmetric primitives such as SHA-2, Blake hash function, Skein hash function, XTEA block cipher, or ChaCha20 stream cipher, which all use a modulus that has a power-of-two. Other examples are lattice-based cryptographic schemes in which polynomial multiplication and addition are preferably performed on arithmetic shares, while binomial sampling, for example, requires both arithmetic and Boolean masking. These schemes often use a modulus different than power-of-two and require additional modulo reductions. Consequently, there is a demand for efficient techniques that facilitate the conversion between arithmetic and Boolean sharing types in both fields with a modulus of two and prime fields. Summary According to a first aspect of the present invention, there is provided a method performed by an information processing apparatus for converting a Boolean share, x', of a data value, x, of length k bits, into Arithmetic mask shares, zi Z2, wherein the Boolean share, x', has been obtained by a XOR operation with a value, r, such that x' = x © r and whereby the data value x may be recovered by an arithmetic operation on the Arithmetic mask shares, zi Z2 , the method comprising: sampling a random variable, Y; determining initial shares ai, az, as, and as as: ax <- x' a2^ x' © y a3 r + y az_ y 1 / 4 ' kt / y determining bits of an intermediate arithmetic masked share z\, as follows, where negates the bit value: Z1 a3 zl © (a? A -ia2) for bit values i between 2 and k-\: z{ <- a\ © (aj-1A -ia|-1) at each value i for a variable d between 3 and i+\, and then for each value m between d- 2 and 1, determining a value t as follows: j <- i + 1 — d t *- a^A , * . j+m t <- t A a. determining the arithmetic masked shares as: z] zj © t z2 «- a2. According to a second aspect of the invention there is provided a method performed by an information processing apparatus for converting Boolean shares, which are %', n, and r2, of a data value, x, of length &bits, into Arithmetic mask shares, zi, zj, andzj, wherein the Boolean share, x', has been obtained by a XOR operation with two random values, n and n, such that x' = x © © r2 and whereby the data value x may be recovered by an arithmetic operation on the Arithmetic mask shares, zi, zz, and zs, the method comprising: sampling seven random integers si, S2, yi, y2, a, P, 8; generating first intermediate values as: a, x' a2 a a3 ?i © Yi a4^r2® Y2 a5 <- (x' © a © Yi) + Xi a6 <- (x' © a © Y2) + / 2 m1 «- s2 © r± m2 a © r2 m3 «- s2 <- rr m5 «- a © r2 © s2 generating second intermediate values as: ® ® b2 <- a2 © a3 © a4 h3 ^ ^ © a5 © a3 b4^ a6® a3 b5 «- nt m1 — m2 n2 <- m2 © m3 n3 <- m1 © m3 n4 «- m3 n5 m5 — m4 generating third intermediate values as: q «- + b2) © b3 c2 b4® 8 c3^ 6 c4 <- b5 c3 <- (b^ © 5) + c6 P o±<- n2®n3 © 6 o2^ ns® 8 °3 nl o4 n4 generating fourth intermediate values as: di <- (q© c2 © c4) + c5 d2 <- q © c3 d3 «- ((q© c2) + c3) © c2 d4 «- c4 d5 c6 Pl ox © 02 © 03 P2 <- «4 Generating arithmetic mask shares, zi, Z2, and zj, as: d2 © d3© (d4 — d^) z2 d4 — pt z3 P2- Further features and advantages of the invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, which is made with reference to the accompanying drawings. Brief Description of the Drawings Figure 1 shows a method for performing first-order secure Boolean to arithmetic mask conversion for an integer in binary form; Figure 2 shows a method for performing first-order secure Boolean to arithmetic mask conversion for an integer modulo an arbitrary number, q; Figure 3 shows functions 10-DomAnd, 10-DomAndRefresh, and 10-DomAndXorRefresh; Figure 4 shows a function 10-KSABonowBitGen that generates a borrow-bit (underflow) generated during a subtraction; Figure 5 shows a method for performing second-order secure Boolean to arithmetic mask conversion for an integer in binary form; Figures 6a and 6b shows functions 20-DomAnd, 20-DomAndRefresh, and 20-DomAndXorRefresh; Figure 7 shows a function 20-KSABorrowBitGen that generates a borrow-bit (underflow) generated during a subtraction; Figure 8 shows a method for performing second-order secure Boolean to arithmetic mask conversion for an integer modulo an arbitrary number, q; and Figure 9 is a schematic diagram showing components of an information processing apparatus. Detailed Description As discussed in the background, a countermeasure against side-channel attacks on hardware systems is masking. To mask a sensitive variable, it is split into masked shares. Once a sensitive variable has been split into masked shares, functions may be applied to each share separately and a combination of the output shares of the function is the same as the result of applying the function directly to the sensitive variable. In this way, probing attacks on the hardware can be thwarted because a probe only obtains information about processing of a masked share and an attacker does not gain information about the sensitive variable unless information about all the masked shares can be obtained, which is more difficult to achieve. However, once a sensitive variable has been split into masked shares, such as Boolean masked shares, not all functions can be applied without modification. Modified operations may be applied to the Boolean masked shares, but these operations may not be efficient to implement. Logical operations may be applied to the Boolean masked shares, but arithmetic operations such as additions may require arithmetic masking to be efficiently implemented. Accordingly, there is a desire to convert Boolean masked shares to arithmetic masked shares to allow sequences of operations to be applied without the need to combine the masked shares and re-mask the sensitive variable, which potentially exposes the sensitive variable to probing attacks. In the following description methods for converting Boolean masked shares to arithmetic masked shares are described. The first and second embodiments are methods which are 1-PINI secure and the third and fourth embodiments are methods that are 2-PINI secure, where PINI stands for Probe-Isolating Non-Interference. Intuitively (i.e. not a formal definition), 1-PINI secure indicates that the method is secure if any probe used to monitor a hardware system is not allowed to observe different share domains processed by the hardware. If the probe is positioned at the output shares, the measurement must be limited to data propagating within the same share domain as the output share on which the probe was placed. A method is 2-PINI secure if the method remains secure if two probes (two inputs) are used to monitor at most two share domains processed by the hardware system. Throughout this patent specification we denote the Boolean operations AND, OR, and XOR as A, V, and ®. We denote a shift of the binary representation of a variable x to the left with x « / where i represents the bit positions. Likewise, we denote a right shift by i positions with x » i. Addition and subtraction operations are represented as + and - signs. The operations may be performed in the field z2k (integers represented as binary strings) where k G Z>0 represents the bit length of the field. A Boolean masking scheme with security order d that splits up a sensitive variable x G z2k into d + 1 Boolean shares (n, ..., Xd+i) such that x =0¾1 xt is considered to fulfil the correctness property for Boolean operations. Further if the shares are selected randomly from a uniform distribution, the shares fulfil the uniformity property. A shared function fix, y) is considered correct if the sum of its shared component functions f equals to / (x, y), i.e., f(x,y) =0¾1 ft- Throughout the description, we use the subscript to refer to the different mask shares. A superscript is used to refer to the individual bits of the mask share. For example, x2 refers to the fourth bit of the third mask share. First embodiment (1st order B2A) A first embodiment provides a first-order (1-PINI) secure Boolean-to-Arithmetic (B2A) mask conversion algorithm. The first embodiment is applicable to integers Z expressed in binary form. Figure 1 shows a method referred to as 10-SecB2A2k. The input to the method is a pair of Boolean shares, x' and r of a sensitive variable x. The Boolean shares are related as follows: x' = x © r The sensitive value, x, may be recovered as follows: x'®r = x®r®r = x The method additionally uses a random integer (binary string of length £) y. The method generates arithmetic masks, zi and Z2, where: The arithmetic shares, z\ and zi, being calculated may be expressed as follows: = x + (x © r © Y) z2 = x © r © y The following description provides a secure and hardware efficient way of determining the arithmetic shares. The method begins in step 1 by determining initial shares a;, as, as, and a4 as follows: a2^ x' ® y a3 «- r + y al_ -y / TA 1 / W f In steps 2 to 4, bits of an intermediate arithmetic masked share z^, are determined as follows: zf «- a3 zl aj © (a? A -^) Here negates the bit value, which is to say that a 0 bit is converted to 1 and a 1 bit is converted to 0. For the other bit values i between 2 and k-\: In parallel a value t is determined in steps 5 to 10 of Figure 1, at each value i (i.e., as the bit values of z\ between 2 and k-\ are determined) for a variable d between 3 and / +1, and then for each value m between d- 2 and 1, the value t is determined as follows: j i + 1 — d t a! A -iaJ, 1 ‘r . j- a j+m t <- t A a. The arithmetic share zi is then determined by XOR with t such that: rU . / TX f-z2 *“ a2 Accordingly, arithmetic masked shares z\ and zz are generated from Boolean masked shares x' and r. The method described above may be implemented by computing initial shares «i, «2, «3, and m and storing the results in a register. The first arithmetic share, zi, may be calculated using a modifier Ripple-Carry Adder. As the first arithmetic share is computed in the same share domain (i.e. based on values ai to «4) it can be computed in a single clock cycle. The second share is also calculated in the same share domain. As discussed further below, when implemented in a circuit, the method may have a latency that is independent of the word size, k. Second embodiment (1st order B2AQ) Many cryptographic algorithms require a Boolean to Arithmetic mask conversion in a field of integers modulo an arbitrary number (i.e., not limited to 2). The arbitrary number will be q, where q <2k where k is a parameter. In such implementations, the sensitive value being masked is reduced to modulo q before it is arithmetically shared. Figure 3 shows three functions that are used in the following method. 10-DomAnd takes four shares ao, ai, bo, and bi and a random bit, r° and generates two intermediate values yo and yi. The function generates shares using an AND function. 10-DomAnd is: fotaoM = (Oo^o) yo f^a^b^r0 ) = (a0AM © r° -> y[ fz^bo.r0) = (a^bu) ®r° ^y^ / 3 (MJ = (MM ^yi yi © yi = yo yi © yi = yi 10-DomAndRefresh takes an additional bit of randomness compared to 10-DomAnd, which allows all the component functions to be refreshed (made uniform again). 10-DomAndRefresh is: fo^b^r1) = (aohbo) ©r1 y^ fi(a0>bltr° ) = (MM ©r° yi f2(MoM = uMo) ©r° -> yi ^(a^b^r1) = (a^b^ ©r1 yi yi © yi = y0 yi © yi = yi 10-DomAndXorRefresh takes shares of a third value, c, to generate shares using a function f(a, b, c) = ab®c. 10-DomAndXorRefresh is: foiao> b0, Co.r1) = (a0Ah0) © c0 © r1 -> % r° ) = (a0A&i) © r° y; = (aiAb0) © r° -> y2 f3 (a1; br, q, r1) = (c^Abi) © q © r1 y3 yi © yi = yo y'2 © yi = yi Figure 2 illustrates steps of a method, referred to herein as 10-SecB2Aq. The input to the method is a pair of Boolean shares, x' and r of a sensitive variable x. The Boolean shares are related as in the first embodiment: x' = x © r The method generates arithmetic masks, z\ and 22, where: X = Zi - z2 The method works modulus q, where q <2k and the output value x lies between [0, q-1], In step 1 of the 10-SecB2Aq method, the method of the first embodiment, 10-SecB2A2K, is applied to input shares x' and r. The arithmetic shares z\ and z^ are referred to as ti = zi and t2 = Z2. In step 2, a value u is determined: In step 3, a function 10-KSABorrowBitGen is used on the shares x' and r. 10-KSABorrowBitGen is illustrated in Figure 4. The 10-KSABorrowBitGen function securely calculates a single underflow (borrow) bit of a subtraction operation (x - q) using a Boolean masked carry chain. 1O-KSABorrowBitGen takes two input values, xo and xi. Accordingly, when referring to Figure 4, x'= xo and r = xi. In steps 1 to 5, a Refresh is performed in which even bits of the input shares xo and xi are randomized thereby generating randomised shares ao and ai. The Refresh is defined as (Xq, xi) = (Xo©r‘, x| ©r') where each r' is a single bit randomness. In step 7, a constant, y, is determined as: y ^2k -q The constant j is illustrated as u in Figure 4. The value is referred to asy herein to avoid confusion with the value u calculated in step 2 of Figure 2. In steps 8 to 10, The functions 10-DomAnd and 10-DomAndRefresh referred to above are used to generate shares of randomised shares ao and ai by applying 10-DomAnd and 10-DomAndRefresh to bits of the randomized shares ao and ai. As illustrated in Figure 3, the newly generated shares are designated yo and yi. These new shares are designated y0 ao and )0 -» The values Po, p\, gl0 and g\ are determined using the following expressions applied to each share (i e., the shares are not illustrated below for simplicity, but the same expression is used for each share): gl (yl 1 A a1 1 A a1) © (ylA a1) © (yl M ylA a1 x) pi (yi-i©a'^1) A (yz © a') The constant, y, calculated in step 7 obviously doesn’t change between shares. In steps 12 to 14 of Figure 4, the following determinations are made for j = 2 to loyy^k) - 1: k and for i between 1 and -7: m a — 1 I <- a — ft — 1 (p^p^ *- 10-DomAnd(t0,t1,pl0,p{') (,g™,g™) 10 J)omAndXorRe fresh^to,!^, glQ, g[, g™, g™) a a — 2p The method then determines borrow bits bo and bi as: k . k . --1--1 (bo,^) «- lO.DomAndXorRefres^p^^p'^^g^ ,g^ ,go~\g']~]) Returning to Figure 2 at steps 4 to 8 the method determines calculation values wj and W2 as: w±<- A (t2 © u)j © t2 w2 (K A (t2 ® u)) Here bt in the figures indicates repetition of the bit value bi to generate a Ar-bit word. Similarly, b2 in the figures indicates repetition of the bit value b2 to generate a b-bit word. The 10-SecB2Aq method determines the modulo reduced arithmetic shares zi and Z2 as: Zi «- H Z2 Wi ® w2. Implementations of the method of the second embodiment may take log2(£)+2 cycles. For example, they may take 7 clock cycles for a 32-bit implementation. This method may be applied in low-latency and / or low resource applications. The method is pipelineable and needs 48 bits of randomness each cycle. Third embodiment (2nd order B2A) The third embodiment provides a second-order (2-PINI) secure Boolean-to-Arithmetic (B2A) mask conversion algorithm. The third embodiment is applicable to integers Z expressed in binary form. Figure 5 shows a method referred to as 20-SecB2A2k. As the method is a second order method, there are three shares rather than two. Accordingly, the input to the method is three Boolean shares, x'. n and rz of a sensitive variable x. The Boolean shares are related as follows: x' = x © rr © r2 The method will generate Arithmetic mask shares, zi, Z2, andrj. The sensitive value, x, may be recovered by x = z± — z2 — z3. The method begins by sampling seven random integers si, S2, yi, y2, a, P, 8; A first cycle, in steps 2 to 12 of Figure 5, generates first intermediate values as: a± «- x' a2 a az_ -y / TA 1 / 3 '1 tP Fl a4 ® / 2 a5 ^ (%' © a © Yi) + Fi a6 <- (%' © a © y2) + y2 mz_ c / TA 1 * ' 1 yii z_ / v / TA y / 712 * My '2 m3 <- s2 <- rr m5 a © r2© s2 In a second cycle, shown in steps 14 to 23, the method generates second intermediate values as: bA «- cii © a3 © a4 b2 «— a2 © a3 © a4 b3 <- -S'] © a3 © u3 b4 *- a& © «3 b5 «" n4 <- mx — m2 n2 m2 © m3 n3 m1 © m3 n4 «- m3 n3 m3— m4 In a third cycle, shown in steps 25 to 34, the method generates third intermediate values as: ci (^+½) © b3 c2 <- b4 © S c3^ 5 c4 <- b3 C5 <- ( / )5 © 5) + c6 01 «- n2 © n3 © 6 o2^ n5® 5 o3 o4 n4 In a fourth cycle, shown in steps 36 to 42, the method generates fourth intermediate values as: di (Q © c2 © c4) + c5 d2 q © c3 d3 <- ((cx © c2) + c3) © c2 d4 * C4 c6 Pl = »1 ® »2 ® 03 P2 °4 In steps 44 to 46, the method generates arithmetic mask shares, zi Z2 Z3, as: = ^2 ® ® (^1 — ^5) z2^d4- Pi P2- Implementations of this method may complete within four clock cycles. A discussion of the performance of implementations of the method follows further below. Fourth embodiment (2nd order B2AQ) As explained in connection with the second embodiment, some cryptographic algorithms require a Boolean to Arithmetic mask conversion in a field of integers modulo an arbitrary number (i.e., not limited to 2). The arbitrary number will be q, where q <2k where k is parameter. In such implementations, the sensitive value being masked is reduced to modulo q before it is arithmetically shared. Figures 6a and 6b show three functions that are used in the following method. 20-DomAnd takes six shares ao, ai, bo, bi, co and ci and three random bits, r°, r1, and r2 and generates three intermediate values yo, yi, and y2. The function generates shares using an AND function. 20-DomAnd is: / 0(^0 A ) = (a0Ab0) yo fi^b^r0) = (aoAbJ ® r° y^ / 2(^2^1) = (a0Ab2) © r1 y2 / 3(^1, b0,r°) = (a^bo) ® r° y^ / 4(^1) = (aiAbt)^y; / sKV2) = (a^b^^r2 y^ f^a^bo.r1 ) = (a2Ab0) ®rr f7(a2,br,r2} = (a2Abi) ® r2 -> y7 = y^ yo © y{ © y2 = y0 yi © yi © ys = yi yi © yi © yi = y2 20-DomAndRefresh takes an additional 6 bits of randomness compared to 20-DomAnd, which allows all the component functions to be refreshed (made uniform again). 20-DomAndRefresh is: fQ(a0,b0,r°,rr} = (a0Ab0) ® r°®r1 y'Q fi h, r1, r2) = (a^b^ © r1 © r2 yi f2 (a0, b2, r2, r3) = (a0Ab2) © r2 © r3 yi / 3 (a^ b0, r3, r4) = (at Ab0) © r3 © r4 -> y2 br, rf r5) = (^Abi) © r4 © r5 yi / 5(a1( b2, r5, r6) = (¾Ab2) © r5 © r6 -> yf f6(a2, b0, r6, r7 ) = (a2Ab0) © r6 © r7 yi f7(a2,bi,r7, r8) = (a^AM ©r7 ©r8 y7 f8(a2, b2,rs,r°) = (a2Ab2) © rs © r° y^ yo © yi © y2 = y0 yi © yi © yi = yt yi © yi © yi = y2 Shown in Figure 6b, 20-DomAndXorRefresh takes shares of a third value, c, to generate shares using a function ffa, b, c) = ab © c. 20-DomAndXorRefresh is: f0(a0, b0, c0 r0^1 ) = (a0Ab0) ® c0 © r° © r1 yi fi («o< blt r1, r2) = (a0AbJ © r1 © r2 y{ f2(a0> b2, r2, r3) = (a0Ab2) © r2 ® r3 yi b0,r3,r4) = (a-^bo) © r3© r4 yi c1( r4, r5) = (^Abi) © q © r4 © r5 y^ / 5(a-p b2, r5, r6) = (at Ab2) © r5 ® r6 -> y$ f6 (a2, b0, r6, r7 ) = (a2Ab0) © r6 © r7 -> y^ fy^.b^r7,r8) = (a2A6i) © r7 © r8 yi f^a2,b2,c2,r8,r°} = (a2Ab2} © c2 ©r8©r° -> y^ yo © y[ © y2 = y0 ys © y[ © y^ = yi ye © y'y © ys = y2 Figure 8 illustrates steps of a method, referred to herein as 20-SecB2Aq. The input to the method is the three Boolean shares, x', n, and r - of a sensitive variable x. The Boolean shares are related as in the third embodiment: x' = x © rt © r2 The method will generate Arithmetic mask shares, zi, Z2, andzj. The sensitive value, x, may be recovered by x = zt — z2 — z3. The method works modulus q, where q <2k and the output value x lies between [0, <7-1], In step 1 of the 20-SecB2Aq method, the method of the first embodiment, 20-SecB2A2K, is applied to input shares x', n, and n. The arithmetic shares z\, zz, and zy are referred to as ti = zi, tz = z.2, and ts = zs. In step 2, a value u is determined: u t3 + q In step 3, a function 20-KSABorrowBitGen is used on the shares x', n, and n. 20-KSABorrowBitGen is illustrated in Figure 7. The 20-KSABorrowBitGen function securely calculates a single underflow (borrow) bit of a subtraction operation (x - q) using a Boolean masked carry chain. 20-KSABorrowBitGen takes three input values, xo, xi, and x2. Accordingly, when referring to Figure 7, x'= xo, ri = Xi and r2 = x2. In steps 1 to 5, a Refresh is performed in which even bits of the input shares xo, Xi, and X2 are randomized thereby generating randomised shares ao, «i, and «2. The Refresh is defined as: f I -vz* l -v* £ ''V' £ / TX -y» I / T\ -y* £ -vz* £ / TX -yr I / TX -y* £ -vz* I / TX -y< £ / TX y* I X X %2 J — xP I q \P tP tp I 2 / A2 xt / *2 ' Q) where r^, and are each a single bit randomness. In step 7, a constant, y, is determined as: y 2k - q The constant j is illustrated as u in Figure 7. The value is referred to asy herein to avoid confusion with the value u calculated in step 2 of Figure 8. In steps 8 to 10, The functions 20-DomAnd and 20-DomAndRefresh referred to above are used to generate shares of the randomized shares ao, ai, and «2 by applying 20-DomAnd and 20-DomAndRefresh to bits of the randomized shares ao, ai, and «2. As illustrated in Figures 6a and 6b, the shares are designated yo, yi, andy2. These new shares are designated y0 ao , Ti ai, 72 a2- The values Po, p[, P2, go , g[ and gl2 and determined using the following expressions applied to each share (i.e., the shares are not illustrated below for simplicity, but the same expression is used for each share): gl (yt-1 A a1-1 f\ a1^ © (yl / \a1^ ® (yt-1 Ay1 A a1-1) Pl (y1-1® a1-1) A (yl © a1) The constant, y, calculated in step 7 obviously doesn’t change between shares. In steps 12 to 14 of Figure 4, the following determinations are made for j = 2 to log2(k) - 1: a k k and for i between 1 and -7: m a — 1 I <- a — ft — 1 (W.MPo^pM (p™,p™,p™) <- 20.DomAnd(t0,t1,t2 PcmPLpD 20-DomAndXorRefresh(t0, h,t2,glQ,g\,g[,g™,g™,g^ a a — 2p The method then determining borrow bits bo, bi and 62 as: 1^--1 2 OoAA) 20.DomAndXorRefresh(po-1,p^1, p^1, gl0, g[, gl2, go-1, g'^l> g^1) Returning to Figure 8, at steps 4 to 7 the method determines calculation values wi and w? as: w* «— (b^ A (£3 © u))© t2 w2^(p2X (t3 © u)) ® a w3 <- (b^ A (t3 © u)) © a Here bt indicates a Ar-time repetition of the same bit, bi, to get a Ar-bit value. Similarly, b2 and b3 indicate a A-time repetition of the same bit, 62, and bi respectively to get a ^-bit value. The 20-SecB2Aq method determines modulo reduced arithmetic shares zi, Z2 and Z2 as: zi z2 <- t2 Z3 Wi © w2 © w3. Implementations of the fourth embodiment will take the maximum of 5 cycles and logj(A')+2 cycles to execute. Implementations of the fourth embodiment may be suited to low-latency and / or low resource applications. The method is fully pipelineable, such that it can accept new values at each cycle. Implementation and performance The above methods may be implemented in software or hardware. In hardware implementations, a processing unit includes circuitry configured to perform each of the operations described above. An example using a Kintex-7 processing unit will be discussed in greater detail below. The methods may also be implemented in field programmable gate arrays (FPGA) or application specific integrated circuits (ASIC). Implementation of the method described above by software is also possible. Figure 9 is a schematic diagram of components of an example information processing apparatus suitable for use in performing the method described above. The diagram is illustrative and different hardware configurations for information processing apparatus are possible as is well known in the art. The information processing apparatus includes an I / O interface 90, such a USB port, Thunderbolt port, etc. to which an additional device, such as a storage device, could be connected. The information processing apparatus comprises a processing unit in the form of a processor 91, such as a CPU, GPU or TPU, a storage in the form of memory 92, a network module 93, a display 94, and a user interface 95. The network module may allow the information processing apparatus to communicate over a network such as a Wi-Fi network, a mobile telecommunications network, a local area network etc. The user interface may include components such as a keyboard, mouse, camera, etc. The components of the information processing apparatus may communicate with each other over a bus 86. Further components may be provided but are not shown or described. Any of the steps of the methods described above may be performed by computer-readable instructions of one or more programs stored in a storage and executed by a processing unit on one or more information processing apparatuses. The table below shows data relating to implementations of the first embodiment. Design Arch. Latency Rand Freq TP LUT FF DSP Device 1 T1 RCA 32 4 101 101 227 223 0 Spartan- 6 1 T1 KSA 6 31 62 330 937 1,330 0 Spartan-6 2 HPC2 KSA 12 249 176 469 2,936 3,981 0 Spartan-ri 2 T1 KSA 6 31 228 1,216 873 1,416 0 Spartanri 3 T1 KSA 6 160 454 2,421 2,464 1,323 0 Artix-7 4 HPC3 KSA. 10 283 150 4,800 1,638 2,874 0 Kintex- 7 Embod 1(F) 1 32 502 16,064 188 126 0 Kintex-7 Embod 1(S) 1 32 285 9,120 76 94 1 Kintex- 7 The above table shows characteristics of implementations of the first embodiment compared to hardware implementations reported in prior works. Under the design column, 1 refers to T. Schneider, A. Moradi, and T. Giineysu. ‘Arithmetic 5 Addition over Boolean Masking—Towards First- and Second-Order Resistance in Hardware’. In ACNS 2015, volume 9092 of LNCS, pages 559-578. Springer, Heidelberg, 2015. The numeral 2 refers to Florian Bache and Tim Giineysu. ‘Boolean Masking for Arithmetic Additions at Arbitrary Order in Hardware’. Applied Sciences, 12(5), 2022. 10 The numeral 3 refers to Tim Fritzmann, Michiel Van Beirendonck, Debapriya Basu Roy, Patrick Karl, Thomas Schamberger, Ingrid Verbauwhede, and Georg Sigi. ‘Masked Accelerators and Instruction Set Extensions for Post-Quantum Cryptography’. IACR Trans. Cryptogr. Hardw. Embed. Syst, 2022(1):414-460, 2022. The numeral 4 refers to Quinten Norga, Jan-Pieter D’Anvers, Supama Kundu, and Ingrid Verbauwhede. ‘Mask Conversions for d+1 shares in Hardware, with Application to Lattice-based PQC' IACR Cryptol. ePrint Arch.., 2024. The first embodiment was implemented in two configurations using two different target configurations: a fast (F) configuration that uses no DSPs and a small (S) configuration that forces the compiler to use the available DSP48 slices. In the second column, Arch, refers to the architecture within the relevant paper. The latency in the third column is in cycles. The fourth column, Rand., indicates the number of bits of randomness required. The frequency, Freq., in the fifth column is in MHz and indicates clock speed. The sixth column shows throughput, TP, in Mbits / s. The LUT column shows the number of look-up tables, the FFs column shows the number of flip flops, and the DSPs column indicates the number of digital signal processing units. Finally, Device indicates the type of device used. The fast configuration of embodiment 1 achieves a maximum frequency of 502 MHz and a throughput of 16 Gbits / s and is therefore 3 times faster than the next fastest solution investigated. The small configuration of the first embodiment requires only 76 LUTs, 94 FFs, and 1 DSP making it 2.5 times smaller than the smallest solution investigated. The following table shows data relating to implementations of the third embodiment. The columns have the same meanings as before. Design Arch. Latenc y Rand Freq TP LUT FF DSP Device 1 T1 RCA 65 8 107 52 388 387 0 Spartan -6 1 T1 KSA 12 128 63 168 4,223 5,509 0 Spartan -6 2 KSA 12 747 148 395 3,915 8,001 0 Spartan -6 4 HPC3 KSA 19 1,080 125 4,000 7,946 18,03 2 0 Kintex- 7 Embo d3(F) Pipe 4 224 515 16,48 0 912 992 0 Kintex- 7 Embo d3 (S) Pipe 4 224 392 12,54 4 555 704 10 Kintex- 7 Embo d3(F) Iter 4 128 434 3,472 968 333 0 Kintex- 7 Embo d3 (S) Iter 4 128 322 2,576 900 330 2 Kintex- 7 Compared to related implementations, implementations of the third embodiment have a fixed latency of 4 for any value of k. The third embodiment was implemented in four implementations. There were pipelined (Pipe) and iterative (Iter) 5 versions. The pipelined version can accept new inputs each clock cycle. The iterative version can accept new inputs every 4 clock cycles and re-uses the registers and adders to lower the resource requirements. In the iterative version, 10 registers are needed in total which get re-used and may be overwritten in each cycle. As can be seen from the table, the third embodiment shows a generally high 10 throughput and 1 ow 1 atency. The following table shows performance of implementations of the second and fourth embodiments: Design k Latency Rand Freq TP LUT FF DSP Embod 2 4 4 6 606 2,424 62 (47) 58 2 Embod 2 8 5 12 588 4,704 132 (106) 126 2 2 Embod 2 16 6 24 555 8,880 298 (236) 262 2 Embod 2 32 7 48 454 14,528 653 (458) 536 2 Embod 4 4 5 28 444 1,776 163 (133) 174 11 Embod 4 8 5 56 444 3,552 356 (284) 366 11 Embod 4 16 6 112 392 6,144 726 (590) 750 11 Embod 4 32 7 224 370 11,840 1,432 (1,198) 1,518 11 The number shown in brackets in connection with the number of LUTs is the LUT requirement when the device is clocked at 200 MHz. The table above relates to pipelined implementations of each of the second and fourth embodiments. The comparison above does not include a comparison with related prior art implementations because suitable hardware performance data was unable to be obtained. The embodiments described above may be used during implementations of the following cryptographic methods: generating a hash; generating a stream cipher; performing a masked application look up; performing a cryptographic function; generating a signature; generating a ciphertext; and generating a block cipher. In each case, during performance of the method, Boolean operations are performed on masked shares and the masked shares may be converted to arithmetic shares in order to allow the cryptographic method to be completed. One of the abovedescribed methods is used to convert the Boolean masked share to an arithmetic masked share. Accordingly, the above-described embodiments may be implemented in a hash method, a method of generating stream cipher, a masked application look-up, a method of performing a cryptographic function, a signature method, a method of generating a ciphertext and a method of generating a block cipher. Particular examples, given by way of example only, are SHA-2, Blake hash function, Skein hash function, XTEA block cipher, or ChaCha20 stream cipher. The methods may be used in lattice-based cryptographic schemes. Apparatus to implement these methods and computer programs to perform these methods are also contemplated. 5 It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. Furthermore, equivalents and modifications not described above may also be employed without 10 departing from the scope of the invention, which is defined in the accompanying claims.

Claims

1. A method performed by an information processing apparatus for converting a Boolean share, x', of a data value, x, of length k bits, into Arithmetic mask shares, zi and Z2, wherein the Boolean share, x', has been obtained by a XOR operation with a value, r, such that x' = x ®r and whereby the data value x may be recovered by an arithmetic operation on the Arithmetic mask shares, zi and Z2 , the method comprising: sampling a random variable, Y;determining initial shares ai, az, as, and a4 as:a^ <- x'a2 x' ® ya3 r + ya^r © ydetermining bits of an intermediate arithmetic masked share z\, as follows, where negates the bit value:zf <- a3Zi <- © (a° A -ia°)for bit values i between 2 and k-1:zi 0 ^at1)at each value i for a variable d between 3 and / +1, and then for each value m between d- 2 and 1, determining a value t as follows:j <- i + 1 — dt al -ial1 4-. * . j+mt t A aJ4determining the arithmetic masked shares as:z{ z[@ tz2 a22. A method according to claim 1, wherein the data value x may be recovered by taking a difference between zi and zz.

3. A method according to any preceding claim wherein the data value, x, is to be reduced to modulo q, the method further comprising, in a case that ti = zi and / 2 = Z2.determining:u = t2 + qfor %'= xo and r = xi performinga Refresh in which even bits of the input shares xo and Xi are randomized thereby generating randomized shares ao and ai;determining a constant y:y 2k — qapplying functions:gl (y1-1 A a1-1 A a1) © (ylA al)©( y1-1 / \yl A a'-1)Pl (y1-1 ©a1-1) A (yl © a1)masked by applying 10-DomAnd and 10-DomAndRefresh to bits of randomized shares ao and m such that:(po, Pi) 10-DomAnd(alo © yl, a{, a^1 ® y1-1, al-1) 10-DomAndRefresh(alQ) a\, a^1, at^y^y1-1) subsequently:for J = 2 to log2(k) - 1:a «- k / 3 2^1kand for i between 1 and -7:m <- a — 1I a — p — 1(Wi) (p™ pF)(PcFpF) 10.DomAnd(t0, t^p^pl)GjF’PF) 10-DomAndXorRefresh(tQ, tn^FPi’PoFpF)a <- a —determining borrow bits bo and bi as:k k_1(bQ.bP) IQ-DomAndXorRefresh^pQ^.p^.g^ ,g^ >go^1,gi^1)determining calculation values wj and W2 as:Wi <- A (t2 © u)^ © t2W2 A (t2 ® u))determining modulo reduced arithmetic shares zi and Z2 as:ZiZ2 Wi © w2.

4. A method according to claim 3, wherein the Refresh is performed as: (Xq, x|) = (Xq © rl, © rl) where each r' is a single bit randomness.

5. A method according to claim 3 or claim 4, wherein where 10-DomAnd is: fo(ao,bo) = (aoAbo) -> y^ ;ACflo^i^0) = (doAbi) ©r° yl ; / 2(^, b0,r°) = (ajAbo) Sr° / 3(^^) = (^AbO^y^;yo©Ji = Yo; andy^y3 = yi-6. A method according to any of claims 3 to 5, wherein 10-DomAndRefresh is: fo(ao, b0, r1) = (a0Ab0) © r1 y^ ; / 1(^ bv r° ) = (a0Abi) © r° ; / 2(^,60^0) = (^Abo) © r° y2 ;^(a^b^r1) = (UiAbJ ©r1 y2 ■yo © yl = y0; andy2 ©ys =yi-7. A method according to any of claims 3 to 6, wherein 10-DomAndXorRefreshis:fo(ao> b0, c0, r1) = (a0Ab0) © c0 © r1 y^ ;fi(aQ, bi,r0 ) = (a0AM © r° y{ ; / 2(^1^0^°) = (¾Ab0) © r° y' :f^a^.b^c^r1^ = (ciiAbi) © q © r1 y2 ;yo © Ji = yo; andy2 ©ys = yi-8. A method performed by an information processing apparatus for converting Boolean shares, which are x', n, and ri, of a data value, x, of length k bits, into Arithmetic mask shares, zi, zi, andzj, wherein the Boolean share, %', has been obtained by a XOR operation with two random values, ri and ri, such that x' = x © © r2 andwhereby the data value x may be recovered by an arithmetic operation on the Arithmetic mask shares, zi, zz, and zs, the method comprising:sampling seven random integers si, S2, yi, y2, a, P, 8;generating first intermediate values as:a± <- x'az_ y 1 / 3 '1 CP 71a4 ^2 ® / 2a5 (x' © a © Yi) + 7i a6 <- (%' © a © 72) + 72 m1 <- s2 ©2 * My '2m3 s2<- rrms a © r2®s2generating second intermediate values as:b2 <— (^2 © ^3 ©63 ^ ^ © a5 © a3i4 *- a6 © a3b5 SiH i m , — m2n2 m2 © m3n3 <- mi © m3n4 <- m3n5 «- m5 — m4generating third intermediate values as:( / ¾ + b2) © b3c2 b^® 8c3^ 5b3c- «— ( / ¾ © 5) + / 3c6^ (3Oi n2 © n3 © 8o2^ ns® 8o3 ^«1o4generating fourth intermediate values as:di «- (Ci © c2 © c4) + c5d2 <- q © c3d3 «- ((q© c2) + c3) © c2d4 <c4d5 c6Pi Oi © o2 © o3Pz «4generating arithmetic mask shares, zi z2 z2, as:^1 <- d2 © d3 © (dt - d5)z2 d4 - piz3 P2-9. A method according to claim 8, wherein the data value x can be recovered by subtracting the arithmetic mask shares z2 and z2 from z2.

10. A method according to claim 8 or claim 9 wherein the data value, x, is to be reduced to modulo q, the method further comprising, in a case that ti = zi, t2 = z2, and t3=Z3'.determining:u t3 + qfor x'= xo, h = xi, r2 = X2 performinga Refresh in which even bits of the input shares xo, xi and X2 are randomized thereby generating randomized shares ao, ai, and «2;determining a constant y:y 2k — qapplying functions:gl (y1-1A A al) © (yl A a1) © (yt-1 / \yl / \ a1-1)Pl (yt-1 © ai-1) A (yl © a1)masked by applying functions 20-DomAnd and 20-DomAndRefresh to bits of randomized shares ao, ai, and «2 such that:(Po’PLPz) 20-DomAnd(alo © yl, a{, al2, a^Qy1-1, a1^1, a^1) 20-DomAndRefresh(al0,al1, al2, a^1, a^1, a1^1, yl, y1-1) subsequently:for / = 2 to log2(k) - 1:a kP 2^1fcand for i between 1 and -7:m a — 1I ct — p — 1(p™, Pi1’ P21) 20.DomAnd(t0, t1( t2i pl0, p{, p1^PD 20.DomAndXorRefresh(t0, t1( t2> do. >9^>9?)a a — 2pdetermining borrow bits bo, bi and b2 as:(ho, h2)20.DomAndXorRefresh^po-1,p^-1, p2-1, 9o> 9i> 5o-1> 9i -1> -1)sampling a random value a;determining calculation values wi, and as:w± A (t3 © u))©t3w2 (¾ A (t3 ® u)) ® aw3 (b3 A (t3 ® u)) © adetermining modulo reduced arithmetic shares zi, z; and Z3 as:% hZ2 ^2Z3 IV, © W2 © W3.

11. A method according to claim 10, wherein the Refresh is performed as: (x^x'^x1^) = ^©^©Fpxj ®r[®r2,xl2 ®r2®r^) where r^, r], and are each a single bit randomness.

12. A method according to claim 10 or claim 11, wherein where 20-DomAnd is: fo(ao>bo) = (aohbo) ;fdao-bt.r0^ = (aoAbJ ©r° -> y{ ; / 2(¾^1) = (a0Ah2) ©r1 -> y2 ;f3(altb0,r°) = (a^bo) © r° y3 ;4(^,^)= (aiAbi)^y4; / 5(0^ b2,r2) = (a1Ab2)©r2 y3 ■f6(a2, b0, r1) = (a2Ab0) © r1 ; / 7(a2, blt r2) = (a2Abi) © r2 y7 ; / 8(a2, b2) = (a2Ab2) -* y8 ;yo © y[ © y2 = y0;y3 © y4 © ys = yx, and ye©y;©ys =y2.

13. A method according to any of claims 10 to 12, wherein 20-DomAndRefresh is:fo(ao> b0, r°, r1 ) = (o0Ab0) © r° © r1 -+ y^ ;fi(a0, r1, r2) = © r1 © r2 -+ y{ ;f2(aQ,b2,r2,r3} = (a0Ab2) © r2 © r3 y'2 ;f3 (alt b0,r3, r4) = (¾ Ab0) © r3 © r4 -+ y3 ;4(fli, bi, r4, r5) = (aiAbi) © r4 © r5 y^ ;f5(altb2,r5,r6) = © r5© r6 -+ y$ ;4(a2» b0, r6, r7 ) = (o2Ab0) © r6 © r7 y^ ;bv r7, r8) = (a2Abt) © r7 © r8 ^ y4b2, r8, r°) = (a2Ab2) © r8 © r° y^ ;yo © yi © y2 = y0;y3 © y4 © ys = yi; andy6©y7®ys = y2-14. A method according to any of claims 10 to 13, wherein 20-DomAndXorRefresh is:4(¾ b0, c0 r°, r1 ) = (a0Ab0) © c0 © r° © r1 y^ ;A (a0, b±, r1, r2) = (aoAbj) © r1 © r2 y{ ;4(ao,b2,r2,r3) = (o0Ab2) ® r2 © r3 y'2 ;4 (at, bQ, r3, r4) = (atAb0) ® © r4 -+ y3 ;blr clr r4, r5) = (¢^4^) © q © r4 © r5 -+ y^ \f5(aj, b2, r5, r6) = (¾Ab2) © r5 © r6 -+ y3 ;4(a2, b0, r6, r7 ) = (a2Ab0) © r6 © r7 y^ ;4(a2,4, r7, r8) = (a2A4) © r7 © r8 yy ;4(a2, b2, c2, r8, r°) = (a2Ab2) © c2 © r8 © r° y^ ;yo © y[ © y'2 = y0;ys © y4 © ys = yi; andye©y;©ys =y2.

15. A method of at least one of:generating a hash;generating a stream cipher;performing a masked application look up;performing a cryptographic function;generating a signature;generating a ciphertext; andgenerating a block cipher;comprising the method of any of claims 1 to 11.

16. An information processing apparatus comprising a processing unit and a storage, wherein the storage stores instructions that are configured to cause the information processing apparatus to perform a method according to any of claims 1 to 15.

17. A program that, when executed on an information processing apparatus, causes the information processing apparatus to perform a method according to any of claims 1 to 15.

18. A non-transitory computer-readable storage medium storing instructions that,when executed by an information processing apparatus, cause the information processing apparatus to perform a method according to any of claims 1 to 15.

Images