Methods for converting a boolean share to an arithmetic share

Abstract

The present invention relates to a method performed by an information processing apparatus for converting a Boolean share of a data value into Arithmetic mask shares. An information processing apparatus and a program are also provided.

Description

[0001]METHODS FOR CONVERTING A BOOLEAN SHARE TO AN ARITHMETIC SHARE Technical Field The present invention relates to methods performed by an information processing apparatus for converting Boolean shares of a data value into Arithmetic mask shares. An information processing apparatus and a program are also provided. Background Side-channel attacks attempt to extract secret information from a hardware system, such as a processor. During such attacks, an attacker measures or analyses physical parameters for the system, such as supplied current, execution time, electromagnetic radiation etc. to try to obtain information from the system. For example, an attacker may attempt to measure power consumption by attaching probes to the system. A countermeasure against side-channel attacks is masking. In a masking scheme a sensitive variable is split into several shares, whose recombination results in the same original (unshared) value. The shares need to be ‘correct’ for a function, f, to be applied, which is true if the combination of the output shares for a function f equals the value of f applied to the combination of input shares. The shares should also be independent (uniform) such that knowledge of all the shares is required before information about the sensitive variable can be gained. The application of masking in cryptographic operations varies based on the type of operations performed. Logical operations like XOR and shifts are safeguarded using Boolean masking, while additions, subtractions, and multiplications may be implemented more efficiently using arithmetic and multiplicative masking, respectively. However, cryptographic algorithms often involve a combination of these operations, necessitating the conversion of masks between Boolean and arithmetic forms to get correct results or use of modified operations. Typical examples are symmetric primitives such as SHA-2, Blake hash function, Skein hash function, XTEA block cipher, or ChaCha20 stream cipher, which all use a modulus that has a power-of- two. Other examples are lattice-based cryptographic schemes in which polynomial multiplication and addition are preferably performed on arithmetic shares, while binomial sampling, for example, requires both arithmetic and Boolean masking. These schemes often use a modulus different than power-of-two and require additional modulo reductions. Consequently, there is a demand for efficient techniques that facilitate the conversion between arithmetic and Boolean sharing types in both fields with a modulus of two and prime fields. Summary According to a first aspect of the present invention, there is provided a method performed by an information processing apparatus for converting a Boolean share, ^^^^′, of a data value, x, of length k bits, into Arithmetic mask shares, z1 z2, wherein the Boolean share, ^^^^′, has been obtained by a XOR operation with a value, r, such that ^^^^′= ^^^^ ^ ^^^^ and whereby the data value x may be recovered by an arithmetic operation on the Arithmetic mask shares, z1z2, the method comprising: sampling a random variable, γ; determining initial shares a1, a2, a3, and a4 as: ^^^^ ← ^^ ′1 ^^^^^^ ← ^ ′2 ^^^ ⊕ ^^^^^^^^3 ← ^^^^ + ^^^^^^^^4 ← ^^^^ ⊕ ^^^^determining bits of an intermediate arithmetic masked share ^^^^1^^^^, as follows, where negates the bit value: ^^^^0 01 ← ^^^^3^^^^1 11 ← ^^^^3 ⊕ (^^^^0 01 ∧ ¬^^^^4)for bit values i between 2 and k-1: at each value i for a variable d between 3 and i+1, and then for each value m between d – 2 and 1, determining a value t as follows: ^^^^ ← ^^^^ + 1 − ^^^^^^^^ ← ^^^^ ^^^^^^^^1∧ ¬^^^^4^^^^ ← ^^^^ ∧ ^^^^^^^^+^^^^4 determining the arithmetic masked shares as: ^^^^^^^^1 ← ^^^^^^^^1 ⊕ ^^^^^^^^2 ← ^^^^2.According to a second aspect of the invention there is provided a method performed by an information processing apparatus for converting Boolean shares, which are r1, and r2, of a data value, x, of length k bits, into Arithmetic mask shares, z1, z2, and z3, wherein the Boolean share, has been obtained by a XOR operation withtwo random values, r1 and r2, such that ^^^^′ = ^^^^ ^ ^^^1^ ⊕ ^^^2^ and whereby the data value xmay be recovered by an arithmetic operation on the Arithmetic mask shares, z1, z2, and z3, the method comprising: sampling seven random integers s1, s2, γ1, γ2, α, β, δ; generating first intermediate values as: ^^^^ ′1 ← ^^^^^^^^2 ← ^^^^^^^^3 ← ^^^1^ ⊕ ^^^^1^^^^4 ← ^^^2^ ⊕ ^^^^2^^^^5 ← (^^^^′ ^ ^^^^ ⊕ ^^^^1) + ^^^^1^^^^6 ← (^^^^′ ^ ^^^^ ⊕ ^^^^2) + ^^^^2 ^^^^2 ← ^^^^ ⊕ ^^^2^^^^^3 ← ^^^^2^^^^4 ← ^^^1^^^^^5 ← ^^^^ ⊕ ^^^2^ ^ ^^^^2generating second intermediate values as: ^^^^1 ← ^^^^1 ⊕ ^^^^3 ^ ^^^^4^^^^2 ← ^^^^2 ⊕ ^^^^3 ^ ^^^^4^^^^3 ← ^^^^1 ⊕ ^^^^5 ^ ^^^^3^^^^4 ← ^^^^6 ⊕ ^^^^3 ^^^^1 ← ^^^^1 − ^^^^2^^^^2 ← ^^^^2 ^ ^^^^3^^^^3 ← ^^^^1 ^ ^^^^3^^^^4 ← ^^^^3^^^^5 ← ^^^^5 − ^^^^4generating third intermediate values as: ^^^^2 ← ^^^^4 ^ ^^^^^^^^3 ← ^^^^^^^^4 ← ^^^^5^^^^5 ← (^^^^5 ⊕ ^^^^) + ^^^^^^^^6 ← ^^^^^^^^1 ← ^^^^2 ^ ^^^^3 ⊕ ^^^^^^^^2 ← ^^^^5 ⊕ ^^^^ ^^^^4 ← ^^^^4generating fourth intermediate values as: ^^^^1 ← (^^^^1^ ^^^^2 ⊕ ^^^^4) + ^^^^5^^^^2 ← ^^^^1 ^ ^^^^3^^^^3 ← ((^^^^1^ ^^^^2) + ^^^^3) ^ ^^^^2^^^^4 ← ^^^^4^^^^5 ← ^^^^6^^^^1 ← ^^^^1 ⊕ ^^^^2 ^ ^^^^3^^^^2 ← ^^^^4Generating arithmetic mask shares, z1, z2, and z3, as: ^^^^1 ← ^^^^2 ⊕ ^^^^3^ (^^^^1 − ^^^^5)^^^^2 ← ^^^^4 − ^^^^1 Further features and advantages of the invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, which is made with reference to the accompanying drawings. Brief Description of the Drawings Figure 1 shows a method for performing first-order secure Boolean to arithmetic mask conversion for an integer in binary form; Figure 2 shows a method for performing first-order secure Boolean to arithmetic mask conversion for an integer modulo an arbitrary number, q; Figure 3 shows functions 10-DomAnd, 10-DomAndRefresh, and 10- DomAndXorRefresh; Figure 4 shows a function 10-KSABorrowBitGen that generates a borrow-bit (underflow) generated during a subtraction; Figure 5 shows a method for performing second-order secure Boolean to arithmetic mask conversion for an integer in binary form; Figures 6a and 6b shows functions 20-DomAnd, 20-DomAndRefresh, and 20- DomAndXorRefresh; Figure 7 shows a function 20-KSABorrowBitGen that generates a borrow-bit (underflow) generated during a subtraction; Figure 8 shows a method for performing second-order secure Boolean to arithmetic mask conversion for an integer modulo an arbitrary number, q; and Figure 9 is a schematic diagram showing components of an information processing apparatus. Detailed Description As discussed in the background, a countermeasure against side-channel attacks on hardware systems is masking. To mask a sensitive variable, it is split into masked shares. Once a sensitive variable has been split into masked shares, functions may be applied to each share separately and a combination of the output shares of the function is the same as the result of applying the function directly to the sensitive variable. In this way, probing attacks on the hardware can be thwarted because a probe only obtains information about processing of a masked share and an attacker does not gain information about the sensitive variable unless information about all the masked shares can be obtained, which is more difficult to achieve. However, once a sensitive variable has been split into masked shares, such as Boolean masked shares, not all functions can be applied without modification. Modified operations may be applied to the Boolean masked shares, but these operations may not be efficient to implement. Logical operations may be applied to the Boolean masked shares, but arithmetic operations such as additions may require arithmetic masking to be efficiently implemented. Accordingly, there is a desire to convert Boolean masked shares to arithmetic masked shares to allow sequences of operations to be applied without the need to combine the masked shares and re-mask the sensitive variable, which potentially exposes the sensitive variable to probing attacks. In the following description methods for converting Boolean masked shares to arithmetic masked shares are described. The first and second embodiments are methods which are 1-PINI secure and the third and fourth embodiments are methods that are 2- PINI secure, where PINI stands for Probe-Isolating Non-Interference. Intuitively (i.e. not a formal definition), 1-PINI secure indicates that the method is secure if any probe used to monitor a hardware system is not allowed to observe different share domains processed by the hardware. If the probe is positioned at the output shares, the measurement must be limited to data propagating within the same share domain as the output share on which the probe was placed. A method is 2-PINI secure if the method remains secure if two probes (two inputs) are used to monitor at most two share domains processed by the hardware system. Throughout this patent specification we denote the Boolean operations AND, OR, and XOR as ∧, ∨, and ⊕. We denote a shift of the binary representation of a variable x to the left with x ≪ i where i represents the bit positions. Likewise, we denote a right shift by i positions with x ≫ i. Addition and subtraction operations are represented as + and − signs. The operations may be performed in the field ^^^^2^^^^ (integers represented as binary strings) where k ∈ Z≥0 represents the bit length of the field. A Boolean masking scheme with security order d that splits up a sensitivevariable x ∈ ^^^^2^^^^ into d + 1 Boolean shares (x1, ..., xd+1) such that ^^^^ ^^^^^^^^is considered to fulfil the correctness property for Boolean operations. Further if the shares are selected randomly from a uniform distribution, the shares fulfil the uniformity property. A shared function f(x, y) is considered correct if the sum of its sharedcomponent functions fi equals to f(x, y), i.e., ^^^^(^^^^,^^^^) ^^^^^^^^. Throughout the description, we use the subscript to refer to the different mask shares. A superscript is used to refer to the individual bits of the mask share. For example, ^^^^34refers to the fourth bit of the third mask share. First embodiment (1storder B2A) A first embodiment provides a first-order (1-PINI) secure Boolean-to- Arithmetic (B2A) mask conversion algorithm. The first embodiment is applicable to integers ℤ expressed in binary form. Figure 1 shows a method referred to as 10-SecB2A2k. The input to the method is a pair of Boolean shares, ^^^^′and r of a sensitive variable x. The Boolean shares are related as follows: ^^^^′ = ^^^^ ^ ^^^^The sensitive value, x, may be recovered as follows: ^^^^′ ^ ^^^^ = ^^^^ ^ ^^^^ ^ ^^^^ = ^^^^The method additionally uses a random integer (binary string of length k) γ. The method generates arithmetic masks, z1 and z2, where: ^^^^ = ^^^^1 − ^^^^2The arithmetic shares, z1 and z2, being calculated may be expressed as follows: ^^^^1 = ^^^^ + (^^^^ ^ ^^^^ ^ ^^^^)^^^^2 = ^^^^ ^ ^^^^ ^ ^^^^The following description provides a secure and hardware efficient way of determining the arithmetic shares. The method begins in step 1 by determining initial shares a1, a2, a3, and a4as follows: ^^^^ ′1 ← ^^^^^^^^2 ← ^^^^′ ⊕ ^^^^^^^^3 ← ^^^^ + ^^^^^^^^4 ← ^^^^ ⊕ ^^^^In steps 2 to 4, bits of an intermediate arithmetic masked share ^^^^1^^^^, are determined as follows: ^^^^0 01 ← ^^^^3 Here negates the bit value, which is to say that a 0 bit is converted to 1 and a 1 bit is converted to 0. For the other bit values i between 2 and k-1: In parallel a value t is determined in steps 5 to 10 of Figure 1, at each value i (i.e., as the bit values of z1 between 2 and k-1 are determined) for a variable d between 3 and i+1, and then for each value m between d – 2 and 1, the value t is determined as follows: ^^^^ ← ^^^^ + 1 − ^^^^^^^^ ← ^^^^ ^^^^^^^^1∧ ¬^^^^4^^^^ ← ^^^^ ∧ ^^^^^^^^+^^^^4 The arithmetic share z1 is then determined by XOR with t such that: ^^^^^^^^1 ← ^^^^^^^^1 ⊕ ^^^^^^^^2 ← ^^^^2Accordingly, arithmetic masked shares z1and z2are generated from Boolean masked shares ^^^^′and r. The method described above may be implemented by computing initial shares a1, a2, a3, and a4 and storing the results in a register. The first arithmetic share, z1, may be calculated using a modifier Ripple-Carry Adder. As the first arithmetic share is computed in the same share domain (i.e. based on values a1 to a4) it can be computed in a single clock cycle. The second share is also calculated in the same share domain. As discussed further below, when implemented in a circuit, the method may have a latency that is independent of the word size, k. Second embodiment (1storder B2AQ) Many cryptographic algorithms require a Boolean to Arithmetic mask conversion in a field of integers modulo an arbitrary number (i.e., not limited to 2). The arbitrary number will be q, where q <2kwhere k is a parameter. In such implementations, the sensitive value being masked is reduced to modulo q before it is arithmetically shared. Figure 3 shows three functions that are used in the following method. 10- DomAnd takes four shares a0, a1, b0, and b1and a random bit, r0and generates two intermediate values y0 and y1. The function generates shares using an AND function. 10-DomAnd is: ^^^3^ (^^^^1, ^^^^1) = (^^^^ ′1⋀^^^^1) → ^^^^3^^^^′ ^ ^^^′0 ^1 = ^^^^0^^^^′ ^ ^^ ′2 ^^3 = ^^^^110-DomAndRefresh takes an additional bit of randomness compared to 10- DomAnd, which allows all the component functions to be refreshed (made uniform again).10-DomAndRefresh is: ^^^^ (^^^^ , ^^^^ , ^^^^1) = (^^^ ) 1 ′0 0 0 ^0⋀^^^^0 ^^^^^ → ^^^^0^^^^ (^^^^ , ^ 0 ) 0 ′1 0 ^^^1, ^^^^ = (^^^^0⋀^^^^1) ^^^^^ → ^^^^1 ^^^^′0 ^ ^^^^′1 = ^^^^0^^^^′ ′2 ^ ^^^^3 = ^^^^110-DomAndXorRefresh takes shares of a third value, c, to generate shares usinga function ^^^^(^^^^, ^^^^, ^^^^) = ^^^^^^^^^^^^^. 10-DomAndXorRefresh is: ^^^^ (^^^^ , ^^^^ , ^^^^ , ^^^^1) = 1 ′3 1 1 1 (^^^^1⋀^^^^1) ^ ^^^^1 ^ ^^^^ → ^^^^3^^^^′0 ^ ^^^^′1 = ^^^^0^^^^′ ^ ^^ ′2 ^^3 = ^^^^1Figure 2 illustrates steps of a method, referred to herein as 10-SecB2Aq. The input to the method is a pair of Boolean shares, ^^^^′and r of a sensitive variable x. The Boolean shares are related as in the first embodiment: ^^^^′ = ^^^^ ^ ^^^^The method generates arithmetic masks, z1and z2, where: ^^^^ = ^^^^1 − ^^^^2The method works modulus q, where q <2kand the output value x lies between [0, q- 1]. In step 1 of the 10-SecB2Aq method, the method of the first embodiment, 10- SecB2A2K, is applied to input shares ^^^^′and r. The arithmetic shares z1 and z2 are referred to as t1 = z1 and t2 = z2. In step 2, a value u is determined: ^^^^ ← ^^^^2 + ^^^^ In step 3, a function 10-KSABorrowBitGen is used on the shares ^^^^′and r.10- KSABorrowBitGen is illustrated in Figure 4. The 10-KSABorrowBitGen function securely calculates a single underflow (borrow) bit of a subtraction operation (x - q) using a Boolean masked carry chain.10-KSABorrowBitGen takes two input values, x0 and x1. Accordingly, when referring to Figure 4, ^^^^′= x0 and r = x1. In steps 1 to 5, a Refresh is performed in which even bits of the input shares x0and x1are randomized thereby generating randomised shares a0and a1. The Refresh isdefined as (^^^^^^^^0 , ^^^^^^^^1) = (^^^^^^^^0^^^^^^^^^ , ^^^^^^^^1 ^^^^^^^^^) where each ri is a single bit randomness.In step 7, a constant, y, is determined as: ^^^^ ← 2^^^^ − ^^^^The constant y is illustrated as u in Figure 4. The value is referred to as y herein to avoid confusion with the value u calculated in step 2 of Figure 2. In steps 8 to 10, The functions 10-DomAnd and 10-DomAndRefresh referred to above are used to generate shares of randomised shares a0and a1by applying 10- DomAnd and 10-DomAndRefresh to bits of the randomized shares a0and a1. As illustrated in Figure 3, the newly generated shares are designated y0 and y1. These newshares are designated ^^^^ ^^^^ ^^^^ ^^^^ ^^^^0 → ^^^^0 and → ^^^^1. The values ^^^^0 , ^^^^1 , ^^^^0 and ^^^^1 aredetermined using the following expressions applied to each share (i.e., the shares are not illustrated below for simplicity, but the same expression is used for each share): ^^^^^^^^ ← (^^^^^^^^−1 ∧ ^^^^^^^^−1 ∧ ^^^^^^^^) ⊕ (^^^^^^^^⋀ ^^^^^^^^) ^ (^^^^^^^^−1⋀ ^^^^^^^^⋀ ^^^^^^^^−1) The constant, y, calculated in step 7 obviously doesn’t change between shares. In steps 12 to 14 of Figure 4, the following determinations are made for j = 2 to log2(k) – 1: ^^^^ ← ^^^^ and for i between 1 and^^^^2^^^^: ^^^^ ← ^^^^ − 1^^^^ ← ^^^^ − ^^^^ − 1 (^^^^^^^^,^^^^^^^^) ← 10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^ ^^^^ ^^^^ ^^^^0 1 - ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ℎ(^^^^0, ^^^^1,^^^^0 ,^^^^1 ,^^^^0 ,^^^^1 )^^^^ ← ^^^^ − 2^^^^The method then determines borrow bits b0and b1as: ^^^^ ^^ (^^^^0, ^^^^1) ← 10-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ℎ(^^^^^^^−1 ^^^^−10 , ^^^^1 ,^^^^2−^^ ^1 2−1 ^^^^−1 ^^^^−10 ,^^^^1,^^^^0,^^^^1) Returning to Figure 2 at steps 4 to 8 the method determines calculation values w1 and w2 as: Here ^^�^^1 in the figures indicates repetition of the bit value b1 to generate a k-bitword. Similarly, ^�^^^2in the figures indicates repetition of the bit value b2to generate a k-bit word. The 10-SecB2Aq method determines the modulo reduced arithmetic shares z1 and z2 as: ^^^^1 ← ^^^^1 Implementations of the method of the second embodiment may take log2(k)+2 cycles. For example, they may take 7 clock cycles for a 32-bit implementation. This method may be applied in low-latency and / or low resource applications. The method is pipelineable and needs 48 bits of randomness each cycle. Third embodiment (2ndorder B2A) The third embodiment provides a second-order (2-PINI) secure Boolean-to- Arithmetic (B2A) mask conversion algorithm. The third embodiment is applicable to integers ℤ expressed in binary form. Figure 5 shows a method referred to as 20-SecB2A2k. As the method is a second order method, there are three shares rather than two. Accordingly, the input to the method is three Boolean shares, r1and r2of a sensitive variable x. The Boolean shares are related as follows: ^^^^′ = ^^^^ ^ ^^^1^ ^ ^^^^2The method will generate Arithmetic mask shares, z1, z2, and z3. The sensitivevalue, x, may be recovered by ^^^^ = ^^^^1 − ^^^^2 − ^^^^3.The method begins by sampling seven random integers s1, s2, γ1, γ2, α, β, δ; A first cycle, in steps 2 to 12 of Figure 5, generates first intermediate values as: ^^^^ ′1 ← ^^^^^^^^2 ← ^^^^^^^^3 ← ^^^1^ ⊕ ^^^^1^^^^4 ← ^^^2^ ⊕ ^^^^2^^^^ ← ′5 (^^^^ ^ ^^^^ ⊕ ^^^^1) + ^^^^1^^^^ ← ′6 (^^^^ ^ ^^^^ ⊕ ^^^^2) + ^^^^2^^^^1 ← ^^^^2 ⊕ ^^^1^^^^^2 ← ^^^^ ⊕ ^^^2^^^^^3 ← ^^^^2^^^^4 ← ^^^1^^^^^5 ← ^^^^ ⊕ ^^^2^ ^ ^^^^2In a second cycle, shown in steps 14 to 23, the method generates second intermediate values as:^^^^1 ← ^^^^1 ⊕ ^^^^3 ^ ^^^^4^^^^2 ← ^^^^2 ⊕ ^^^^3 ^ ^^^^4^^^^3 ← ^^^^1 ⊕ ^^^^5 ^ ^^^^3^^^^4 ← ^^^^6 ⊕ ^^^^3^^^^5 ← ^^^^1^^^^1 ← ^^^^1 − ^^^^2^^^^2 ← ^^^^2 ^ ^^^^3^^^^3 ← ^^^^1 ^ ^^^^3^^^^4 ← ^^^^3^^^^5 ← ^^^^5 − ^^^^4In a third cycle, shown in steps 25 to 34, the method generates third intermediate values as: ^^^^2 ← ^^^^4 ^ ^^^^^^^^3 ← ^^^^^^^^4 ← ^^^^5^^^^5 ← (^^^^5 ⊕ ^^^^) + ^^^^^^^^6 ← ^^^^^^^^1 ← ^^^^2 ^ ^^^^3 ⊕ ^^^^^^^^2 ← ^^^^5 ⊕ ^^^^^^^^3 ← ^^^^1^^^^4 ← ^^^^4In a fourth cycle, shown in steps 36 to 42, the method generates fourth intermediate values as: ^^^^1 ← (^^^^1 ^ ^^^^2 ⊕ ^^^^4) + ^^^^5^^^^2 ← ^^^^1 ^ ^^^^3^^^^3 ← ((^^^^1 ^ ^^^^2) + ^^^^3) ^ ^^^^2^^^^4 ← ^^^^4^^^^5 ← ^^^^6^^^^1 = ^^^^1 ⊕ ^^^^2 ^ ^^^^3^^^^2 ← ^^^^4In steps 44 to 46, the method generates arithmetic mask shares, z1z2z3, as: ^^^^1 = ^^^^2 ⊕ ^^^^3 ^ (^^^^1 − ^^^^5)^^^^2 ← ^^^^4 − ^^^^1^^^^3 ← ^^^^2.Implementations of this method may complete within four clock cycles. A discussion of the performance of implementations of the method follows further below. Fourth embodiment (2ndorder B2AQ) As explained in connection with the second embodiment, some cryptographic algorithms require a Boolean to Arithmetic mask conversion in a field of integers modulo an arbitrary number (i.e., not limited to 2). The arbitrary number will be q, where q <2kwhere k is parameter. In such implementations, the sensitive value being masked is reduced to modulo q before it is arithmetically shared. Figures 6a and 6b show three functions that are used in the following method. 20-DomAnd takes six shares a0, a1, b0, b1, c0 and c1 and three random bits, r0, r1, and r2and generates three intermediate values y0, y1, and y2. The function generates shares using an AND function.20-DomAnd is: ^^^^ (^^^ ) ′0 ^0, ^^^^0 = (^^^^0⋀^^^^0) → ^^^^0^^^^ (^^^^ , ^^^^ , ^^^^0) = (^^^^ ⋀^^^^ ) ^ ^ 0 ′1 0 1 0 1 ^^^ → ^^^^1^^^^ (^^^^ , ^^^^ , 1) 1 ′2 0 2 ^^^^ = (^^^^0⋀^^^^2) ^ ^^^^ → ^^^^2 ^^^^(^^^^ , ^^^^ ) = (^^^^ ⋀^^^^ ) → ^ ′8 2 2 2 2 ^^^8^^^^′0 ^ ^^^^′1 ^ ^^^^′2 = ^^^^0^^^^′ ^ ^^^′ ′3 ^4 ^ ^^^^5 = ^^^^1^^^^′ ^ ^^^^′ ^ ^^^^′6 7 8 = ^^^^220-DomAndRefresh takes an additional 6 bits of randomness compared to 20- DomAnd, which allows all the component functions to be refreshed (made uniform again).20-DomAndRefresh is: ^^^^′ ′ ′0 ^ ^^^^1 ^ ^^^^2 = ^^^^0^^^^′ ^ ^^^^′ ^ ′3 4 ^^^^5 = ^^^^1^^^^′6 ^ ^^^^′7 ^ ^^^^′8 = ^^^^2Shown in Figure 6b, 20-DomAndXorRefresh takes shares of a third value, c, togenerate shares using a function ^^^^(^^^^, ^^^^, ^^^^) = ^^^^^^^^ ^ ^^^^.20-DomAndXorRefresh is: ^^^^′ ^ ^^^^′ ^ ^^ ′0 1 ^^2 = ^^^^0^^^^′ ′ ′3 ^ ^^^^4 ^ ^^^^5 = ^^^^1^^^^′ ^ ^^^′ ′6 ^7 ^ ^^^^8 = ^^^^2Figure 8 illustrates steps of a method, referred to herein as 20-SecB2Aq. The input to the method is the three Boolean shares, ^^^^′, r1, and r2 of a sensitive variable x. The Boolean shares are related as in the third embodiment: ^^^^′ = ^^^^ ^ ^^^1^ ^ ^^^^2The method will generate Arithmetic mask shares, z1, z2, and z3. The sensitivevalue, x, may be recovered The method works modulus q, where q <2kand the output value x lies between [0, q-1]. In step 1 of the 20-SecB2Aq method, the method of the first embodiment, 20- SecB2A2K, is applied to input shares ^^^^′, r1, and r2. The arithmetic shares z1, z2, and z3are referred to as t1 = z1, t2 = z2, and t3 = z3. In step 2, a value u is determined: ^^^^ ← ^^^^3 + ^^^^In step 3, a function 20-KSABorrowBitGen is used on the shares r1, and r2. 20-KSABorrowBitGen is illustrated in Figure 7. The 20-KSABorrowBitGen function securely calculates a single underflow (borrow) bit of a subtraction operation (x - q) using a Boolean masked carry chain.20-KSABorrowBitGen takes three input values, x0, x1, and x2. Accordingly, when referring to Figure 7, ^^^^′= x0, r1= x1and r2= x2. In steps 1 to 5, a Refresh is performed in which even bits of the input shares x0, x1, and x2 are randomized thereby generating randomised shares a0, a1, and a2. The Refresh is defined as: where ^^^0^^^^^, ^^^1^^^^^, and ^^^2^^^^^are each a single bit randomness. In step 7, a constant, y, is determined as: ^^^^ ← 2^^^^ − ^^^^The constant y is illustrated as u in Figure 7. The value is referred to as y herein to avoid confusion with the value u calculated in step 2 of Figure 8. In steps 8 to 10, The functions 20-DomAnd and 20-DomAndRefresh referred to above are used to generate shares of the randomized shares a0, a1,and a2by applying 20-DomAnd and 20-DomAndRefresh to bits of the randomized shares a0, a1, and a2. As illustrated in Figures 6a and 6b, the shares are designated y0, y1, and y2. These newshares are designated ^^^^ ^^^^ ^^^^ ^^^^ ^^^^ ^^^^0 → ^^^^0 , ^^^^1 → ^^^^1, ^^^^2 → ^^^^2. The values ^^^^0 , ^^^^1 , ^^^^2 , ^^^^0 , ^^^^1 and^^^^2^^^^and determined using the following expressions applied to each share (i.e., the shares are not illustrated below for simplicity, but the same expression is used for each share): ^^^^^^^^ ←�^^^^^^^^−1 ∧ ^^^^^^^^−1 ∧ ^^^^^^^^� ⊕�^^^^^^^^⋀^^^^^^^^� ^ (^^^^^^^^−1 ⋀ ^^^^^^^^ ⋀ ^^^^^^^^−1)^^^^^^^^ ← (^^^^^^^^−1^ ^^^^^^^^−1) ⋀ (^^^^^^^^ ⊕ ^^^^^^^^)The constant, y, calculated in step 7 obviously doesn’t change between shares. In steps 12 to 14 of Figure 4, the following determinations are made for j = 2 to log2(k) – 1: ^^^^ ← ^^^^^^^^ ← 2^^^^−1 and for i between 1 and^^^^2^^^^: ^^^^ ← ^^^^ − 1^^^^ ← ^^^^ − ^^^^ − 1 ^^^^ ← ^^^^ − 2^^^^The method then determining borrow bits b0, b1 and b2 as: (^^^^0, ^^^^1, ^^^^2) ←20-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ℎ(^^^^^^^^−1 ^^^^−1 ^^^^−1 ^^^^ ^^^^ ^^^^ ^^^^−1 ^^^^−1 ^^^^−10 , ^^^^1 ,^^^^2 ,^^^^0 ,^^^^1 ,^^^^2 ,^^^^0 ,^^^^1 ,^^^^2 )Returning to Figure 8, at steps 4 to 7 the method determines calculation values w1and w2as: Here ^^�^^1 indicates a k-time repetition of the same bit, b1, to get a k-bit value.Similarly,�^^^^2 and�^^^^3 indicate a k-time repetition of the same bit, b2, and b3 respectivelyto get a k-bit value. The 20-SecB2Aq method determines modulo reduced arithmetic shares z1, z2 and z2 as: ^^^^2 ← ^^^^2^^^^3 ← ^^^^1 ⊕ ^^^^2 ⊕ ^^^^3. Implementations of the fourth embodiment will take the maximum of 5 cycles and log2(k)+2 cycles to execute. Implementations of the fourth embodiment may be suited to low-latency and / or low resource applications. The method is fully pipelineable, such that it can accept new values at each cycle. Implementation and performance The above methods may be implemented in software or hardware. In hardware implementations, a processing unit includes circuitry configured to perform each of the operations described above. An example using a Kintex-7 processing unit will be discussed in greater detail below. The methods may also be implemented in field programmable gate arrays (FPGA) or application specific integrated circuits (ASIC). Implementation of the method described above by software is also possible. Figure 9 is a schematic diagram of components of an example information processing apparatus suitable for use in performing the method described above. The diagram is illustrative and different hardware configurations for information processing apparatus are possible as is well known in the art. The information processing apparatus includes an I / O interface 90, such a USB port, Thunderbolt port, etc. to which an additional device, such as a storage device, could be connected. The information processing apparatus comprises a processing unit in the form of a processor 91, such as a CPU, GPU or TPU, a storage in the form of memory 92, a network module 93, a display 94, and a user interface 95. The network module may allow the information processing apparatus to communicate over a network such as a Wi-Fi network, a mobile telecommunications network, a local area network etc. The user interface may include components such as a keyboard, mouse, camera, etc. The components of the information processing apparatus may communicate with each other over a bus 86. Further components may be provided but are not shown or described. Any of the steps of the methods described above may be performed by computer-readable instructions of one or more programs stored in a storage and executed by a processing unit on one or more information processing apparatuses. The table below shows data relating to implementations of the first embodiment. Design Arch. Latency Rand Freq TP LUT FF DSP Device 1 T1 32 4 101 101 227 223 0 Spartan- RCA 6 1 T1 6 31 62 330 937 1,330 0 Spartan- KSA 6 2 HPC2 12 249 176 469 2,936 3,981 0 Spartan- KSA 6 2 T1 6 31 228 1,216 873 1,416 0 Spartan- KSA 6 3 T1 6 160 454 2,421 2,464 1,323 0 Artix-7 KSA 4 HPC3 10 283 150 4,800 1,638 2,874 0 Kintex- KSA 7 Embod 1 32 502 16,064 188 126 0 Kintex- 1 (F) 7 Embod 1 32 285 9,120 76 94 1 Kintex- 1 (S) 7 The above table shows characteristics of implementations of the first embodiment compared to hardware implementations reported in prior works. Under the design column, 1 refers to T. Schneider, A. Moradi, and T. Güneysu. ‘Arithmetic Addition over Boolean Masking—Towards First- and Second-Order Resistance in Hardware’. In ACNS 2015, volume 9092 of LNCS, pages 559–578. Springer, Heidelberg, 2015. The numeral 2 refers to Florian Bache and Tim Güneysu. ‘Boolean Masking for Arithmetic Additions at Arbitrary Order in Hardware’. Applied Sciences, 12(5), 2022. The numeral 3 refers to Tim Fritzmann, Michiel Van Beirendonck, Debapriya Basu Roy, Patrick Karl, Thomas Schamberger, Ingrid Verbauwhede, and Georg Sigl. ‘Masked Accelerators and Instruction Set Extensions for Post-Quantum Cryptography’. IACR Trans. Cryptogr. Hardw. Embed. Syst., 2022(1):414–460, 2022. The numeral 4 refers to Quinten Norga, Jan-Pieter D’Anvers, Suparna Kundu, and Ingrid Verbauwhede. ‘Mask Conversions for d+1 shares in Hardware, with Application to Lattice-based PQC’. IACR Cryptol. ePrint Arch., 2024. The first embodiment was implemented in two configurations using two different target configurations: a fast (F) configuration that uses no DSPs and a small (S) configuration that forces the compiler to use the available DSP48 slices. In the second column, Arch. refers to the architecture within the relevant paper. The latency in the third column is in cycles. The fourth column, Rand., indicates the number of bits of randomness required. The frequency, Freq., in the fifth column is in MHz and indicates clock speed. The sixth column shows throughput, TP, in Mbits / s. The LUT column shows the number of look-up tables, the FFs column shows the number of flip flops, and the DSPs column indicates the number of digital signal processing units. Finally, Device indicates the type of device used. The fast configuration of embodiment 1 achieves a maximum frequency of 502 MHz and a throughput of 16 Gbits / s and is therefore 3 times faster than the next fastest solution investigated. The small configuration of the first embodiment requires only 76 LUTs, 94 FFs, and 1 DSP making it 2.5 times smaller than the smallest solution investigated. The following table shows data relating to implementations of the third embodiment. The columns have the same meanings as before. Design Arch. Latenc Rand Freq TP LUT FF DSP Device y 1 T1 65 8 107 52 388 387 0 Spartan RCA -6 1 T1 12 128 63 168 4,223 5,509 0 Spartan KSA -6 2 HPC2 12 747 148 395 3,915 8,001 0 Spartan KSA -6 4 HPC3 19 1,080 125 4,000 7,946 18,03 0 Kintex- KSA 2 7 Embo Pipe 4 224 515 16,48 912 992 0 Kintex- d 3 (F) 0 7 Embo Pipe 4 224 392 12,54 555 704 10 Kintex- d 3 (S) 4 7 Embo Iter 4 128 434 3,472 968 333 0 Kintex- d 3 (F) 7 Embo Iter 4 128 322 2,576 900 330 2 Kintex- d 3 (S) 7 Compared to related implementations, implementations of the third embodiment have a fixed latency of 4 for any value of k. The third embodiment was implemented in four implementations. There were pipelined (Pipe) and iterative (Iter) versions. The pipelined version can accept new inputs each clock cycle. The iterative version can accept new inputs every 4 clock cycles and re-uses the registers and adders to lower the resource requirements. In the iterative version, 10 registers are needed in total which get re-used and may be overwritten in each cycle. As can be seen from the table, the third embodiment shows a generally high throughput and low latency. The following table shows performance of implementations of the second and fourth embodiments: Design k Latency Rand Freq TP LUT FF DSP Embod 4 4 6 606 2,424 62 (47) 58 2 2 Embod 8 5 12 588 4,704 132 126 2 2 (106) 2 16 6 24 555 8,880 298 262 2 Embod (236) 2 Embod 32 7 48 454 14,528 653 536 2 2 (458) Embod 4 5 28 444 1,776 163 174 11 4 (133) Embod 8 5 56 444 3,552 356 366 11 4 (284) Embod 16 6 112 392 6,144 726 750 11 4 (590) Embod 32 7 224 370 11,840 1,432 1,518 11 4 (1,198) The number shown in brackets in connection with the number of LUTs is the LUT requirement when the device is clocked at 200 MHz. The table above relates to pipelined implementations of each of the second and fourth embodiments. The comparison above does not include a comparison with related prior art implementations because suitable hardware performance data was unable to be obtained. The embodiments described above may be used during implementations of the following cryptographic methods: generating a hash; generating a stream cipher; performing a masked application look up; performing a cryptographic function; generating a signature; generating a ciphertext; and generating a block cipher. In each case, during performance of the method, Boolean operations are performed on masked shares and the masked shares may be converted to arithmetic shares in order to allow the cryptographic method to be completed. One of the above- described methods is used to convert the Boolean masked share to an arithmetic masked share. Accordingly, the above-described embodiments may be implemented in a hash method, a method of generating stream cipher, a masked application look-up, a method of performing a cryptographic function, a signature method, a method of generating a ciphertext and a method of generating a block cipher. Particular examples, given by way of example only, are SHA-2, Blake hash function, Skein hash function, XTEA block cipher, or ChaCha20 stream cipher. The methods may be used in lattice-based cryptographic schemes. Apparatus to implement these methods and computer programs to perform these methods are also contemplated. It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. Furthermore, equivalents and modifications not described above may also be employed without departing from the scope of the invention, which is defined in the accompanying claims.

Claims

CLAIMS 1. A method performed by an information processing apparatus for converting a Boolean share, ^^^^′, of a data value, x, of length k bits, into Arithmetic mask shares, z1 and z2, wherein the Boolean share,has been obtained by a XOR operation with avalue, r, such that ^^^^′ = ^^^^ ^ ^^^^ and whereby the data value x may be recovered by anarithmetic operation on the Arithmetic mask shares, z1 and z2 , the method comprising: sampling a random variable, γ; determining initial shares a1, a2, a3, and a4 as: ^^^^ ← ^^ ′1 ^^^^^^2 ← ^^^^′ ⊕ ^^^^^^^^3 ← ^^^^ + ^^^^^^^^4 ← ^^^^ ⊕ ^^^^determining bits of an intermediate arithmetic masked share ^^^^1^^^^, as follows, where negates the bit value: ^^^^0 ← ^ 01 ^^^3^^^^11 ← ^^^^13 ⊕ (^^^^01 ∧ ¬^^^^04)for bit values i between 2 and k-1:at each value i for a variable d between 3 and i+1, and then for each value m between d – 2 and 1, determining a value t as follows: ^^^^ ← ^^^^ + 1 − ^^^^^^^^ ← ^^^^ ^^^^^^^^1∧ ¬^^^^4^^^^ ← ^^^^ ∧ ^^^^^^^^+^^^^4 determining the arithmetic masked shares as: ^^^^^^^^ ^^^1 ← ^^^^ ^1 ⊕ ^^^^^^^^2 ← ^^^^2.

2. A method according to claim 1, wherein the data value x may be recovered by taking a difference between z1and z2.

3. A method according to any preceding claim wherein the data value, x, is to be reduced to modulo q, the method further comprising, in a case that t1 = z1 and t2 = z2: determining: ^^^^ = ^^^^2 + ^^^^for ^^^^′= x0 and r = x1 performing a Refresh in which even bits of the input shares x0and x1are randomized thereby generating randomized shares a0and a1; determining a constant y: ^^^^ ← 2^^^^ − ^^^^applying functions: ^^^^^^^^ ← (^^^^^^^^−1 ∧ ^^^^^^^^−1 ∧ ^^^^^^^^) ⊕ (^^^^^^^^⋀ ^^^^^^^^)^( ^^^^^^^^−1 ⋀ ^^^^^^^^ ⋀ ^^^^^^^^−1)masked by applying 10-DomAnd and 10-DomAndRefresh to bits of randomized shares a0 and a1 such that:subsequently: for j = 2 to log2(k) – 1: ^^^^ ← ^^^^^^^^ ← 2^^^^−1and for i between 1 and^^^^2^^^^: ^^^^ ← ^^^^ − 1^^^^ ← ^^^^ − ^^^^ − 1(^^^^ , ^^^^ ) ← (^^^^^^^^, ^ ^^^^0 1 0 ^^^1 )^^^^ ← ^^^^ − 2^^^^determining borrow bits b0 and b1 as:determining calculation values w1and w2as:determining modulo reduced arithmetic shares z1 and z2 as: ^^^^1 ← ^^^^1^^^^2 ← ^^^^1 ⊕^^^^2.

4. A method according to claim 3, wherein the Refresh is performed as: ^^^^^^^^ i^) where each r is a single bit randomness.

5. A method according to claim 3 or claim 4, wherein where 10-DomAnd is: ^^^^(^^^^ , ^^^^ ) ′0 0 0 = (^^^^0⋀^^^^0) → ^^^^0 ;^^^^(^^^^ 0) 0 ′1 0, ^^^^1, ^^^^ = (^^^^0⋀^^^^1) ^ ^^^^ → ^^^^1 ;^^^^(^^^^ , ^^^^ ) = (^^^^ ⋀^^^^ ) → ^^^^′3 1 1 1 1 3 ;^^^^′^^^^^′0 1 = ^^^^0; and^^^^′^ ′2 ^^^^3 = ^^^^1.

6. A method according to any of claims 3 to 5, wherein 10-DomAndRefresh is:^^^^′0 ^ ^^^^′1 = ^^^^0; and^^^^′2 ^ ^^^^′3 = ^^^^1.

7. A method according to any of claims 3 to 6, wherein 10-DomAndXorRefresh is:^^^^′0 ^ ^^^^′1 = ^^^^0; and^^^^′ ′2 ^ ^^^^3 = ^^^^1.

8. A method performed by an information processing apparatus for converting Boolean shares, which arer1, and r2, of a data value, x, of length k bits, into Arithmetic mask shares, z1, z2, and z3, wherein the Boolean share,has been obtainedby a XOR operation with two random values, r1 and r2, such that ^^^^′ = ^^^^ ^ ^^^1^ ⊕ ^^^2^ andwhereby the data value x may be recovered by an arithmetic operation on the Arithmetic mask shares, z1, z2, and z3, the method comprising: sampling seven random integers s1, s2, γ1, γ2, α, β, δ; generating first intermediate values as: ^^^^ ′1 ← ^^^^^^^^2 ← ^^^^^^^^3 ← ^^^1^ ⊕ ^^^^1^^^^4 ← ^^^2^ ⊕ ^^^^2^^^^ ′5 ← (^^^^ ^ ^^^^ ⊕ ^^^^1) + ^^^^1^^^^ ′6 ← (^^^^ ^ ^^^^ ⊕ ^^^^2) + ^^^^2^^^^2 ← ^^^^ ⊕ ^^^2^^^^^3 ← ^^^^2^^^^4 ← ^^^1^^^^^5 ← ^^^^ ⊕ ^^^2^ ^^^^^2generating second intermediate values as: ^^^^1 ← ^^^^1 ⊕ ^^^^3 ^ ^^^^4^^^^2 ← ^^^^2 ⊕ ^^^^3 ^ ^^^^4^^^^3 ← ^^^^1 ⊕ ^^^^5 ^ ^^^^3^^^^4 ← ^^^^6 ⊕ ^^^^3^^^^5 ← ^^^^1^^^^1 ← ^^^^1 − ^^^^2^^^^2 ← ^^^^2 ^ ^^^^3^^^^3 ← ^^^^1 ^ ^^^^3^^^^5 ← ^^^^5 − ^^^^4generating third intermediate values as:^^^^2 ← ^^^^4 ^ ^^^^^^^^3 ← ^^^^^^^^4 ← ^^^^5^^^^5 ← (^^^^5 ⊕ ^^^^) + ^^^^^^^^6 ← ^^^^^^^^1 ← ^^^^2 ^ ^^^^3 ⊕ ^^^^^^^^2 ← ^^^^5 ⊕ ^^^^^^^^4 ← ^^^^4generating fourth intermediate values as: ^^^^1 ← (^^^^1 ^ ^^^^2 ⊕ ^^^^4) + ^^^^5^^^^2 ← ^^^^1 ^ ^^^^3^^^^3 ← ((^^^^1^ ^^^^2) + ^^^^3) ^ ^^^^2^^^^4 ← ^^^^4^^^^1 ← ^^^^1 ⊕ ^^^^2 ^ ^^^^3^^^^2 ← ^^^^4generating arithmetic mask shares, z1z2z3, as: ^^^^1 ← ^^^^2 ⊕ ^^^^3 ^ (^^^^1 − ^^^^5)^^^^2 ← ^^^^4 − ^^^^1^^^^3 ← ^^^^2.

9. A method according to claim 8, wherein the data value x can be recovered by subtracting the arithmetic mask shares z2 and z3 from z1.

10. A method according to claim 8 or claim 9 wherein the data value, x, is to be reduced to modulo q, the method further comprising, in a case that t1 = z1, t2 = z2, and t3 = z3: determining: ^^^^ ← ^^^^3 + ^^^^for ^^^^′= x0, r1= x1, r2= x2performing a Refresh in which even bits of the input shares x0, x1and x2are randomized thereby generating randomized shares a0, a1, and a2; determining a constant y: ^^^^ ← 2^^^^ − ^^^^applying functions:^^^^^^^^ ←�^^^^^^^^−1 ⊕ ^^^^^^^^−1� ⋀ (^^^^^^^^ ⊕ ^^^^^^^^)masked by applying functions 20-DomAnd and 20-DomAndRefresh to bits of randomized shares a0, a1, and a2such that:subsequently: for j = 2 to log2(k) – 1: ^^^^ ← ^^^^^^^^ ← 2^^^^−1and for i between 1 and^^^^2^^^^: ^^^^ ← ^^^^ − 1^^^^ ← ^^^^ − ^^^^ − 1^^^^ ← ^^^^ − 2^^^^determining borrow bits b0, b1and b2as:(^^^^0, ^^^^1, ^^^^2) ←20-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ℎ(^^^^^^^^−1 ^^^^−1 ^^^^−1 ^^^^ ^^^^ ^^^^ ^^^^−1 ^^^^−1 ^^^^−10 , ^^^^1 ,^^^^2 ,^^^^0 ,^^^^1 ,^^^^2 ,^^^^0 ,^^^^1 ,^^^^2 )sampling a random value α; determining calculation values w1, w2, and w3 as:^^^^2 ← (^�^^^2 ∧ (^^^^3 ⊕ ^^^^)) ⊕^^^^^^^^3 ← (^�^^^3 ∧ (^^^^3 ⊕ ^^^^)) ⊕^^^^determining modulo reduced arithmetic shares z1, z2and z3as: ^^^^1 ← ^^^^1^^^^2 ← ^^^^2^^^^3 ← ^^^^1 ⊕^^^^2 ⊕^^^^3.

11. A method according to claim 10, wherein the Refresh is performed as: (^^^^^^^^ , ^^^^^^^^ , ^^^^^^^^ ) = (^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^ ^^^^ ^^^^ ^^^^ ^^^^ ^^^^ ^^^^ ^^^^ ^^^^0 1 2 0 0 1^ , ^^^^1 ^^^^1^^^^^^2 , ^^^^2 ^^^^2^^^^^^0) where ^^^^0, ^^^1^, and ^^^2^ areeach a single bit randomness.

12. A method according to claim 10 or claim 11, wherein where 20-DomAnd is: ^^^^(^^^^ , ^^^^ ) = (^^^^ ⋀^^^^ ) → ^ ′0 0 0 0 0 ^^^0 ;^^^^(^^^^ , ^^^^ , ^^0) 0 ′1 0 1 ^^ = (^^^^0⋀^^^^1) ^ ^^^^ → ^^^^1 ;^^^^(^^^^ , ^^^^ ) = (^^^^ ⋀^^^^ ) → ^^′8 2 2 2 2 ^^8 ;^^^^′0 ^ ^^^^′1 ^ ^^^^′2 = ^^^^0;^^^^′3 ^ ^^^^′4 ^ ^^^^′5 = ^^^^1; and^^^^′ ^ ^^^^′ ^ ′6 7 ^^^^8 = ^^^^2.

13. A method according to any of claims 10 to 12, wherein 20-DomAndRefresh is:^^^^′ ^ ^^^^′ ^ ^^^^′0 1 2 = ^^^^0;^^^^′ ^ ^ ′ ′3 ^^^4 ^ ^^^^5 = ^^^^1; and^^^^′ ^ ^^^^′ ^ ^^^^′6 7 8 = ^^^^2.

14. A method according to any of claims 10 to 13, wherein 20-DomAndXorRefresh is:^^^^′ ^ ^^^^′ ^ ^^^′0 1 ^2 = ^^^^0;^^^^′ ^ ′ ′3 ^^^^4 ^ ^^^^5 = ^^^^1; and^^^^′ ^ ^^^^′ ^ ^^^′6 7 ^8 = ^^^^2.

15. A method of at least one of: generating a hash; generating a stream cipher;performing a masked application look up; performing a cryptographic function; generating a signature; generating a ciphertext; and generating a block cipher; comprising the method of any of claims 1 to 11.

16. An information processing apparatus comprising a processing unit and a storage, wherein the storage stores instructions that are configured to cause the information processing apparatus to perform a method according to any of claims 1 to 15.

17. A program that, when executed on an information processing apparatus, causes the information processing apparatus to perform a method according to any of claims 1 to 15.

18. A non-transitory computer-readable storage medium storing instructions that, when executed by an information processing apparatus, cause the information processing apparatus to perform a method according to any of claims 1 to 15.

Images