Transition from a Boolean masking to an arithmetic masking

Patent metadata

Field	Value
Publication number	US-11386239-B2
Application number	US-201816491896-A
Country	US
Kind code	B2
Filing date	Feb 28, 2018
Priority date	Mar 6, 2017
Publication date	Jul 12, 2022
Grant date	Jul 12, 2022

Abstract

A method for the transition is provided from a Boolean masking of a value to be kept secret to an additive masking of the value to be kept secret. The value to be kept secret is present in the Boolean masking as a representation masked with a first Boolean mask and a second Boolean mask. A first additive mask and a second additive mask are determined for the value to be kept secret. A first masking transition is executed in which the first Boolean mask is converted into the first additive mask. A second masking transition is executed in which the obfuscation value is converted into an additive correction value, and a third masking transition is executed in which the second Boolean mask is converted into the second additive mask.

First claim

The invention claimed is:

1. A method for a masking transition of a cryptographic calculation, the masking transition being a transition from a Boolean masking of a value to be kept secret to an additive masking of the value to be kept secret, the value to be kept secret being present in the Boolean masking as a representation masked with a first Boolean mask and a second Boolean mask, and wherein a first additive mask and a second additive mask are determined for the value to be kept secret, the method comprising:
executing a first masking transition in which the first Boolean mask is converted into the first additive mask, wherein the first additive mask is a masked representation of an additive mask corresponding to the first Boolean mask, wherein the first additive mask is masked with an obfuscation value serving as a Boolean mask;
executing a second masking transition in which the obfuscation value is converted into an additive correction value; and
executing a third masking transition in which the second Boolean mask is converted into the second additive mask,
wherein a Boolean masked representation results from applying the first Boolean mask and the second Boolean mask to the value to be kept secret and an additive masked representation results from applying the first additive mask and the second additive mask to the value to be kept secret, and
wherein the Boolean masked representation has a same value as the additive masked representation.

2. The method according to claim 1 , wherein the obfuscation value serving as the Boolean mask is determined randomly.

3. The method according to claim 1 , wherein at least two further random obfuscation values are used and each of the first, second, and third masking transitions uses at least one of these further random obfuscation values or a value derived therefrom.

4. The method according to claim 1 , wherein at least two further random obfuscation values are used and both the first and the third masking transition respectively use at least two of the further random obfuscation values or values derived therefrom.

5. The method according to claim 1 , wherein the first masking transition is executed with the value to be kept secret as a base value.

6. The method according to claim 1 , wherein the second masking transition is executed with a base value which results from an additive mask corresponding to the first Boolean mask.

7. The method according to claim 1 , wherein the third masking transition is executed with a base value which results from an additive masking of the value to be kept secret with an additive mask corresponding to the first Boolean mask.

8. The method according to claim 1 , wherein the third masking transition is executed at least partly before the first masking transition or at least partly before the second masking transition.

9. The method according to claim 1 , wherein the second additive mask is determined by applying the additive correction value in an additive operation to an additive mask corresponding to the second Boolean mask.

10. The method according to claim 1 , wherein the second additive mask corresponds to the second Boolean mask and that the additive correction value is supplied as a further method result.

11. The method according to claim 1 , wherein the method is embedded between a first section and a second section of the cryptographic calculation,
wherein in the first section the masked representation is generated or processed by at least one operation which is compatible with the Boolean masking, and in the second section the masked representation is further processed by at least one operation which is compatible with the arithmetic masking.

12. The method according to claim 1 , wherein at least one of the first, second and third masking transition is executed according to a method which, when regarded alone, is protected against first-order side channel attacks, but not against second-order side channel attacks.

13. The method according to claim 1 , wherein the method serves for the protection against second-order side channel attacks.

14. A computer program product having a plurality of program commands which cause at least one processor to execute a method of claim 1 .

15. The method according to claim 1 , further comprising encrypting the Boolean masked representation, which is a value that results from applying the first Boolean mask and the second Boolean mask to the value to be kept secret, to generate encrypted data for secure communication.

16. The method according to claim 15 , further comprising securely communicating the encrypted Boolean masked representation.

17. The method according to claim 1 , further comprising preventing a side channel attack of the value to be kept secret by encrypting the Boolean masked representation rather than directly encrypting the value to be kept secret, and providing the encrypted the Boolean masked representation for secure communications.

18. A device comprising:
a portable data carrier or chip module,
wherein the device includes at least one processor and at least one memory, and
wherein the device is arranged to execute a method for a masking transition of a cryptographic calculation, the masking transition being a transition from a Boolean masking of a value to be kept secret to an additive masking of the value to be kept secret, the value to be kept secret being present in the Boolean masking as a representation masked with a first Boolean mask and a second Boolean mask, and wherein a first additive mask and a second additive mask are determined for the value to be kept secret, the method including
executing a first masking transition in which the first Boolean mask is converted into the first additive mask, wherein the first additive mask is a masked representation of an additive mask corresponding to the first Boolean mask,
wherein the additive mask is masked with an obfuscation value serving as a Boolean mask;
executing a second masking transition in which the obfuscation value is converted into an additive correction value; and
executing a third masking transition in which the second Boolean mask is converted into the second additive mask,
wherein a Boolean masked representation results from applying the first Boolean mask and the second Boolean mask to the value to be kept secret and an additive masked representation results from applying the first additive mask and the second additive mask to the value to be kept secret, and
wherein the Boolean masked representation has a same value as the additive masked representation.

Assignees

• Giesecke & Devrient Mobile Security Gmbh

Inventors

• Pulkus Jürgen
• Hoffmann Lars

Classifications

• H04L2209/046

  of operations, operands or results of the operations · CPC title

• G06F21/755 Primary

  with measures against power attack · CPC title

• G06F7/575

  Basic arithmetic logic units, i.e. devices selectable to perform either addition, subtraction or one of several logical operations, using, at least partially, the same circuitry · CPC title

• H04L9/003 Primary

  for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA] · CPC title

• G06F2207/7238

  Operand masking, i.e. message blinding, e.g. (A+r)**e mod n; k.(P+R) · CPC title