A Nearly Tight Proof of Duc et al.’s Conjectured Security Bound for Masked Implementations
Résumé
We prove a bound that approaches Duc et al.'s conjecture from Eurocrypt 2015 for the side-channel security of masked imple- mentations. Let Y be a sensitive intermediate variable of a cryptographic primitive taking its values in a set Y. If Y is protected by masking (a.k.a. secret sharing) at order d (i.e., with d + 1 shares), then the complexity of any non-adaptive side-channel analysis measured by the number of queries to the target implementation required to guess the secret key with sucient condence is lower bounded by a quantity inversely proportional to the product of mutual informations between each share of Y and their respective leakage. Our new bound is nearly tight in the sense that each factor in the product has an exponent of −1 as conjectured, and its multiplicative constant is O(log |Y| · |Y|−1 · C−d), where C ≤ 2 log(2) ≈ 1.38. It drastically improves upon previous proven bounds, where the exponent was −1/2, and the multiplicative constant
was O|Y|−d. As a consequence for side-channel security evaluators, it
is possible to provably and eciently infer the security level of a masked implementation by simply analyzing each individual share, under the necessary condition that the leakage of these shares are independent.
Domaines
Cryptographie et sécurité [cs.CR]Origine | Fichiers produits par l'(les) auteur(s) |
---|