Transition from a Boolean masking to an arithmetic masking
AssigneeGiesecke+Devrient Mobile Security GmbH
InventorsJürgen Pulkus, Lars Hoffmann
Life of this patent
Estimating the term…
Abstract
A method for the transition is provided from a Boolean masking of a value to be kept secret to an additive masking of the value to be kept secret. The value to be kept secret is present in the Boolean masking as a representation masked with a first Boolean mask and a second Boolean mask. A first additive mask and a second additive mask are determined for the value to be kept secret. A first masking transition is executed in which the first Boolean mask is converted into the first additive mask. A second masking transition is executed in which the obfuscation value is converted into an additive correction value, and a third masking transition is executed in which the second Boolean mask is converted into the second additive mask.
Claims18
A method for a masking transition of a cryptographic calculation, the masking transition being a transition from a Boolean masking of a value to be kept secret to an additive masking of the value to be kept secret, the value to be kept secret being present in the Boolean masking as a representation masked with a first Boolean mask and a second Boolean mask, and wherein a first additive mask and a second additive mask are determined for the value to be kept secret, the method comprising:
- executing a first masking transition in which the first Boolean mask is converted into the first additive mask, wherein the first additive mask is a masked representation of an additive mask corresponding to the first Boolean mask, wherein the first additive mask is masked with an obfuscation value serving as a Boolean mask;
- executing a second masking transition in which the obfuscation value is converted into an additive correction value;
- and
- executing a third masking transition in which the second Boolean mask is converted into the second additive mask,
- wherein a Boolean masked representation results from applying the first Boolean mask and the second Boolean mask to the value to be kept secret and an additive masked representation results from applying the first additive mask and the second additive mask to the value to be kept secret, and
- wherein the Boolean masked representation has a same value as the additive masked representation.
A device comprising:
- a portable data carrier or chip module,
- wherein the device includes at least one processor and at least one memory, and
- wherein the device is arranged to execute a method for a masking transition of a cryptographic calculation, the masking transition being a transition from a Boolean masking of a value to be kept secret to an additive masking of the value to be kept secret, the value to be kept secret being present in the Boolean masking as a representation masked with a first Boolean mask and a second Boolean mask, and wherein a first additive mask and a second additive mask are determined for the value to be kept secret, the method including
- executing a first masking transition in which the first Boolean mask is converted into the first additive mask, wherein the first additive mask is a masked representation of an additive mask corresponding to the first Boolean mask,
- wherein the additive mask is masked with an obfuscation value serving as a Boolean mask;
- executing a second masking transition in which the obfuscation value is converted into an additive correction value;
- and
- executing a third masking transition in which the second Boolean mask is converted into the second additive mask,
- wherein a Boolean masked representation results from applying the first Boolean mask and the second Boolean mask to the value to be kept secret and an additive masked representation results from applying the first additive mask and the second additive mask to the value to be kept secret, and
- wherein the Boolean masked representation has a same value as the additive masked representation.
Dependencies are inferred from the claim text.