Method of executing an algorithm for protecting an electronic device by affine masking and associated device
AssigneeThales
InventorsGuillaume Fumaroli, Sylvain Lachartre, Jean Martinelli, Emmanuel Prouff, Mathieu Rivain
Life of this patent
Estimating the term…
Abstract
A method of executing an algorithm includes protecting an electronic device by affine masking. The electronic device executes operations on secret variables x, the secret variables x being binary vectors of a given size N other than zero. The method further includes replacing the secret variables x using an affine masking operation, by the following affine function: m(x)=R.x+r, where R is a random invertible binary matrix with N rows and N columns and r is a random binary vector of size N.
Claims15
A method of executing an algorithm, said method comprising protecting an electronic device by affine masking, wherein said device executes operations on secret variables x, said secret variables x being binary vectors of a given size N other than zero, said method further comprising replacing said secret variables x using an affine masking operation, by the following affine function:
- m(x)=R.x+r, where R is a random invertible binary matrix with N rows and N columns and r is a random binary vector of size N,
- wherein said electronic device executes at least one linear operation on a set of secret variables z1, . . . , zm, producing the result z=A1z1+A2z2+ . . . +Amzm, where the variables A1, A2 . . . Am are matrices, each of which commutes with the matrix R and its inverse R−1, and the operation of the affine masking of said result z is carried out by the following steps:
- apply said operation of affine masking to the set of said variables z1, . . . zm in order to produce the set of masked variables z1, . . . , zm;
- determine, from said random vector r and a second random binary vector r′, a third random vector r″=r′(A1+ . . . +Am)r;
- and
- determine the result z of the affine masking operation applied to the result z of said linear operation, by the following calculation steps:
- z=A1 z1+r″
- For i varying from 2 to m,
- z= z+Ai zi
- z= z+r+r′.
A method of executing an algorithm, said method comprising protecting an electronic device by affine masking, wherein said device executes operations on secret variable x, said secret variables x being binary vectors of a given size N other than zero, said method further comprising replacing said secret variables x using an affine masking operation, by the following affine function:
- m(x)=R.x +r, where R is a random invertible binary matrix with N rows and N columns and r is a random binary vector of size N, wherein said electronic device executes at least one linear operation on a set of secret variables z1, . . . , zm of size N, producing the result z=A1z1+A2z2+ . . . +Amzm, where the variables A1, A2 . . . Am are matrices which do not commute with the matrix R or its inverse R−1, and the operation of the affine masking of said result z is executed by the following steps:
- determine, for the set of said binary vectors x of size N, the table TR, such that TR[x]=R.x;
- determine, for the set of said binary vectors x of size N, the table TR−1, such that TR−1[x]=R−1x;
- determine, for the set of said binary vectors x of size N, the tables Ai such that Ai[x]=TR[AiTR−1[x]], for i varying from 1 to m;
- apply said operation of affine masking to the set of said variables z1, . . . zm in order to produce the set of masked variables z1, . . . , zm;
- calculate, from said random vector r and a second random binary vector r′, the binary vector r″=( A1[r]+ . . . + Am[r])+r′;
- and
- determine the result z of the affine masking operation applied to the result z of said linear operation, by the following calculation steps:
- z=A1[ z1]+r″
- For i varying from 2 to m,
- z= z+ Ai[ zi]
- z= z+r+r′.
A method of executing an algorithm, said method comprising protecting an electronic device by affine masking, wherein said device executes operations on secret variable x, said secret variables x being binary vectors of a given size N other than zero, said method further comprising replacing said secret variables x using an affine masking operation, by the following affine function:
- m(x)=R.x+r, where R is a random invertible binary matrix with N rows and N columns and r is a random binary vector of size N, wherein said electronic device executes at least one non-linear operation S on at least one secret variable y, producing the result y′=S(y), and in that the operation of affine masking of said result y′ is executed by the following steps:
- apply said affine masking operation to the secret variable y in order to produce the result y=R·y+r;
- determine an adapted operation S′ of the non-linear operation S by the following relation:
- S′(●)=R·S(R−1·(●+r))+r;
- and
- determine the result y′ of the affine masking operation applied to the result y′ of said non-linear operation, by the following relation:
- y′=S′( y).
Dependencies are inferred from the claim text.