Addition with Blinded Operands

Abstract

The masking countermeasure is an efficient method to protect cryptographic algorithms against Differential Power Analysis (DPA) and similar attacks. For symmetric cryptosystems, two techniques are commonly used: Boolean masking and arithmetic masking. Conversion methods have been proposed for switching from Boolean masking to arithmetic masking, and conversely. The way conversion is applied depends on the combination of arithmetic and Boolean/logical operations executed by the underlying cryptographic algorithm.

This paper focuses on a combination of one addition with one or more Boolean operations. Building on a secure version of a binary addition algorithm (namely, the and-xor-and-double method), we show that conversions from Boolean masking to arithmetic masking can be avoided. We present an application of the new algorithm to the XTEA block-cipher.

A Optimized Variant of Goubin’s Method

We show in this appendix how to rearrange the operations in the secure $\mathrm {A}{\rightarrow }\mathrm {B}$ algorithm used for converting $A = x-r$ to $x'=x\oplus r$. As a result, the algorithm cost is slightly reduced.

The carry expansion formula expressed using $t_i$, $0\le i \le k-1$ (see [8, Corollary 2.1]) can be simplified. The idea is to start the recursion with $t_0 = 0$ instead of $t_0 = 2\gamma$. The value of $t_1$ then simplifies to $t_1 = 2\bigl [t_0 \mathbin { \& }(A \mathbin {\oplus }r) \mathbin {\oplus }\omega \bigr ] = 2\omega$. The recursion formula can so be re-written as

$$ t_i = {\left\{ \begin{array}{ll} 2\omega &{} \text {if } i = 1 ,\\ 2\left[ t_i\mathbin { \& }(A\mathbin {\oplus }r)\mathbin {\oplus }\omega \right] &{} \text {for } 2 \leqslant i \leqslant k-1 . \end{array}\right. } $$

The main loop within the secure $\mathrm {A}{\rightarrow }\mathrm {B}$ conversion algorithm becomes then:

We extract the first loop iteration and trade five operations against one logical shift operation. This reduces the algorithm cost to ${\underline{5k+1}}$ operations. This small change has no impact on the security of the algorithm.