Additively Homomorphic Ring-LWE Masking

Abstract

In this paper, we present a new masking scheme for ring-LWE decryption. Our scheme exploits the additively-homomorphic property of the existing ring-LWE encryption schemes and computes an additive-mask as an encryption of a random message. Our solution differs in several aspects from the recent masked ring-LWE implementation by Reparaz et al. presented at CHES 2015; most notably we do not require a masked decoder but work with a conventional, unmasked decoder. As such, we can secure a ring-LWE implementation using additive masking with minimal changes. Our masking scheme is also very generic in the sense that it can be applied to other additively-homomorphic encryption schemes.

An Attack on the Multiplication

An adversary could mount the following attack with a zero-value power model to recover only whether $s[i]=0$ or not. Note that the distribution of $(c_1+c'_1)\cdot s$ when $s=0$ and $c_1+c'_1$ is uniform random is different from the distribution of $(c_1+c'_1) \cdot s$ when $s\ne 0$. This effect resembles [GT02], with the important difference that here the attacker has no control over $(c_1+c'_1)$ and that the outcome of the attack is recovering only whether $s[i]=0$ or not.

• 1. locate time samples where $(c_1+c'_1)[i] \cdot s[i]$ is handled $i\in \{0,\ldots , 255\}$.

• 2. cluster $(c_1+c'_1)[i] \cdot s[i]$ into two groups according to mean power consumption (or variance).

• 3. tag the two groups as $s[i]=0$ or $s[i]\ne 0$.