Randomizing the Montgomery Multiplication to Repel Template Attacks on Multiplicative Masking
Marcel Medwed, Christoph Herbst · 2010
Abstract. For a long time multiplicative masking together with highly regular exponentiation algorithms was believed to thwart all side-channel based threats. Recent research results showed that the multiplicative masking itself can be attacked in order to recover the used masks. In this paper we propose a countermeasure which closes this security gap. The basic idea is to protect the masking step by introducing a randomized multiplication. The proposed method is cheap in terms of performance overhead. The memory overhead is reasonable.