Higher-order Masking and Shuing for Software Implementations of Block Ciphers - Extended Version ? -
Matthieu Rivain, Emmanuel Prou, Julien Doget · 2009
Dierential Power Analysis (DPA) is a powerful side channel key recovery attack that eciently breaks block ciphers implementations. In software, two main techniques are usually applied to thwart them: masking and operations shuing. To benefit from the advantages of the two techniques, recent works have proposed to combine them. However, the schemes which have been designed until now only provide limited resistance levels and some advanced DPA attacks have turned out to break them. In this paper, we investigate the combination of masking and shuing. We moreover extend the approach with the use of higher-order masking and we show that it enables to significantly improve the security level of such a scheme. We first conduct a theoretical analysis in which the eciency of advanced DPA attacks targeting masking and shuing is quantified. Based on this analysis, we design a generic scheme com- bining higher-order masking and shuing. This scheme is scalable and its security parameters can be chosen according to any desired resistance level. As an illustration, we apply it to protect a software implementation of AES for which we give several security/eciency trade-os.