Gaussian Elimination (GE) is a critical operation in the signing procedure of multivariate- and code-based schemes. In this paper, we provide a masking scheme for GE with back substitution to defend against arbitrary-order attacks. We propose a masked algorithm for transforming a system of linear equations into row-echelon form. This is realized by introducing techniques for efficiently making leading (pivot) elements one while avoiding costly conversions between Boolean and multiplicative masking at all orders. We also propose a technique for efficient masked back substitution, which eventually enables a secure unmasking of the output. All novel gadgets are proven secure in the t-probing model. Additionally, we evaluate the overhead of our countermeasure for several post-quantum candidates and their different security levels at first-, second-, and third-order, including UOV, MAYO, SNOVA, QR-UOV, and MQ-Sign. Notably, the operational cost of first-, second-, and third-order masked GE is 2.3 \(\times \) higher, and the randomness cost is 1.2 \(\times \) higher in MAYO compared to UOV for security levels III and V. In contrast, these costs are similar in UOV and MAYO for one version of level I. We also show detailed performance results for first-, second- and third-order masked GE implementations on the Arm Cortex-M4 and compare them with unmasked cycle counts. Our first-order masked implementation has an overhead of factor 15.1 \(\times \) , 15.2 \(\times \) , and 15.4 \(\times \) compared to the unprotected implementation of UOV-I, UOV-III and UOV-V.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Masking Gaussian Elimination at Arbitrary Order with Application to Multivariate-and Code-Based PQC

  • Quinten Norga,
  • Suparna Kundu,
  • Uttam Kumar Ojha,
  • Anindya Ganguly,
  • Angshuman Karmakar,
  • Ingrid Verbauwhede

摘要

Gaussian Elimination (GE) is a critical operation in the signing procedure of multivariate- and code-based schemes. In this paper, we provide a masking scheme for GE with back substitution to defend against arbitrary-order attacks. We propose a masked algorithm for transforming a system of linear equations into row-echelon form. This is realized by introducing techniques for efficiently making leading (pivot) elements one while avoiding costly conversions between Boolean and multiplicative masking at all orders. We also propose a technique for efficient masked back substitution, which eventually enables a secure unmasking of the output. All novel gadgets are proven secure in the t-probing model. Additionally, we evaluate the overhead of our countermeasure for several post-quantum candidates and their different security levels at first-, second-, and third-order, including UOV, MAYO, SNOVA, QR-UOV, and MQ-Sign. Notably, the operational cost of first-, second-, and third-order masked GE is 2.3 \(\times \) higher, and the randomness cost is 1.2 \(\times \) higher in MAYO compared to UOV for security levels III and V. In contrast, these costs are similar in UOV and MAYO for one version of level I. We also show detailed performance results for first-, second- and third-order masked GE implementations on the Arm Cortex-M4 and compare them with unmasked cycle counts. Our first-order masked implementation has an overhead of factor 15.1 \(\times \) , 15.2 \(\times \) , and 15.4 \(\times \) compared to the unprotected implementation of UOV-I, UOV-III and UOV-V.