Detecting faults in inner product masking scheme

Abstract

Side-channel analysis and fault injection attacks are two typical threats to cryptographic implementations, especially in modern embedded devices. Thus, there is an insistent demand for dual side-channel and fault injection protections. As we know, masking is a kind of provable countermeasure against side-channel attacks. Recently, inner product masking (IPM) was proposed as a promising higher-order masking scheme against side-channel analysis, but not for fault injection attacks. In this paper, we devise a new masking scheme named IPM-FD. It is built on IPM, which enables fault detection. This novel masking scheme has three properties: the security orders in the word-level probing model, bit-level probing model and the number of detected faults. IPM-FD is proven secure both in the word-level and in the bit-level probing models and allows for end-to-end fault detection against fault injection attacks. Furthermore, we illustrate its security order by interpreting IPM-FD as a coding problem and then linking it to one defining parameters of linear code and show its implementation cost by applying IPM-FD to AES-128.

An optimal codes for IPM-FD with \(k=2\)

Table 6 Examples with ${\mathbb {K}}= {\mathbb {F}}_2$, $d_w$ and $d_b$ are security orders at word level and bit level, respectively. In this case, the same codes can also be used in BM-FD, while BM-FD is defined over ${\mathbb {K}}= {\mathbb {F}}_{2^l}$

By using Magma [35], we present some instances for IPM-FD with $k=2$, in particular ${\mathbb {K}}= {\mathbb {F}}_{2^4}$ in Table 5 and ${\mathbb {K}}= {\mathbb {F}}_{2}$ in Table 6, respectively. Interestingly, we notice that for ${\mathbb {K}}= {\mathbb {F}}_{2}$ the best minimum distance of ${\mathbf {H}}^\perp$ is equal to BKLC(GF(2), n, 2), where n is the same as in Table 6.