Lightweight Conversion from Arithmetic to Boolean Masking for Embedded IoT Processor

Abstract

A masking method is a widely known countermeasure against side-channel attacks. To apply a masking method to cryptosystems consisting of Boolean and arithmetic operations, such as ARX (Addition, Rotation, XOR) block ciphers, a masking conversion algorithm should be used. Masking conversion algorithms can be classified into two categories: “Boolean to Arithmetic (B2A)” and “Arithmetic to Boolean (A2B)”. The A2B algorithm generally requires more execution time than the B2A algorithm. Using pre-computation tables, the A2B algorithm substantially reduces its execution time, although it requires additional space in RAM. In CHES2012, B. Debraize proposed a conversion algorithm that somewhat reduced the memory cost of using pre-computation tables. However, they still require $(2^{(k+1)})$ entries of length $(k+1)$-bit where k denotes the size of the processed data. In this paper, we propose a low-memory algorithm to convert A2B masking that requires only $(2^k)(k)$-bit. Our contributions are three-fold. First, we specifically show how to reduce the pre-computation table from $(k+1)$-bit to $(k)$-bit, as a result, the memory use for the pre-computation table is reduced from $(2^{(k+1)})(k+1)$-bit to $(2^k)(k)$-bit. Second, we optimize the execution times of the pre-computation phase and the conversion phase, and determine that our pre-computation algorithm requires approximately half of the operations than Debraize’s algorithm. The results of the 8/16/32-bit simulation show improved speed in the pre-computation phase and the conversion phase as compared to Debraize’s results. Finally, we verify the security of the algorithm against side-channel attacks as well as the soundness of the proposed algorithm.

1. Introduction

Side-channel attacks exploit various types of physical leakage—including power consumption, electromagnetic radiation, running time, etc.—during the execution of a cryptographic algorithm on a real device [1,2,3]. Differential Power Analysis (DPA), which was introduced in 1999 by P. Kocher, is a statistical method that retrieves secret keys using information leakage from the power consumption of the device [4]. Since the introduction of DPA, the importance of implementing countermeasures against side-channel attacks has only grown.

The masking method was suggested by T. Messerges to provide theoretical security against the DPA attack [5,6,7]. The masking method breaks the relation between the algorithmic value (the value specified by the algorithm) and the processed value (the value that is actually processed by the device) by using random numbers. The typical types of masking methods include Boolean masking and arithmetic masking [8]. Boolean masking uses an XOR (exclusive or) to blind values such as $x^{\prime }=x\oplus r$, and arithmetic masking uses an algebraic operation such as $A=(x-r)mod{2}^k$.

These two types of masking should be selectively used for cryptographic algorithms that consist of Boolean and arithmetic operations such as ARX (Addition, Rotation, XOR) block ciphers [9,10,11], cryptographic hash functions [12,13], and stream ciphers [14]. In general, Boolean operations (AND, XOR, SHIFT, etc.) and arithmetic operations (Addition, Subtraction, Multiplication, etc.) can be efficiently computed using Boolean masking and arithmetic masking, respectively; however, it is very difficult to execute arithmetic operations in Boolean masking and to execute Boolean operations in arithmetic masking. This problem can be easily solved using a masking conversion algorithm between Boolean and arithmetic masking.

1.1. Related Work

The first masking conversion algorithm to counteract first-order DPA was proposed by L. Goubin in 2001 [15]. This conversion algorithm from Boolean to arithmetic masking (B2A) has been elaborately implemented without any improvements made upon it. In contrast, the conversion algorithm from arithmetic to Boolean masking (A2B) is quite sluggish and could be improved in terms of the execution time. More specifically, the B2A algorithm has a constant execution time within the arbitrary bit size of the processed data, while the A2B algorithm requires substantially more execution time as the bit size increases.

Coron et al. tried to use memory to address this limitation [16]. They described the use of pre-computation tables to obtain large benefits in terms of execution time, although it required additional space in RAM. There have also been numerous attempts to optimize the memory use [17,18,19,20,21].

Recently B. Debraize proposed a conversion algorithm that offered a substantial reduction in memory for the use of pre-computation tables [22]. Briefly, this proposal iterates the conversion phase with a k-bit value using a $(k+1)$-bit table.

1.2. Our Contribution

Masking conversion algorithms are mainly used to mask ARX ciphers. Most of the ARX ciphers, which is used in the IoT environments, are consisted of 32-bit unit operations. These ciphers aim to achieve fast encryption and a small code size. However, even if the ARX cipher is masked by Debraize’s method, memory usage is still of concern. To overcome this problem, we propose an extremely low-memory algorithm that converts from arithmetic masking to Boolean masking.

The contributions of this paper are as follows:

• Reducing the memory usage: We further reduce the memory usage of the pre-computation table from the $(2^{(k+1)})(k+1)$-bit achieved by Debraize’s method [22] to $(2^k)(k)$-bit. The main idea is that the pre-computation table can be reduced by one bit based on the fact that the XOR operation is the same as the subtraction on ${\mathbb{F}}_2$; this is the so-called LSB trick. The LSB trick has been mentioned in previous papers, but we apply this trick specifically to the A2B algorithms. Furthermore, we validate this intuitive fact using mathematical induction. As a result, our proposal can save one bit for each table. Our proposal also allows for compact, optimized memory usage in the real world. For example, if k is 8-bit, our algorithm can be constructed using a char data type.
• Reducing the execution time: We reduce the execution time of the pre-computation phase to approximately half of that achieved by Debraize’s method. When measuring the execution time of the algorithms using a pre-computation table, some researchers have focused only on the encryption parts. However, in the real world, the execution time of the pre-computation phase cannot be disregarded. We design a new pre-computation algorithm to minimize the number of for loops and the number of operators in each for loop. Our evaluation shows that our proposal requires approximately half of the operations of Debraize’s pre-computation algorithm. In additional, we simulate 8-bit, 16-bit, and 32-bit environments. On average, the results of the simulation show improvements in speed of 87% in the pre-computation phase and of 23% in the conversion, compared to that in [22].
• Verifying the security and the soundness: We verify the security against side-channel attacks and the soundness of the proposed algorithm using mathematical induction. That is, we show that all intermediate values of the proposed algorithm are random, and the soundness is reflected by the fact that the proposed algorithm always returns the correct output for an arbitrary input.

1.3. Outline of the Paper

The rest of this paper is organized as follows. In Section 2, we introduce the conversion algorithms currently used to convert between Boolean masking and arithmetic masking. Section 3 is the core of the paper, in which we present a new conversion algorithm to convert from arithmetic masking to Boolean masking. In Section 4, we analyze the security against side-channel attacks as well as the soundness of the proposed algorithm. In Section 5, we present performance metrics for our method and Debraize’s method. Finally, we conclude in Section 6.

2. Background

2.1. Masking Method

Masking methods use random numbers to break the relationship between the power consumption of a crypto-device and sensitive values in a crypto-algorithm. Numerous articles have been published on a variety of masking types, such as Boolean masking [23], arithmetic masking [8], polynomial masking [24], and inner product masking [25]. Among these, Boolean masking and arithmetic masking are the most widely known masking types.

Boolean masking and arithmetic masking use the following respective formulae:

• Boolean Masking: $x^{\prime }=x\oplus r_x$
• Arithmetic Masking: $A=x-r_{x}mod{2}^k$

Given k-bit values; x is a sensitive value depending on the key; and $x^{\prime }$, A, and $r_x$ are Boolean masked values, arithmetic masked values, and masking values, respectively.

Boolean and arithmetic masking are used for algorithms that consist of Boolean and arithmetic operations, such as ARX block ciphers [9,10,11], cryptographic hash functions [13], and stream ciphers [14]. More specifically, additions are computed on the arithmetic masking, and SHIFT, XOR, and AND are computed on Boolean masking. In this case, a conversion algorithm between arithmetic and Boolean masking is necessary, and this algorithm must be secure against DPA attacks.

The first masking conversion algorithm was introduced by T. Messerges [26], but vulnerabilities were discovered in it against DPA attacks. In CHES 2001, L. Goubin proposed an improved masking conversion algorithm that guaranteed security against DPA attacks [15]. That algorithm can convert from Boolean to arithmetic masking with only 5 XORs and 2 subtractions. This algorithm has recently been extended to a higher-order masking scheme [20,27]. According to [20,27], these countermeasures have time complexity $O(n^2·k)$ and $O(2^n)$ for n shares on the security against t-th order DPA attacks, respectively.

In contrast, conversion algorithms from arithmetic to Boolean masking have been improved through various efforts.

2.2. Arithmetic to Boolean (A2B) Masking

Conversion algorithms from arithmetic to Boolean masking can be broadly classified into two types based on the concept of hardware adders: carry look-ahead-based algorithms and ripple-carry-based algorithms. The first category operates with two values, i.e., Generation and Propagation, whether carry values are either propagated (at least one input is 1) or generated (both inputs are 1). Carry look-ahead-based algorithms can be implemented with Boolean operators such as SHIFT, AND, and XOR. A conversion algorithm of the first category, presented in FSE 2015 by Coron et al., reduces the complexity to a logarithmic scale [21]. However, it is hard to speed up this algorithm using memory storage, such as with pre-computation tables. On the other hand, algorithms in the second category iterate the task of adding the carry value generated in the lower stages to the upper stages. Ripple-carry-based algorithms are easy to optimize in terms of execution time by using memory. There have been various comparisons between the two categories. However, the performance of each algorithm and type of algorithm depends on the implementation environment, such as memory size, CPU architecture, and cryptographic algorithms.

In this paper, we propose an A2B algorithm to optimize memory storage based on the second type of algorithm.

2.3. The A2B Algorithm Based on the Ripple-Carry Adder

Ripple-carry-based A2B algorithms were first proposed by Goubin then improved by Coron, Neiße, and Debraize by using a pre-computation table. This paper briefly summarizes the point of each algorithm and explains their working principles in the following sections.

2.3.1. Goubin’s A2B Algorithm

The Algorithm 1 was proposed by L. Goubin in CHES2001. We classify it as a ripple-carry-based algorithm because it computes the carry bit generated from the lower bits to the upper bits in Lines 11–16, such as the concept of the ripple-carry-based algorithms. Goubin’s A2B algorithm iterates K times with the K-bit input, meaning that this algorithm is inefficient for large inputs. The algorithm is based on the following recursion formula:

Theorem 1

(Goubin’s recursion formula [15]). If we denote $x^{\prime }=(A+r)\oplus r$, we also have $x^{\prime }=A\oplus u_{K-1}$, where $u_{K-1}$ is obtained from the following recursion formula:

$$\{\begin{array}{}\mathrm{(1)}& u_0=0\hfill \mathrm{(2)}& \forall K\ge 0,u_{K+1}=2[u_K\wedge (A\oplus r)\oplus (A\wedge r)].\hfill \end{array}$$

Algorithm 1 Goubin’s A2B Algorithm [15]

Require:$(A,r)$ /* $A=x-r$ */

Ensure:$(x^{\prime },r)$ /* $x^{\prime }=x\oplus r$ */

1: $\mathsf{{\rm Y}}\leftarrow rand()$ 2: $T\leftarrow 2\mathsf{{\rm Y}}$ 3: $x^{\prime }\leftarrow \mathsf{{\rm Y}}\oplus r$ 4: $\Omega \leftarrow \mathsf{{\rm Y}}\wedge x^{\prime }$ 5: $x^{\prime }\leftarrow T\oplus A$ 6: $\mathsf{{\rm Y}}\leftarrow \mathsf{{\rm Y}}\oplus x^{\prime }$ 7: $\mathsf{{\rm Y}}\leftarrow \mathsf{{\rm Y}}\wedge r$ 8: $\Omega \leftarrow \Omega \oplus \mathsf{{\rm Y}}$ 9: $\mathsf{{\rm Y}}\leftarrow T\wedge A$ 10: $\Omega \leftarrow \Omega \oplus \mathsf{{\rm Y}}$ 11: for$i=1$ to $K-1$ do 12:   $\mathsf{{\rm Y}}\leftarrow T\wedge r$ 13:   $\mathsf{{\rm Y}}\leftarrow \mathsf{{\rm Y}}\oplus \Omega$ 14:   $T\leftarrow T\wedge A$ 15:   $\mathsf{{\rm Y}}\leftarrow \mathsf{{\rm Y}}\oplus T$ 16:   $T\leftarrow 2\mathsf{{\rm Y}}$ 17: end for 18: $x^{\prime }\leftarrow x^{\prime }\oplus T$ 19: return$x^{\prime },r$

2.3.2. Coron’s A2B Algorithm

As Goubin’s A2B algorithm requires several operations that are linear in terms of the sizes of bits, it can serve as a bottleneck when implemented. Coron et al. improved the A2B algorithm by using pre-computation look-up tables. They used the pre-computation table $T[.]$ of $(k·n)$-bit size to reduce the number of iterations from K to $K/k$. The Algorithms 2 and 3 are improved versions from [22]. Although Coron’s algorithm takes time in the pre-computation phase, the execution time of its conversion phase can be reduced in comparison to that of Goubin’s algorithm. In summary, Coron’s algorithm has been improved in terms of execution time. However, this algorithm still has a disadvantage in terms of its memory usage (i.e., the table size is too large).

Table 1. Intermediate Values of Algorithm 3.

Line	Intermediate Value of $\mathit{A}(\mathit{i}=0)$
1	$A-(r\Vert \dots \Vert r)-\Gamma mod{2}^{k·n}$
	$=x-R-(r\Vert \dots \Vert r)-{\sum }_{i=1}^{n-1}{2}^{i·k}·\gamma mod{2}^{k·n}$
3	$(x_h\Vert 0_k)-(R_h\Vert 0_k)-(r\Vert \dots \Vert 0_k)-{\sum }_{i=1}^{n-1}{2}^{i·k}·\gamma$
	$+x_l-R_l-rmod{2}^{k·n}$
4	$(x_h\Vert 0_k)-(R_h\Vert 0_k)-(r\Vert \dots \Vert 0_k)-{\sum }_{i=1}^{n-1}{2}^{i·k}·\gamma$
	$+x_l-rmod{2}^{k·n}$
5	$(x_h\Vert 0_k)-(R_h\Vert 0_k)-(r\Vert \dots \Vert 0_k)-{\sum }_{i=1}^{n-1}{2}^{i·k}·\gamma$
	$+T[x_l-r]mod{2}^{k·n}$
	$=(x_h\Vert 0_k)-(R_h\Vert 0_k)-(r\Vert \dots \Vert 0_k)-{\sum }_{i=\mathbf{2}}^{n-1}{2}^{i·k}·\gamma$
	$+(c\Vert 0_k)+(x_l\oplus r)mod{2}^{k·n}$
	$=((x_h+c)\Vert 0_k)-(R_h\Vert 0_k)-(r\Vert \dots \Vert 0_k)-{\sum }_{i=\mathbf{2}}^{n-1}{2}^{i·k}·\gamma$
	$+(x_l\oplus r)mod{2}^{k·n}$
7	$=\dot{x_h}-R_h-(r\Vert \dots \Vert r)-{\sum }_{i=1}^{n-2}{2}^{i·k}·\gamma mod{2}^{(n-1)·k}$

shows the intermediate value A of Algorithm 3 when loop $i=0$. $0_k$ indicates 0 filled with k-bits. c denotes the carry bit at the pre-computation table $T\left[A\right]$ in Algorithm 2. As can be verified in Table 1, the initial and final forms of the for loop are the same, i.e., it is intuitively confirmed that the algorithm operates recursively and correctly. The main idea for handling the carry bit is to blind the carry bit with a large random number $\gamma$. To omit the step of removing the masking value $\gamma$ in the conversion phase, these algorithms calculate $\Gamma$ in the pre-computation phase and subtract it at the beginning of the conversion phase.

Algorithm 2 Improved Coron’s Table T Generation [22]

Require:$None$

Ensure:$T[.],r,\Gamma$

1: Generate a random k-bit r and a random $((n-1)·k)$-bit $\gamma$ 2: $\Gamma \leftarrow {\sum }_{i=1}^{n-1}{2}^{i·k}·\gamma mod{2}^{n·k}$ 3: ${\gamma }^{\prime }\leftarrow \gamma \Vert r$ 4: for$A=0$ to $2^k-1$ do 5:   $T\left[A\right]\leftarrow (A+{\gamma }^{\prime }mod{2}^{k·n})\oplus r$ 6: end for 7: return$T[.],r,\Gamma$

Algorithm 3 Improved Coron’s A2B Algorithm [22]

Require:$(A,R),T[.],r,\Gamma$ /* $x=A+Rmod{2}^{k·n}$ */

/* $T[.],r,\Gamma$ generated during pre-computation phase */

Ensure:$(x^{\prime },R)$ /* $x=x^{\prime }\oplus R$ */

1: $A\leftarrow A-(r\Vert \dots \Vert r)-\Gamma mod{2}^{k·n}$ 2: for$i=0$ to $n-1$ do 3:   Split A into $A_h\Vert A_l$ and R into $R_h\Vert R_l$   (such that $A_l$ and $R_l$ have size k) 4:   $A\leftarrow A+R_{l}mod{2}^{(n-i)·k}$ 5:   $A\leftarrow (A_h\Vert 0_k)+T\left[A_l\right]mod{2}^{k·n}$ 6:   $x_i^{\prime }\leftarrow A_l\oplus R_l$ 7:   $A\leftarrow A_h$ and $R\leftarrow R_h$ 8: end for 9: return$(x_{n-1}^{\prime }\Vert \dots \Vert x_0^{\prime })\oplus (r\Vert \dots \Vert r)$

2.3.3. Neiße’s A2B Algorithm

Neiße et al. suggested a new method to handle carry bits using complemented values in the conversion phase. This method was able to reduce the size of the pre-computation table. An adapted version of the Neiße-Pulkus method was proposed in [22]; however, the author claimed that this A2B algorithm is vulnerable to combination attacks that distinguish 00...00 and 11...11(−1) using the Simple Power Analysis (SPA) attack and recovers the secret values using the DPA attack. For example, let us suppose that the value z at the conversion phase in [22] is extracted as 0 by the SPA attack. In this case, the most significant bit (i.e., the carry bit) is biased, and this biased bit allows for side-channel attacks. However, this vulnerability can easily be made secure. In addition, Neiße’s A2B algorithm in [22] does not work. Algorithms 4 and 5 are versions of this algorithm that are correct and secure against combination attacks due to their use of the LSB (Least Significant Bit) trick. The LSB trick is a technique that reduces pre-computation tables by one bit based on the equivalence that the Boolean masked value $B_i$ is the same as the arithmetic masked value $A_i$ on ${\mathbb{F}}_2$. The LSB trick was mentioned in Neiße’s paper, and we applied this trick specifically to the A2B algorithms. However, it is not perfectly safe to change $(0,-1)$ to $(0,1)$ against SPA. It has been published that binary classification of “0” and “1” is possible using side-channel information [28]. Neiße’s A2B algorithm could be potentially exploited via side-channel vulnerabilities.

The working principle of Neiße’s algorithm is that the converted data from arithmetic to Boolean masking are either $(x,R)$ or $(\overline{x},\overline{R})$. Their complementary values are determined by z. Although this masking scheme does not mask the carry bit with a probability of $1/2$, the carry bit is 0 or 1 with probabilities of $\frac{(2^k-1)}{2^{k+1}}$ and $\frac{(2^k+1)}{2^{k+1}}$ respectively for arbitrary z and r. In other words, the probability that the carry bit is generated for any sensitive value x is always equal to the same distribution, and so it is safe against DPA attacks.

Table 2. Intermediate Values of Algorithm 5.

Line	Intermediate Value of $\mathit{A}(\mathit{i}=0)$
1	$\tilde{A}+z-(r\Vert \dots \Vert r)mod{2}^{k·n}$
	$=\widetilde{(x-R)}+z-(r\Vert \dots \Vert r)mod{2}^{k·n}$
	$=\tilde{x}-\tilde{R}-(r\Vert \dots \Vert r)mod{2}^{k·n}$
	$(\because \widetilde{(a-b)}=\tilde{a}-\tilde{b}-z)$
4	$(\widetilde{x_h}\Vert 0_k)-(\widetilde{R_h}\Vert 0_k)-(r\Vert \dots \Vert 0_k)$
	$+\widetilde{x_l}-\widetilde{R_l}-rmod{2}^{k·n}$
5	$(\widetilde{x_h}\Vert 0_k)-(\widetilde{R_h}\Vert 0_k)-(r\Vert \dots \Vert 0_k)$
	$+\widetilde{x_l}-rmod{2}^{k·n}$
6	$(\widetilde{x_h}\Vert 0_k)-(\widetilde{R_h}\Vert 0_k)-(r\Vert \dots \Vert 0_k)$
	$+T[\widetilde{x_l}-r]mod{2}^{k·n}$
	$=(\widetilde{x_h}\Vert 0_k)-(\widetilde{R_h}\Vert 0_k)-(r\Vert \dots \Vert 0_k)+(c^{\prime }\Vert 0_k)$
	$+(\widetilde{x_l}\oplus r)mod{2}^{k·n}$
	$=(\widetilde{(x_h+c)}\Vert 0_k)-(\widetilde{R_h}\Vert 0_k)-(r\Vert \dots \Vert 0_k)$
	$+(\widetilde{x_l}\oplus r)mod{2}^{k·n}$
8	$=\widetilde{\dot{x_h}}-\widetilde{R_h}-(r\Vert \dots \Vert r)mod{2}^{(n-1)·k}$

shows the intermediate value A of Algorithm 5 when loop $i=0$. For a value w, let $\tilde{w}$ denote w if $z=0$, and $\overline{w}$ if $z=1$. These computations are based on following equations.

$$\{\begin{array}{}\mathrm{(3a)}& \widetilde{(p+q)}=\tilde{p}+\tilde{q}+z\hfill \mathrm{(3b)}& \widetilde{(p-q)}=\tilde{p}-\tilde{q}-z\hfill \end{array}$$

As we can verify in Table 2, the initial and final forms of the for loop are the same. The algorithm operates recursively.

Algorithm 4 Neiße’s Table T Generation [17]

Require:$None$

Ensure:$T[.],r,\gamma ,z,Z[.]$

1: Generate a random bit z, a random k-bit r, and a random $(n·k)$-bit $\gamma$ 2: for$A=0$ to $2^k-1$ do 3:   $T\left[A\right]\leftarrow \{(A+r)\oplus r\}\gg 1$ 4: end for 5: $Z\left[0\right]\leftarrow \gamma$ 6: $Z\left[1\right]\leftarrow \gamma \oplus (-1mod{2}^{k·n})$ 7: return$T[.],r,\gamma ,z,Z[.]$

Algorithm 5 Neiße’s A2B Algorithm with LSB trick [17]

Require:$(A,R),T[.],r,\gamma ,z,Z[.]$ /* $x=A+Rmod{2}^{k·n}$ */

/* $T[.],r,\gamma ,z,Z[.]$ generated during pre-computation phase */

Ensure:$(x^{\prime },R)$ /* $x=x^{\prime }\oplus R$ */

1: $A\leftarrow ((A\oplus \gamma )\oplus Z\left[z\right])-(r\Vert \dots \Vert r)+zmod{2}^{k·n}$ 2: $R\leftarrow (R\oplus \gamma )\oplus Z\left[z\right]$ 3: for$i=0$ to $n-1$ do 4:   Split A into $A_h\Vert A_l$ and R into $R_h\Vert R_l$   (such that $A_l$ and $R_l$ have size k) 5:   $A\leftarrow A+R_{l}mod{2}^{(n-i)·k}$ 6:   $A\leftarrow (A_h\Vert 0_k)+(T\left[A_l\right]\Vert {\mathtt{LSB}}_{A_l})mod{2}^{(n-i)·k}$ 7:   $x_i^{\prime }\leftarrow A_l\oplus R_l$ 8:   $A\leftarrow A_h$ and $R\leftarrow R_h$ 9: end for 10: return$(x_{n-1}^{\prime }\Vert \dots \Vert x_0^{\prime })\oplus (r\Vert \dots \Vert r)$

2.3.4. Debraize’s A2B Algorithm

B. Debraize proposed an A2B algorithm which was quite optimized in terms of the memory usage of the pre-computation table as well as the execution time with security against DPA attacks. Debraize’s algorithms reduce the complexity of the conversion phase by using the masked carry bit as the input to the table. This means that the algorithm does not require for extra costs to handle the carry bit. However, the LSB trick briefly mentioned previously in this paper is not easy to directly apply to Debraize’s algorithms. Algorithms 6 and 7 are versions of Debraize’s algorithms adjusted to include the LSB trick. As shown at Line 6 in Algorithm 7, it is required for the process to update the carry bit of the previous for loop on the LSB.

Table 3. Intermediate Values of Algorithm 7.

Line	Intermediate Value of A and $\mathit{\beta }$
1	A : $A-(r\Vert \dots \Vert r)mod{2}^{k·n}$
	$=x-R-(r\Vert \dots \Vert r)mod{2}^{k·n}$
2	$\beta$ : $\rho$
4 $(i=0)$	A : $(x_h\Vert 0_k)-(R_h\Vert 0_k)-(r\Vert \dots \Vert 0_k)$
	$+x_l-R_l-rmod{2}^{k·n}$
5 $(i=0)$	A : $(x_h\Vert 0_k)-(R_h\Vert 0_k)-(r\Vert \dots \Vert 0_k)$
	$+x_l-rmod{2}^{k·n}$
6 $(i=0)$	$\beta \Vert x_0^{\prime }$ : $((T[\beta \Vert A_l]\Vert {\mathtt{LSB}}_{A_l})\oplus \beta )\oplus \rho$
	$=((T[(\rho \oplus 0)\Vert (x_l-r)]\Vert {\mathtt{LSB}}_{(x_l-r)})\oplus \rho )\oplus \rho$
	$=(c\oplus \rho )\Vert (x_l\oplus r)\Vert {\mathtt{LSB}}_{(x_l-r)}$
	$=(c\oplus \rho )\Vert (x_l\oplus r)$
	$\therefore \beta$  : $c\oplus \rho$
	$x_0^{\prime }$ : $x_l\oplus r$
8 $(i=0)$	A : $x_h-R_h-(r\Vert \dots \Vert r)mod{2}^{(n-1)·k}$
	$=x-R-(r\Vert \dots \Vert r)mod{2}^{(n-1)·k}$
	(Carry c is not yet updated in the register A)
4 $(i=1)$	A : $(x_h\Vert 0_k)-(R_h\Vert 0_k)-(r\Vert \dots \Vert 0_k)$
	$+x_l-R_l-rmod{2}^{(n-1)·k}$
5 $(i=1)$	A : $(x_h\Vert 0_k)-(R_h\Vert 0_k)-(r\Vert \dots \Vert 0_k)$
	$+x_l-rmod{2}^{(n-1)·k}$
6 $(i=1)$	$\beta \Vert x_1^{\prime }$ : $((T[\beta \Vert A_l]\Vert {\mathtt{LSB}}_{A_l})\oplus \beta )\oplus \rho$
	$=((T[(\rho \oplus c)\Vert (x_l-r)]\Vert {\mathtt{LSB}}_{(x_l-r)})\oplus (c\oplus \rho ))\oplus \rho$
	$=((c_{\mathtt{new}}\oplus \rho )|\left|((x_l+c)\oplus r)\right||{\mathtt{LSB}}_{(x_l-r)})\oplus c$
	$=(c_{\mathtt{new}}\oplus \rho )\Vert ((x_l+c)\oplus r)\Vert ({\mathtt{LSB}}_{(x_l-r)}\oplus c)$
	$=(c_{\mathtt{new}}\oplus \rho )\Vert ((x_l+c)\oplus r)\Vert {\mathtt{LSB}}_{(x_l+c-r)}$
	$=(c_{\mathtt{new}}\oplus \rho )\Vert ((x_l+c)\oplus r)$
	$\therefore \beta$  : $c_{\mathtt{new}}\oplus \rho$
	$x_i^{\prime }$ : $x_l\oplus r$
8 $(i=1)$	A : $x_h-R_h-(r\Vert \dots \Vert r)mod{2}^{(n-2)·k}$
	$=x-R-(r\Vert \dots \Vert r)mod{2}^{(n-2)·k}$
	(Carry $c_{\mathtt{new}}$ is not yet updated in the register A)

provides an understanding of Debraize’s conversion process. Although the original algorithms are well designed in terms of execution time and memory usage, applying the LSB trick incurs additional costs.

Algorithm 6 Debraize’s Table T Generation [22]

Require:$None$

Ensure:$T[.],r,\rho$

1: Generate a random k-bit r and a random bit $\rho$ 2: for$A=0$ to $2^k-1$ do 3:   $T[\rho \Vert A]\leftarrow \{(A+r)\oplus (\rho \Vert r)\}\gg 1$ 4:   $T[\rho \oplus 1\Vert A]\leftarrow \{(A+r+1)\oplus (\rho \Vert r)\}\gg 1$ 5: end for 6: return$T[.],r,\rho$

Algorithm 7 Debraize’s A2B Algorithm with LSB trick [22]

Require:$(A,R),T[.],r,\rho$ /* $x=A+Rmod{2}^{k·n}$ */

/* $T[.],r,\rho$ generated during pre-computation phase */

Ensure:$(x^{\prime },R)$ /* $x=x^{\prime }\oplus R$ */

1: $A\leftarrow A-(r\Vert \dots \Vert r)mod{2}^{n·k}$ 2: $\beta \leftarrow \rho$ 3: for$i=0$ to $n-1$ do 4:   Split A into $A_h\Vert A_l$ and R into $R_h\Vert R_l$   (such that $A_l$ and $R_l$ have size k) 5:   $A\leftarrow A+R_{l}mod{2}^{(n-i)·k}$ 6:   $\beta \Vert x_i^{\prime }\leftarrow ((T[\beta \Vert A_l]\Vert {\mathtt{LSB}}_{A_l})\oplus \beta )\oplus \rho$ 7:   $x_i^{\prime }\leftarrow x_i^{\prime }\oplus R_l$ 8:   $A\leftarrow A_h$ and $R\leftarrow R_h$ 9: end for 10: return$(x_{n-1}^{\prime }\Vert \dots \Vert x_0^{\prime })\oplus (r\Vert \dots \Vert r)$

3. Our Proposal

In this section, we propose an A2B algorithm that is designed for extremely low memory usage while preserving execution time. Our A2B algorithm consists of the use of one table only (like [17]), combined with the stronger secure management of the carry bit such that the carry bit is masked with the same probability (like [22]). The key idea is to construct a pre-computation table of the same size as the input bits. To handle the carry bit with stronger security, we designed a memory of size two which was constructed to minimize the additional costs in the A2B conversion phase.

3.1. Pre-Computation Phase

Algorithm 8 is a new algorithm that generates the pre-computation tables of our A2B algorithm. Table G is stored, except for the LSB of $\{(A+r)\oplus (\gamma \Vert r)\}\in {\mathbb{F}}_{2^{k+1}}$ at Line 3. The A2B algorithm works correctly even if the pre-computation table does not store the LSB; this is the so-called LSB trick. The reason for this is that the subtraction in the arithmetic masking and the XOR in the Boolean masking are equal on ${\mathbb{F}}_2$. This means that the information regarding the LSB can be handled by a trick in the A2B algorithm without needing to be stored in the pre-computation table. The conversion process is described in further detail in Section 4. In summary, our pre-computation table G is constructed with k-bit memories, and it can be hugely advantageous in real devices that use the char type. In addition, table C is used to handle carry bits and $\Gamma$ is used to guarantee security against DPA attacks. For a carry bit c, table C is based on the following equation, with $\alpha$ and k denoting a random value and the size of converted bits, respectively.

$$C[c\oplus \gamma ]=(c+\alpha )·2^k$$

The bit sizes of table C and $\Gamma$ should make up the total bit size of ($k·n$)-bit, and the reason for this is discussed in further detail in Section 4. Algorithm 8 is also remarkable not only in terms of memory usage but also in terms of execution time. Debraize’s Algorithm 6 has two steps (Lines 3, 4) inside the for loops. This means that the number of generated tables is $2^{k+1}$. Quantitatively, the number of for loops of Algorithm 6 can be considered to be $2^{k+1}$, whereas ours has only $2^k$ loops, like [17]. Therefore, our algorithm will take approximately half of the execution time required by Debraize’s algorithm. In terms of the security against side-channel attacks of a carry bit, our A2B masking scheme masks the carry bit with a probability of 1/2, like [22], and the outputs of table C are uniformly distributed in $[0,2^{k·(n-1)})\Vert 0_k$. We designed $\Gamma$ to eliminate the extra step of removing $\alpha$ in the conversion phase.

Algorithm 8 Table G and C generation

/* G is used of k-bit register */

/* C and Γ are used of $(k·n)$-bit register */

Require:$None$

Ensure:$G[.],C[.],\Gamma ,r$

1: Generate a random $((k-1)·n)$-bit $\alpha$, a random k-bit r and a random bit $\gamma$ 2: for$A=0$ to $2^k-1$ do 3:   $G\left[A\right]\leftarrow \{(A+r)\oplus (\gamma \Vert r)\}\gg 1$ 4: end for 5: $C\left[\gamma \right]\leftarrow \alpha ·2^k$ 6: $C[\gamma \oplus 1]\leftarrow (\alpha +1)·2^k$ 7: $\Gamma \leftarrow {\sum }_{l=1}^{n-1}(\alpha ·2^{l·k})$ 8: return$G[.],C[.],\Gamma ,r$

3.2. Conversion Phase

Algorithm 9 is the proposed A2B algorithm using the pre-computation table. This algorithm divides the arithmetic masked value A into a k-bit, converts it to a Boolean masked value $B_i$, and handles carry bit using the table C. At Line 4, the masked LSB can be computed correctly because the Boolean masked value $B_i$ is the same as the arithmetic masked value $A_i$ on ${\mathbb{F}}_2$. At Line 6, the carry bit t, which is masked by $\gamma$ in Algorithm 8 (Line 3), is handled by table $C\left[t\right]$ by adding $\alpha$ or $\alpha +1$ when the carry bit is 0 or 1, respectively. As we designed the algorithm to subtract $\Gamma$ at Line 1, $\alpha$ of table C is removed without the need for any extra steps. It is also worth noting that our algorithm does not require modulus operations. In real devices, data that exceeds the memory size of the register is automatically deleted. Based on this, our algorithm proceeds with the A2B conversion from the least significant word to the most significant word without any modulus operations.

Algorithm 9 Conversion of a $(k·n)$-bit variable

/* Notation: Split A into $A_{n-1}\Vert \dots \Vert A_i\Vert \dots \Vert A_0$ and

R into $R_{n-1}\Vert \dots \Vert R_i\Vert \dots \Vert R_0$, such that $A_i$ and $R_i$ have size k */

/* r and $B_i$ is used of k-bit register */

/* A is used of $(k\ast n)$-bit register */

Require:$(A,R),G[.],C[.],\Gamma ,r$ /* $x=A+Rmod{2}^{k·n}$ */

/* $G[.],C[.],\Gamma ,r$ generated during pre-computation phase */

Ensure:$(x^{\prime },R)$ /* $x=x^{\prime }\oplus R$ */

1: $A\leftarrow A-(r\Vert \dots \Vert r)-\Gamma$ 2: for$i=0$ to $n-1$ do 3:   $A\leftarrow A+(R_i·2^{i·k})$ 4:   $t\Vert B_i\leftarrow G\left[A_i\right]\Vert {\mathtt{LSB}}_{A_i}$ 5:   $B_i\leftarrow B_i\oplus R_i$ 6:   $A\leftarrow A+(C\left[t\right]·2^{i·k})$ 7:   $A\leftarrow A\&(\overline{2^{(i+1)·k}-1})$ 8: end for 9: return$(B_{n-1}\Vert \dots \Vert B_0)\oplus (r\Vert \dots \Vert r)$

4. Security Analysis and Soundness of Algorithm

When proposing a new countermeasure, two crucial points are the security analysis and soundness. First, to achieve security against first-order DPA attacks, we prove that all intermediate values to process our A2B algorithm are masked by random numbers. Namely, if the intermediate values of the algorithm are uniformly distributed random numbers (i.e., masking values), this algorithm can be considered as having achieved security against first-order DPA attacks. Second, the soundness is that an algorithm achieves its goal with arbitrary inputs in any case. We then use mathematical induction to prove the soundness of our countermeasures.

Now, we analyze the security of our A2B algorithm. To achieve this goal, we enumerate all intermediate values of our algorithms (Algorithms 8 and 9), then verify whether these values have any random numbers.

Algorithm 8 is the algorithm that computes pre-computation tables. The mainly handled data is the masking value. This phase is a good target for horizontal correlation attacks [29,30]. However, this attack can effectively cope with shuffling and dummy operations. In terms of sensitive values such as the key, this algorithm is computed without any sensitive values. The only information attackers can gain is the masking value. To recover the key, the pre-computation and conversion phase should be measured twice. These two probings deviate from the assumption of the first-order DPA. That is, the higher-order DPA should be required to restore the secret key in the pre-computation and conversion algorithms.

Algorithm 9 is the A2B algorithm. We prove the randomness of each intermediate value as shown in

Table 4. Intermediate Values.

$V_1\dots V_7$ is intermediate values of Algorithm 9

$V_1=(x-R)-(r\Vert \dots \Vert r)-{\sum }_{l=1}^{n-1}(\alpha ·2^{l·k})$

$V_3=[(x-R-(r\Vert \dots \Vert r))-{\sum }_{l=i+1}^{n-1}(\alpha ·2^{l·k})]\Vert (x-r)\Vert 0_{i·k}$

$V_4=(c\oplus \gamma )\Vert (x_{withoutLSB}\oplus r_{withoutLSB})\Vert (x_{LSB}-r_{LSB})$

$=(c\oplus \gamma )\left|\right|(x\oplus r)$

$V_5=x\oplus r\oplus R_i$

$V_6=(x-R)-(r\Vert \dots \Vert r)$

$-{\sum }_{l=i+2}^{n-1}(\alpha ·2^{l·k})\Vert (x+c-R-r)\Vert (x-r)\Vert 0_{i·k}$

$V_7=(x-R)-(r\Vert \dots \Vert r)$

$-{\sum }_{l=i+2}^{n-1}(\alpha ·2^{l·k})\Vert (x+c-R-r)\Vert 0_{(i+1)·k}$

. Table 4 shows that the sensitive value x; the random values $r,R,\gamma$, and $\alpha$ are combined in $V_i$. $0_l$ indicates 0 filled with l-bits. $V_i$ denotes the intermediate values at A in Algorithm 9, where i is the number of the Line, i.e., $V_1,V_3,V_6$, and $V_7$ are Lines 1, 3, 6, and 7, respectively.

• $V_1$ is constructed with the masking value R, the masking value r of table G, and the masking value $\alpha$ of table C. $\alpha$ does not mask the lower k-bit. $V_1$ is uniformly distributed by R, so it guarantees the side-channel security.
• $V_3$ is concatenated with the upper part like $V_1$; the middle part, which is $(x-r)$, by adding $R_i·2^{i·k}$; and the lower part, which is always filled with 0s, by Line 7. Since masking values R and r are independent, this distribution is uniformly random.
• $V_4,V_5$ are values that have been converted from arithmetic to Boolean masking by table G. The carry bit is masked with $\gamma$, and the rest are masked with r. These Lines are secure because $\gamma$ and r are independent and random numbers.
• $V_6$ is constructed with the upper part like $V_1$; the upper-middle part, which is $(x+c-R-r)$; the lower-middle part like $V_3$; and the lower part as 0s. The masking value $\alpha$ of the upper-middle part is removed by adding table C. The security against side-channel attacks is explained by the same principle as that of $V_3$.
• $V_7$ is the clearing process to 0s in the lower part, this step is important to achieve the side-channel safety. If the algorithm omits this clearing process, the pattern of the masking values of the lower part is represented as a concatenated form like $r\Vert r$. In this case, the distribution of the lower part is not uniform. As a result, the distribution of the side-channel signals is determined by sensitive data. In other words, the algorithm cannot provide security against side-channel attacks, and therefore, a clearing process must be performed.

We now use mathematical induction to prove the soundness of the proposed algorithm. In detail, we observe changes in the internal state at $i=0$ (the first loop) through the Base case. At this time, we prove the operating principles of the pre-computation tables by Lemmas 1 and 2. In the Inductive hypothesis, we define the state when loop $i=a$. This can be easily inferred in the form of a Base case. Finally, in the Inductive step, we claim that the proposed A2B algorithm for arbitrary $k,n$ works correctly.

$X_i^j$ denotes the partial bits of X from the i-th to the j-th bits. For example, $(R_k^{n-1}\Vert 0_0^{k-1})$ means the concatenated bits of the R from $(n-1)$-th to k-th bits, and other bits which are zeros.

Theorem 2.

The proposed A2B algorithm for arbitrary$k,n$works correctly.

Proof. 

Base case: The algorithm works correctly in the initial state ($i=0$), as shown in the following steps.

$$\begin{array}{cc}\hfill (\mathrm{Line}1)& A=(x-R)-(r\Vert \dots \Vert r)-{\displaystyle \sum _{l=1}^{n-1}}(\alpha ·2^{l·k})\hfill \end{array}$$

(4)

$$\begin{array}{cc}\hfill (\mathrm{Line}3)& A=x-(R_k^{n-1}\Vert 0_0^{k-1})-(r\Vert \dots \Vert r)-{\displaystyle \sum _{l=1}^{n-1}}(\alpha ·2^{l·k})\hfill \end{array}$$

(5)

We must verify that the A2B operation at Lines 4 and 5 is correct. Refer to the following Lemma 1:

Lemma 1.

At Lines 4 and 5, the arithmetic masked value$A_i$is correctly converted from arithmetic masking to Boolean masking with pre-computation table G.

Proof. 

The value of table G is as follows.

$$\begin{array}{cc}\hfill G\left[A_i\right]& =\{(A_i+r)\oplus (\gamma \Vert r)\}\gg 1\hfill \\ & =\{(c\oplus \gamma )\Vert (x\oplus r)\}\gg 1\hfill \\ & =\{(c\oplus \gamma )\Vert B_i\}\gg 1\hfill \end{array}$$

This means that the output of $G\left[A_i\right]$ is $\{(c\oplus \gamma )\Vert B_i\}$ without the LSB.

In the LSB, the Boolean masked value ($x^{\prime }=x\oplus r$) is the same as the arithmetic masked value on ${\mathbb{F}}_2$ ($A=x-rmod2$), based on the following definition.

Remark 1.

Exclusive or (XOR) is defined in the arithmetic as modulo-2 addition/subtraction.

In the above definition, LSB of $A_i$ is $A_{i}mod2$.

$$A_{i}mod2=x-rmod2=(x\oplus r)\&1=B_i\&1$$

The important implication of this equation is that we can calculate without storing the LSB in the masking conversion process. This is the so-called LSB trick. Line 4 is summarized as follows.

$$G\left[A_i\right]\Vert (\mathit{LSB}of{A}_i)=(c\oplus \gamma )\Vert B_i=t\Vert B_i$$

Therefore, Lines 4 and 5 are valid. □

$$(\mathrm{Line}6)\{\begin{array}{}\mathrm{(6a)}& \begin{array}{c}\mathrm{when}c=0,\hfill \\ A=x-(R_k^{n-1}\Vert 0_0^{k-1})\hfill \\ -(r\Vert \dots \Vert r)-{\displaystyle \sum _{l=2}^{n-1}}(\alpha ·2^{l·k})\hfill \end{array}\mathrm{(6b)}& \begin{array}{c}\mathrm{when}c=1,\hfill \\ A=(x+1)-(R_k^{n-1}\Vert 0_0^{k-1})\hfill \\ -(r\Vert \dots \Vert r)-{\displaystyle \sum _{l=2}^{n-1}}(\alpha ·2^{l·k})\hfill \end{array}\end{array}$$

Here, for Line 6, we must prove that the carry bit is handled correctly by table C.

Lemma 2.

 The carry bit is handled correctly by table C at Line 6.

Proof. 

It can be easily proven by the definition of Table C

$$C\left[\gamma \right]=\alpha ·2^k,C[\gamma \oplus 1]=(\alpha +1)·2^k$$

That is, the result of $C\left[t\right]$ is $\alpha ·2^k$ when c is 0 and $(\alpha +1)·2^k$ when c is 1. When table C is added to A, we designed $\alpha$ of the next converted block to be naturally removed by $-\Gamma (=-{\sum }_{l=1}^{n-1}(\alpha ·2^{i·k}))$ at Line 1. Consequently, the correct carry bit is added, and thus Line 6 is valid. □

The end of the initial for loop is as follows.

$$\begin{array}{c}(\mathrm{Line}7)\hfill \\ ({\dot{x}}_k^{n-1}\Vert 0_0^{k-1})-(R_k^{n-1}\Vert 0_0^{k-1})-(r\Vert \dots \Vert r\Vert 0_0^{k-1})-{\displaystyle {\displaystyle \sum _{l=2}^{n-1}}}(\alpha ·2^{l·k})\hfill \end{array}$$

(7)

$\dot{x}$ is a sensitive value computed for the carry bit.

Inductive hypothesis: Suppose the algorithm holds for $i=a$ before the for loop.

Then, $A=(x_{a·k}^{n-1}\Vert 0_0^{a·k-1})-(R_{a·k}^{n-1}\Vert 0_0^{a·k-1})-(r\Vert \dots \Vert r\Vert 0_0^{a·k-1})-{\sum }_{l=a+1}^{n-1}(\alpha ·2^{l·k})$.

Additionally, suppose the algorithm holds for $i=a+1$ before the for loop.

Then, $A=({\dot{x}}_{(a+1)·k}^{n-1}\Vert 0_0^{(a+1)·k-1})-(R_{(a+1)·k}^{n-1}\Vert 0_0^{(a+1)·k-1})-(r\Vert \dots \Vert r\Vert 0_0^{(a+1)·k-1})-{\sum }_{l=a+2}^{n-1}(\alpha ·2^{l·k})$.

Inductive step: Show that if $i=a$ of the for loop holds, then $i=a+1$ of the for loop also holds. We proved this step, as shown in

Table 5. The Inductive Step.

Line	A
2	$(x_{a·k}^{n-1}\Vert 0_0^{a·k-1})-(R_{a·k}^{n-1}\Vert 0_0^{a·k-1})$
	$-(r\Vert \dots \Vert r\Vert 0_0^{a·k-1})-{\sum }_{l=a+1}^{n-1}(\alpha ·2^{l·k})$
3	$(x_{a·k}^{n-1}\Vert 0_0^{a·k-1})-(R_{(a+1)·k}^{n-1}\Vert 0_0^{(a+1)·k-1})$
	$-(r\Vert \dots \Vert r\Vert 0_0^{a·k-1})-{\sum }_{l=a+1}^{n-1}(\alpha ·2^{l·k})$
4, 5	Lemma 1
6	Lemma 2
	$\left\{\begin{array}{c}\mathrm{when}c=0,\hfill \\ (x_{a·k}^{n-1}\Vert 0_0^{a·k-1})-(R_{(a+1)·k}^{n-1}\Vert 0_0^{(a+1)·k-1})\hfill \\ -(r\Vert \dots \Vert r\Vert 0_0^{a·k-1})-{\sum }_{l=a+2}^{n-1}(\alpha ·2^{l·k})\hfill \\ \mathrm{when}c=1,\hfill \\ ((x_{a·k}^{n-1}+2^{(a+1)·k})\Vert 0_0^{a·k-1})-(R_{(a+1)·k}^{n-1}\Vert 0_0^{(a+1)·k-1})\hfill \\ -(r\Vert \dots \Vert r\Vert 0_0^{a·k-1})-{\sum }_{l=a+2}^{n-1}(\alpha ·2^{l·k})\hfill \end{array}\right.$
7	$({\dot{x}}_{(a+1)·k}^{n-1}\Vert 0_0^{(a+1)·k-1})-(R_{(a+1)·k}^{n-1}\Vert 0_0^{(a+1)·k-1})$
	$-(r\Vert \dots \Vert r\Vert 0_0^{(a+1)·k-1})-{\sum }_{l=a+2}^{n-1}(\alpha ·2^{l·k})$

. This table shows that $i=a+1$ at the end of the for loop indeed holds.

Thus, the inductive case holds. Now, by mathematical induction, our A2B algorithm works correctly for an arbitrary $k,n$ Q.E.D. □

5. Performance Analysis

We summarize the performance of the proposed algorithm, Debraize’s algorithm ([22]), and Neiße’s algorithm ([17]) in

Table 6. Comparison of the total number of operations and table sizes.

	[17]	[22]	Proposal
Table size(RAM)	$(2^k)$k-bit	$(2^{(k+1)})$k-bit	$(2^k)$k-bit
[Pre-computation Phase]
ADD	$2^k$	$3·2^k$	$2^k+n$
XOR	$2^k+1$	$5·2^k+1$	$2^k+2$
SHIFT	$2^k$	$4·2^k+1$	$2^k+n+2$
[Conversion Phase]
ADD/SUB	$3·n+2$	$n+1$	$2·n+2$
XOR/AND	$8·n+6$	$12·n+2$	$6·n+1$
SHIFT	$3·n$	$5·n$	$4·n$
Look-up Table	$n+2$	n	$2·n$
[ATMega Simulator]
Pre-computation Phase	26,502	56,177	30,113
Conversion Phase	1508	1466	1335
[MSP430 Simulator]
Pre-computation Phase	11,349	26,681	13,736
Conversion Phase	704	735	557
[ARM Simulator]
Pre-computation Phase	5147	10,259	5670
Conversion Phase	228	251	197

. The proposed algorithms have advantages in terms of the memory usage and the execution time of the pre-computation phase like [17]. The execution time of the A2B conversion phase with the LSB trick also shows good performance in various environments.

To summarize, one of the advantages in terms of memory usage is that it uses approximatively half the memory in the pre-computation phase compared to Debraize’s algorithm. Another advantage in terms of memory usage is that the data type of our pre-computation table is compact and reasonable in real devices, because typical devices only support char, short, and int. The advantage in the execution time of the pre-computation phase is that it requires approximately half the time that Debraize’s does, as the table only has half as many entries.

In the conversion phase, the operations of the ADD/SUB, XOR/AND and SHIFT are very similar in the three algorithms; however, the proposed algorithm has slightly fewer operators. To count the operations, we counted the number of operators with the following rules.

-

In Algorithm 5, the concatenating process at Line 6 (front) as one AND.

-

In Algorithm 5, the concatenating process at Line 6 (rear) as one SHIFT, one AND, and one XOR.

-

In Algorithm 6, the concatenating process at Line 3 and 4 (front) as one SHIFT and one XOR.

-

In Algorithm 6, the concatenating process at Line 3 and 4 (rear) as one SHIFT and one XOR. (Computes only once)

-

In Algorithm 7, the splitting process at Line 4 as two SHIFTs and two ANDs.

-

In Algorithm 7, the modulus at the Line 5 as one AND.

-

In Algorithm 7, the concatenating at the Line 6 (front) as one SHIFT and one AND.

-

In Algorithm 7, the concatenating at the Line 6 ($T[\beta \Vert A_l]$) as one SHIFT, one AND, and one XOR.

-

In Algorithm 7, the concatenating at the Line 6 (rear) as one SHIFT, one AND, and one XOR.

-

In Algorithm 8, the concatenating process at Line 3 as one SHIFT and one XOR. (Computes only once)

-

In Algorithm 9, the concatenating process at Line 4 (front) as one SHIFT and one AND.

-

In Algorithm 9, the concatenating process at Line 4 (rear) as one SHIFT, one AND, and one XOR.

-

In Algorithm 9, the clearing process at Line 7 as one AND.

The results of the simulation show the number of clocks required to execute on the AVR (generic device -v4/8-bit), MSP430 (generic MSP430 device/16-bit) and ARM (Cortex-A17/32-bit) offered by the IAR Embedded Workbench. The parameters k and n of the masking conversion are 8-bit and 32-bit, respectively. The compiler optimization option is not used, because it could create vulnerabilities to side-channel attacks due to unintended optimization. As can be inferred from the number of operators, the numbers of clocks in the pre-computation phase in our simulation and that of [17] are less than half of that in Debraize’s algorithm. On the other hand, the results of the conversion phase vary greatly depending on the microcontroller. The reason Debraize’s algorithm is relatively fast on the 8-bit-based microcontroller (AVR simulator) is that the 8-bit operators are major parts of the whole operation, whereas the reason our algorithm produced comparable results on the 32-bit-based microcontroller (ARM simulator) is that the main part of ours is mostly composed of 32-bit operations, such as Lines 6, 7 in Algorithm 9. In addition, there are several parts of our algorithm for which it is easy to apply optimization during actual implementation. For example, in a loop unrolling technique, our algorithm can be coded as for is to constants, and avoid duplicate operations by using temporary variables. Concretely, in the case of $k=8$ and $n=4$, we can code Line 3 of Algorithm 9 like $A+R\&\mathtt{0}\mathtt{xff}$, $A+R\&\mathtt{0}\mathtt{xff}\mathtt{00}$; and Line 7 can also be coded as $A\&\mathtt{0}\mathtt{xffffff}\mathtt{00}$, $A\&\mathtt{0}\mathtt{xffff}\mathtt{0000}$.

In terms of performance, our results are better than [22] and similar to [17]. However, in terms of side-channel security, [17] has potential vulnerabilities of the binary classification referred to [28]. That is, our proposals provide excellent performance like [17] and stronger secure management of the carry bit like [22]. Due to recent advances in technology, low-priced devices have achieved great improvements, and as a result 32-bit-based microprocessors have gained widespread use. The proposed algorithms are confirmed to have great advantages not only in terms of memory, but also in terms of the execution time and security in a practical environment.

6. Conclusions and Future Work

In this paper, we proposed an A2B algorithm using a pre-computation table with low memory usage. This algorithm has a comparable overhead in terms of execution time in various environments, and it compactly optimizes the memory in a real environment.

Given that the threat of side-channel attacks is increasing, masking techniques are also advancing. However, the high-order masking methods used by conversion algorithms to convert between arithmetic and Boolean masking using pre-computation tables are still being challenged. Therefore, optimization studies for the high-order masking of conversion algorithms should continue.