Dynamic masking
A circuit includes a cipher accessing a plurality of read-write memory units configured to handle data tables obtained from a modified mask; wherein the modified mask is being determined from an initial mask and a random value, the random value selecting one or more modifications of the initial mask amongst a plurality of predefined modifications including permutation operations. Developments of the invention describe the use of mathematically optimal or equivalent masks; the use of random values; a range of permutation operations comprising offset shifting and/or rotation and/or XOR operations and/or coprime construction; the use of round masks; the use of a Physically Unclonable Function; the refresh or update of modified masks and/or round masks; and verifications of the optimality and/or integrity of masks. System features (e.g. CPU, co-processor, local and/or remotely accessed external memory storing masks, volatile memory) and computer program products are described.
1. A system, comprising one or more memory units, and a circuit, comprising a cipher block, said cipher block accessing said one or more memory units, wherein:
said cipher block is configured to handle data tables;
said memory units are configured to store said data tables;
said memory units are read-write memory units;
said data tables are obtained from a modified mask; and
said modified mask being determined by modifying an initial mask using a random value, the random value selecting one or more modifications applied to the initial mask amongst a plurality of predefined modifications including permutation operations,
wherein the initial mask is a mathematically optimal mask selected among a code C and a dual code D of code C, wherein C is a constant hamming weight code and wherein D is a code with a large dual distance, the large dual distance of the dual code D forming a security parameter which expresses a number of probed variables that an attacker needs.
2. The system of claim 1 , wherein the modified mask is a codeword of a code equivalent to the self-dual code of constant hamming weight.
3. The system of claim 1 , wherein predefined modifications or permutation operations comprise offset shifting and/or rotation and/or XOR operations.
4. The system of claim 1 , further configured to modify the modified mask determined from the initial mask into a round mask.
5. The system of claim 4 , wherein a round mask is determined from permutation operations comprising rotation and/or coprime construction.
6. The system of claim 1 , wherein the random value is provided by a Pseudo Random Number Generator circuit and/or a True Random Number Generator circuit.
7. The system of claim 1 , wherein the random value is provided by a Physically Unclonable Function.
8. The system of claim 1 , wherein the initial mask is provided by a server external to said system and/or by an external memory, said external memory being local and/or remotely accessed.
9. The system of claim 1 , wherein the memory is a volatile memory.
10. The system of claim 1 , wherein one or more of the initial mask, a modified mask or a round mask is refreshed.
11. The system of claim 10 , wherein a refresh rate is configurable.
12. The system of claim 1 , wherein the optimality and/or an integrity of the initial mask is verified prior to effective masking of data.
13. The system of claim 1 , wherein said memory units comprise double-port memory units, a memory-unit comprising two data tables for simultaneous writing and reading operations, along with a switching mechanism.
14. The system of claim 1 , wherein the one or more memory units are located physically adjacent to the cipher block.
15. A computer implemented method, comprising the steps of:
receiving an initial mask and data tables, said data tables being stored in memory units, said memory units being read-write memory units;
receiving a random value;
modifying the initial mask into a modified mask using said random value, the random value selecting one or more modifications applied to the initial mask amongst a plurality of predefined modifications comprising permutation operations;
obtaining masked data tables from the modified mask and the received data tables;
storing said masked data tables; and
handling said stored masked data tables in a cipher,
wherein the initial mask is a mathematically optimal mask, selected among a code C and a dual code D of code C, wherein C is a constant hamming weight code and wherein D is a code with a large dual distance, the large dual distance of the dual code D forming a security parameter which expresses a number of probed variables that an attacker needs.
16. A computer program comprising instructions for carrying out the steps of the method according to claim 15 when said computer program is executed on a computer.