I'm Implementing a protocol that uses masking techniques (or blinding factors), so we can mask a value $y_0$ as $m_0=y_0 \cdot r_0$ where $y_0 \in \mathbb{Z}_p$ and $r_0 \stackrel {R}\leftarrow \mathbb{Z}_p$ (let $_p$ be a prime number) and the $m_0$ can be unmasked as $m_0\cdot r^{-1}_0=y_0$ at any time.

My Question is: what function do I need to use to get $r_0$ (or $r_i$ in general)?

Can I Use Pseudo-random generators (PRG)? Why?


1 Answer 1


Blinding technics are well know now to defeat most attacks against SCA. You need a random number generator (True or Pseudo) to generate unpredictable random $r_i$. Additionnal precautions against Zero Attacks values can alo be taken. Try this: $m_0=y_0 \times r_0 \; + \; r_1 \times p \; mod \;(r_2 \times p)$

  • 1
    $\begingroup$ What is meant by Zero Attacks ? Any relation to Zero-Value Point Attacks ? $\endgroup$
    – fgrieu
    Commented Feb 12, 2015 at 11:12
  • $\begingroup$ If I use PRG, I need to pick a seed first, then I specify the range, t get a uniformly random value. What should I do for the next $r_i$ (e.g. $r_1$) using the seed same seed? $\endgroup$
    – user13676
    Commented Feb 12, 2015 at 11:27
  • 1
    $\begingroup$ What do you mean by SCA? $\endgroup$
    – cygnusv
    Commented Feb 12, 2015 at 11:59
  • $\begingroup$ @cygnusv: SideChanelAttacks for short, but other kinds could be considered $\endgroup$ Commented Feb 12, 2015 at 12:19
  • $\begingroup$ @user13676: preferably $r_0 \; and \; r_1$ should be in the same magnitude of the initial or the blinded modulus. By the practice, it's enought to chose a small random value for $r_2$. $\endgroup$ Commented Feb 12, 2015 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.