2
$\begingroup$

I'm Implementing a protocol that uses masking techniques (or blinding factors), so we can mask a value $y_0$ as $m_0=y_0 \cdot r_0$ where $y_0 \in \mathbb{Z}_p$ and $r_0 \stackrel {R}\leftarrow \mathbb{Z}_p$ (let $_p$ be a prime number) and the $m_0$ can be unmasked as $m_0\cdot r^{-1}_0=y_0$ at any time.

My Question is: what function do I need to use to get $r_0$ (or $r_i$ in general)?

Can I Use Pseudo-random generators (PRG)? Why?

$\endgroup$
-1
$\begingroup$

Blinding technics are well know now to defeat most attacks against SCA. You need a random number generator (True or Pseudo) to generate unpredictable random $r_i$. Additionnal precautions against Zero Attacks values can alo be taken. Try this: $m_0=y_0 \times r_0 \; + \; r_1 \times p \; mod \;(r_2 \times p)$

$\endgroup$
  • 1
    $\begingroup$ What is meant by Zero Attacks ? Any relation to Zero-Value Point Attacks ? $\endgroup$ – fgrieu Feb 12 '15 at 11:12
  • $\begingroup$ If I use PRG, I need to pick a seed first, then I specify the range, t get a uniformly random value. What should I do for the next $r_i$ (e.g. $r_1$) using the seed same seed? $\endgroup$ – user13676 Feb 12 '15 at 11:27
  • 1
    $\begingroup$ What do you mean by SCA? $\endgroup$ – cygnusv Feb 12 '15 at 11:59
  • $\begingroup$ @cygnusv: SideChanelAttacks for short, but other kinds could be considered $\endgroup$ – Robert NACIRI Feb 12 '15 at 12:19
  • $\begingroup$ @user13676: preferably $r_0 \; and \; r_1$ should be in the same magnitude of the initial or the blinded modulus. By the practice, it's enought to chose a small random value for $r_2$. $\endgroup$ – Robert NACIRI Feb 12 '15 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.