# Higher-Order Side Channel Security and Mask Refreshing: linear function?

and I wanted to implement Algorithm 4 / Algorithm 5 on my own. There is one thing I cannot understand: where does function g come from (used in Algorithm 4)? It is said to be a $\mathbb{F}_2$-linear function.

Any ideas?

Actually, it's any $\mathbb{F}_2$-linear function you want it to be.
That is, those two algorithms are generic ways, given a linear $g$ and a threshld (secret-shared) value $x$, to compute a threshold version of $x \times g(x)$ (where $\times$ is $GF(2^n)$ field multiplication).
• As an example, you might use that primitive several times to generate a threshold implementation of the AES SBox; the hard part of that (for a threshold implementation) is computing $x^{254}$ – poncho Aug 22 '16 at 20:10
• This means, as suggested in the paper, I can plug that into the algorithm for computing $x^{254}$ – 今天春天 Aug 23 '16 at 5:09