I'm interested in lattice type cryptosystem such as Mod-LWR.

But I found that integer multiplication¹ is not safe for side-channel attacks.

I tried to make masking method by own method but it failed in t-test².

Are there any masking methods for integer multiplication?

¹ This is modular multiplication, but modulo is power of 2. So in 8bit multiplication, output is 8bit. I assume the multiplication itself has bitwidth of 13bit, just like a PQC candidate, SABER.

² The test is Welch's t-test. I tested my hardware (hspice converted from verilog) circuit with measuring power traces within constant period. With random input random output vs. fixed input fixed output. Power differs with input random number that used in B2A, A2B masking.

• This is general multiplication, not modular multiplication of big numbers? – Maarten Bodewes Feb 5 at 3:39
• @MaartenBodewes This is modular multiplication, but modulo is power of 2. So in 8bit multiplication, output is 8bit. I assume the multiplication itself has bitwidth of 13bit, just like a PQC candidate, SABER. – Pyong Feb 5 at 5:25
• @fgrieu It is Welch's t-test. I tested my hardware(hspice converted from verilog) circuit with measuring power traces within constant period. With random input random output vs. fixed input fixed output. Power differs with input random number that used in B2A, A2B masking. – Pyong Feb 5 at 6:28
• Did you try arithmetic masking, i.e., additive masking modulo $2^n$? Despite not being a field, the same formulas for multiplication as in ia.cr/2010/441 can be used, but you will need quite some random for mask refreshing. – j.p. Feb 6 at 7:12

Generally speaking, there's not a way to mask the power of a circuit without dual-rail encoding. With dual rail encoding, you pass but $$x$$ and $$\bar{x}$$ so that have skew free, self-clocking circuits; however, an separate advantage is that you mask the power. Although this is used in asynchronous systems, it's fine in a synchronous system as well, and showed up in literature in 1955.