# Are there any masking methods for integer multiplication masking?

I'm interested in lattice type cryptosystem such as Mod-LWR.

But I found that integer multiplication¹ is not safe for side-channel attacks.

I tried to make masking method by own method but it failed in t-test².

Are there any masking methods for integer multiplication?

¹ This is modular multiplication, but modulo is power of 2. So in 8bit multiplication, output is 8bit. I assume the multiplication itself has bitwidth of 13bit, just like a PQC candidate, SABER.

² The test is Welch's t-test. I tested my hardware (hspice converted from verilog) circuit with measuring power traces within constant period. With random input random output vs. fixed input fixed output. Power differs with input random number that used in B2A, A2B masking.

• This is general multiplication, not modular multiplication of big numbers? – Maarten Bodewes Feb 5 '20 at 3:39
• @MaartenBodewes This is modular multiplication, but modulo is power of 2. So in 8bit multiplication, output is 8bit. I assume the multiplication itself has bitwidth of 13bit, just like a PQC candidate, SABER. – Pyong Feb 5 '20 at 5:25
• @fgrieu It is Welch's t-test. I tested my hardware(hspice converted from verilog) circuit with measuring power traces within constant period. With random input random output vs. fixed input fixed output. Power differs with input random number that used in B2A, A2B masking. – Pyong Feb 5 '20 at 6:28
• Did you try arithmetic masking, i.e., additive masking modulo $2^n$? Despite not being a field, the same formulas for multiplication as in ia.cr/2010/441 can be used, but you will need quite some random for mask refreshing. – j.p. Feb 6 '20 at 7:12

## 1 Answer

Generally speaking, there's not a way to mask the power of a circuit without dual-rail encoding. With dual rail encoding, you pass but $$x$$ and $$\bar{x}$$ so that have skew free, self-clocking circuits; however, an separate advantage is that you mask the power. Although this is used in asynchronous systems, it's fine in a synchronous system as well, and showed up in literature in 1955.

HSPICE does model the meantime to collisions in the circuit well, so you don't see the "hiss" of the transistors. In fact, no models actually describe channel noise. If you break the multiply unit into an addition-based Montgomery tree, it will be constant time and the power will likely disappear into the noise floor if you do it at either a bit or byte widths. If you have a device physicist handy, you can likely prove that the change in power with bits is not actually able to be seen on a "unit scale".