To my understanding, shuffling means simply to permute the elements in vector $\mathbf{v}$ pseudorandomly, using a PRP $\pi (\mathrm{seed},\mathbf{v})$. A secure PRP should yield a permutation indistinguishable from a random one.

However, I'd still have 2 questions on this subject:

  1. Is there a more formal definition to shuffling?

  2. What is the purpose of shuffling? Is it simply to misalign power traces for differential power analysis attacks?

  • $\begingroup$ What's the context? Shuffling is used in many context such a voting protocols, but als in oblivious data-structures. $\endgroup$ – Maeher Jul 30 '20 at 11:12
  • $\begingroup$ I found it mentioned under the generic 'protecting encryption' label, so I suppose anything broad goes. $\endgroup$ – Daniel B Jul 30 '20 at 11:23

In side channel, shuffling makes correlation attacks harder. For example, if you shuffle the 16 AES S-Boxes in the first round each execution, and you target say first S-Box' output in the attack, at any single point in the trace you will see information related directly to that output only on 1/16th of all traces, and in the other 15/16th traces there will be something else, which qualifies as "noise" for the attack.

Note that this countermeasure is rather weak and is mostly considered complimentary to more sound masking countermeasure. Indeed, after taking 16 times more traces (maybe a bit more), the correlation would become noticeable again. While this adds up to the practical attack complexity, it is impossible to achieve exponential complexity increase, as masking allows.

  • $\begingroup$ Thanks! I know this is out of the scope of the original question, but could you detail a bit about how masking (simple, higher-order) works and how it can be used together with shuffling? You also mentioned masking trumps shuffling in terms of security. Why is that? $\endgroup$ – Daniel B Jul 30 '20 at 12:15
  • $\begingroup$ Are there any paper for the claims? $\endgroup$ – kelalaka Jul 30 '20 at 14:29
  • $\begingroup$ @kelalaka CHES 2009 paper by Rivain et al. may be a good start ia.cr/2009/420 $\endgroup$ – Fractalice Aug 6 '20 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.