Masking is the process of replacing operations (internally to some cryptographic algorithm) on intermediate values with operations on secret shared values. Then, even if some number of these secret-shared values leak (say due to various side-channel attacks), one can maintain security (due to the information-theoretic security of the secret-sharing scheme).

I'm interested in the possibility of masked bigint arithmetic. Namely, one represents $x\in \mathbb{Z}_{2^{2048}}$ (for example) as

$$x = \sum_{i = 0}^{63} x_i 2^{32i}$$

where each $x_i \in\mathbb{Z}_{2^{32}}$, and we sill be masking each $x_i$ individually. Standard addition and multiplication of the masked shares are rather straightforward --- I'm in particular curious how one deals with carrying.

This seems like the kind of thing that someone should have worked-out in the literature, specifically to mask RSA implementations. But I haven't been able to find anything (I've seen some discussion of masked RNS implementations of RSA, which is more straightforward conceptually). Is it known how to mask BigInt arithmetic?

  • $\begingroup$ Doesn't OpenSSL have implementation for masking? AFAIK there is nothing special since it has some ported GNU/GMP. $\endgroup$
    – kelalaka
    Jan 25, 2022 at 23:43
  • $\begingroup$ @kelalaka has anyone written up somewhere what they do? Thanks to your pointer I've found this, but it would definitely be preferable for me to look at pseudocode. $\endgroup$
    – Mark
    Jan 25, 2022 at 23:53
  • $\begingroup$ It takes time to read the code, I now, What are you looking here and see the line 155 there. $\endgroup$
    – kelalaka
    Jan 25, 2022 at 23:57
  • $\begingroup$ and we still be masking each $x_i$ individually. It is impossible since there is a mangling of the masks, right? $\endgroup$
    – kelalaka
    Jan 26, 2022 at 0:23
  • $\begingroup$ @kelalaka It doesn't seem straightforward, but neither does masked multiplication (which iirc in the general case of $n$th order masking reduces to the multiplication protocol of the GMW MPC protocol). Here, I'm mostly wondering if there is another non-obvious way to compute the "carrying" step masked --- if not, for my particular application I can appeal to a RNS type of arithmetic, but it is somewhat more awkward. $\endgroup$
    – Mark
    Jan 26, 2022 at 2:03


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.