Masking is the process of replacing operations (internally to some cryptographic algorithm) on intermediate values with operations on secret shared values. Then, even if some number of these secret-shared values leak (say due to various side-channel attacks), one can maintain security (due to the information-theoretic security of the secret-sharing scheme).

I'm interested in the possibility of masked bigint arithmetic. Namely, one represents $$x\in \mathbb{Z}_{2^{2048}}$$ (for example) as

$$x = \sum_{i = 0}^{63} x_i 2^{32i}$$

where each $$x_i \in\mathbb{Z}_{2^{32}}$$, and we sill be masking each $$x_i$$ individually. Standard addition and multiplication of the masked shares are rather straightforward --- I'm in particular curious how one deals with carrying.

This seems like the kind of thing that someone should have worked-out in the literature, specifically to mask RSA implementations. But I haven't been able to find anything (I've seen some discussion of masked RNS implementations of RSA, which is more straightforward conceptually). Is it known how to mask BigInt arithmetic?

• Doesn't OpenSSL have implementation for masking? AFAIK there is nothing special since it has some ported GNU/GMP. Jan 25, 2022 at 23:43
• @kelalaka has anyone written up somewhere what they do? Thanks to your pointer I've found this, but it would definitely be preferable for me to look at pseudocode.
– Mark
Jan 25, 2022 at 23:53
• It takes time to read the code, I now, What are you looking here and see the line 155 there. Jan 25, 2022 at 23:57
• and we still be masking each $x_i$ individually. It is impossible since there is a mangling of the masks, right? Jan 26, 2022 at 0:23
• @kelalaka It doesn't seem straightforward, but neither does masked multiplication (which iirc in the general case of $n$th order masking reduces to the multiplication protocol of the GMW MPC protocol). Here, I'm mostly wondering if there is another non-obvious way to compute the "carrying" step masked --- if not, for my particular application I can appeal to a RNS type of arithmetic, but it is somewhat more awkward.
– Mark
Jan 26, 2022 at 2:03