2 research outputs found
Higher-order CIS codes
We introduce {\bf complementary information set codes} of higher-order. A
binary linear code of length and dimension is called a complementary
information set code of order (-CIS code for short) if it has
pairwise disjoint information sets. The duals of such codes permit to reduce
the cost of masking cryptographic algorithms against side-channel attacks. As
in the case of codes for error correction, given the length and the dimension
of a -CIS code, we look for the highest possible minimum distance. In this
paper, this new class of codes is investigated. The existence of good long CIS
codes of order is derived by a counting argument. General constructions
based on cyclic and quasi-cyclic codes and on the building up construction are
given. A formula similar to a mass formula is given. A classification of 3-CIS
codes of length is given. Nonlinear codes better than linear codes are
derived by taking binary images of -codes. A general algorithm based on
Edmonds' basis packing algorithm from matroid theory is developed with the
following property: given a binary linear code of rate it either provides
disjoint information sets or proves that the code is not -CIS. Using
this algorithm, all optimal or best known codes where and are shown to be -CIS for all
such and , except for with and with .Comment: 13 pages; 1 figur
Masks will Fall Off -- Higher-Order Optimal Distinguishers
Higher-order side-channel attacks are able to break the security of cryptographic implementations even if they are protected with masking countermeasures.
In this paper, we derive the best possible distinguishers
(High-Order Optimal Distinguishers or HOOD)
against masking schemes under the assumption that the attacker can profile.
Our exact derivation admits simple approximate expressions for high and low noise and shows to which extent the optimal distinguishers reduce to known attacks in the case where no profiling is possible.
From these results, we can explain theoretically the empirical outcome of recent works on second-order distinguishers.
In addition, we extend our analysis to any order and to the application to masked tables precomputation.
Our results give some insight on which distinguishers have to be considered in the security analysis of cryptographic devices