High-order masking of NTRU

Authors

  • Jean-Sébastien Coron University of Luxembourg, Luxembourg
  • François Gérard University of Luxembourg, Luxembourg
  • Matthias Trannoy University of Luxembourg, Luxembourg; IDEMIA, Cryptography & Security Labs, Courbevoie, France
  • Rina Zeitoun IDEMIA, Cryptography & Security Labs, Courbevoie, France

DOI:

https://doi.org/10.46586/tches.v2023.i2.180-211

Keywords:

High-order masking, lattice-based cryptography, NTRU

Abstract

The main protection against side-channel attacks consists in computing every function with multiple shares via the masking countermeasure. While the masking countermeasure was originally developed for securing block-ciphers such as AES, the protection of lattice-based cryptosystems is often more challenging, because of the diversity of the underlying algorithms. In this paper, we introduce new gadgets for the high-order masking of the NTRU cryptosystem, with security proofs in the classical ISW probing model. We then describe the first fully masked implementation of the NTRU Key Encapsulation Mechanism submitted to NIST, including the key generation. To assess the practicality of our countermeasures, we provide a concrete implementation on ARM Cortex-M3 architecture, and eventually a t-test leakage evaluation.

Downloads

Published

2023-03-06

Issue

Section

Articles

How to Cite

High-order masking of NTRU. (2023). IACR Transactions on Cryptographic Hardware and Embedded Systems, 2023(2), 180-211. https://doi.org/10.46586/tches.v2023.i2.180-211