Olivier Rioul

Sylvain

Xavier Standaert

Prof. Sihem Mesnager

Prof Joseph Boutros

Prof Claude Carlet

Prof Patrick Solé

Prof Yongbin Zhou

Prof Naghmeh Karimi

Dr Oualid Trabelsi

Dr Alexander Schaub

Dr Sébastien Carré

Dr Khaled Karray

Dr Youssef Souissi

Dr Sofiane Takarabt

Mme Yi Liu

M Julien Béguinot

M Trevor Kroeger

Dr M Chao Zheng

Yiwen Gao

M Jingdian

Mme Mme Huizhong Qian Li

M Zhang

Yang Guang

Prof Mme Bruno Thedrez

Florence Besnard

Wei Cheng

Keywords: AES Advanced Encryption Standard. ASIC Application Specific Integrated Circuit. AWGN Additive White Gaussian Noise. BKLC Best Known Linear Code. BM Boolean Masking. CI Correlation Immunity, usually with a order d. CPA Correlation Power Analysis. Rationale Quantitative? Target Tools / Metrics Conformance-based Impl. t-test, χ 2 -test, etc Probing model, etc. Moment-based Impl. SNR, NICV, etc. Information-theoretic Abstract & Impl. Entropy, MI, α-information, etc. Attack-based Impl. Success rate, Guessing entropy, etc

Cryptographic algorithms are nowadays prevalent in establishing secure connectivity in our digital society. Such computations handle sensitive information like encryption keys, which are usually very exposed during manipulation, resulting in a huge threat to the security of the sensitive information concealed in cryptographic components. Eventually, the compromission of keys results in the compromission of the whole connected system. In the field of embedded systems security, side-channel analysis is one of the most powerful techniques against cryptographic It has been a long journey to be here. I am really happy that I have enjoyed so much at research work and in life, which gives me courage and faith in being a mature researcher and a better person. I could not make it this far without help, support and encouragement from many people and I would like to express my sincere gratitude to them.

First and foremost, I'm deeply grateful to my Ph.D supervisors:

implementations. It consists in the extracting the sensitive data by exploiting certain physically observable leakages during the execution of the cryptographic components. As such attacks pose a real threat, various protections have been studied and developed, wherein the random masking is one of the most well-established. Basically, masking provides provable security against side-channel analysis by splitting (at a systematic level) any sensitive variable into several random shares. A fundamental parameter for a masking scheme is its security order t.

Thereby, any adversaries aiming at key-recovering must employ strictly more than t shares to launch a higher-order attack, whereas the data complexity increases exponentially in t (under noisy conditions), which in turn is providing security against side-channel analysis.

The main subject of this thesis is the measurable side-channel security of cryptographic implementations, particularly in the presence of random masking. Overall, this thesis consists of two topics. One is the leakage quantification of the most general form of masking equipped with the linear codes, so-called code-based masking; the other one is exploration of applying more generic information measures in a context of side-channel analysis. Two topics are inherently connected to each other in assessing and enhancing the practical security of cryptographic implementations.

Regarding the former, we propose a unified coding-theoretic framework for measuring the information leakage in code-based masking. Specifically, our framework builds formal connections between coding properties (including the dual distance and the kissing number of codes) and leakage metrics in side-channel analysis (including signal-to-noise ratio and mutual information).

As has been reported in literature, different linear codes have distinct impact on the side-channel iii resistance of a code-based masking. Those formal connections enable us to push forward the quantitative evaluation on how the linear codes can affect the concrete security of all code-based masking schemes, including non-redundant cases (e.g., inner product masking, direct sum masking, etc) and redundant cases (e.g., polynomial masking based on Shamir's secret sharing, etc). Moreover, relying on our framework, we consolidate code-based masking by providing the optimal linear codes in the sense of maximizing the side-channel resistance of the corresponding masking scheme. Our framework is finally verified by attack-based evaluation, where the attacks utilize maximum-likelihood based distinguishers and are therefore optimal.

Regarding the latter, we present a full spectrum of application of alpha-information, a generalization of (Shannon) mutual information, for assessing side-channel security. In sidechannel analysis, mutual information is frequently adopted in an information-theoretic evaluation of side-channel security level. By a communication channel model, mutual information provides an upper bound on the success rate of any attacks given a fixed set of side-channel measurements, or it gives a lower bound on the number of measurements to achieve a specific success rate.

However, those bounds are loose, even much looser in highly noisy scenarios. In this thesis, we propose to utilize a more general information-theoretic measure, namely alpha-information (α-information) of order α. The new measure also gives the upper bound on success rate and the lower bound on the number of measurements. More importantly, with proper choices of α, α-information provides very tight bounds, in particular, when α approaches to positive infinity, the bounds will be exact. As a matter of fact, maximum-likelihood based distinguishers will converge to the bounds. Therefore, we demonstrate how the two world, information-theoretic measures (bounds) and maximum-likelihood based side-channel attacks, are seamlessly connected in side-channel analysis.

In summary, our study in this thesis pushes forward the evaluation and consolidation of side-channel security of cryptographic implementations. From a protection perspective, our quantitative outputs allow to empower practical masked implementations with the highest achievable side-channel resistance when equipped with the optimal linear codes. Therefore, we provides a best-practice guideline for the application of code-based masking. From an evaluation perspective, the application of alpha-information enables practical evaluators and designers to have a more accurate (or even exact) estimation of concrete side-channel security level of their cryptographic chips.

Résumé

Les algorithmes cryptographiques jouent un rôle prédominant pour établir une connectivité sécurisée dans notre société numérique actuelle. Ces calculs traitent des informations sensibles telles que des clés de chiffrement, qui sont généralement très exposées lors de la manipulation, ce qui représente une menace énorme pour la sécurité des informations sensibles dans les composants cryptographiques et l'ensemble des systèmes connectés. Dans le domaine de la sécurité des systèmes embarqués, l'analyse des canaux auxiliaires est l'une des techniques les plus puissantes contre les implémentations cryptographiques. Elle consiste à extraire les données sensibles en exploitant certaines fuites physiquement observables lors de l'exécution des composants cryptographiques. Comme ces attaques représentent une menace réelle, diverses protections ont été étudiées et développées. Parmi celles-ci, le masquage aléatoire est l'une des mieux établies. Fondamentalement, le masquage offre une sécurité prouvable contre l'analyse des canaux auxiliaires en divisant toute variable sensible en plusieurs parts aléatoires. Un paramètre fondamental pour un schéma de masquage est son ordre de sécurité t ≥ 0. Ainsi, tout adversaire visant à récupérer des clés doit utiliser strictement plus de t parts pour lancer une attaque d'ordre supérieur, alors que la complexité des données augmente de façon exponentielle en t (sous des conditions liées à la puissance du bruit de mesure), ce qui à son tour fournit une sécurité contre les attaques par canaux auxiliaires.

Le sujet principal de cette thèse concerne la sécurité mesurable des canaux auxiliaires des implémentations cryptographiques, en particulier en présence de masquage aléatoire. Globalement, cette thèse se compose de deux sujets. L'un est la quantification des fuites de la forme la plus générale de masquage équipé des codes linéaires, dit masquage à base de code ; l'autre est l'exploration de l'application de mesures d'information plus génériques dans un contexte d'analyse de canaux auxiliaires. Ces deux sujets sont intrinsèquement liés l'un à l'autre dans l'évaluation et l'amélioration de la sécurité pratique des implémentations cryptographiques.

Pour ce qui concerne le premier sujet, nous proposons un cadre théorique de codage unifié pour mesurer la fuite d'informations dans le masquage basé sur les codes. Plus précisément, notre cadre établit des connexions formelles entre les propriétés de codage (y compris la distance v duale et le nombre de points de contact permettant un sondage) et les métriques de fuite dans l'analyse des canaux auxiliaires (y compris le rapport signal sur bruit et l'information mutuelle). Comme cela a été rapporté dans la littérature, différents codes linéaires ont un impact distinct sur la résistance aux attaques par canal auxiliaires d'un masquage basé sur un code. Ces connexions formelles nous permettent de faire avancer l'évaluation quantitative sur la façon dont les codes linéaires peuvent affecter la sécurité concrète de tous les schémas de masquage basés sur les codes, y compris les cas non-redondants (par exemple, masquage basé sur le produit scalaire, masquage par somme directe, etc.) et les cas redondants (par exemple, masquage polynômial basé sur le partage secret de Shamir, etc.). De plus, en nous appuyant sur notre cadre théorique, nous consolidons le masquage basé sur le code en fournissant les codes linéaires optimaux dans le sens qu'ils maximisent la résistance des canaux auxiliaires du schéma de masquage correspondant. Notre formalisation est finalement vérifiée par une évaluation basée sur les attaques, où les attaques utilisent des distingueurs basés sur le maximum de vraisemblance et sont donc optimales.

Concernant le deuxième sujet, nous présentons un spectre complet d'applications d'une variante de l'information mutuelle de Shannon, appelée "alpha-information". Il s'agit d'une généralisation de l'information mutuelle permettant d'évaluer la sécurité d'une implémentation face aux attaques par canaux auxiliaires. Dans l'analyse des canaux auxiliaires, l'information mutuelle est fréquemment adoptée dans une évaluation du point de vue de la théorie de l'information afin d'établir le niveau de sécurité des attaques par canaux auxiliaires. Par un modèle de canal de communication, l'information mutuelle fournit une limite supérieure sur le taux de succès de toute attaque étant donné un ensemble fixe de mesures de canaux auxiliaires.

Alternativement, elle donne une limite inférieure sur le nombre de mesures pour atteindre un taux de succès spécifique. Cependant, ces limites sont souples, encore plus souples dans des scénarios à fort bruit de mesure. Dans cette thèse, nous proposons d'utiliser une mesure plus générale du point de vue de la théorie de l'information, à savoir l'information alpha (α-information) d'ordre α. La nouvelle mesure donne également la limite supérieure du taux de succès et la limite inférieure du nombre de mesures. Ce qui est remarquable, c'est qu'avec des choix appropriés de α, l'information α fournit des bornes très proches de la réalité ; en particulier, lorsque α tend vers l'infini (positif), les limites seront exactes. En fait, les distingueurs basés sur le maximum de vraisemblance convergeront vers les limites. Par conséquent, nous démontrons comment les deux mondes, à savoir les mesures du point de vue de la théorie de l'information (limites) et vi les attaques par canaux auxiliaires basées sur le maximum de vraisemblance, sont parfaitement connectés dans l'analyse par canaux auxiliaires.

En résumé, notre étude dans cette thèse fait avancer l'évaluation et la consolidation de la sécurité des canaux auxiliaires des implémentations cryptographiques. Du point de vue de la protection, nos sorties quantitatives permettent de mettre en oeuvre des implémentations masquées concrètes, implémentant une résistance vis-à-vis des attaques par canal auxiliaire la plus élevée possible lorsqu'elles sont équipées des codes linéaires optimaux. Par conséquent, nous fournissons un guide des meilleures pratiques pour l'application du masquage basé sur le code.

Du point de vue de l'évaluation, l'application de l'alpha-information permet aux évaluateurs et concepteurs (développeurs) d'avoir une estimation plus précise (voire exacte) du niveau de sécurité concret des canaux auxiliaires émanant de leurs puces cryptographiques. vii This dissertation is dedicated to my respectful parents, my beloved soulmate Tong Zhao, my brother and my whole family for everything.

I would never have made it this far without your selfless love, constant support and inspiring encouragement.

This dissertation is especially dedicated to the memory of my grandfather, those indelible and warm memories will stay with me all my life. [START_REF] Brier | Correlation power analysis with a leakage model[END_REF]8,5] where all codes have different d ⊥ D and B d ⊥ D . The solid curves are from numerical simulation, while the dotted lines are estimated by using Eqn. 4.17. . . . . . . . . where the three public points are: α 1 = α i , α 2 = α j , α 3 = α k . . . . . . . . . . . . 6.2 The intra-share independence issue: the existence of higher-order leakages decreases the security of the corresponding masking scheme (two public parameters are α 1 = α i , α 2 = α j as in Tab. with different noise levels by using q max = 4800 traces. Note that we omit the bounds given by I(X; Y|T) as they are invisible when plotted together with bounds given by I(U; Y|T). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

I Introduction and Contributions 1

8.7

Comparison of the minimum number of traces q min to reach P s ≥ 95% predicted by our new bound, by I(X; Y|T) as in [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF] and also the baseline given by an ML Part I

Introduction and Contributions

Cryptography & Cybersecurity

Nowadays, abundant electronic devices are proliferating in our daily life, such as SIM cards, cell-phones, bank cards, etc. For instance, from Eurosmart's survey 1 , there are about 9.54 billion shipped units of secure elements. Particularly, the Telecom market has closed 2020 with around 5,1 billion units shipped, including 309 million units shipped for eSIM and a 4,8 billion units for SIM, which experienced a significant increase. Those secure elements are widely deployed in 1. INTRODUCTION telecom, financial services, device manufacturers, etc. However, such secure elements usually handle some sensitive information, which are very exposed during computations when loading, manipulating, and storing them, resulting in massive scales of vulnerabilities and attacks in practice. As a consequence, improving their security has become the highest priority task.

In this respect, modern cryptography is the cornerstone to build the chain of trust and security.

It plays a fundamental and pivotal role in establishing secure connectivity in this emerging digital era. In other words, cryptography makes secure communications between different parties possible and evolves along with computation and communication technologies. Basically, cryptography provides five primary functionalities including confidentiality, integrity, authentication, nonrepudiation and key exchange. Those functionalities are well-established on the basis of various concepts of mathematics such as information-theoretic security, computational-complexity theory, number theory, coding theory, probability theory and so on.

Relying on mathematical tools, it is feasible to devise and construct theoretically secure cryptographic algorithms or protocols. In the field of symmetric key cryptography, the Data Encryption Standard (DES) [START_REF]Data Encryption Standard[END_REF] and its successor Advanced Encryption Standard (AES) [START_REF]Advanced Encryption Standard (AES)[END_REF] is one of the most important algorithms that was published two decades ago by National Institute of Standards and Technology (NIST). On the contrary, in the field of public key cryptography, RSA [START_REF] Rivest | A Method for Obtaining Digital Signatures and Public-Key Cryptosystems[END_REF] and ECC [START_REF] Koblitz | Elliptic curve cryptosystems[END_REF][START_REF] Victor | Use of Elliptic Curves in Cryptography[END_REF] are two well-known instances that are based on the intractability of the corresponding mathematical problems.

The Root of Security & the Chain of Security

As a basic rule and common consensus in cryptography, Kerckhoffs's principle, dated back to 19th century, states that a cryptosystem should be secure, even if everything about the system is accessible to adversaries except the key [START_REF] Kerckhoffs | La cryptographie militaire (1)[END_REF][START_REF] Kerckhoffs | La cryptographie militaire (2)[END_REF]. It is followed and reformulated by Claude E.

Shannon in 1949 known as Shannon's maxim: "one ought to design (crypto) systems under the assumption that the enemy will immediately gain full familiarity with them" [START_REF] Shannon | Communication theory of secrecy systems[END_REF]. The keys in a cryptosystem form the basis for the root of trust that is critical to the system. Theoretically, above constructions (e.g., AES, RSA, ECC, etc) are computationally secure in this regard under the black-box assumption, wherein an adversary can only access to inputs and outputs of a cryptosystem.

However, in practical applications, the keys are not static but manipulated dynamically in the digital world. Indeed, each stage of manipulations (computations) shall expose those keys,

Side-Channel Analysis

which leads to the demand of chain of security to guarantee security in reality. As a matter of fact, any digital devices will leak physically observable information [START_REF] Micali | Physically observable cryptography (extended abstract)[END_REF] of internal states during executions. Although mathematical proofs of security for cryptographic algorithms are fundamental and indispensable, they usually cannot guarantee the practical security of the corresponding cryptographic implementations. In reality, those cryptographic algorithms must be run in some physical devices. Therefore, those physical observations usually violate the black-box setting assumption that an adversary can only access to the inputs and outputs of a cryptographic algorithm. As knowing certain observable information makes it advantageous to adversary, the black-box model is lifted to gray-box setting by considering any (abstract) form of observable leakages existing in practice. Accordingly, the attacks exploiting those physically observable leakages are called physical attacks.

Side-Channel Analysis

Side-channel analysis (SCA) is among the most powerful physical attacks against cryptographic implementations. Since the seminal works [START_REF] Paul | Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems[END_REF][START_REF] Paul | Differential power analysis[END_REF], a very large amount of SCAs have been proposed by exploiting various observable physical leakages in practice. Those physical leakages include but not limited to the running time [START_REF] Dhem | A Practical Implementation of the Timing Attack[END_REF][START_REF] Paul | Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems[END_REF], the power consumption [START_REF] Clavier | Differential Power Analysis in the Presence of Hardware Countermeasures[END_REF][START_REF] Paul | Differential power analysis[END_REF], the electromagnetic emanations [START_REF] Gandolfi | Electromagnetic analysis: Concrete results[END_REF][START_REF] Quisquater | ElectroMagnetic Analysis (EMA): Measures and Counter-Measures for Smard Cards[END_REF], the acoustic emission [START_REF] Camurati | Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers[END_REF]73], the photonic emission [START_REF] Carmon | Photonic side channel attacks against RSA[END_REF][START_REF] Ferrigno | When AES blinks: introducing optical side channel[END_REF][START_REF] Krämer | Differential Photonic Emission Analysis[END_REF],

etc., and more exploitable leakages emerge as technology improves (e.g., Nanotechnology)

and in-depth understanding of behaviors of elementary circuits, like micro-architectural data leakages [START_REF] Ge | A survey of microarchitectural timing attacks and countermeasures on contemporary hardware[END_REF]93,[START_REF] Lipp | Meltdown: Reading Kernel Memory from User Space[END_REF][START_REF] Marshall | MIRACLE: micro-architectural leakage evaluation[END_REF]. Essentially, any measurable secret-dependent information or behaviors of the underlying cryptographic devices can be exploited to launch a successful side-channel attack.

In principle, side-channel analysis consists of extracting the sensitive information from noisy measurements. It is commonly classified into two classes depending on the ability of the adversary and corresponding setting.

• Non-profiling attacks. An adversary attempts to extract the sensitive information by correlating side-channel measurements and hypothetical leakages. Several well-known attacks are simple power analysis (SPA) [START_REF] Paul | Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems[END_REF], differential power analysis (DPA) [START_REF] Paul | Differential power analysis[END_REF],

correlation power analysis (CPA) [START_REF] Brier | Correlation power analysis with a leakage model[END_REF], mutual information analysis (MIA) [START_REF] Gierlichs | Mutual information analysis[END_REF][START_REF] Veyrat-Charvillon | Mutual Information Analysis: How, When and Why?[END_REF], etc.

• Profiling attacks. They are two-phrase attacks. an adversary is assumed to possess an identical device to build some exact profiles on the leakage behaviors and then apply these

INTRODUCTION

profiles during the attack phrase. Some well-known instances are template attack [START_REF] Chari | Template attacks[END_REF],

stochastic attack [START_REF] Schindler | A Stochastic Model for Differential Side Channel Cryptanalysis[END_REF], etc. In particular, the template attack is known as the most powerful side-channel attack knowing the leakage model.

Additionally, machine learning (including deep learning) techniques have been adapted into side-channel analysis in both non-profiling [START_REF] Perin | Keep it unsupervised: Horizontal attacks meet deep learning[END_REF][START_REF] Ramezanpour | SCAUL: power side-channel analysis with unsupervised learning[END_REF][START_REF] Timon | Non-Profiled Deep Learning-Based Side-Channel Attacks[END_REF] and profiling settings [10,[START_REF] Cagli | Convolutional Neural Networks with Data Augmentation Against Jitter-Based Countermeasures -Profiling Attacks Without Pre-processing[END_REF][START_REF] Masure | A comprehensive study of deep learning for side-channel analysis[END_REF][START_REF] Wouters | Revisiting a methodology for efficient CNN architectures in profiling attacks[END_REF][START_REF] Zaid | Methodology for efficient CNN architectures in profiling attacks[END_REF]. In essence, side-channel classifies different key hypotheses relying on observations, in which learning-based techniques shall amplify those attacks dramatically. However, those learning-based attacks tolerate a loss of interpretability on results, even in some restricted scenarios.

Protections and Code-based Masking

In order to protect cryptographic chips (implementations) against SCA, many countermeasures have been proposed, wherein three main routines are masking, shuffling and hiding. Specifically, masking schemes [START_REF] Chari | Towards Sound Approaches to Counteract Power-Analysis Attacks[END_REF][START_REF] Coron | Side Channel Cryptanalysis of a Higher Order Masking Scheme[END_REF][START_REF] Mangard | Power Analysis Attacks: Revealing the Secrets of Smart Cards[END_REF][START_REF] Rivain | Provably Secure Higher-Order Masking of AES[END_REF] randomize the dependency between sensitive data and leakages by dividing each sensitive variable into several random shares to thwart SCA, while

Shuffling schemes [START_REF] Coron | Secure wire shuffling in the probing model[END_REF][START_REF] Herbst | An AES Smart Card Implementation Resistant to Power Analysis Attacks[END_REF][START_REF] Rivain | Higher-Order Masking and Shuffling for Software Implementations of Block Ciphers[END_REF] randomize the order of operations during the executions. Quite differently, by circuit-level alteration, hiding-based countermeasures [START_REF] Clavier | Differential Power Analysis in the Presence of Hardware Countermeasures[END_REF][START_REF] Mangard | Power Analysis Attacks: Revealing the Secrets of Smart Cards[END_REF][START_REF] Rauzy | Formally Proved Security of Assembly Code Against Leakage[END_REF] attempt to make the leakages uniformly independent to the data processed, while it is difficult to have any guarantee [START_REF] Immler | Your rails cannot hide from localized EM: how dual-rail logic fails on fpgas[END_REF]. Among them, masking schemes are a class of the most attractive and frequently used techniques against SCA, since they provide formally provable security and could be implemented on algorithmic-level without any hardware alteration.

Masking Schemes

Featured with the favorable provable security, masking has triggered a fruitful line of works, ranging from theoretical constructions of secure components (usually called gadget) to practical resilience evaluations by side-channel attacks. Typically, the key parameter of a masking scheme is the security order t under the probing model [86], which indicates the least order (t + 1) of a successful attack must have. In a t-th order secure masking, each sensitive variable into at least t + 1 shares. The rationale is that, the attack complexity increases exponentially with the number of shares [START_REF] Chari | Towards Sound Approaches to Counteract Power-Analysis Attacks[END_REF][START_REF] Prouff | Masking against Side-Channel Attacks: A Formal Security Proof[END_REF] given a sufficient amount of noise, while the implementation cost increases only quadratically (or cubically in higher-order glitch-free implementations [START_REF] Grosso | Masking vs. Multiparty Computation: How Large Is the Gap for AES?[END_REF]).

Protections and Code-based Masking

Various masking schemes have been proposed since 1999, as shown in Fig. 1.1. Typically instances include Boolean masking [START_REF] Chari | Towards Sound Approaches to Counteract Power-Analysis Attacks[END_REF], Inner Product masking (IPM) [2,3], Leakage Squeezing (LS) [START_REF] Carlet | Achieving side-channel high-order correlation immunity with leakage squeezing[END_REF][START_REF] Carlet | Statistical properties of side-channel and fault injection attacks using coding theory[END_REF] and Direct Sum masking (DSM) [START_REF] Bringer | Orthogonal Direct Sum Masking -A Smartcard Friendly Computation Paradigm in a Code, with Builtin Protection against Side-Channel and Fault Attacks[END_REF][START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF]. Note that those proposals marked in blue are the first proposals of the corresponding schemes. An exception exists for the original IPM [4], since there exist some first-order information leakages that are fixed in the improved one [2]. To the best of our knowledge, the generalized code-based masking (GCM) [35,[START_REF] Wang | Efficient and Private Computations with Code-Based Masking[END_REF] is the most generic scheme in this respect 1 . In particular, polynomial masking [77,[START_REF] Prouff | Higher-Order Glitches Free Implementation of the AES Using Secure Multi-party Computation Protocols[END_REF] is also a special case of GCM, which is built upon Shamir's secret sharing (SSS) scheme [START_REF] Shamir | How to share a secret[END_REF]. Naturally, two questions arise: first, how to measure information leakage in different schemes?

[BFGV12] [BFG15] [BFG+17] [CGM19] [CDG+14] [CG18] [WSY+16] [WMCS20] [CGC+21a] [CGC+21b] PM DSM [PGS+17] [MGD11] [PR11] Generalized code-based masking [CGG+19] [GM11] [CMP18] [Car13] [CDGM12]
and second, for each scheme, how to choose optimal codes (or parameters)?

Generalizing to Code-based Masking

Code-based masking follows the generalization trend and unifies many schemes by concentrating on the encodings in sharing. In code-based masking, two linear codes are involved, namely C and D. The only requirement is that there is no nonzero codeword in their intersections [35,[START_REF] Wang | Efficient and Private Computations with Code-Based Masking[END_REF].

As a result, the resilience of a code-based masking against side-channel analysis depends highly on the two linear codes, in which the coding-theoretic properties shall be connected to algebraic complexity from a view of (pseudo)-Boolean function.

INTRODUCTION

The first representative scheme is IPM, in which the encoding is similar to the simplest Boolean masking except that each share is equipped with a linear function (multiplied by a public constant). It consumes n parameters in an n-share setting and enjoys the simple structure that can be implemented quite efficiently [3]. As a special instance of non-redundant code-based masking, two linear codes in IPM are complementary, resulting in a super simplification when evaluating its side-channel resistance. Indeed, we demonstrate that the side-channel security of IPM only depends on properties of the code D [37]. More generally, only the code D matters in any non-redundant code-based masking like DSM.

Another typical example is the polynomial masking that is based on the SSS scheme. It also employs n public parameters in an n-share setting, but forms an entirely different encoding.

Essentially, the encoding in SSS-based masking can be reformulated and connected to the Reed-Solomon (RS) codes [START_REF] Chabanne | Linear repairing codes and side-channel attacks[END_REF][START_REF] Macwilliams | The Theory of Error-Correcting Codes[END_REF]. Considering an (n, t)-SSS based sharing as depicted in Fig. 1.2, it forms n shares while provides a t-th order privacy (side-channel resistance) rather than nt parameters in a random setting. From a coding-theoretic perspective, the RS code is optimal in a given finite field which achieves the Singleton bound [START_REF] Richard | Maximum distance q -nary codes[END_REF]. However, as shown in [START_REF] Chabanne | Linear repairing codes and side-channel attacks[END_REF], distinct public points play a role in the resilience and the efficiency of the protection.

Therefore, the questions above still remain.

In the above two representative schemes, we can refine the second question: how to choose n parameters to maximize the side-channel protection? More straightforwardly, how to choose public points in the case of SSS-based masking. 1.5 Towards Measurable Side-Channel Security

Towards Measurable Side-Channel Security

Side-channel attacks pose a considerable threat to cryptographic devices that are physically or remotely accessible by an attacker. Naturally, the side-channel leakage is at the core of evaluating the practical security of a given cryptographic implementation. That is, how much information can an adversary collect and/or how much of it can be exploited in practice? Regarding the former, we refer to information leakage quantification, in which we aim at measuring side-channel leakage in a quantification way. Those leakages might be independent of specific attacks relying on different statistical tools in the corresponding side-channel distinguishers. On the contrary, the latter is much more relevant to the probability of success in extracting sensitive variables (like secret keys) in real scenarios.

Information Leakage Quantification

Quantifying the information leakage is essential in assessing the concrete side-channel security of a cryptographic chip. Typically, the performance of a side-channel distinguisher is highly determined by the amount of information leakage that is usually measured by leakage metrics like signal-to-noise ratio, correlation coefficients, mutual information, etc.

According to different leakage models and the abstraction level of cryptographic implementations, the strategies for quantifying side-channel leakages are roughly classified into five categories as follows.

• Firstly, the conformance-based leakage detection aims at answering the following question at a high abstraction level: does the device under test leak side-channel information? [START_REF] Bhasin | NICV: Normalized Inter-Class Variance for Detection of Side-Channel Leakage[END_REF][START_REF] Cooper | Test Vector Leakage Assessment (TVLA) Methodology in Practice[END_REF][START_REF] Moradi | Leakage Detection with the χ 2 -Test[END_REF]. Those statistical tools include Welch's t-test [START_REF] Bhasin | NICV: Normalized Inter-Class Variance for Detection of Side-Channel Leakage[END_REF][START_REF] Cooper | Test Vector Leakage Assessment (TVLA) Methodology in Practice[END_REF], χ 2 -test [START_REF] Moradi | Leakage Detection with the χ 2 -Test[END_REF][START_REF] Richter | A comparison of χ 2 -test and mutual information as distinguisher for side-channel analysis[END_REF], etc. A similar approach is detailed in ISO/IEC 17825 [87].

• Secondly, the proof-based evaluation intends to prove the side-channel resistance of a masked design under abstract models like the probing model [86] and related variants [START_REF] Duc | Unifying Leakage Models: From Probing Attacks to Noisy Leakage[END_REF][START_REF] Dziembowski | Noisy leakage revisited[END_REF][START_REF] Prest | Unifying leakage models on a rényi day[END_REF][START_REF] Prouff | Masking against Side-Channel Attacks: A Formal Security Proof[END_REF]. Typically, under independence assumption and large noise condition, several leakage models are equivalent with certain forms of constants [START_REF] Prest | Unifying leakage models on a rényi day[END_REF] in providing formal security guarantees of the masked implementation. However, physical defaults like couplings, glitches, etc., usually contradict assumptions behind the probing model [5,[START_REF] Mangard | Successfully Attacking Masked AES Hardware Implementations[END_REF].

As a consequence, it is recommended to launch more quantitative evaluations in assessing practical side-channel security.

INTRODUCTION

• Thirdly, the moment-based evaluation attempts to find the least order of moments of side-channel measurement that depend on the sensitives. Representative metrics including signal-to-noise ratio (SNR) [START_REF] Standaert | A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks[END_REF] under proper definitions and the normalized inter-class variance (NICV) [START_REF] Bhasin | Side-Channel Leakage and Trace Compression using Normalized Inter-Class Variance[END_REF], etc. Particularly, NICV is connected to SNR in the sense that both of them evaluate the key-dependent variance of leakage. With proper definition, SNR can also be used to measure the leakage in presence of higher-order masking schemes.

• Fourthly, the information-theoretic evaluation aims at measuring side-channel leakages by utilizing information-theoretic measures [START_REF] Standaert | A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks[END_REF][START_REF] Whitnall | A Comprehensive Evaluation of Mutual Information Analysis Using a Fair Evaluation Framework[END_REF]. In essential, it usually provides information-theoretic bounds on the probability of success for any side-channel distinguishers given a set side-channel measurements [41,[START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF]. The frequently used measures include Shannon mutual information (MI), Kullback-Leibler divergence, conditional entropy, etc.

Additionally, some more general measures like Rényi entropy and Rényi divergence shall be considered for a purpose of more accurate evaluation.

• Finally, the fifth category of attack-based evaluation is at the core of side-channel security evaluation, which aims at assessing the probability of success of a specific side-channel distinguisher. We shall detail more in the following subsection.

Summing up, the conformance-based leakage detection only provides qualitative assertion on whether the masked circuits leak or not, while other evaluations give quantitative assessment of concrete side-channel security. In the following, we present the last evaluation strategy, which quantifies information leakage by exploitation.

Information Leakage Exploitation by Attacks

As is argued frequently, the leakage detected information-theoretic evaluation (e.g., using mutual information) might not lead to a successful attack in practice. Eventually, the exploitability of the side-channel leakage determines the success rate of certain attacks.

In this respect, the last category, namely the attack-based evaluation is at the core of side-channel security evaluation, which aims at assessing the probability of success of a specific side-channel distinguisher. Relying on large variety of side-channel distinguishers like correlation power analysis [START_REF] Brier | Correlation power analysis with a leakage model[END_REF], template attacks [START_REF] Chari | Template attacks[END_REF], stochastic attacks [START_REF] Schindler | A Stochastic Model for Differential Side Channel Cryptanalysis[END_REF], higher-order optimal distinguisher [START_REF] Bruneau | Masks Will Fall Off -Higher-Order Optimal Distinguishers[END_REF], etc, the attack-based evaluation provides more accurate assessment of leakage, which captures device-specific features of side-channel leakage. In particular, some metrics • Impl. is short for implementations;

• Abstract denotes abstract or theoretical constructions.

All above five strategies are summarized in Tab. 1.1. To a large extent, all five evaluation approaches are complementary to each other in practical application, varying with different evaluation requirements and necessary expertise on launching evaluations.

Measuring Leakage in a General Context

Shannon information theory (e.g., entropy, conditional entropy, mutual information, etc) is frequently adopted in side-channel analysis for measuring the leakage from an informationtheoretic perspective. More generally, the problem of information leakage quantification shall be extended into a more general one: given two dependent random variables X and Y , how to measure the information that Y brings on X. Intuitively, it is to measure the difference between the amount of uncertainty on X alone and the remaining uncertainty when Y is known (the

INTRODUCTION

equivocation). There is consensus, since the founding work of Shannon [START_REF] Shannon | A mathematical theory of communication[END_REF][START_REF] Shannon | Communication theory of secrecy systems[END_REF], that this information must be given by the mutual information I(X; Y ) = H(X) -H(X|Y ) where H(X)

is the entropy and H(X|Y ) is the equivocation.

Mutual information has been successfully applied to solve many telecommunication problems.

However, recent theories in computer science and information theory show that this paradigm is not always satisfying in practice [START_REF] Smith | On the foundations of quantitative information flow[END_REF]. Indeed, the "operational" definition of the quantities I(X, Y ), H(X), H(X|Y ) is linked to the size of the corresponding typical sets (via the AEP, the asymptotic equipartition property), thanks to the law of large numbers. It thus supposes to constitute sequences i.i.d. infinitely long of X and Y to be operational. We would prefer more practical definitions for much shorter sequences, typically for discrete variables, where the knowledge of the information implies knowing at least partially X. For instance, in sidechannel analysis, the key-recovery attack is essentially to recover a discrete sub-key by utilizing unintentional side-channel leakages (like computation time, electromagnetic emanation, power consumption for embedded implementations).

In this regard, another promising approach is using Rényi entropy and divergence [START_REF] Rényi | On measures of entropy and information[END_REF], which are known as α-information theory with a flexible order α (such that α > 0 and α = 1). It is indeed a generalization of Shannon information theory. Particularly, Sibson's α-information [START_REF] Sibson | Information radius[END_REF] is more appropriate for some applications [START_REF] Issa | Operational definitions for some common information leakage metrics[END_REF][START_REF] Issa | An Operational Approach to Information Leakage[END_REF] than other proposals, which generalizes mutual information (without mutuality). More recently, several conditional versions of α-information have been proposed [START_REF] Amedeo | On conditional sibson's α-mutual information[END_REF][START_REF] Liu | On Conditional α-Information and its Application to Side-Channel Analysis[END_REF][START_REF] Tomamichel | Operational interpretation of Rényi information measures via composite hypothesis testing against product and markov distributions[END_REF] for generalizing conditional mutual information. Especially, [START_REF] Liu | On Conditional α-Information and its Application to Side-Channel Analysis[END_REF] shows great potentials when applied into side-channel analysis by providing much tighter bounds on the probability of success, although only few candidates of order α are provided. During this thesis, the main subject targets the measurable security of cryptographic chips. More specifically, the first topic is how to unify and quantify the information leakage of cryptographic implementations in the presence of masking protections. In this regard, we present a coding-theoretic framework to concretely measure the information leakage in codebased masking. Secondly, how the general information-theoretic measures (e.g., Rényi entropy, α-divergence, α-information, etc) can be exploited to evaluate and understand the concrete security level of cryptographic devices. In this respect, we present information-theoretic bounds on the maximum success rate of key-recovery attacks and the minimum number of side-channel traces to achieve a specific success rate.

Empowering Inner Product Masking by Optimal Codes

The first contribution of this thesis lies in optimizing Inner Product Masking (IPM) by providing the optimal codes for it [START_REF] Cheng | Optimal Codes for Inner Product Masking[END_REF]37,40]. IPM is proposed to strengthen the frequently used Boolean

CONTRIBUTIONS

masking by improving the algebraic complexity of encoding (or sharing). We propose a codingtheoretic approach to quantitatively assess the side-channel security of the IPM. Specifically, starting from the expression of IPM in a coded form, we use two defining parameters of the code (namely the dual distance and the kissing number ) to characterize its side-channel resistance.

We then connect it to two leakage metrics, namely signal-to-noise ratio (SNR) and mutual information (MI) from an information-theoretic aspect. Next, we show how to systematically choose optimal codes (in the sense of maximizing the resilience) to optimize IPM. We present a simple but effective algorithm for choosing optimal codes for IPM, which should be of special interest for designers when selecting optimal parameters for IPM.

Leakage Quantification of the Code-based Masking

In this thesis, we follow a generalization approach by targeting the most general code-based masking called generalized code-based masking (GCM) [35], which includes Boolean masking, IPM, Leakage Squeezing (LS), Direct Sum masking (DSM), Shamir's Secret Sharing (SSS)-based masking, etc. We follow the above coding-theoretic approach and propose a unified leakage quantification framework for GCM by connecting the side-channel resistance of GCM with two coding properties of the corresponding linear codes used in GCM. The two coding properties are the dual distance and the adjusted kissing number. We demonstrate that the two properties are analytically linked to commonly used leakage metrics, namely signal-to-noise ratio and mutual information, in the case of GCM.

As straightforward applications, we show that our extended framework is consistent with the above in IPM. Particularly, the adjusted kissing number converges to the kissing number when the masking is non-redundant, e.g., in cases of IPM and DSM. Secondly, we illustrate how the redundancy in SSS-based masking affects its side-channel resistance [35]. We highlight that the public interpolation points (see in Fig. 1.2) significantly impact the side-channel resistance of SSS-based masking. We then provide an information-theoretic evaluation on public points and show the optimal public points for SSS-based masking.

Bounding Success Rate in Recovering Secret Key

The third part of this thesis completes side-channel resistance of the code-based masking by providing attack-based evaluations and present information-theoretic bounds when attacking masked cryptographic implementations. In this respect, success rate (SR) is one of the ultimate 2.4 Generic Information-Theoretic Measures in SCA metrics in side-channel analysis. Firstly, we employ the higher-order optimal distinguisher (HOOD) against instances of code-based masking, namely IPM and SSS-based masking corresponding to redundant and non-redundant cases, respectively. The experimental results of HOOD exactly confirm our previous information-theoretic evaluations. We emphasize that the redundancy in code-based masking can only decrease its resilience against practical attacks. We also provide some optimal and worst cases of both IPM and SSS-based masking, especially the worst cases of (3, 1)-SSS based masking is less resilient than the first-order Boolean masking in spite of the same security order.

Secondly, we derive information-theoretic bounds on the success rate following a communication channel model [41,138]. When evaluating the practical side-channel security of chips, it is extremely useful to have an upper bound on success rate of any attack given a (fixed) number of side-channel measurements. Or conversely, it is equivalent to derive a lower bound on the number of queries for a given success rate of any attacks. In this thesis, we derive several bounds in both directions by using information-theoretic tools, particularly for cryptographic implementations protected by masking schemes (including the code-based masking). In particular, those bounds are bidirectional by either providing upper bounds on success rate of any attacks or lower bounds on the number of traces to achieve a certain success rate.

Generic Information-Theoretic Measures in SCA

In the final part of this thesis, we investigate more general information-theoretic measures in the context of side-channel analysis [START_REF] Cheng | Guessing a secret cryptographic key from side-channel leakages[END_REF][START_REF] Liu | On Conditional α-Information and its Application to Side-Channel Analysis[END_REF], particularly in comparison with Shannon entropy and mutual information [35,138]. Those measures include Rényi entropies, guessing entropy and α-information, etc. In the problem of guessing a cryptographic key, we illustrate a full spectrum of upper bounds on the probability of success by using conditional α-information between the secret key and information leakage. Especially, we show that the success rate is tightly upper bounded by α-information of a larger enough order (e.g., when α ≥ 100.00, as shown in Fig. 2.1).

More importantly, we demonstrate that the success rate of the maximum-likelihood (ML) based attack converges to the exact upper bound by the conditional α-information of order α → ∞ (also called maximal information). The ML-based attacks are optimal, for instance, consider HOOD when the leakage model is known. Therefore, our derivatives imply that this bound is also achievable. To the best of our knowledge, we shall for the first time seamlessly connect information-theoretic measures and real attacks in side-channel analysis. Taking the

CONTRIBUTIONS

Hamming weight leakage with additive white Gaussian noises, numerical results confirm our findings and show meaningful indications in practice. As a perspective, it would be extremely interesting to extend our evaluation into protected scenarios, e.g., in the presence of masking.

Outline of the Thesis

This thesis mainly consists of four parts and accompanied with the introduction and conclusion parts. The overall structure of this thesis is diagrammed as in Fig. 2.2.

In Part II, we focus on optimizing inner product masking by a coding-theoretic approach.

Some basics on the linear codes, Pseudo-Boolean functions and information theory are firstly revisited in Chap. 3 and they will be used throughout this thesis. Secondly, we dive into IPM in Chap. 4 by forming it into a coding-theoretic fashion. Then the information leakage is measured by both signal-to-noise ratio and mutual information, along with numerical results. Moreover, we present the rationale of selecting optimal codes on the basis of our leakage quantification.

Next, in Part III we present the generalization of several masking schemes into the most general scenario, and also extend our coding-theoretic approach into this general scenario.

Specifically, in Chap. 5, we extend the leakage quantification approach to redundant scenarios,

Outline of the Thesis

This Thesis

Part I

Introduction & Contributions

Part II

SR, MI

Evaluations

Information-theoretic evaluation (by MI or 𝛼-info.) for instance in the case of SSS-based masking. As an application, in Chap. 6, we present an example that exactly verifies the effectiveness of our new framework and provides optimal linear codes in several cases.

Then, in Part IV we first present an attack-based evaluation on code-based masking in Chap. 7. In order to amplify the attack, we employ the optimal one that is based on the maximum-likelihood rule. We highlight that those numerical results are well-coincided with our theoretical derivatives. Second, we show how to derive several information-theoretic bounds on the success rate of any attacks in Chap. 8.

Last in Part V or in Chap. 9, we illustrate how those more general information-theoretic tools can be applied in side-channel analysis. We first explore the application of Rényi information theory (including Rényi entropy, Rényi divergence and related extensions) into the problem of guessing the secret key from its Hamming weight leakage. Second, we propose to use conditional α-information to assess the concrete side-channel security.

The conclusions of this thesis are in Part VI along with possible investigations in the future.

Additional proofs and materials are included in appendices, Part VII.

Part II

Optimizing Inner Product Masking in a Coding-Theoretic Approach CHAPTER 3

Preliminaries: Basics on Linear Codes, Vector Space and Pseudo-Boolean Functions

In this chapter, we revisit basics of the linear codes, the vector spaces and the pseudo-Boolean functions that are used through this thesis.

Linear Codes

We recall several known definitions and properties of linear codes, which hold respectively when the base field is K = F 2 or K = F 2 . Let n, k, d ∈ N * be positive integers such that k ≤ n. The linear code is defined as follows.

Definition 3.1 (Linear code [START_REF] Macwilliams | The Theory of Error-Correcting Codes[END_REF]). A linear code C is a set of vectors, also called codewords, which form a vector space. The parameters of a linear code C is a triple (n, k, d), where n is the code length, k denotes its dimension, and d is its minimum distance. The parameters are denoted as [n, k, d] q to refer to the finite field F q the code is defined on.

PRELIMINARIES

The minimum distance of a code C is defined as

d C = min c,c ∈C d H (c,
W C (X, Y) = n i=0 B i X n-i Y i (3.1)
where

B i = |{c ∈ C|w H (c) = i}|
• B 0 = 1, B 1 = • • • = B d C -1 = 0, • B d C > 0,
C ⊥ = {u ∈ K n | ∀c ∈ C, c • u = 0}
, where c • u is the standard inner product.

Definition 3.4 (Dual Distance [START_REF] Macwilliams | The Theory of Error-Correcting Codes[END_REF]). The dual distance d ⊥ C of a linear code C is the minimum Hamming weight w H (u) of nonzero u ∈ K n , such that c∈C (-1) c•u = 0.

Let E a vector space of K n . The indicator of E is the application

x ∈ K n → 1 E (x) = 1 if x ∈ E, 0 otherwise.
Then we introduce a well-known property of the linear code as follows.

Lemma 3.2. For arbitrary linear code C and u ∈ K n , we have c∈C (-1

) c•u = |C|1 C ⊥ (u).
Proof. We give this well-known proof for the self-contained content. For u ∈ C ⊥ , it is straightforward to see that c∈C (-1

) c•u = |C|. Suppose that u ∈ C ⊥ , thus ∃v ∈ C such that u • v = 1. We denote C = C ∪ (C + v) and dim(C ) = dim(C) -1. Then c∈C (-1) c•u = c ∈C (-1) c •u + c ∈C (-1) (c +v)•u = c ∈C (-1) c •u -c ∈C (-1) c •u = 0.

Complementary Vector Space

Therefore, the dual distance of a linear code C is the same as the minimum distance of the dual code C ⊥ .

In According to [START_REF] Gary | Handbook of Finite Fields[END_REF]Theorem 5.1.18], there exists a self-dual basis of F q over F q if and only if either q is even or both q and are odd. For the sake of simplicity, we herein fix q = 2. We call above expansion the sub-field representation defined as follows. Correspondingly, two kinds of security order t w and t b are at word-and bit-level, respectively.

Summing up, the two definitions build a direct link between word-and bit-level representation of a linear code and the corresponding conversion. This allows to connect the word (or register)level probing and the bit-level probing security models, depending on the granularity of the attacker spying tool.

Complementary Vector Space

In this section, we introduce relevant properties of complementary vector space that will be needed to derive our results. The set of n-bit vectors is denoted by F n 2 , which is an n-dimensional vector space over the finite field K = F 2 .

An [n, k, d] q linear code C over K is a k-dimensional subspace of K n , therefore, we use the same notations as for the linear codes.

⊕ D = K n ) if C + D = K n , and C ∩ D = {0}, that is: ∀z ∈ K n , ∃!(c, d) ∈ C × D, such that z = c + d.

PRELIMINARIES

Accordingly, we shall define the complementary codes as follows.

Definition 3.8 (Complementary Linear Codes [START_REF] Yang | The condition for a cyclic code to have a complementary dual[END_REF]). Two linear codes C and D are complementary if C + D = K n , and C ∩ D = {0}. Lemma 3.3. Let C and D be two vector spaces in K n built from independent bases, meaning that

C ∩ D = {0}. Then C ⊥ ∩ D ⊥ = (C ⊕ D) ⊥ .
Proof. First of all, we notice that (C ⊕ D) ⊥ ⊆ C ⊥ . Indeed, a vector orthogonal to all vectors of C ⊕ D is in particular orthogonal to all vectors of C + 0 = C. In a symmetric way, we have that

(C ⊕ D) ⊥ ⊆ D ⊥ . Therefore, (C ⊕ D) ⊥ ⊆ C ⊥ ∩ D ⊥ .
Let us now prove the converse inclusion. Let x ∈ C ⊥ ∩ D ⊥ . For any vector y in C ⊕ D, there exists a unique pair (c, d) ∈ C × D (owing to the complementarity of vector spaces C and D), Proof. By application of Lemma 3.3, we have that

such that y = c + d. Now, x • y = x • (c + d) = x • c + x • d = 0 + 0 = 0. Indeed, x • c = 0 because x ∈ C ⊥ and x • d = 0 because x ∈ D ⊥ . Therefore, we also have C ⊥ ∩ D ⊥ ⊆ (C ⊕ D) ⊥ .
C ⊥ ∩ D ⊥ = (C ⊕ D) ⊥ = (K n ) ⊥ . Now, as K n is the universe code, we have (K n ) ⊥ = {0}.
Actually, for the general case when C and D are not complementary, we can complement C ⊕ D with a vector space E, such that:

• C ∩ D = {0}, C ∩ E = {0}, D ∩ E = {0}, • C ⊕ D ⊕ E = K n .
Then, a similar result as Lemma 3.4 holds:

Lemma 3.5. C ⊥ ∩ D ⊥ ∩ E ⊥ = {0}.
Proof. Similar with the proof of Lemma 3.4, first treat C ⊕ D together and then straightforwardly apply Lemma 3.3, which gives the results.

In this thesis, we consider two cases in the code-based masking:

• In the generalized code-based masking as a general case [35,[START_REF] Wang | Efficient and Private Computations with Code-Based Masking[END_REF]: C ∩ D = {0}, and C ⊕ D ⊆ K n , where two linear codes C and D are not necessarily complement to each other. In particular, the redundant case when n > t + 1 corresponds to the strict condition:

C ⊕ D K n and then {0} C ⊥ ∩ D ⊥ .
• In inner product masking or direct sum masking as special cases: C ∩ D = {0}, and C ⊕ D = K n , meaning that C and D are complementary. This is the case of [37], where we have C ⊥ ∩ D ⊥ = {0} as shown in Lemma 3.4.

Pseudo-Boolean Functions

Pseudo-Boolean Functions

Leakage functions turn a bitvector into a real value, which the attacker measures. Those functions are pseudo-Boolean functions P :

K n → R, where K = F 2 .
It is well-known that a pseudo-Boolean function P can be uniquely expressed in a monomial basis [START_REF] Carlet | A New Representation of Boolean Functions[END_REF] called Numerical Normal Form (NNF) [START_REF] Nisan | On the degree of boolean functions as real polynomials[END_REF]:

P (Z) = I∈{0,1} n β I Z I , (3.2)
where Z I = i∈{1,...,n } s.t. Ii=1 Z i , and

β I ∈ R. For instance, Z (000•••0)2 = 1, Z (100•••0)2 = Z 1 and Z (110•••0)2 = Z 1 Z 2 .
In fact, P is a nice abstraction of practical attacks. For example, in differential power analysis [START_REF] Paul | Differential power analysis[END_REF] against the most/least significant bit of the sensitive variable, then P equals

Z (100•••0)2 or Z (000•••1)2 .
Moreover, in correlation power analysis [START_REF] Brier | Correlation power analysis with a leakage model[END_REF] when the Hamming weight model is adopted,

P equals w H (Z) = Z (100•••0)2 + Z (010•••0)2 + • • • + Z (000•••1)2 .
Thanks to the existence and the uniqueness of NNF, we can define the numerical degree of P as follows.

Definition 3.9 (Numerical Degree [START_REF] Carlet | A New Representation of Boolean Functions[END_REF]). The numerical degree of a pseudo-Boolean function ). The Fourier transform of a pseudo-Boolean function P : K n → R is denoted by P : K n → R, and is defined as: P (z) = y∈K n P (y)(-1) y•z .

Recall from [START_REF] Carlet | Boolean Functions for Cryptography and Error Correcting Codes: Chapter of the monography Boolean Models and Methods in Mathematics[END_REF][START_REF] Carlet | A New Representation of Boolean Functions[END_REF] that, P (z) = (-1) w H (z) I⊆{1,...,n };supp(z)⊆I 2 n -|I| β I where β I = 2 -n (-2) |I| z∈F n 2 ;I⊆supp(z) P (z). Definition 3.11 (Convolution [22, §2.2]). The convolution of two pseudo-Boolean functions f and g is defined as:

(f ⊗ g)(z) = y∈K n f (y)g(y + z).
We recall below two well-known properties of Fourier transform as well as a property on the convolution. We omit the proofs for the sake of brevity and refer to [START_REF] Carlet | Boolean Functions for Cryptography and Error Correcting Codes: Chapter of the monography Boolean Models and Methods in Mathematics[END_REF] for details.

]). f ⊗ g(z) = f (z)• g(z), ∀z ∈ K n .

PRELIMINARIES

Shannon Information-Theoretic Measures

We also define some information theoretic tools. The entropy of a random vector X of length q is defined by:

H(X) = - x∈X q Pr(x) log 2 Pr(x).
The conditional entropy of a random vector X knowing vector Y is defined by:

H(X | Y) = - y∈Y q Pr(y)H(X | Y = y) = - y∈Y q Pr(y) x∈X q Pr(x | y) log 2 Pr(x | y).
The Mutual Information between two random vectors X and Y is defined as

I(X; Y) = H(X) -H(X | Y). The conditional Mutual Information I(X; Y | T) where X, Y and T are random vectors is defined as I(X; Y | T) = H(X | T) -H(X | Y, T).
Last, the Kullback-Leibler divergence between two distributions p and q over the same set X is defined as:

D(p q) = x∈X P(x) log 2 p(x) q(x) .
CHAPTER 4

Measuring the Leakages in IPM and Optimal Codes

Introduction of Inner Product Masking

Masking is one of the most investigated countermeasures against side-channel analysis, allowing all cryptographic operations to be performed on the masked data. Essentially, masking is a sound way to improve the side-channel security of cryptographic implementations, since given high enough noise, the attack complexity increases exponentially with the number of shares [START_REF] Prouff | Masking against Side-Channel Attacks: A Formal Security Proof[END_REF],

while the implementation cost increases only quadratically (or only cubically in higher-order glitches free implementations [START_REF] Grosso | Masking vs. Multiparty Computation: How Large Is the Gap for AES?[END_REF]). For instance, the Boolean masking scheme is the simplest one which enables high performance when implemented on real circuits. The first provably secure higher-order masking scheme has been introduced by Ishai et al. [86] for the protection of single bits in F 2 . Then, this scheme has been extended to the protection of words (e.g. bytes in F 2 8 ) with higher-order security by Rivain et al. [START_REF] Rivain | Provably Secure Higher-Order Masking of AES[END_REF]. Interestingly, it has been noticed later that this masking scheme can be further improved by mixing bits in each share (of = 8 bits).

In brief, the main idea is to elevate the bit-level algebraic complexity of the masking scheme.

Thus in this respect, Inner Product Masking (IPM) scheme has been proposed as an alternative, in which inner product is adopted as a mixing operation.

The IPM scheme has been first introduced by Balasch et al. at ASIACRYPT'12 [4] as an alternative to masking schemes like Boolean or multiplicative masking and has been further improved by Balasch et al. at EUROCRYPT'15 [2] and at ASIACRYPT'17 [3]. In IPM, the random masks are not used plain, but a mixing between the bits is carried out by the multiplication with a public vector α = (1, α 2 , . . . , α n ) and then involved into the cryptographic

computation (Z = X + α 2 Y 2 + • • • + α n Y n ,
where X is the sensitive data and Y i are the n -1 masks). Interestingly, by different settings of vector L and mask materials, Balasch et al. [4] pointed out that IPM is the generalization of four typical kinds of masking schemes, namely the Boolean one, the multiplicative one [START_REF] Dj | Multiplicative Masking and Power Analysis of AES[END_REF], the affine one [START_REF] Fumaroli | Affine Masking against Higher-Order Side Channel Analysis[END_REF] and the polynomial one [77,[START_REF] Prouff | Higher-Order Glitches Free Implementation of the AES Using Secure Multi-party Computation Protocols[END_REF].

4.2

The-State-of-the-Arts

The-State-of-the-Arts

The concrete security order of a masking scheme depends not only on the number of shares but also on the encodings involving the sensitive variables and mask materials into cryptographic operations. With the same number of shares, Balasch et al. [4] observed that the IPM leaks consistently less than Boolean masking, and further demonstrated this observation in [2,3]. In fact, this observable feature originates from the encoding of IPM, in which the random masks are multiplied by the coordinates of the public parameter α ∈ F n 2 . Therefore several bits in each share are mixed together, which increases the algebraic complexity of the encoding. By contrast, in Boolean masking the masks are directly involved by bit-wise XOR operation. This is the primary advantage of IPM. Furthermore, another interesting effect in [3,Fig. 3] is that the different choices of the L vector in IPM significantly affect its concrete bit-level security. For instance, with n = 2 shares made up of = 8 bits (byte-oriented), the security order in bounded moment model [7] can be t bound = 3, while the security order in (word-level) probing model is

only t w = 1.
In fact, this parameter effect in IPM has been studied firstly by Wang et al. [START_REF] Wang | Inner Product Masking for Bitslice Ciphers and Security Order Amplification for Linear Leakages[END_REF], named as "Security Order Amplification". Wang et al. propose the parameter O min , the lowest keydependent statistical moment, as a metric to measure the amplified security order. This metric O min is directly related to the bit-level security order t b in bit-level probing model proposed by Poussier et al. [START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF] since O min = t b + 1. More importantly, Poussier et al. firstly introduce the coding form of IPM as: Z = XG + Y H where X, Y, Z are the sensitive variable, random mask(s) and masked variable, G and H are the generator matrices of two codes C and D, respectively. Then they prove that the bit-level security of IPM is related to one of the defining parameters of the code D (namely its dual distance d ⊥ D ). This result gives an explanation of the security order amplification discussed in [START_REF] Wang | Inner Product Masking for Bitslice Ciphers and Security Order Amplification for Linear Leakages[END_REF].

The other line of research on the encoding and parameter effect of masking schemes is about the Leakage Squeezing (LS) which stems from Carlet et al. [START_REF] Carlet | Statistical properties of side-channel and fault injection attacks using coding theory[END_REF]. Particularly, Carlet et al. show that IPM is an instance of LS. They statistically studied the security order of LS scheme by linking the correlation immunity [START_REF] Carlet | Boolean Functions for Cryptography and Error Correcting Codes: Chapter of the monography Boolean Models and Methods in Mathematics[END_REF] of the indicator of the code (that equals the dual distance d ⊥ D minus 1), the mutual information (MI ) and the success rate (SR) of side-channel attacks together. More precisely, in logarithmic form, mutual information log(MI ) is a linear function of the logarithmic noise variance log(σ 2 ), and the slope (security order) of this linear function equals the dual distance of D. To summarize, the bit-level security order t b of IPM is

d ⊥ D -1,
where d ⊥ D is the dual distance of the code D in the coding form. Related works are summarized in Tab. 4.1 (note that SNR is short for attack signal-to-noise ratio [102, § 4.3.2, page 73]). [START_REF] Carlet | Statistical properties of side-channel and fault injection attacks using coding theory[END_REF][START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF] and in this paper.

Actually, the security order of IPM depends on the code D involved in the scheme, which can be easily demonstrated by information-theoretic metric. As shown in Fig. 4.1(a), the security order (the slope) of IPM depends on the dual distance of the chosen code D, namely d ⊥ D . Specifically, the slope in the log-log plot representation of MI as a function of noise variance

σ 2 is -d ⊥ D .
However, it can be observed that for different choices of the code D with the same dual distance, the MI s are distinctly different as shown in Fig. 4.1(b). The smaller the number of nonzero codewords of minimal weight (B d ⊥ D ), the smaller the MI consistently over the full range of noise variance σ2 . Similar situations happen with success rates of optimal attacks [START_REF] Bruneau | Masks Will Fall Off -Higher-Order Optimal Distinguishers[END_REF],

indicating that only parameter of D equal to the dual distance d ⊥ D is not enough to characterize the side-channel resistance of IPM. Therefore, a natural question is: What is/are other defining parameter(s) of D that influence the concrete side-channel security level of IPM? Since the different choices of the code D have critical impacts on the concrete security order of IPM, then another question that comes with it is: how to choose optimal codes in the sense of side-channel resistance for IPM?

IPM in a Coding-Theoretic Form

Let an information word X ∈ K = F 2 and n-1 masks Y i ∈ K, the Boolean masking scheme [START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF] protects X as:

Z = X + n i=2 Y i , Y 2 , Y 3 , . . . , Y n = XG + Y H, (4.1)
where G, H are generator matrices of two linear codes C and D as follows, respectively. Moreover, C and D are supplementary codes such that C ⊕ D = K n .

G = 1 0 0 • • • 0 ∈ K 1×n , H =       1 1 0 • • • 0 1 0 1 • • • 0 . . . . . . . . . . . . . . . 1 0 0 • • • 1       ∈ K (n-1)×n . (4.2)
IPM is an encoding to improve the algebraic complexity by mixing bits in each share together.

In IPM, linear functions are applied to mask materials y i to construct only the first share.

We define a family of bijective linear functions

f i : K → K defined by f i (y i ) = α i y i where α = (α 1 , . . . , α n ) ∈ K n , α 1 = 1 and α i ∈ K\{0} for i ∈ {2, 3, . . . , n}.
Then the IPM scheme [2] with n shares is expressed as:

Z = (X + n i=2 f i (Y i ), Y 2 , Y 3 , . . . , Y n ) = XG + Y H. (4.3)
Remark 4.1 (Word-level security order). In the first share Z 1 of Z, X is masked only by mask

Y 1 , where Y 1 is a uniformly distributed mask equal to Y 1 def = n i=2 f i (Y i ).
But still, the masking scheme is more than second-order secure since the attacker cannot directly measure a leakage

MEASURING THE LEAKAGES IN IPM AND OPTIMAL CODES

arising from Y 1 . Instead, to get information from Y 1 , the attacker should measure the leakage from shares (Z 2 , . . . , Z n ) = (Y 2 , . . . , Y n ), hence a n-order attack.

Two generator matrices G and H of the above linear codes are as follows. Note that this encoding3 was first introduced in [START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF] and we borrow it here.

G = 1 0 0 • • • 0 ∈ K 1×n , H =       α2 1 0 • • • 0 α3 0 1 • • • 0 . . . . . . . . . . . . . . . αn 0 0 • • • 1       ∈ K (n-1)×n . (4.4)
IPM is a generalization of Boolean masking (by choosing

α i = 1, 1 ≤ i ≤ n).

Quantifying Leakages of IPM via SNR

In this section, we focus on quantitatively assessing the leakages of IPM by SNR. Let P :

K n → R
where K = F 2 with numerical degree d • P be the leakages collected (and manipulated) by the attacker. In practice, d • P reflects the strength of the attacker, because it is the number of masked bits which shall be combined together to unveil a dependency on the key. Two typical situations are:

-The devices leak bits individually, as in the probing model [86]. Therefore, the degree d of the leakage function is the number of probed bits.

-The devices leak bits as words in parallel through a leakage function φ. The attackers subsequently apply their strategy (a composition function) ψ on top of φ. For instance, φ is the Hamming weight and ψ consists of raising the result at some power d, resulting in

P = ψ • φ = w H (•) d .

Leakage Model & Attack Strategy

In practice, the security of a cryptographic implementation not only depends on its leakages during execution but also highly relates to the capability of an adversary to exploit these leakages.

For instance, for a t-th order secure masking scheme, an adversary can launch a successful d-th order attack against it when d is greater than t. model with additive Gaussian noise into consideration, we specify the leakages of a real device in two cases:

• In a serial implementation, all shares are manipulated at different times (clock cycles). We denote the leakages from the device as L i = φ(z i ) + N i , where z i ∈ K = F 2 is the ith share and N i ∼ N (0, σ 2 ) for i ∈ {1, . . . , n} are associated noises. From the attacker's point of view, the best strategy is to combine these leakages together to launch higher-order attacks. As is known, the centered product combination is the most efficient combination function [START_REF] Prouff | Statistical Analysis of Second Order Differential Power Analysis[END_REF] 4 . Thus,

L ser = d i=1 L i = d i=1 (φ(z i ) + N i ) = d i=1 φ(zi) P (z): z∈K n +ζ + d i=1 N i ,
where the adversary combines leakages of d shares over all n shares. ζ denotes intermediate terms with numerical degree d • ζ < d that does not depend on the sensitive variables thus have no positive impact on attacks. Assume that N i for i ∈ {1, 2, . . . , n} are i.i.d, then

V d i=1 N i = σ 2d .
• In a fully parallel implementation, all shares are manipulated at the same time (the same clock cycle). Thus we have L = φ(z) + N = n i=1 φ(z i ) + N by assuming the device leaks in linear leakage model, where z ∈ K n and z i ∈ K = F 2 . In this case, the best strategy is to use

MEASURING THE LEAKAGES IN IPM AND OPTIMAL CODES

the least d-th order of statistical moments to launch the attack. Therefore,

L par = L d = n i=1 φ(z i ) + N d = d i=1 φ(zi) P (z): z∈K n +ζ + N d ,
where ζ denotes intermediate terms with numerical degree d • ζ < d. For Gaussian noise N ∼ N (0, σ 2 ), by higher-order moments for Gaussian variables [120, § 5.4], we have:

V N d = E N 2d -E N d 2 = σ 2d (2d -1)!! if d is odd, σ 2d (2d -1)!! -(d -1)!! if d is even.
Hence, the variance of noise by raising to power d is proportional to σ 2d , namely:

V N d ∝ σ 2d . (4.5)
In summary, we formalize the leakage function (with the attacker's strategy) by a pseudo-

Boolean function P : K n → R such that P (z) = d i=1 φ(z i ),
which can be decomposed into P (Z) = I∈F n 2 α I Z I as in Eqn. 5.4. In both cases, we have V N d ∝ σ 2d . Thanks to this model, we are able to explain the link between leakages at word-level and at bit-level. We also give an explanation on the physical defaults like physical couplings in a quantitative way. For instance, in AES implemented on a 32-bit embedded device (e.g. ARM Cortex 4), leakages of four bytes of intermediates may interfere with each other because of couplings, thus could leak the sensitive data from the joint distribution of leakages. This kind of joint distributions corresponds to the assignment of different values for α I of P (Z) as in Eqn. 5.4.

Definition of SNR.

The SNR [START_REF] Mangard | Power Analysis Attacks: Revealing the Secrets of Smart Cards[END_REF] is a critical security metric in the field of side-channel analysis, which is the ratio between the signal variance and the noise variance.

Let L = P (Z)+N denote the leakage which is irrespective to serial or parallel implementations.

N denotes the independent noise with variance V

[N ] = σ 2 total ∝ σ 2d as shown in Eqn. 4.5. We have V [E [P (Z) + N |X]] = V [E [P (Z)|X]], then the SNR of leakages is defined as: SN R = V [E [L|X]] V [N ] = V [E [P (Z)|X]] σ 2 total . (4.6)
In side-channel analysis, if SNR is null, attacks are merely impossible. Otherwise, attacks are possible and are all the more powerful as the SNR is larger.

Quantifying Leakages of IPM via SNR

Quantifying Leakages of IPM by SNR

Recall the coding form of IPM, whereby the sensitive variable X is encoded into Z by:

Z = XG + Y H ∈ K n = F n 2 .
Let us consider this equation in F 2 basefield, and thus let

X = F 2 , Y = F (n-1) 2
and Z = F n 2 . We clarify the computations as follows (where D is expanded as per Def. 3.6):

-

E [P (Z)|X = x] for a given x ∈ X is: E [P (xG + Y H)] = y∈Y P(Y = y)P (xG + yH) = 1 |Y| y∈Y P (xG + yH) = 1 |D| d∈D P (xG + d), -For any variable X, we have that V [E [P (Z)|X]] = E E [P (Z)|X] 2 -E [E [P (Z)|X]] 2 .
Hence, we have the following two lemmas to compute terms

E E [P (Z)|X] 2 and E [E [P (Z)|X]] for IPM. Lemma 4.1. E [E [P (Z)|X]] = 1 2 n P (0). Lemma 4.2. E E [P (Z)|X] 2 = 1 2 2n x∈D ⊥ P (x) 2 .
The proofs of Lemma 4.1 and 4.2 are in Appendix A.1. Therefore for the SNR of IPM scheme we have the following theorem.

Theorem 4.1. Let a device be protected by the IPM scheme as Z = XG + Y H. Assume the leakages of the device can be represented in the form: L = P (Z) + N and an adversary may launch a d-th order attack by using higher-order moments (e.g., in parallel scenarios) or multivariate combinations (e.g., in serial scenarios). Hence the SNR of the exploitable leakages is:

SNR = 2 -2n σ 2 total x∈D ⊥ \{0} P (x) 2 ,
where σ 2 total ∝ σ 2d .

Proof. On the basis of Lemma 4.1 & 4.2, we have that

SN R = V [E [L|X]] V [N ] = E E [P (Z)|X] 2 -E [E [P (Z)|X]] 2 V ar(N ) = 2 -2n σ 2 total   x∈D ⊥ P 2 (x) -P 2 (0)   = 2 -2n σ 2 total x∈D ⊥ \{0} P 2 (x).
(4.7)

MEASURING THE LEAKAGES IN IPM AND OPTIMAL CODES

Remarkably, this quantity does not depend on the properties of the code C, except for the fact it is supplementary to D in K n (recall Lemma 4.1). The only factor for the SNR of IPM that makes all the differences is the choice of D. The special interest of Theorem 4.1 is that it allows quantifying the leakages of any IPM and its variants (e.g. [START_REF] Wang | Inner Product Masking for Bitslice Ciphers and Security Order Amplification for Linear Leakages[END_REF]). In a nutshell, Theorem 4.1 works under any form of P . Indeed, as shown in Fig. 4.2, the function P is composed of the leakage function φ from a device and the attack strategy ψ from an adversary, where φ and ψ can be any functions. In particular, a real device may produce nonlinear leakages rather than the simple Hamming weight one, where Theorem 4.1 can be applied straightforwardly.

Link between SNR and Security Order t

In fact, it is easy to build the connection between SNR and the side-channel security order of an implementation by checking whether SNR equals 0. From Theorem 4.1, we deduce the security order t of IPM from SNR as follows. Proof. We know from [17, Lemma 1] (in fact, this is a direct consequence of results of [START_REF] Carlet | A New Representation of Boolean Functions[END_REF]) that, given a pseudo-Boolean function P , one has

P (z) = 0 for all z ∈ K n such that w H (z) > d • P . Let z ∈ D ⊥ \{0}; then w H (z) ≥ d ⊥ D .
Assuming that the numerical degree of P is strictly less than d ⊥ D , we then have w H (z) ≥ d ⊥ D > d • P , which means that P (z) equals 0, resulting in the fact that SN R =

Connecting SNR with Code Parameters

As common leakage models, Hamming weight and affine models have been validated in practice [START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF] for side-channel analysis. We set φ(z) = w H (z), then use P (z) = w H (z) d as a leakage model. Clearly, the numerical degree of P is d • P = d. Moreover, one can write:

P (z) = w H (z) d = J1+•••+J n =d d J 1 , . . . , J n n i=1 z Ji i = J∈N n , s.t. n i=1 Ji=d w H (J)<d d J z J + d! I∈{0,1} n w H (I)=d z I , (4.8)
where

N = {0, 1, . . .} is the set of integers. The multinomial coefficient d J1,...,J n is defined as d! J1!•••J n ! (recall that J = (J 1 , . . . , J n ) ∈ N n with n i=1 J i = d).
This coefficient equals to d! as long as for all i (1 ≤ i ≤ n ), J i = 0 or 1. Now, the terms in P (z) are categorized into two cases:

• z J where J ∈ N n , w H (J) < d, which consists in products of < d bits of z, as z J = i∈{1,...,n } s.t. Ji>0 z i ,

• z I where I ∈ {0, 1} n , w H (I) = d which consists in products of d bits of z, as

z I = i∈{1,...,n } s.t. Ii=1 z i . Indeed, let i ∈ {1, . . . , n }, then z Ji i = 1 if J i = 0, and z Ji i = z i if J i > 0.
The first terms z J have numerical degree d • (z J ) < d, hence can be discarded in the analysis (they contribute nothing to the SNR). Remaining terms of numerical degree d are: I∈{0,1} n , w H (I)=d z I . Hence we have following theorem for quantifying the leakages of IPM.

Theorem 4.3. Let a device leak in Hamming weight model, which is protected with IPM at bit-level security order t = d ⊥ D -1. A higher-order attack is possible only if the attacker uses a leakage function P with d • P = d > t. Moreover, the SNR can be quantified by:

SNR =    0 if d • P ≤ t B d ⊥ D σ 2 total d ⊥ D ! 2 d ⊥ D 2 if d • P = t + 1 = d ⊥ D .
(4.9)

Proof. Let ϕ I (z) = z I where I ∈ {0, 1} n . Thus

z I = i∈I z i = i∈I (1 -(-1) zi ) 2 = 1 2 d i∈I (1 -(-1) zi ). (4.10)

MEASURING THE LEAKAGES IN IPM AND OPTIMAL CODES

By Theorem 4.2, all monomials with numerical degree d • < d have SN R = 0, hence we only focus on monomials with d

• = d. We have ϕ I (z) = φ I (z) + (-1) d 2 d (-1) i∈I zi where φ I (z) is linear combination of monomials with numerical degree d • < d in ϕ I (z). The Fourier transform of ϕ I (z) is ϕ I (y) = φ I (y) + (-1) d 2 d z (-1) z•I (-1) z•y = φ I (y) + (-1) d 2 d z (-1) z•(I+y) = φ I (y) + (-1) d 2 n -d 1 {I} (y).
V [E [P (Z)|X]] = y∈D ⊥ \{0} P 2 (y) 2 2n = 2 -2n y∈D ⊥ \{0}   I|w H (I)=d (-1) d 2 n -d d I 1 {I} (y)   2 = 2 -2d y∈D ⊥ , w H (y)=d   I|w H (I)=d d I 1 {I} (y)   2 = 2 -2d y∈D ⊥ , w H (y)=d (d!) 2 = B d d! 2 d 2 .
(4.12)

Finally, using Theorem 4.2, it appears that the only possible solution of

d is d = d ⊥ D such that SN R = 0, thus V [E [P (Z)|X]] = B d ⊥ D d ⊥ D ! 2 d ⊥ D 2 , then SN R = V [E [P (Z)|X]] V [N ] = B d ⊥ D σ 2 total d ⊥ D ! 2 d ⊥ D 2 . ( 4.13)
In a nutshell, Theorem 4.3 provides a quantitative way for assessing the side-channel security level of an implementation under Hamming weight leakages. More importantly, the SNR is linked to two parameters of the code used in IPM, which brings great convenience on simplifying the assessment. In practice, the designer can easily select a better or even optimal code for IPM which amplifies the side-channel resistance of the implementation protected by IPM.

In fact, the quantitative result in Theorem 4.3 can be extended to all linear (affine) leakages [START_REF] Le | Mutual Information Analysis under the View of Higher-Order Statistics[END_REF] which can be expressed as:

P : z ∈ F n 2 → P (z) = β 0 + β, z ∈ R, (4.14)

Quantifying Leakages of IPM via SNR

where β 0 ∈ R is an unimportant additive constant that can be considered null (which is dropped

in the sequel), β = (β 1 , • • • , β n ) ∈ R n (note that β i is normalized by β i = √ n β 2
β i , where

β 2 = n i=1 β 2 i is the L 2 -norm of β)
are coordinate-wise weights, and x, y = n i=1 x i •y i ∈ R is the canonical scalar product. This leakage model is also known as UWSB model ("unevenly weighted sum of the bits") as in [START_REF] Zhao | Systematic Construction and Comprehensive Evaluation of Kolmogorov-Smirnov Test Based Side-Channel Distinguishers[END_REF]. The validity of this leakage model can be tested easily by stochastic profiling [START_REF] Schindler | A Stochastic Model for Differential Side Channel Cryptanalysis[END_REF] on practical samples. Therefore, we denote the leakage function as:

P (z) = n i=1 β i z i d = J1+J2+••• +J n =d d J 1 , . . . , J n n i=1 β i z i Ji = J∈N n , w H (I)<d J1+•••+J n =d d J βz J + d! I∈{0,1} n w H (I)=d βz I . (4.15)
Thus, we deduce the following corollary for SNR under UWSB leakage model as follows:

Corollary 4.1. Let a device leak in UWSB model, which is protected with IPM at bit-level security t = d ⊥ D -1. A higher-order attack is possible only if the attacker uses a leakage function P with numerical degree d • P = d > t. Moreover, the SNR is:

SNR = λ • 1 σ 2 total d! 2 d 2 =    0 if d • P ≤ t λ • 1 σ 2 total d ⊥ D ! 2 d ⊥ D 2 if d • P = t + 1 = d ⊥ D , (4.16
)

where λ = y∈D ⊥ w H (y)=d 1≤i≤n s.t. yi=1 β i 2 , and λ = 0 if d < d ⊥ D .
For instance, as the Hamming weight model is a special case of UWSB model with performs best against side-channel analysis, which validates our approach on selecting optimal codes for IPM.

β i = 1 for i ∈ {1, 2, . . . , n }, we obtain λ = B d ⊥ D ,

MEASURING THE LEAKAGES IN IPM AND OPTIMAL CODES

σ 2 •SNR when P (Z) = w H (Z) d d ⊥ D B d ⊥ D d = 1 d = 2 d = 3 d = 4 MI •10 3 (σ = 3) α 2 (Non-equivalent codes) max B 2 =8 0 2.0000 > 0 > 0 4.4025 {α 0 } 1 2 min B 2 =1 0 0.2500 > 0 > 0 3.8410 {α 7 } max B 3 =7 0 0 3.9375 > 0 0.5470 {α 24 , α 25 } 3 min B 3 =1 0 0 0.5625 > 0 0.
To summarize, there are three optimal codes (up to equivalence) for 2-share IPM on F 2 8 . Those codes have dual distance 4 and only 3 codewords of nonzero minimum weight equal to 3. Those codes are the optimal for 2-share IPM operating on bytes, and were previously not specifically distinguished amongst binary codes of parameters [START_REF] Brier | Correlation power analysis with a leakage model[END_REF]8] 2 . Their generating matrix are provided in Appendix B.1.

Measuring Leakages by Mutual Information

We investigate the security order of IPM at both word-and bit-level, and show the essential reason of the "Security Order Amplification" which has been observed and described in [3,[START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF][START_REF] Wang | Inner Product Masking for Bitslice Ciphers and Security Order Amplification for Linear Leakages[END_REF].

We here go further by using an information-theoretic metric, the standard notion of mutual information (MI), to quantify the leakages of IPM.

Security Orders at Word-level t w and Bit-level t b

The first important property of IPM is its higher security order at bit-level than at word-level, namely t b ≥ t w . Here we start from a very well-known property of the generator matrix. and is perfectly masked. Therefore no information on X can be recovered.

Measuring Leakages by Mutual Information

Lemma 4.3. The IPM is secure at the maximized order t w in the terms of probing model if and only if the code generated by the

1 × n matrix H ⊥ = (α 1 = 1, α 2 , α 3 , . . . , α n ) is a code with parameters [n, 1, d w ] 2 , where d w = t w + 1.
Proof. Note that

H ⊥ = (1, α 2 , α 3 , . . . ,
= t w + 1.
Obviously, we have d ⊥ D = n if and only if α i = 0 for i ∈ {1, 2, . . . , n}. Therefore, the security order of IPM scheme is

t w = d ⊥ D -1 = (n -1) over K = F 2 .
This has been formally proved in [2,3] and pointed out in [START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF]. We put it here in Lemma 4.3 for completeness of this thesis and we can directly obtain the word-level security order t w by Theorem 4.2. In brief, IPM is optimal in term of word-level security and has the same security order as Boolean masking (where α i = 1).

Bit-Level Security Order t b

By code expansion as Def. 3.6, we can expand the code

D from K = F 2 to K = F 2 , which turns a code [n, 1, d w ] 2 to [n , , d b ] 2 .
At first, we show the connection between the two security orders t w and t b as follows.

Lemma 4.4. In IPM, the word-level security order is not greater than bit-level security order, namely t w ≤ t b .

In fact, this is essentially the "Security Order Amplification" as explained in [START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF]. Here we give another proof as follows.

Proof. With code expansion, the generator matrix

H ⊥ = (1, α 2 , • • • , α n ) is expanded to [H ⊥ ] 2 = (I , [α 2 ], • • • , [α n ]
), as per Def. 3.6. Since α i = 0, we have at least one 1 in each row of [α i ].

MEASURING THE LEAKAGES IN IPM AND OPTIMAL CODES

Otherwise, if one row of [α i ] is all zeros, we have:

[α i ] =      0 0 • • • 0 ---- ---- ----      ∈ F × 2 then [α i ] is not invertible which indicates that L i does not exist. Remark 4.2.
It is worth mentioning that since the Boolean masking is a special case of IPM with α i = 1 for i ∈ {1, . . . , n}, we always have

t w = n -1, t b = n -1.
While for IPM, t b can be greater than n -1 if there exists at least one i ∈ {1, . . . , n} such that α i ∈ {0, 1}, where the algebraic complexity of IPM is greater than Boolean masking.

To optimize IPM scheme, we aim at choosing t b as large as possible compared to t w , thereby increasing the security order as much as possible. For instance, with n = 2 shares of = 4 bits, we have F 16 = {0, 1, α, . . . , α 14 }, where (refer to Tab. 4.5 for all codes), respectively. Therefore, in this case, the optimal t b for IPM is 2.

F 16 := F 2 [α]/ α 4 + α + 1 .

Linking Mutual Information with Code Parameters

The other primary means to evaluate the security of a cryptographic implementation is to utilize the information-theoretic analysis. In this sense, mutual information is a well-known metric in the field of side-channel analysis [START_REF] Standaert | A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks[END_REF]. Therefore we use it to assess the leakages of IPM as follows.

Theorem 4.4. For a device leaking under the Hamming weight model that is protected by IPM scheme with Z = XG + Y H, the mutual information I(L; X) between the leakage L = P (Z) + N and the sensitive variable X is approximately equal to the first nonzero term:

I(L; X) ≈ d ⊥ D !B d ⊥ D 2 ln 2•2 2d ⊥ D • 1 σ 2d ⊥ D
when the leakage function P of a higher-order attack has numerical degree

d • P = d ⊥ D . Specifically, I(L; X) =    0, if d • P < d ⊥ D d ⊥ D !B d ⊥ D 2 ln 2•2 2d ⊥ D × 1 σ 2d ⊥ D + O 1 σ 2(d ⊥ D +1) , if d • P = d ⊥ D , when σ → +∞ (4.17)
where σ is the standard deviation of noise.

Proof. It is obvious that there is no leakage when

d • P = d < d ⊥ D .
We assess the leakages in an information-theoretic sense as the mutual information between P (Z) and X, defined by I(P (Z); X) = H(P (Z)) -H(P (Z)|X), where:

Measuring Leakages by Mutual Information

-the entropy is H(P (Z)) =z P(P (z)) log 2 P(P (z)), -the conditional entropy H(P (Z)|X) is:

H(P (Z)|X) = - x∈F 2 P X (x) z P(P (z)|x) log 2 P(P (z)|x).
In the presence of noise N , the mutual information between the noisy leakage L = P (Z) + N and the sensitive variable X can be developed using a Taylor's expansion 5 [START_REF] Carlet | Achieving side-channel high-order correlation immunity with leakage squeezing[END_REF]:

I(L; X) = +∞ d=0 1 2 d! ln 2 x∈F 2 P X (x) (k d (P (Z)|x) -k d (P (Z))) 2 (V ar(P (Z)) + σ 2 ) d = 1 ln 2 +∞ d=0 1 2 d! V [k d (P (Z)|X)] (V [P (Z)] + σ 2 ) d , (4.18)
where k d is the d-th order cumulant [START_REF] Cardoso | Dependence, Correlation and Gaussianity in Independent Component Analysis[END_REF].

As for a d-CI (Correlation Immune) function [START_REF] Carlet | Boolean Functions for Cryptography and Error Correcting Codes: Chapter of the monography Boolean Models and Methods in Mathematics[END_REF] that is not (d + 1)-CI, all moments of order i ≤ d are centered, so are the cumulants. Hence the first nonzero cumulant k

d ⊥ D (X) is equal to µ d ⊥ D (X). It results that in Eqn. 4.18, the term V [k d (P (Z)|X)] is null for all d < d ⊥ D , and it is equal to V µ d ⊥ D (P (Z)|X) = V E P (Z) d ⊥ D |X for d = d ⊥ D .
Thus, assuming the device is leaking in Hamming weight model, the mutual information can be developed at the first order in 1/σ 2d ⊥ D by Eqn. 4.18:

I(L; X) = d ⊥ D !B d ⊥ D 2 ln 2 • 2 2d ⊥ D × 1 σ 2d ⊥ D + O 1 σ 2(d ⊥ D +1) , (4.19)
when σ → +∞. This proves Theorem 4.4.

Particularly from Theorem 4. 2 7 2 6 25 2 4 2 3 2 2 2 1 2 0 2 1 2 2 2 3 2 4 2 5 2 6 2 7 2 8 2 9 2 10

Noise level:

2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2
Mutual information: From Fig. 4.4, the codes for practical applications can be chosen according to the noise level of real devices (situations). For instance, if the noise level is σ 2 > 2, the d ⊥ D is more dominant on choosing optimal codes, while if

I( ; X) Numerical Calc Unprotected: d D =1, B d D =4 IPM with d D =2, B d D =4 IPM with d D =2, B d D =3 IPM with d D =2, B d D =2 IPM with d D =2, B d D =1 IPM with d D =3, B d D =4 IPM with d D =3, B d D =3 BKLC with d D =4, B d D =14 Approximation d D =1, B d D =4 d D =2, B d D =4 d D =2, B d D =3 d D =2, B d D =2 d D =2, B d D =1 d D =3, B d D =4 d D =3, B d D =3 d D =4, B d D =14
σ 2 < 2 -1 , B d ⊥ D is more important; for noise level σ 2 in [2 -1 , 2]
, more efforts are needed in choosing a good code. . Hereafter, we show how to use this framework to select the optimal codes for IPM.

A Unified Leakage Assessment Framework for IPM

Selecting Optimal Codes for IPM

Recall that the generator matrix of dual code Summing up, our framework is generic and applicable to IPM under Hamming weight and affine leakages. From the perspective of designers, it would be advantageous to choose the optimal codes with proper d ⊥ D and B d ⊥ D by using Alg. 1 instead of finding them via long and tedious design then evaluation cycles. Some optimal codes are shown in Tab. 4.3. Table 4.3: The optimal codes for IPM in several scenarios with BKLCs and Boolean one in comparison (refer to [START_REF] Cheng | Optimal Linear Codes for IPM[END_REF] for list of all codes).

D ⊥ is H ⊥ = (α 1 = 1, α 2 , α 3 , . . . , α n ).

MEASURING THE LEAKAGES IN IPM AND OPTIMAL CODES

d w = n if α i = 0 2 D 2 ← {[D] 2 | D ∈ D} over F 2 with [D ⊥ ] 2 : [n , , d b ] 2 ; 3 d b ← max{d ⊥ D | D ∈ D 2 } ; // Optimize in bit-level (d b ) 4 D = {D| d ⊥ D =
F 2 IPM Codes BKLC Codes d ⊥ ipm -d ⊥ bool d ⊥ ipm -d ⊥ bklc SRbool=0.8 SRipm=0.8 SRbklc=0.8 Comments n = 2 = 4 H ⊥ = (1, α 5 ): d ⊥ D = 3, B d ⊥ D = 3 [8, 4, 4]: (unique) d ⊥ D = 4, B d ⊥ D = 14 1 -1 800 (1D) 340 (2D)
4,000 (1D)

1,320 (2D)

8,400 (1D)

2,500 (2D) [START_REF] Carlet | Statistical properties of side-channel and fault injection attacks using coding theory[END_REF][START_REF] Wang | Inner Product Masking for Bitslice Ciphers and Security Order Amplification for Linear Leakages[END_REF] = 8 H ⊥ = (1, α 8 ):

d ⊥ D = 4, B d ⊥ D = 3
[16, 8, 5]: (unique)

d ⊥ D = 5, B d ⊥ D = 24 2 -1 1,900 (1D) 870 (2D)
>80,000 (1D) >20,000 (2D) >100,000 (1D) >40,000 (2D) [START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF]. We introduce one nonlinear code [START_REF] Brier | Correlation power analysis with a leakage model[END_REF]256,6) [START_REF] Bhasin | Analysis and improvements of the DPA contest v4 implementation[END_REF]4,6]:

n = 3 = 4 H ⊥ = (1, α 5 , α 10 ): d ⊥ D = 6, B d ⊥ D = 12
d ⊥ D = 6, B d ⊥ D = 12 3 0 4,600 (1D) 310 (3D) >45,000 (1D) 3,050 (3D)
>45,000 (1D)

3,050 (3D)

New, the best

IPM code is equivalent to BKLC code = 8 H ⊥ = (1, α 18 , α 183 ): d ⊥ D = 8, B d ⊥ D = 7
[24, 8, 8]:

d ⊥ D = 8, B d ⊥ D = 130 5 0 - - - [123],

The Completeness of Our Unified Framework

In this chapter, we quantify the side-channel security of IPM using two complementary metrics, namely the SNR and the MI, since they depict different aspects of the side-channel leakage.

Specifically,

• the SNR measures the amount of leakage at a given moment (mean, variance, etc.) in the bounded leakage model;

• the MI measures the total leakage distribution, namely depending on all orders of moments of the leakage.

Both metrics are correlated with the attack metric SR, which is the pragmatic evaluation of the exploitability of the leakage. This means that the smaller the SNR or the MI, the smaller the SR for a given number of traces used to attack. Moreover, the two complementary metrics are utilized to thoroughly validate our unified framework.

Our framework shows that security can be assessed only in terms of dual distance d

α 2 α 3 Weight Enumerators I(Z; X) α 1 α 2 α 5
α 5

[ (0, 1), (4, 2), (5, 3), (6, 2), (7,4), (8,3), (9, 1) ] 0.016494

α 1 α 8 α 7
α 9

[ (0, 1), (4, 2), (5, 3), (6, 2), (7,4), (8,3), (9, 1) ] 0.016377 The key takeaway from the mathematical analysis of the previous section is that the two metrics SNR and MI concur, in that show that d ⊥ D and B d ⊥ D are the two relevant parameters to consider when seeking for an optimal code D. Namely, theorems 4.3 and 4.4 agree in that SNR and MI decrease when d ⊥ D increases and when B d ⊥ D decreases. Therefore, we deduce an algorithm to sort codes D of given length n with respect to their suitability in terms of IPM resistance. It is sketched in Alg. 1 (borrowed from [37]). Note that we call the linear codes used in IPM as IPM codes, where all of them are at word-level over the field F 2 , while all codes in DSM [START_REF] Bringer | Orthogonal Direct Sum Masking -A Smartcard Friendly Computation Paradigm in a Code, with Builtin Protection against Side-Channel and Fault Attacks[END_REF] are at bit-level over F 2 . In addition, we present the unprotected one and the BKLC code of parameters [START_REF] Brier | Correlation power analysis with a leakage model[END_REF]8,5]. It is worth noting that the code with parameters [START_REF] Brier | Correlation power analysis with a leakage model[END_REF]8,5] is unique [START_REF] Cheng | Detecting Faults in Inner Product Masking Scheme -IPM-FD: IPM with Fault Detection[END_REF] (up to equivalence). In Fig. 4.5, when dual distance d ⊥ D gets larger, the slopes of mutual information curves get steeper. Therefore, the BKLC code has the best side-channel resistance and it is better than all IPM codes (but this code cannot be used to carry out secure and provable computations, as is the case of IPM codes). Among IPM codes, these with d ⊥ D = 4 are better than others (d ⊥ D = 3 or d ⊥ D = 2). Remark 4.3. In Fig. 4.5, all curves of codes in IPM are between the blue and the red ones over all range of noise variances σ 2 . Moreover, the Boolean one (the first orange curve under the blue one) is the highest among all codes in IPM, which indicates clearly that Boolean masking is the worst case of IPM in the sense of side-channel resistance.

MEASURING THE LEAKAGES IN IPM AND OPTIMAL CODES

2 4 2 3 2 2 2 1 2 0 2 1 2 2 2
B d ⊥ D = 1.
It is worthy noting that Boolean masking is special case of IPM with α 2 = α 0 , which is the highest curves in Fig. 4.6 (the worst case of IPM). Hence in the sense of side-channel resistance, IPM is more advantageous than the Boolean masking.

In summary, the (sub-)optimal codes in the class of d ⊥ D = 2 are these with the minimized

B d ⊥ D = 1 (meaning α 2 ∈ {α 7 , α 248 })
. This is in consistent with Theorem 4.4.

IPM Codes with d ⊥ D = 3

Secondly, we investigate all linear codes with d ⊥ D = 3. There are 146 codes (68 non-equivalent codes) in IPM. Mutual information: I( ; X)

MEASURING THE LEAKAGES IN IPM AND OPTIMAL CODES

IPM codes with d D =2 IPM: L 2 = 0 , B d D =8 IPM: L 2 = 1 , B d D =7 IPM: L 2 = 2 , B d D =6 IPM: L 2 = 3 , B d D =5 IPM: L 2 = 4 , B d D =4 IPM: L 2 = 5 , B d D =3 IPM: L 2 = 6 , B d D =2 IPM: L 2 = 7 , B d D =1
W (X, Y) = X 16 + 3X 13 Y 3 + 4X 12 Y 4 + 16X 11 Y 5 + 36X 10 Y 6 + 43X 9 Y 7 + 45X 8 Y 8 + 48X 7 Y 9 + 36X 6 Y 10 + 17X 5 Y 11 + 6X 4 Y 12 + XY 15 . (4.20)
The takeaway point for all codes with d ⊥ D = 3 is that, they are preferable when the noise level is very low (e.g., σ 2 < 2 -3 ). Nevertheless, the optimal dual distance for 2-share IPM over Mutual information: I( ; X) Mutual information: I( ; X) Clearly, the optimal codes for IPM is the code with minimal B d ⊥ D = 3. These codes are optimal with σ 2 > 1 and they correspond to α 2 ∈ {α 8 , α 247 , α 126 , α 129 , α 127 , α 128 }. In summary, a takeaway conclusion is that the optimal codes are with α 2 ∈ {α 8 , α 126 , α 128 } (only three We underline that all above codes with corresponding α 2 in IPM, dual distance d ⊥ D , the parameter B d ⊥ D and weight enumerators are available on Github [START_REF] Cheng | Optimal Linear Codes for IPM[END_REF] (all codes for 2-share and 3-share IPM over both F 2 4 and F 2 8 are included).

F 2 8 is
IPM codes with d D =3 IPM: L 2 = 25 , B d D =7 IPM: L 2 = 26 , B d D =6 IPM: L 2 = 27 , B d D =5 IPM: L 2 = 36 , B d D =4 IPM: L 2 = 37 , B d D =3 IPM: L 2 = 38 , B d D =2 IPM: L 2 = 39 , B d D =1
IPM codes with d D =4 IPM: L 2 = 59 , B d D =15 IPM: L 2 = 61 , B d D =14 IPM: L 2 = 57 , B d D =13 IPM: L 2 = 113 , B d D =11 IPM: L 2 = 56 , B d D =10 IPM: L 2 = 84 , B d D =9 IPM: L 2 = 74 , B d D =8 IPM: L 2 = 14 , B d D =7 IPM: L 2 = 10 , B d D =6 IPM: L 2 = 9 , B d D =5 IPM: L 2 = 41 , B d D =4 IPM: L 2 = 8 , B d D =3

Estimation of MI by Theorem 4.4

In this section, we use the MI to show the impact of B d ⊥ D in each of above three classes. In addition, we add the unprotected one, the Boolean one (α 2 = α 0 = 1) and the BKLC one for comparison and shown in Fig. 4.9. Mutual information: . The solid curves are from numerical simulation, while the dotted lines are estimated by using Eqn. 4.17.

2 4 2 3 2 2 2
I( ; X) Numerical Calc IPM: L i =0, unprotected! IPM: L 2 = 0 , d D =2, B d D =8 IPM: L 2 = 1 , d D =2, B d D =7 IPM: L 2 = 7 , d D =2, B d D =1 IPM: L 2 = 24 , d D =3, B d D =7 IPM: L 2 = 39 , d D =3, B d D =1 IPM: L 2 = 60 , d D =4, B d D =15 IPM: L 2 = 8 , d D =4, B d D =3 BKLC code: [16, 8 , 5]
From Fig. 4.9, we can choose directly the optimal codes for IPM (the green curve). Furthermore, the BKLC code of parameters [START_REF] Brier | Correlation power analysis with a leakage model[END_REF]8,5] is better than all IPM codes and it is the best one among all linear codes (but it cannot be used in IPM since there is no IPM code of parameter (1, α 2 ) corresponding to the generator matrix of this BKLC code). This again confirms the advantages of DSM beyond IPM in 2-share setting. However, the best IPM codes in 3-share setting could be as good as the codes used in DSM.

Further Applications to More General Masking Schemes

In Fig. 4.9, the estimated MI (dotted curves) are close to numerical calculation (solid curves) when the noise level is high. Moreover, the side-channel resistance of IPM is highly depend on the linear codes used in it, which can be quantified easily by using two properties of the codes.

In a nutshell, even with 2-share setting, the side-channel resistance of IPM can be significantly different. Hence, a dedicated choice of optimal codes for IPM is more than preferable, where Alg. 1 provides a good solution.

Further Applications to More General Masking Schemes

We show in this work the optimal codes for 2-share IPM over F 2 8 . In fact, our approach also allows analyzing all codes used in DSM, which is the generalization of IPM. Consequently, these results would be interesting for designers in practice, since the selection of the best parameters of DSM is simple but very effective.

More generally speaking, IPM is a special case of Leakage Squeezing (LS) [START_REF] Carlet | Achieving side-channel high-order correlation immunity with leakage squeezing[END_REF] and Direct Sum Masking (DSM) [START_REF] Bringer | Orthogonal Direct Sum Masking -A Smartcard Friendly Computation Paradigm in a Code, with Builtin Protection against Side-Channel and Fault Attacks[END_REF][START_REF] Carlet | Statistical properties of side-channel and fault injection attacks using coding theory[END_REF]. The connections between these masking schemes are shown in Fig. 4.10.

Moreover, the efficient and secure algorithms for performing the elementary operations like addition and multiplication on shared data are proposed in [START_REF] Wang | Efficient and Private Computations with Code-Based Masking[END_REF] for DSM. In particular, in the case of IPM, more efficient computations have been proposed in [3], in which the multiplication part can be simplified. From a performance perspective, the overhead of IPM is about 40% and 60% more than the Boolean masking when deployed on AES-128, for 2-share and 3-share implementations, respectively [3, Tab. 2].

Direct Sum masking (DSM)

Leakage Squeezing (LS)

Inner Product masking (IPM)

Boolean masking

MEASURING THE LEAKAGES IN IPM AND OPTIMAL CODES

Furthermore, the optimality of the selected codes not only holds under Hamming weight model, but also holds under the "unevenly weighted sum of the bits" (UWSB) model, in which each bit in the sensitive variables leaks differently. Indeed, in both cases the leakage function P have the degree equal to 1. Eventually, Theorem 4.3 is more general and can be used to assess the codes under the nonlinear or higher order moments leakages where d • P > 1, e.g.,

P (Z) = w H (Z) d has d • P = d.
The Impact of Different Irreducible Polynomials. Although all representations of F 2 8

are isomorphic and therefore equivalent, they do not preserve their properties after sub-field extension. In particular, there are 30 irreducible polynomials over F 2 8 and two typical cases of them are:

• g 1 (α) = α 8 + α 4 + α 3 + α + 1: which is the standard irreducible polynomial in AES 7 , • g 2 (α) = α 8 + α 4 + α 3 + α 2 + 1: which is the default irreducible polynomial in Magma and
Matlab, also the one used in this chapter.

In IPM, the irreducible polynomial plays an important role in expanding codes from F

Conclusions

In this part, we followed a quantitative approach to characterize the side-channel resistance of IPM scheme. In particular, we proposed a unified framework and linked it to two theoretical metrics (SNR and mutual information), and also an attack metric (success rate). The framework Noise level: log 10 ( 2 )

2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 8 6 4 2
Mutual information: I( ; X) in its weight enumeration polynomial. We showed that the concrete security level of IPM can be fully depicted by our framework. By our framework, we provided a quantitative explanation for "Security Order Amplification", which has been observed in previous works including CARDIS '16, CARDIS'17 and ASIACRYPT'17. At last, we proposed an effective method to select the optimal codes for IPM and validated by experiments.

g 2 ( ) = 8 + 4 + 3 + 2 + 1; d D =4, B d D =3 g 1 ( ) = 8 + 4 + 3 + + 1; d D =4, B d D =4
Although we validated our framework by simulated leakages with realistic noise parameters, it is still not clearly verified on real devices. As a perspective, we will consider the practical validations of our findings. Moreover, we show in Tab. 4.3 and 4.5 optimal codes obtained by an exhaustive study, which is very time-consuming. Such method to find the optimal codes becomes computationally impossible when the number of shares n gets larger (e.g., n > 5).

Hence, a systematic (e.g., algebraic) construction of better codes than mere random codes is much preferable and could be leveraged. However, it is still an open problem to construct optimal or suboptimal codes for IPM or LS with a larger number of shares.

Part III

Information Leakage in Code-based Masking: Formalization, Quantification and Applications

QUANTIFYING LEAKAGE IN CODE-BASED MASKING

Introduction

Masking is one of the most well-studied countermeasures to protect cryptographic implementations against side-channel attacks due to the favorable provable security it provides. The core idea underlying any masking scheme is to split the sensitive (key-dependent) variables into several shares and perform independent computations on masked variables only. Indeed, the rationale is that, given a sufficient amount of noise, the attack complexity increases exponentially with the number of shares [START_REF] Chari | Towards Sound Approaches to Counteract Power-Analysis Attacks[END_REF][START_REF] Prouff | Masking against Side-Channel Attacks: A Formal Security Proof[END_REF], while the implementation cost increases only quadratically (or only cubically in higher-order glitch-free implementations [START_REF] Grosso | Masking vs. Multiparty Computation: How Large Is the Gap for AES?[END_REF]).

Two key ingredients of a masking scheme are the encoding for randomizing the sensitive variables, and the masked operations for manipulating the random shares. Regarding the latter, the secure masked operations can be constructed effectively [86,[START_REF] Rivain | Provably Secure Higher-Order Masking of AES[END_REF] for both bit-and word-oriented variables. Furthermore, thanks to the well-established concept of (Strong) Non-Inference (NI and SNI) introduced by Barthe et al. [6], the basic gadgets carrying out the elementary operations (e.g., addition, multiplication, etc.) can be composed to construct the whole implementation without losing the claimed security properties. Regarding the former, the encoding is a more fundamental ingredient in masking that provides the achievable upper bounds of side-channel security order with tunable public parameters. Indeed, firstly, the side-channel security order of the full implementation cannot exceed the security order of the corresponding encoding, and secondly, when implemented ideally, the security order of an implementation can be guaranteed by its encoding. However, evaluating the concrete side-channel resistance of the encoding in general cases remains an open problem since many different encodings in various masking schemes behave differently when fed with diverse parameters. Therefore, a unified quantification approach would formalize and compare the security of different encodings and find optimal parameters for a specific masking scheme.

Unifying Masking Schemes by Generalization

Generalization is a promising approach to unify different masking schemes. In this trend, the code-based masking generalizes many existing schemes, including Boolean masking, Inner Product masking (IPM)1 [2, 3], Leakage Squeezing (LS) [START_REF] Carlet | Achieving side-channel high-order correlation immunity with leakage squeezing[END_REF][START_REF] Carlet | Statistical properties of side-channel and fault injection attacks using coding theory[END_REF] and Direct Sum masking (DSM) [START_REF] Bringer | Orthogonal Direct Sum Masking -A Smartcard Friendly Computation Paradigm in a Code, with Builtin Protection against Side-Channel and Fault Attacks[END_REF][START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF]. To the best of our knowledge, the generalized code-based masking (GCM) [START_REF] Wang | Efficient and Private Computations with Code-Based Masking[END_REF] 5.1 Introduction is the most generic scheme in this respect. In particular, polynomial masking [77,[START_REF] Prouff | Higher-Order Glitches Free Implementation of the AES Using Secure Multi-party Computation Protocols[END_REF] is also a special case of GCM, which is built upon Shamir's secret sharing (SSS) scheme [START_REF] Shamir | How to share a secret[END_REF].

Let X ∈ F k 2 and Y ∈ F t 2 be respectively the sensitive variable and t random masks. Then the encoded variable in GCM writes:

Z = XG + Y H ∈ F n 2 ,
given that k + t ≤ n, where G and H are generator matrices of two codes C and D, respectively.

For the sake of simplicity, we take k = 1, but essentially, the GCM can use packed secret sharing techniques [START_REF] Grosso | Masking vs. Multiparty Computation: How Large Is the Gap for AES?[END_REF][START_REF] Wang | Efficient and Private Computations with Code-Based Masking[END_REF] to improve the performance by parallelism. However, the side-channel security evaluation of encoding is similar to any k, since each of the k sensitive variables is encoded similarly. The overview of connections between these masking schemes is shown in • Intersection I: as pointed out in [START_REF] Costes | Redundant code-based masking revisited[END_REF], Boolean masking can be considered as a special case of polynomial masking for small enough parameters (n ≤ 6 or equivalently t ≤ 5).

• Intersection II: in [2], the authors claimed that the polynomial masking is a special case of IPM.

However, this generalization does not indicate the exact connections between SSS-scheme and RS codes. Indeed, if we take the polynomial evaluations in encoding into consideration, the generalization from SSS-based masking to IPM is valid only when n = 2 and t = 1.

QUANTIFYING LEAKAGE IN CODE-BASED MASKING

• Intersections III and IV: in SSS-based masking, if n = t + 1, the codes C and D are complementary, therefore they can be viewed as DSM (or LS) scheme. Otherwise, if n > t + 1, the corresponding masking schemes are out of DSM's scope. On the other side, the linear codes for DSM may not be converted into SSS-based schemes since the codes in SSS are endowed with a specific algebraic structure.

The most significant benefit of utilizing code-based masking is the higher security order than the simple Boolean masking given the same number of shares. Taking 2-share IPM over 3,37] as an instance, when appropriate public parameters are chosen, the side-channel security order can be maximized to 3 under the bit-probing model [START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF], which is higher than 1 in Boolean masking. Moreover, the security orders are enlarged to 7 vs. 2 (IPM vs. Boolean one) in 3-share scenarios [37, Tab. 2].

F 2 8 [
Currently, the side-channel security order of GCM has been connected to the dual distance of D [START_REF] Carlet | Statistical properties of side-channel and fault injection attacks using coding theory[END_REF][START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF], which is denoted as d ⊥ D . As a special case, the security order t in IPM and DSM is equal to d ⊥ D -1 since the two codes C and D are complementary. However, as pointed out in [37], the dual distance of D is not sufficient to characterize the concrete side-channel resistance of IPM, hence a new framework with a new parameter (more precisely B d ⊥ D , which counts the number of codewords of Hamming weight equal to d ⊥ D in D ⊥ ) is proposed to model IPM's concrete security level more accurately. Nevertheless, this framework is not applicable to GCM since C and D may not be complementary anymore.

Public Points in SSS and Polynomial Masking

To construct a t-th order secure polynomial masking, a polynomial of degree t is firstly selected:

f X (X) = X + t i=1 u i X i ,
where the secret X is then associated as the constant term in f X (X). Secondly, f X (X) is evaluated in n distinct points α i for 1 ≤ i ≤ n, which are called "public points" in the scheme. As a result, the secret X is encoded by using the private parameters u i (which are random masks viewed in the context of masking).

As observed in [START_REF] Chabanne | Linear repairing codes and side-channel attacks[END_REF], the public points in SSS play a significant role in the side-channel resistance of SSS-based masking schemes. In fact, this problem of public points is inherent in the SSS scheme and can be dated back to Massey [START_REF] James | Minimal codewords and secret sharing[END_REF] who claimed that SSS scheme "can be attacked with the well-developed tools of algebraic coding theory". The SSS-based masking provides a practical example whereby changing the public points in polynomial masking, the concrete security level can be significantly different.

Our Contributions

However, to the best of our knowledge, there are neither qualitative principles for selecting good or even optimal public points in SSS-based masking nor a quantitative approach to evaluate the role of public points played in the side-channel resistance of SSS-based masking. In this chapter, we propose solutions to the two problems by utilizing a coding-theoretic quantitative approach.

Independence Assumption behind Masking Schemes

The independence assumption is an indispensable condition behind the security proofs when extending from the probing model to the bounded moment model or noisy leakage models [8,[START_REF] Duc | Unifying Leakage Models: From Probing Attacks to Noisy Leakage[END_REF].

For instance, if this independence condition is violated due to physical defaults (e.g., couplings through the ground or parasitic capacitances, glitches, etc.), the side-channel security order will decrease accordingly [START_REF] Duc | Making Masking Security Proofs Concrete -Or How to Evaluate the Security of Any Leaking Device[END_REF]. However, this independence condition is essentially related to inter-share leakages from different shares in masking and treats each share as a whole.

Moreover, the independence issue also happens in intra-share cases where the leakages of different bits in the same share leak jointly. This kind of leakage is often called non-linear leakages and comes, e.g., from registers or memory units of real devices. In fact, both intra-share and inter-share independence issues can happen simultaneously. Taking AES implemented on ARM Cortex-M4 as an example, where the registers are 32-bit, and each share is in F 2 8 , four shares can be manipulated at the same time. Consequently, the register will leak jointly, including intra-share and inter-share leakages. To the best of our knowledge, the intra-share independence issue has not yet been studied thoroughly in the sense of security order reduction.

We will show that essentially, the intra-share independence is the condition for higher security orders under the bounded moment model [8].

Our Contributions

In view of the above state-of-the-art, our contributions are threefold as follows.

A Unified Leakage Quantification Approach for GCM. We derive a closed-form expression for SNR to quantify the information leakages in GCM for any leakage functions. In particular, we present a simplified expression for the Hamming weight leakage model. In fact, this new result generalizes the framework proposed in [37] for IPM. Furthermore, we use mutual information (MI) to quantify the information leakages of GCM in an information-theoretic sense.

Both SNR and MI are connected to two properties (namely the dual distance and the number

QUANTIFYING LEAKAGE IN CODE-BASED MASKING

of conditioned codewords) of the linear codes used in GCM. Relying on a theoretical analysis of SNR and MI, we propose a unified approach to quantify information leakage in GCM. Then we show how to select optimal codes for GCM by optimizing the two properties. The experimental results confirm that the MI can be minimized by utilizing optimal codes, which indicates the improved concrete security level of the corresponding masking scheme.

Optimal Public Points for SSS-based Polynomial Masking. As an application of our unified approach, we characterize the side-channel resistance of polynomial masking from a coding-theoretic point of view. The first outcome is a more accurate characterization of information leakage and the second outcome is a straightforward method to choose optimal linear codes (parameters) for SSS-based masking. For the first time, we quantify the impact of combining different public points in SSS-based masking in the context of side-channel analysis and show that more shares leak more information (given a specific t). In particular, our codingtheoretic approach can exactly depict the observations made in [START_REF] Chabanne | Linear repairing codes and side-channel attacks[END_REF]. Using MI, we present the quantitative results of information leakages in SSS-based masking, which again validate our unified approach. For the first time, we exhibit several optimal tuples of public points (the linear codes in a coding-theoretic perspective) for SSS-based masking in the sense of side-channel resistance.

Revisited Independence Condition in Masking Schemes. Independence condition requires that the information leakages from different variables are statistically independent. In the context of masking, it exists in two cases: inter-share and intra-share. Specifically, the former means that the leakages of different shares are independent, which is well-studied in literature [8].

The latter deals with the leakages from one share, in which different bits in this share may leak independently or not. To capture both of them, we introduce the leakage function P , where its numerical degree indicates both cases' independence conditions. For instance, the commonly assumed Hamming weight leakage model has a numerical degree equal to 1, a perfect independent case. Moreover, we show how the degree of P affects the side-channel security order of a masking scheme.

We underline that all mathematical derivations presented in this chapter have been verified formally with Magma computational algebra system [158]. The open sources of this work are available on Github [START_REF] Cheng | Open-source: Quantifying Information Leakages in GCM[END_REF].

Encodings in Code-based Masking

Differences between Chap. 4 or [37] with GCM. In this work, we study GCM by using a similar coding-theoretic approach as in [37]. However, two key differences make this work significantly different from [37].

Firstly, GCM generalizes IPM by allowing C, and D to be non-complementary, which allows deriving security metrics in a more general manner. In [37], the authors prove that the sidechannel security of IPM only depends on the code D. While in this work, for the first time, we show that the side-channel security depends on both C and D. In particular, the quantitative findings enable us to put forward optimal GCM encodings which are new upon [START_REF] Costes | Redundant code-based masking revisited[END_REF]: given the same parameters n and t (the number of shares and security order), we decrease the information leakage in GCM to the lesser possible extent.

Secondly, GCM allows for protections in much more general contexts. Namely, GCM can be used to withstand glitches [START_REF] Prouff | Higher-Order Glitches Free Implementation of the AES Using Secure Multi-party Computation Protocols[END_REF] and to detect errors against fault injection attacks on top of preventing side-channel attacks. Therefore, our work has broader implications for the protection of realistic platforms. In a nutshell, GCM opens a new path to derive unified countermeasures against both fault injection and side-channel attacks.

Encodings in Code-based Masking

Technical Overview

Let n, k be positive integers and K = F 2 be a finite field. Let C be an [n, k] q linear code parameter with generator matrix G defined over F q (here we use q = 2 ). Let the irreducible polynomial be g(α) = α 8 + α 4 + α 3 + α 2 + 1 to generate the field K = F 2 8 . Recall that for an (n, t)-SSS scheme, the secret X is split into n shares, and the sharing is t-privacy, where any t + 1 shares can be used to recover the secret but not for less than t shares. Note that the (n, t)-SSS scheme is also connected to the Reed-Solomon (RS) code with parameters [n, t + 1].

Let X ∈ K k , Y ∈ K t and Z ∈ K n be the sensitive variable, the random masks, and the shared variable; we use Eqn. 5.1 as the uniform representation of encoding in GCM which is used throughout the chapter:

Z = XG + Y H ∈ F n 2 , (5.1)
where k + t ≤ n, G and H are two generator matrices of the two codes C and D with C ∩ D = {0}.

In this work, we focus on GCM, which is the most general case of code-based maskings 1 . By using the uniform representation as Eqn. 5.1, we revisit the encodings of code-based masking

QUANTIFYING LEAKAGE IN CODE-BASED MASKING

schemes as in Tab. 5.1.

C ∩ D = {0}, C + D = K n C ∩ D = {0}, C + D = K n C ∩ D = {0}, C + D = K n C ∩ D = {0} C ∩ D = {0} G ∈ K k×n 1 0 0 • • • 0 G ∈ K k×n G ∈ K k×n 1 1 • • • 1 G ∈ K k×n H ∈ K t×n         α 1 1 0 • • • 0 α 2 0 1 • • • 0 . . . . . . . . . . . . . . . α t 0 0 • • • 1         H ∈ K t×n H ∈ K t×n         α 1 1 α 1 2 • • • α 1 n α 2 1 α 2 2 • • • α 2 n . . . . . . . . . . . . α t 1 α t 2 • • • α t n         H ∈ K t×n Security parameters: n, k, t k = 1, n = t + 1 n = k + t.
G, H can be any matrices

n = k + t.
G, H can be any matrices

n ≥ k + t and f X (X).
In glitch-free case,

n ≥ 2t + 1 [131] n ≥ k + t.
G, H can be any matrices

Connecting SSS Scheme to the RS code

We recall the (n, t)-SSS scheme by mainly referring to [START_REF] Castagnos | High-order masking by using coding theory and its application to AES[END_REF][START_REF] Chabanne | Linear repairing codes and side-channel attacks[END_REF]. Let X ∈ K again be the secret and can be split into n shares such that no tuple of shares with cardinality lower than t depends on X. The SSS scheme consists in selecting a random polynomial f X (X) = X + t i=1 u i X i of degree t where u i with 1 ≤ i ≤ t are t random coefficients (masks) in K. The secret X is the constant term: X = f X (0). Then a (n, t)-sharing (Z 1 , Z 2 , . . . , Z n ) of X is defined by evaluating the polynomial f X (X) in n distinct public non-zero points α 1 , α 2 , . . . , α n in K such that Z i = f X (α i ). The recovery of X from its sharing consists in two steps: f X (X) is first recovered by using the Lagrange interpolation and second, f X (X) is evaluated in 0. Since in an (n, t)-SSS, any tuple of shares with cardinality greater than t can be used to recover X, we denote by U the selected shares (|U | ≥ t + 1), which is called the interpolation set.

Actually, these two steps can be combined into one [START_REF] Chabanne | Linear repairing codes and side-channel attacks[END_REF]:

X = Zi∈U Z i • γ i , (5.2)
where the public constants γ i are computed from α i by:

γ i = n j=1 s.t. j =i, Zj ∈U αj αj -αi .
1 LS consists of the application of an arbitrary bijection on the shares. Although it has only been studied on vectors of bits (on F 2 ), it can be trivially extended to vectors on F 2 . When the bijections are linear, LS is thus equivalent to DSM.

Quantifying Information Leakages in GCM

Remark 5.1. Note that in K = F 2 , the subtraction is the same operation as the addition.

Remark 5.2. In an (n, t)-SSS scheme, any combination of more than t shares, meaning |U | ≥ t+1, can be used to recover the polynomial f X (X) and the secret X. Hence, in each combination (e.g., each set U ), γ i should be computed correspondingly.

Next, we recall the Reed-Solomon codes.

Definition 5.1 (Reed-Solomon Code [START_REF] Chabanne | Linear repairing codes and side-channel attacks[END_REF]). The Reed-Solomon code RS(S, t + 1) ⊂ K n of dimension t + 1 over a finite field K and with evaluation subset S = {α 0 , α 1 , . . . , α n } of K is the subspace:

RS(S, t + 1) = {(f (α 0 ), f (α 1 ), . . . , f (α n )); f (X) ∈ K[X] and deg(f ) ≤ t} .
Given the degree of f (X) is t, then t + 1 evaluations of it can be used to recover f (X) itself and the codewords. In terms of RS codes, the sharing of X with SSS scheme is an encoding with a RS code RS ({α 1 , . . . , α n }, t + 1):

Z = (Z 1 , Z 2 , . . . , Z n ) = (X, Y ) G H = XG + Y H, (5.3)
where G H is the generator matrix (α j i ) i∈[1; n], j∈[0; t] . More precisely, G is an 1-by-n matrix equal to (1, 1, . . . , 1) and H is a Vandermonde matrix. By denoting G i and H i the i-th column of G and H respectively, we have:

Z i = f X (α i ) = X + t j=1 Y j α j i = XG i + (Y 1 , . . . , Y t ) H i .
Accordingly, the reconstruction of X from Z = (Z 1 , Z 2 , . . . , Z n ) is done by taking Z i to obtain an interpolation set U such that |U | ≥ t + 1. We also call this scheme the redundant sharing when n > t + 1 since at least t + 1 shares can recover X. We will show in Sec. 6.2 that more redundancies in sharing of SSS-based masking leak more information on X.

Quantifying Information Leakages in GCM

In this section, we use SNR as a leakage metric to evaluate the information leakages in GCM. In particular, SNR quantifies the key-dependent leakage at certain degrees. SNR is thus attractive in that if SNR at a given degree d is null, then one can conclude that the scheme is secure at order d.

Uniform Representation of Leakage Function

As the first step, we formalize the information leakages from a device. In this respect, we rely on the clarification on serial and parallel implementations proposed in [8].

QUANTIFYING LEAKAGE IN CODE-BASED MASKING

Before formalization, we give an example to provide some intuition for the uniform leakage function P . Let Z = (Z 1 , Z 2 , . . . , Z n ) denote the encoded intermediate with n shares and X be the secret. By ignoring the noise, we assume the leakage of each share is L i = Z i under the identity leakage model and L = i L i is the total leakage. To launch a successful attack, an adversary needs to find the (smallest) key-depend statics, namely raising d such that

E L d |X = E L d , but E L i |X = E L i for all i < d.
Equivalently, an adversary needs the smallest d such that V E L d |X = 0, which measures the informative part in L.

Formally, let P = ϕ P • φ P denote the leakage function, where φ P is the leakage model for each share, and ϕ P is the combination function that assembles the leakages from selected shares.

In this thesis, we call φ P and ϕ P the intra-share and inter-share leakage model, respectively.

For instance, in serial implementations, the leakage of each share is:

L i = φ P (Z i ) + N i , then
the exploitable leakages can be combined by ϕ P . For instance, taking the Hamming weight model and centered product as leakage model and combination function, respectively, then

L i = φ P (Z i ) + N i = w H (Z i ) + N i and L = d c=1 (L c -E [L c ]) = P (Z) + N total
where the latter combines leakages of d shares by the normalized product. Consequently, the highest order of key-dependent leakages is captured by P with numerical degree d.

Therefore, we use the following representation of P as a pseudo-Boolean function:

P (Z) = I∈{0,1} n β I Z I , (5.4)
where Two Probing Models. For the purpose of a finer-grain analysis, we clarify the two kinds of probing model (see also [54, §2.2]) and corresponding security orders as follows:

Z I = i∈{1,...,n } s.t. Ii=1 Z i ,
• Bit-probing model: each probe only gets one bit at a time where each bit leaks independently or jointly. Correspondingly, φ P is defined at bit-level and ϕ P at certain degrees are used to combine the bit-level leakages. The security order in the bit-probing model is denoted by t b .

• Word-probing model: each probe gets an -bit word at a time, where an -bit variable leaks as a whole. As a result, the degree of φ P implies how many numbers of bits leaked jointly, in which the intra-share independence condition plays a role in security order reduction, as shown above. Similarly, the security order is then denoted by t w .

When connected to coding-theoretic properties, the security orders t b and t w are related to the dual distance of the code D used in GCM over F 2 and F 2 , respectively [37,[START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF]. More

Quantifying Information Leakages in GCM

precisely 1 , we have t w = d ⊥ D -1 and t b = d ⊥ D2 -1 where D 2 is the sub-field representation of D. In the sequel, we call t the security order for the sake of simplicity, t b and t w should be unambiguous from the context (e.g., variables in F 2 or F 2 ).

SNR-based Information Leakage Quantification

Let P (Z) be a leakage function as in Eqn 5.4 and let N denote the independent noise with zero mean and variance V [N ] = σ 2 total ∝ σ 2d (∝ means proportional to σ 2d ) [37]. Then, the leakage is:

L = P (Z) + N. We have V [E [P (Z) + N |X]] = V [E [P (Z)|X]], where Z = XG + Y H ∈ K n = F n
2 is the encoding in GCM (Equ. 5.1). The SNR of leakages is defined as:

SNR = V [E [L|X]] V [N ] = V [E [P (Z)|X]] σ 2 total . (5.5)
Therefore, we propose the following theorem to quantify the leakages in the GCM scheme by SNR.

Theorem 5.1. Let a device be protected by the GCM scheme as Z = XG + Y H. Assume the leakages of the device can be represented in the form: L = P (Z) + N . Then the SNR of the exploitable leakages is:

SNR = V [E [P (Z)|X]] σ 2 total = 1 2 2n • σ 2 total   x, y∈D ⊥ \C ⊥ ; x+y∈C ⊥ P (x) P (y)   , (5.6)
where σ 2 total ∝ σ 2d is the total noise and P (•) is the Fourier transform of P (•)

The demonstration of Theorem 5.1 involves computing V [E [P (Z)|X]], which can be derived by the following Lemma 5.1. In order to have the paper read fluently, its proof is relegated in Appendix A.1.1 which also proves Theorem 5.1.

Lemma 5.1. Let a pseudo-Boolean function P (Z) denote the leakage function, and taking the same notations as above, we have

V [E [P (Z)|X]] = 1 2 2n
x, y∈D ⊥ \C ⊥ ; x+y∈C ⊥ P (x) P (y).

(5.7)

QUANTIFYING LEAKAGE IN CODE-BASED MASKING

Remark 5.3. Note that Lemma 5.1 encompasses the core result in [37]. Indeed, as a special case, if n = t + 1 in SSS-based masking, the two codes C and D are complementary, as well as C ⊥ and D ⊥ . Since by Lemma 3.4, we have C ⊥ ∩ D ⊥ = {0} and the only possible solution in Eqn. 5.7 is

x = y = 0. Therefore, V [E [P (Z)|X]
] can be simplified into:

V [E [P (Z)|X]] = 1 2 2n x∈D ⊥ \{0} P (x) 2 , (5.8)
which is exactly the same result as in [37].

As a nutshell, the information leakages from GCM can be quantified by Theorem 5.1 under the generic leakage model characterized by P , which evaluates the SNR of the leakages. As a direct result, we have the following proposition, which connects the code property d ⊥ D and the security order in GCM. Proof. Given a pseudo-Boolean function P , one has P (z) = 0 for all z ∈ K n such that w H (z) > deg(P ) [START_REF] Carlet | A New Representation of Boolean Functions[END_REF]. As a result, SNR will be zero since deg(P ) < d ⊥ D and all codewords of D ⊥ \C ⊥ as in Eqn. 5.6 have Hamming weight no less than d ⊥ D .

Consequently, the attacks on GCM fail if deg(P ) < d ⊥ D . Conversely, for an attack to succeed, one must have deg(P ) ≥ d ⊥ D . This is, however, only a necessary condition, but not a sufficient one. Indeed, it is possible that attacks in the setting deg(P ) ≥ d ⊥ D fail. This is illustrated in the next remark.

Remark 5.4. The security order can be even higher than d ⊥ D -1 when there is no x, y ∈ D ⊥ \C ⊥ such that x + y ∈ C ⊥ which have weight d ⊥ D . Indeed, in Eqn. 5.6, the sum will be empty if the degree of P is equal to deg(P ) = d ⊥ D . Thus the SNR is equal to zero, and the security order increases accordingly. A specific example can be found in [164, Example 1] (shown in Appendix 6.1), in which d ⊥ D equals 2 and the security order equals 2 as well.

Quantifying Hamming Weight Leakages

One realistic leakage model is the so-called "Hamming weight" leakage: each bit is leaking in a similar amount, though independently from others. It has been demonstrated to be practical in many works, such as [START_REF] Brier | Correlation power analysis with a leakage model[END_REF]. In this case, the attacker can measure a quantity

P (Z) = w H (XG + Y H).

Simplifications

We use P (z) = w H (z) d as the informative part in a leakage model, which captures the higherorder leakages where the numerical degree deg(P ) equals d. Moreover, we have:

P (z) = w H (z) d = J1+•••+J n =d d J 1 , . . . , J n n i=1 z Ji i = J∈N n , s.t. w H (J)<d; n i=1 Ji=d d J z J + d! I∈{0,1} n ; w H (I)=d z I
(5.9)

where N = {0, 1, . . .} is the set of integers. The multinomial coefficient d J1,...,J n is defined as

d! J1!•••J n ! (recall that J = (J 1 , . . . , J n ) ∈ N n with n i=1 J i = d).
This coefficient equals d! as long as for all i (1 ≤ i ≤ n ), J i = 0 or 1. Now, the terms in P (z) are categorized into two cases: Indeed, let i ∈ {1, . . . , n }, then z Ji i = 1 if J i = 0, and z Ji i = z i if J i > 0. The first terms z J have numerical degree deg(z J ) < d, hence can be discarded in the analysis (they contribute nothing to the SNR). Remaining terms of numerical degree d are: I∈{0,1} n , w H (I)=d z I .

• z J where J ∈ N n , w H (J) < d,
Relying on decomposition in Eqn. 5.9, we can simplify lemma 5.1 as follows.

Lemma 5.2. Let a pseudo-Boolean function P (Z) = w H (Z) d denote the leakage function, and taking the same notations as above, we have

V [E [P (Z)|X]] = B d d! 2 d 2 . ( 5
B d = {(x, y) ∈ (D ⊥ \C ⊥ ) 2 | x + y ∈ C ⊥ , w H (x) = w H (y) = d} .
(5.11)

QUANTIFYING LEAKAGE IN CODE-BASED MASKING

To be more precise, we use subscript 2 (if necessary) to indicate the subfield representation of a linear code. For instance, D 2 denotes the subfield representation of D over F 2 . Therefore, we have the following lemma for B d .

Lemma 5.3. Recall that B d ⊥ D 2
is the coefficient in weight enumerator of D ⊥ 2 defined in Def. 3.2, then we have the following inequality in SSS-based masking:

B d ⊥ D 2 ≥ B d ⊥ D 2 . Proof. B d ⊥ D 2
is the number of pairs of codewords (x, y) in D ⊥ \C ⊥ which satisfy the two conditions: their sum is in C ⊥ and their weights are equal to d ⊥ D2 . Clearly, this number is greater or equal to the same number of pairs where in addition, x and y are chosen to be identical. In the latter case, the number of codewords is equal to:

{x ∈ D ⊥ \C ⊥ |w H (x) = d ⊥ D2 } , (5.12)
because x + y = 0 does always belong to C ⊥ and that x and y have the same Hamming weight since they are equal. Now, Eqn. 5.12 is the minimum nonzero coefficient in the weight enumerator of D ⊥ \C ⊥ , which is equal to B d in SSS-based masking.

Hereafter, we demonstrate Lemma 5.2 by utilizing Eqn. 5.9 to simplify Lemma 5.1.

Proof of Lemma 5.2. Let ϕ I (z) = z I where I ∈ {0, 1} n . Thus

z I = i∈I z i = i∈I (1 -(-1) zi ) 2 = 1 2 d i∈I (1 -(-1) zi ).
(5.13) Since all monomials with numerical degree smaller than d have SNR = 0, we only focus on monomials with numerical degree equal to d. Taking ϕ I (z) = φ I (z) + (-1) d 2 d (-1) i∈I zi where φ I (z) is linear combination of monomials with numerical degree smaller than d in ϕ I (z), then the Fourier transform of ϕ I (z) is:

ϕ I (y) = φ I (y) + (-1) d 2 d z (-1) z•I (-1) z•y = φ I (y) + (-1) d 2 d z (-1) z•(I+y) = φ I (y) + (-1) d 2 d-n 1 {I} (y).
(5.14)

We have φ I (y) = 0 for y with w H (y) ≥ d ⊥ D = t + 1 > d, since given a pseudo-Boolean function P , one has P (z) = 0 for all z ∈ K n with w H (z) > deg(P ) [17, Lemma 1]. As a result, by combining

Quantifying Hamming Weight Leakages

Eqn. 5.14 with Eqn. A.3, we have the following equation:

V[E[P (Z)|X]] = 1 2 2n x, y∈D ⊥ \C ⊥ x+y∈C ⊥ P (x) P (y) = 1 2 2n x, y∈D ⊥ \C ⊥ x+y∈C ⊥   I|w H (I)=d (-1) d 2 d-n d I 1 {I} (x)     I|w H (I)=d (-1) d 2 d-n d I 1 {I} (y)   = 2 -2d x, y∈D ⊥ \C ⊥ x+y∈C ⊥   I|w H (I)=d d I 1 {I} (x)     I|w H (I)=d d I 1 {I} (y)   = d! 2 d 2 x, y∈D ⊥ \C ⊥ ; x+y∈C ⊥ 1 = B d d! 2 d 2 , (5.15)
where B d is the adjusted coefficient in weight enumerator defined in Def. 5.2.

Connecting SNR with Code Properties

Taking Lemma 5.2 as an input to Theorem 5.1, we have the following theorem for Hamming weight leakages in GCM.

Theorem 5.2. Let a device be protected by the GCM scheme as Z = XG + Y H. Assume the device is leaking in Hamming weight model in the form: L = P (Z) + N . Then the SNR of the exploitable leakages is:

SNR = V [E [P (Z)|X]] σ 2 total =    0 , if deg(P ) < d ⊥ D B d ⊥ D σ 2 total d ⊥ D ! 2 d ⊥ D 2 , if deg(P ) = d ⊥ D (5.16)
where σ 2 total is the total noise such that σ We extend the leakage quantification approach by using another metric, namely MI, in an information-theoretic sense. Let the secret X be encoded as in Eqn. 5.1, and let the leakages be L = P (Z) + N , then the MI between L and X is defined as I(L; X) = H(L) -H(L|X) where:

-the total entropy is:

H(L) = -l Pl log 2 Pldl, -the conditional entropy H(L|X) is: H(L|X) = -x∈F 2 Px l Pl|x log 2 Pl|xdl.
In multivariate cases, two entropies are computed on L = (L

I(L; X) = +∞ d=0 1 2 d! ln 2 x∈F 2 P r(x) (k d (P (Z)|x) -k d (P (Z))) 2 (V [P (Z)] + σ 2 ) d (5.17)
where k d is the d-th order cumulant [START_REF] Cardoso | Dependence, Correlation and Gaussianity in Independent Component Analysis[END_REF].

Assuming the device is leaking in the Hamming weight model, we have the following theorem for quantifying the information leakages in GCM.

Theorem 5.3. Let a device be protected by the GCM scheme as Z = XG + Y H. Assume the leakages of the device can be represented in the form: L = P (Z) + N . Then the MI between L and X is estimated as:

I(L; X) =    0 , if deg(P ) < d ⊥ D d ⊥ D !B d ⊥ D 2 ln 2•2 2d ⊥ D × 1 σ 2d ⊥ D + O 1 σ 2(d ⊥ D +1) , if deg(P ) = d ⊥ D , when σ → +∞ (5. 18
)
where σ is the standard deviation of noise in the leakage of each share.

Proof. Since for a d-CI (Correlation Immune) function [22, Def. 1], all moments of order i ≤ d are centered, so are the cumulants. Therefore, the first nonzero cumulant

k d (X) is k d ⊥ D (X) and it equals µ d ⊥ D (X). As a consequence, the term E (k d (P (Z)|X) -k d (P (Z))) 2 in Eqn. 5.17 is null for all d < d ⊥ D and it is equal to E (µ d (P (Z)|X) -µ d (P (Z))) 2 = V µ d ⊥ D (P (Z)|X) = V E P (Z) d ⊥ D |X for d = d ⊥ D .
Assume that the device leaks in Hamming weight model, then P (Z) d ⊥ D has a degree equal to d ⊥ D . Hence the MI is equal to:

I(L; X) = 1 2 ln 2 • d ⊥ D ! V E P (Z) d ⊥ D |X (V [P (Z)] + σ 2 ) d ⊥ D + O 1 (V [P (Z)] + σ 2 ) d ⊥ D +1 , (5.19)

Optimal Codes for GCM

when σ → +∞. Finally, Eqn. 5.19 can be further developed at the first order in 1/σ 2d ⊥ D as follows after involving Eqn. 5.15:

I(L; X) = d ⊥ D !B d ⊥ D 2 ln 2 • 2 2d ⊥ D × 1 σ 2d ⊥ D + O 1 σ 2(d ⊥ D +1)
, when σ → +∞, which proves Theorem 5.3.

A comparison of MIs by estimation and numerical calculation is shown in Fig. 5.2. More precisely, the estimated MIs are converging to numerical one when log 10 σ 2 ≈ 1.5, which verifies Theorem 5.3 numerically.

2.0 1.5 1.0 0.5 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3. 5

Optimal Codes for GCM

Thanks to Theorem 5.1, 5.2 and 5.3, we can compare the information leakages of GCM in a quantitative manner. More importantly, relying on the analytic characterization of information

QUANTIFYING LEAKAGE IN CODE-BASED MASKING

leakages, the three theorems enable us to choose optimal linear codes for GCM. Specifically, the codes with maximized d ⊥ D and minimized B d ⊥ D are the best candidates for GCM. Considering the SSS-based masking as a special case, the optimal public points can be determined straightforwardly by applying the two theorems.

To thoroughly validate the optimal codes, we consider multivariate leakages. In particular, it is shown in [START_REF] Standaert | The World Is Not Enough: Another Look on Second-Order DPA[END_REF] that comparing to sum, absolute difference, and normalized product, the joint distribution is the most efficient way to combine the multivariate leakages in side-channel analysis. In this work, we consider both sum and joint distribution to exploit the multivariate leakages. A comparison of the two combination functions in an information-theoretic sense is presented in Appendix B.3.

We take (3, 1)-SSS based masking as an example of GCM and specify it as follows. Let X be encoded into Z = XG + Y H with n = 3 shares, the two generator matrices are: Thirdly, the strategy to choose the optimal codes for GCM is to maximize the dual distance . Moreover, the concrete side-channel security level of GCM will be improved by optimizing either of the two parameters.

G = ( 1 1 1 ) , H = α 1 α 2 α 3 = 1 α j α k . ( 5
Interestingly, when the noise levels are at certain intervals, the codes with smaller d ⊥ D (also with smaller B d ⊥ D

) may be better than that with larger d ⊥ D . For instance, for the curves in purple (the fourth one) and in sky-blue (the fifth one) of Fig. 5.3, the corresponding d ⊥ D are 2 and 3, .

Conclusions and Perspectives

respectively. When σ 2 < 10, the purple curve shows a better side-channel resistance than the sky-blue one.

Conclusions and Perspectives

This chapter presented a unified approach to quantifying the information leakages of code-based masking in the most general case, namely GCM, which already encompasses many state-of-theart masking schemes. Firstly, by a uniform representation of encodings in GCM, we proposed a

QUANTIFYING LEAKAGE IN CODE-BASED MASKING

quantitative approach to evaluate the concrete security level of GCM. The signal-to-noise ratio and mutual information are used as two complementary metrics to quantify the lowest degree of key-dependent leakages. By this unified approach, we were able to quantify the impact of different codes in GCM and optimize it by choosing optimal codes for it. Next, we evaluated the impact of public points in Shamir's Secret Sharing in the context of masking. Thanks to the unified analytic approach, we showed the impact of public points in side-channel security orders of the corresponding masking. More importantly, we provided a roadmap to optimal linear codes for designers to optimize the SSS-based masking (also GCM) soundly. Lastly, we revisited the independence condition behind the masking scheme and showed that the intra-share dependence could ruin higher-order security under the bounded moment model. In particular, we showed how the higher-order intra-share leakages affect the side-channel security orders precisely.

CHAPTER 6

Redundancy in Code-based Masking

This chapter presents the work [35] published at IACR Trans. Cryptogr. Hardw. Embed. Syst.

(TCHES) 2021, issue 3. Part of results are also been demonstrated in [42].

Contents

A Starter Example

As shown in Remark 5.4, there are some cases of GCM in which the side-channel security order can be greater than the dual distance of D minus one. In particular, Wang et al. [START_REF] Wang | Efficient and Private Computations with Code-Based Masking[END_REF] presented

REDUNDANCY IN CODE-BASED MASKING

an example where the generator matrices of C and D as follows, respectively,

G = 1 1 1 1 0 0 0 0 0 0 0 0 1 1 0 0 ∈ F 2×8 2 , H =    
1 1 0 0 0 0 0 0 0 0 1 1 0 0 0 1 0 0 0 1 1 1 0 0 0 0 0 0 0 1 1 1

    ∈ F 4×8 2 . (6.1)
We can compute the generator matrices of the dual codes C ⊥ and D ⊥ as follows, respectively,

G ⊥ =        
1 0 0 1 0 0 0 0 0 1 0 1 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1

        ∈ F 6×8 2 , H ⊥ =     1 1 0 0 0 0 0 0 0 0 1 0 0 0 1 1 0 0 0 1 0 1 0 1 0 0 0 0 1 1 1 0     ∈ F 4×8 2 , (6.2)
where C ⊥ is a code with parameters In particular, we checked that the first nonzero

B d ⊥ D for nonzero codewords is B 3 = 3.
Therefore the security order is exactly 2 in above example.

Enhancing the SSS-based Polynomial Masking

In the context of masking, the random masks in SSS-based masking are u i for 1 ≤ i ≤ t where α 1 , α 2 , . . . , α n are n public points. Two main observations made in [START_REF] Chabanne | Linear repairing codes and side-channel attacks[END_REF] are:

• the choices of public points α i can have an impact on side-channel resistance of the corresponding masking scheme, therefore, combining different t + 1 tuples of Z i , the efficiencies of corresponding template attacks are different,

• combining more than t + 1 tuples of Z i may improve the attack efficiency in the sense of the number of traces needed to recover the secret key.

Enhancing the SSS-based Polynomial Masking

Recall that the generator matrices in SSS-based masking (e.g., the RS code) from Tab. 5.1, G and H are the same as the generator matrices in DSM when n = t + 1. In the context of masking, we only care about G and H, since the former is used to encode the secret X and the latter is for encoding the random masks (e.g., u 1 , . . . , u t in the case of SSS-based masking).

Note that H is a Vandermonde matrix, resulting in that the code D is a maximum distance separable (MDS) code, it is optimal at word-level. However, with different parameters α i for 1 ≤ i ≤ n, the codes have different impacts on side-channel resistance when they are adopted in masking schemes.

Further Clarifications

We further clarify the properties of the code D and its dual as follows. Let D be an RS code of parameters [n, t, nt + 1] which is generated by H in Eqn. 5.3. Then its dual code D ⊥ is also an RS code of parameters [n, nt, t + 1] [START_REF] Macwilliams | The Theory of Error-Correcting Codes[END_REF]. Recall the connections between the RS code and SSS scheme, D can be used to construct an (n, t)-SSS scheme.

Given that n ≥ t + 1, we assume that t + 1 ≤ n ≤ n, the code D is constructed by selecting n columns from the generator matrix H of D (or equivalently, remove nn columns in H).

Subsequently, the code D has parameters [n , t, nt + 1]. It is also an RS code and its dual code D ⊥ has parameters [n , nt, t + 1]. Therefore, the dual distance of D is equal to D,

namely d ⊥ D = d ⊥ D = t + 1.
In summary, removing some coordinates (n ≥ t + 1) in RS code does not decrease its dual distance (at word-level). Remark 6.1. Note that for two arbitrary linear codes D and D where the latter is generated from the former as above (by selecting some coordinates), we have the following lemma for their dual distances.

Lemma 6.1. d ⊥ D ≤ d ⊥ D .
Proof. Assume u ∈ D ⊥ , by appending nn zeros to u, then the new codeword (u, 0 n-n ) is also a codeword of D ⊥ . Therefore we have d ⊥ D ≤ d ⊥ D [START_REF] Carlet | Construction of some codes suitable for both side channel and fault injection attacks[END_REF].

Interestingly, Lemma 6.1 implies that given a fixed t, adding more shares in an (n, t)-SSS based masking cannot increase the security order of the corresponding masking scheme and can be more likely to lower the security order, especially under the bit-probing model.

Representing Linear Codes in Subfield F 2

We take F 2 as the subfield, then any codes over F 2 can be expanded into subfields by code expansion Def. 3.6. We further investigate the properties of codes D and D .

REDUNDANCY IN CODE-BASED MASKING

Let D 2 and D 2 denote the expanded codes of D and D over F 2 , respectively. Since they are not MDS codes at the bit level, there is no straightforward method to compare the dual distances of D 2 and D 2 . However, by Lemma 6.1, it is obvious to have

d ⊥ D2 ≤ d ⊥ D 2
. This connection helps in SSS-based masking since, by increasing n, the dual distance at word-level keeps the same, but the dual distance at bit-level cannot be larger than in the case with n = t + 1. Moreover, from the adversary's viewpoint, combining more than t + 1 shares may be more efficient when attacking a specific SSS-based implementation.

From the quantitative results in Sec. 5.4, two parameters that have an impact on the sidechannel resistance of GCM is the dual distance d ⊥ D2 and the coefficient

B d ⊥ D 2
. Hereafter, we use the information-theoretic metric to show how the more redundant shares affect the concrete security level in SSS-based masking.

More Redundancy in Sharing Leaks More

We present an information-theoretic evaluation on (3, 1)-SSS based polynomial masking. Taking n = 3 and t = 1, then the three public points (α 1 , α 2 , α 3 ) can be derived by setting α 1 = α i , α 2 = α j and α j = α k , where i, j, k must be distinct integers. Due to the equivalence of the linear codes (Sec. 3.1), we can choose i = 0, 1 ≤ j < k ≤ 254 and obtain 32131 candidates rather than 255 3 = 2731135 in total. Recall that the generator matrices G and H are as in Eqn. 5.20. Therefore, taking a random mask u 1 , the X is encoded into: . The specific properties of the codes are listed in Tab. 6.11 and the MI between the leakages L and X are depicted in Fig. 5.3. The complete details of all linear codes for the (3, 1)-SSS based masking are available in [START_REF] Cheng | Open-source: Quantifying Information Leakages in GCM[END_REF].

Z = (Z 1 , Z 2 , Z 3 ) = XG + u 1 H = (X + u 1 α 1 , X + u 1 α 2 , X + u 1 α 3 ) . ( 6

Enhancing the SSS-based Polynomial Masking

Table 6.1: Exhibiting different codes in (3, 1)-SSS scheme generated by Eqn. 6.3. Note that we take α1 = α i = 1, α2 = α j and α3 = α k . As shown in Tab. 6.1, for the first time, we exhibit an approach to find the optimal codes for SSS-based masking and present optimal codes for (3, 1)-SSS based masking. Specifically, the code with α 1 = 1, α 2 = α 72 and α 3 = α 80 (in the last column of Tab. 6.1) is one of the best candidates for (3, 1)-SSS based masking. In addition, the generator matrices of all three optimal (nonequivalent) codes are shown in Appendix B.2. It is worth noting that the codes obtained by permuting the order of α i for 1 ≤ i ≤ 3 are equivalent, resulting in only three optimal codes for (3, 1)-SSS based masking over F 2 8 .

Using the same settings of (3, 1)-SSS based masking as in Sec. 5.6, the results of MI on the information leakages of 3-share and corresponding 2-share combinations are shown in Fig. 6.1.

In each of four cases, the main takeaway point is that given a specific t in (n, t)-SSS based masking, all the more shares leak more key-dependent information. Specifically, we first highlight that the smallest security order determines the side-channel security of SSS-based masking among all n t+1 combinations. In the context of coding theory, the dual distance of n-share SSS-based masking is determined by the minimum value of dual distances in truncated codes D . Two instances are in Fig. 6 the dual distances of D are 2 and 4, respectively. Interestingly, a recent work [START_REF] Costes | Redundant code-based masking revisited[END_REF] provides empirical comparisons on some instances of (2, 1)-SSS and (3, 1)-SSS based masking, which confirms our information-theoretic evaluation. In summary, the information-theoretic evaluations in Fig. 6.1 confirms that more redundancy in sharing of GCM would leak more information. Besides, one way to find optimal codes for GCM is to build up from (sub-)optimal choices of the codes with less shares.

REDUNDANCY IN CODE-BASED MASKING

(a) α i , α j , α k = 1, α, α 2 .

Different Codes for (3, 1)-SSS and (5, 2)-SSS based Masking

We present further results for both (3, 1)-SSS and (5, 2)-SSS based masking schemes which are supplementary to Tab. 6.1.

Note that in Tab. 6.3 we fix both α 1 and α 2 since there are too many candidates for enumeration (more accurately, 255

Revisiting the Independence Condition

Revisiting the Independence Condition

Failing to ensure the independence of the shares can ruin a masking scheme by revealing a lower order of key-dependent leakages than the designed security order. For instance, the unintentional

REDUNDANCY IN CODE-BASED MASKING

physical coupling [8] in the hardware device can combine leakages from different shares, hence degrade the concrete security level of a masked implementation. In this section, we investigate the intra-share independence issue and show the theoretical condition of higher-order security of code-based masking, especially in GCM as it is the most general case.

Another reason why the independence condition might be broken is the existence of glitches.

Let us reason on a canonical example, namely that of the exclusive-or (XOR) gate. Let Z 1 and Z 2 be two single-bit shares, which enter an XOR gate. Recall that the leakage function is P = ϕ P • φ P as introduced in Sec. 5.4. Taking φ P = 1, then the leakage function is the pseudo-Boolean function ϕ P , which lives in

F 2 × F 2 → R.
It is equal to:

ϕ P (Z 1 , Z 2 ) = Z 1 × Z 2 + (1 -Z 1 ) × (1 -Z 2 ) = 2Z 1 × Z 2 -Z 1 -Z 2 + 1. (6.4)
This function can glitch because of the term Z 1 × Z 2 . Indeed, if Z 1 changes, then the leading term still depends on Z 2 (derivative). Therefore, glitches are dreadful since they consist in combinations from within the chip, even before the measurement noise arrives.

An Information-Theoretic Evaluation of Intra-Share Independence. We consider the Hamming weight as leakage model in a perfect independent case and take the weighted square of Hamming weight as second-order (non-linear) leakages as follows:

φ P (Z i ) = j=1 Z i,j + w j =k Z i,j Z i,k = w H (Z i ) + w j =k Z i,j Z i,k (6.5)
where Z i is an -bit share and w is the weight of second-order leakages. As a consequence, The first observation from Fig. 6.2 is that MI increases along with the increasing amount of second-order leakages. More importantly, in the presence of second-order leakages, the security order under the bit-probing model [START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF] (indicated by the slope of MI curves when the noise level is high) decreases by one since the degree of φ P is 2. Similarly, the security order will 6.4 Related Works The intra-share independence issue: the existence of higher-order leakages decreases the security of the corresponding masking scheme (two public parameters are α1 = α i , α2 = α j as in Tab. 5.1). Note that the blue curves are for the Boolean masking.

P (Z) = φ P (Z)
reduce by two when the degree of φ P equals 3 in the red curves of Fig. 6.2(b). However, the lowest security order under the bit-probing model is bounded by the Boolean masking under the word-probing model. More precisely, increasing the degree of φ P only affects the intra-share independence and therefore decreases the security order under the bit-probing model, while the degree of ϕ P (e.g., induced by couplings) affects the security order under the word-probing model.

Related Works

Differences with [37] in Detail

As summarized in Sec. 5.2, this work tackles GCM, which is a more general masking scheme than the one studied in [37]. In fact, we utilize the same notion of the numerical degree and a similar coding-theoretic approach as in [37], and also the same leakage assessment metrics like SNR and MI. However, generalizing [37] to this work is not trivial at all, we show hereafter the technical differences from [37].

We first highlight the different constructions of the generator matrices G and H in Tab. 5.1

for the codes C and D, respectively. Indeed, C and D are not complementary in GCM, while they are complementary in IPM. In this respect, we show that Eqn. 5.7 is simplified as Eqn. 5.8

when C and D are complementary, thus we recover the main results in [37] (see Remark 5.3). As

REDUNDANCY IN CODE-BASED MASKING

a special case, the framework proposed in [37] is applicable when C and D are complementary, e.g., when n = t + 1 in SSS-based masking.

Moreover, we prove that GCM requires introducing a more general parameter B d (see Def. 5.2), which is a novel parameter for linear codes. Particularly, in [37] the parameter B d only depends on D. While B d depends on both C and D, which indicates the importance of selecting appropriate candidates for both of them in practice. We also provide efficient magma scripts to evaluate this quantity [START_REF] Cheng | Open-source: Quantifying Information Leakages in GCM[END_REF].

Finally, we insist that the generalization in this work is a significant improvement that works for all GCMs. Since firstly, we show in Remark 5.4 that the security order can be greater than the dual distance minus one in GCM, which cannot be explained by the framework in [37], but can be explained perfectly by this work in a quantitative manner. Secondly, the redundancies in GCM allow detecting faults (e.g., for glitch-free designs [START_REF] Prouff | Higher-Order Glitches Free Implementation of the AES Using Secure Multi-party Computation Protocols[END_REF]), which is currently an active research topic. We leave open the question on the construction of coding-theoretic countermeasures against both side-channel and fault injection attacks for future investigation.

Connections with [51]

The SSS-based masking is also the topic of a recent work [START_REF] Costes | Redundant code-based masking revisited[END_REF], in which Costes et al. showed that the Boolean masking is a special case of SSS-based masking when n ≤ 6. More interestingly, their simulation-based multivariate attacks [START_REF] Bruneau | Masks Will Fall Off -Higher-Order Optimal Distinguishers[END_REF] confirm our mathematical derivations, in particular, the information-theoretic evaluation in Fig. 6.1.

More generally, this work provides a unified framework for quantifying information leakage of all GCM instances. As a straightforward application, Theorems 5.2 and 5.3 in this chapter enable us to explain the empirical observations in practical attacks. For instance, the three codes for (3, 1)-SSS in Fig. 3

Efficient Implementations of GCM

In this chapter, we optimize security without touching the performances of GCM (there is no tradeoff between security and performance). Our coding-theoretic approach shows that both SNR and MI security metrics concur that dual distance and adjusted coefficient in weight In terms of performances, they are the same (with respect to memory and speed) as the generic GCM. A more detailed study could consist in attempting to represent the generator matrices G and H as compactly as possible (with as many zeros and ones in coefficients as possible, or with a specific structure, say "cyclic" for instance). Besides, Wang et al. [START_REF] Wang | Efficient and Private Computations with Code-Based Masking[END_REF] showed a complementary way to improve the overall performance of GCM implementations by an amortization technique. Both approaches would ease an efficient implementation of GCM, leaving an open problem for future study.

Further Application to Low Entropy Masking Schemes

Compared with the high cost of masking schemes, lower entropy masking scheme (LEMS) [START_REF] Grosso | Low Entropy Masking Schemes, Revisited[END_REF][START_REF] Nassar | RSM: A small and fast countermeasure for AES, secure against 1st and 2nd-order zero-offset SCAs[END_REF][START_REF] Ye | On the Vulnerability of Low Entropy Masking Schemes[END_REF] provides a practical approach to reduce both randomness and implementation costs by only taking a small set of random masks. As a specific example, rotating S-Box masking (RSM) [START_REF] Bhasin | Analysis and improvements of the DPA contest v4 implementation[END_REF][START_REF] Cheng | How Far Can We Reach? Breaking RSM-Masked AES-128 Implementation Using Only One Trace[END_REF][START_REF] Ming | Mind the balance: Revealing the vulnerabilities in low entropy masking schemes[END_REF][START_REF] Nassar | RSM: A small and fast countermeasure for AES, secure against 1st and 2nd-order zero-offset SCAs[END_REF] takes only 16 random masks which are elaborately chosen to achieve maximal protection. RSM is also the core protection used in DPA Contest v4.1 & v4.2 [START_REF] Abe | DPA Contest[END_REF] for masked AES implementations.

In fact, RSM shall be represented in the form of code-based masking. Specifically, the two codes C and D in RSM are complementary. Let X ∈ F 8 2 be the sensitive variable, then

Z = (X + Y H, Y ) (6.6)
be the encoding in RSM [START_REF] Bhasin | Analysis and improvements of the DPA contest v4 implementation[END_REF] where Z ∈ F 12 2 be the encoded variable, Y ∈ F 4 2 is the mask and H is a 4 × 8 matrix with coefficients in F 2 . Indeed, C is spawn by the 8 × 12 matrix G = (I 8 , 0) and D is spawn by the 4 × 12 matrix H = (H, I 4 ) where H ∈ F 4×8 2 is the generator matrix of the code [8,4,4] (which is known to be optimal and unique [START_REF] Carlet | Statistical properties of side-channel and fault injection attacks using coding theory[END_REF]). Therefore, we have

G = (I 8 0 8×4 ), H = (H I 4 ) =     1 0 0 0 1 1 1 0 1 0 0 0 0 1 0 0 1 1 0 1 0 1 0 0 0 0 1 0 1 0 1 1 0 0 1 0 0 0 0 1 0 1 1 1 0 0 0 1     . (6.7)
As a consequence, the dual distance of D is d ⊥ D = 2. Indeed, the dual code D ⊥ has parameters [START_REF] Bhasin | Analysis and improvements of the DPA contest v4 implementation[END_REF]8,2] and its weight distribution is: [(0, 1), (2,4), (4,[START_REF] Fumaroli | Affine Masking against Higher-Order Side Channel Analysis[END_REF], (6,[START_REF] Micali | Physically observable cryptography (extended abstract)[END_REF], (8,[START_REF] Fano | Class notes for transmission of information[END_REF], (10,8)]. Accordingly,

REDUNDANCY IN CODE-BASED MASKING

the security order of RSM with this [8,4,4] code can only achieve a second-order side-channel resistance (under bit-probing model).

However, the above choice of the code D [START_REF] Bhasin | Analysis and improvements of the DPA contest v4 implementation[END_REF] is not optimal in the sense of d ⊥ D . For instance, it can be improved by using the optimal code [START_REF] Bhasin | Analysis and improvements of the DPA contest v4 implementation[END_REF]4,6] and its dual code has parameters [START_REF] Bhasin | Analysis and improvements of the DPA contest v4 implementation[END_REF]8,3].

The generator matrix of D is then as:

H = (H I 4 ) =     0 1 1 0 1 1 1 0 1 0 0 0 1 0 1 0 1 1 0 1 0 1 0 0 1 1 1 1 1 0 1 1 0 0 1 0 0 0 1 1 0 1 1 1 0 0 0 1     . (6.8)
Note that the coordinates of H is permuted to have a systematic view. Accordingly, the weight distribution of the dual code D ⊥ is: [(0, 1), (3,[START_REF] Brier | Correlation power analysis with a leakage model[END_REF], (4,[START_REF] Cheng | Optimal Linear Codes for IPM[END_REF], (5,[START_REF] Coron | Conversion of security proofs from one leakage model to another: A new issue[END_REF], (6,[START_REF] Coron | Conversion of security proofs from one leakage model to another: A new issue[END_REF], (7,[START_REF] Coron | Conversion of security proofs from one leakage model to another: A new issue[END_REF], (8,[START_REF] Cheng | Optimal Linear Codes for IPM[END_REF], (9,[START_REF] Brier | Correlation power analysis with a leakage model[END_REF], [START_REF] Bhasin | Analysis and improvements of the DPA contest v4 implementation[END_REF]1)],

which achieves a third-order side-channel resistance.

Conclusions and Perspectives

In this chapter, we investigate the side-channel resistance of redundant code-based masking and applications of our theoretical derivatives in SSS-based masking. In particular, we highlight the impact of the adjusted kissing number B d ⊥ D that depends on both codes C and D. As applications, we present optimal codes for (3, 1)-SSS based masking as a first-order protection, and (5, 2)-SSS based masking as a second-order protection, respectively (over both F 2 4 and F 2 8 ).

However, the construction of optimal codes for a large number of shares is still an open problem. We launched an exhaustive study on (3, 1)-SSS based masking and presented some results on (5,2)-SSS in [START_REF] Cheng | Open-source: Quantifying Information Leakages in GCM[END_REF]. But the exhaustive enumeration would be computationally infeasible when n gets larger (e.g., n > 8) in SSS-based masking or, more generally, in GCM. A heuristic solution is to construct new (sub-) optimal codes by concatenating two optimal or sub-optimal codes, following a gradient descent idea. Alternatively, constructing the (sub-)optimal codes by an algebraic approach under certain constraints is a promising solution. We will explore both solutions for GCM in the future.

OPTIMAL ATTACKS IN THE PRESENCE OF CODE-BASED MASKING

Introduction

Side-channel analyses (SCAs) are among the most powerful attacks against cryptographic implementations. Since the seminal works [START_REF] Paul | Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems[END_REF][START_REF] Paul | Differential power analysis[END_REF], a very large amount of SCAs have been proposed by exploiting various observable physical leakages in practice, like power consumption [START_REF] Clavier | Differential Power Analysis in the Presence of Hardware Countermeasures[END_REF][START_REF] Paul | Differential power analysis[END_REF], the electro-magnetic emanations [START_REF] Gandolfi | Electromagnetic analysis: Concrete results[END_REF][START_REF] Quisquater | ElectroMagnetic Analysis (EMA): Measures and Counter-Measures for Smard Cards[END_REF], etc. In essential, SCAs attempt to extract the sensitive information from noisy measurements containing unintended emissions or leakages, where the measurements are correlated with internal states or behaviors of a cryptographic device.

Along with a large body of attacks, numerous countermeasures have been proposed to protect practical implementations against SCAs. Relying on different strategies and principles, two major lines of countermeasures are hiding and masking [START_REF] Mangard | Power Analysis Attacks: Revealing the Secrets of Smart Cards[END_REF]. Specifically, the hiding approach attempts to balance the leakage of different key-dependent operations or data, resulting in less informative signals in side-channel measurements [START_REF] Chen | Dual-Rail Random Switching Logic: A Countermeasure to Reduce Side Channel Leakage[END_REF][START_REF] Tiri | A Logic Level Design Methodology for a Secure DPA Resistant ASIC or FPGA Implementation[END_REF]. In contrast, the masking approach randomizes the internal states by splitting internal sensitive variables into several shares, which breaks the straightforward connection between the sensitive variables and the measurements. In particular, the latter is more preferable since it is featured with the provable security rather than engineering intuitions of designers. However, protecting cryptographic implementations against SCAs is usually not trivial and expensive in the sense of implementation cost [START_REF] Blömer | Provably Secure Masking of AES[END_REF][START_REF] Chari | Towards Sound Approaches to Counteract Power-Analysis Attacks[END_REF][START_REF] Grosso | Masking vs. Multiparty Computation: How Large Is the Gap for AES?[END_REF][START_REF] Prouff | Masking against Side-Channel Attacks: A Formal Security Proof[END_REF]. Furthermore, many proposals of protection are devised under abstract assumptions like independence assumption [7,[START_REF] Mangard | Successfully Attacking Masked AES Hardware Implementations[END_REF], sufficiently noisy condition [START_REF] Chari | Towards Sound Approaches to Counteract Power-Analysis Attacks[END_REF][START_REF] Prouff | Masking against Side-Channel Attacks: A Formal Security Proof[END_REF], etc., which are not always fulfilled in real scenarios [5,[START_REF] Coron | Conversion of security proofs from one leakage model to another: A new issue[END_REF].

Therefore, the evaluation of side-channel security of an implementation, especially in the presence of protection, plays a significant role in understanding its concrete security level and verifying the correctness and effectiveness of certain protections. In the following, we focus on the evaluation of masked implementations.

Evaluation of Side-Channel Security

According to different leakage models and the abstraction level of cryptographic implementations, evaluation tools are classified into four categories.

Firstly, the conformance-based leakage detection utilizes conformance testing to check whether there are significant differences in side-channel measurements of different key-dependent variables and/or operations [START_REF] Cooper | Test Vector Leakage Assessment (TVLA) Methodology in Practice[END_REF][START_REF] Mather | Does my device leak information? an a priori statistical power analysis of leakage detection tests[END_REF][START_REF] Moradi | Leakage Detection with the χ 2 -Test[END_REF][START_REF] Schneider | Leakage assessment methodology -A clear roadmap for side-channel evaluations[END_REF][START_REF] Standaert | How (not) to use welch's t-test in side-channel security evaluations[END_REF]. It is intended to answer the following question at a high abstraction level: does the device under test leak side-channel information? Those 7.1 Introduction statistical tools include Welch's t-test, χ 2 -test, etc. However, the conformance-based leakage detection only provides qualitative result, which is usually independent of the exploitation of the leakages, e.g., to launch a successful key-recovery attack. Furthermore, it might be difficult to interpret the detection result when the conformance testing gives a negative answer indicating no significant leakage. Therefore, other evaluations are necessary to further verify the leakage.

Secondly, the proof-based evaluation intends to prove the side-channel resistance of a masked design under abstract models like the probing model [86] and related variants [START_REF] Duc | Unifying Leakage Models: From Probing Attacks to Noisy Leakage[END_REF][START_REF] Dziembowski | Noisy leakage revisited[END_REF][START_REF] Prest | Unifying leakage models on a rényi day[END_REF][START_REF] Prouff | Masking against Side-Channel Attacks: A Formal Security Proof[END_REF].

Typically, under independence assumption and noise condition, several leakage models are equivalent with certain forms of constants [START_REF] Prest | Unifying leakage models on a rényi day[END_REF] by providing formal security guarantees of the masked implementation. However, physical defaults like couplings, glitches, etc. usually contradict assumptions behind the probing model [5,[START_REF] Mangard | Successfully Attacking Masked AES Hardware Implementations[END_REF]. As a consequence, it is recommended to launch the attacked-based quantitative evaluation.

Thirdly, the information-theoretic evaluation aims at measuring side-channel leakages by utilizing information-theoretic measures [START_REF] Standaert | A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks[END_REF][START_REF] Whitnall | A Comprehensive Evaluation of Mutual Information Analysis Using a Fair Evaluation Framework[END_REF]. The frequently used measures include Shannon mutual information, Kullback-Leibler divergence, conditional entropy, etc. In fact, this category of evaluation measures the full distribution of leakages and provides insights on how much information an adversary can obtain. In essential, it usually provides information-theoretic bounds on the probability of success for any side-channel distinguishers given a set side-channel measurements [41,[START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF]. It is worth mentioning that not all distribution-based leakages can not be exploited by side-channel distinguishers. For instance, correlation power analysis is a typical non-profiling attack and it exploits only a few orders of moments of side-channel leakage.

However, one of the major difficulties of using information-theoretic evaluation is how to estimate the leakage distribution accurately when the number of measurements is not sufficiently enough.

Finally, the attack-based evaluation is at the core of side-channel security evaluation, which aims at assessing the probability of success of a specific side-channel distinguisher. Relying on large variety of side-channel distinguishers like correlation power analysis [START_REF] Brier | Correlation power analysis with a leakage model[END_REF][START_REF] Hanley | Correlation Power Analysis of Large Word Sizes[END_REF], mutual information analysis [START_REF] Éloi De Chérisey | On the optimality and practicability of mutual information analysis in some scenarios[END_REF][START_REF] Gierlichs | Mutual information analysis[END_REF][START_REF] Veyrat-Charvillon | Mutual Information Analysis: How, When and Why?[END_REF], template attacks [START_REF] Chari | Template attacks[END_REF][START_REF] Oswald | Template Attacks on Masking -Resistance Is Futile[END_REF], stochastic attacks [START_REF] Gierlichs | Templates vs. Stochastic Methods[END_REF][START_REF] Schindler | A Stochastic Model for Differential Side Channel Cryptanalysis[END_REF], higherorder optimal distinguisher [START_REF] Bruneau | Masks Will Fall Off -Higher-Order Optimal Distinguishers[END_REF]84], etc, the attack-based evaluation provides more accurate assessment of leakage, which captures device-specific features of side-channel leakage. However, it is infeasible to exhaust all distinguishers to launch attack-based evaluation provided a limited resources and time.

Summing up, the conformance-based leakage detection only provides qualitative assessment of side-channel security while other three evaluations give different levels of quantitative assessment.

OPTIMAL ATTACKS IN THE PRESENCE OF CODE-BASED MASKING

To a large extent, four evaluation approaches are complementary to each other in practical application, varying with different evaluation requirements and necessary expertise on launching evaluations.

In this chapter, we complete the evaluation of side-channel resistance of masked implementations protected by the code-based masking, which is complementary to information-theoretic evaluation in Chap. 4 and 5 for IPM and GCM, respectively.

Metrics in Attack-based Evaluation

Considering a key-recovery attack in SCA, the ultimate metric is the success rate indicating the probability of an adversary can succeed in recovering the secret key [START_REF] Standaert | A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks[END_REF] 1 . In particular, two interrelated problems in attack-based evaluation are, on one hand, how many side-channel measurements are needed for a successful attack? Or on the other hand, what is the probability of success given a certain number of measurements? Therefore, it is preferable to show how the success rate evolve when the number of measurements increases. Moreover, another attack metric is the guessing entropy (GE) [START_REF] Standaert | A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks[END_REF], which measures the average rank of the correct key among all candidates based on distinguishing scores after an attack. GE is complementary to success rate as it indicates how wrongly guessed keys behave before a successful attack, and it converges to 1 when the success rate goes to 100% stably. Therefore, we use both success rate and guessing entropy in evaluating the exploitability of information leakages in the code-based masking.

Contributions

We complete the evaluation of side-channel resistance of code-based masking by attacking results.

In particular, our contributions are as follows.

HOOD-based Evaluation of GCM. We provide an extensive evaluation on the side-channel resistance of the generalized code-based masking. The attacks are based on the higher-order optimal distinguisher as it is the best attack strategy following the Maximum-Likelihood principle.

We investigate both IPM and SSS-based masking, since they are representatives of non-redundant and redundant masking schemes, respectively. We highlight that the side-channel resistance 1 There are different order of success rates when considering an adversary can launch key enumeration [START_REF] Poussier | Simple key enumeration (and rank estimation) using histograms: An integrated approach[END_REF][START_REF] Veyrat-Charvillon | An Optimal Key Enumeration Algorithm and Its Application to Side-Channel Attacks[END_REF] as a post-processing technique after side-channel attacks. However, we focus on the first-order success rate by convention as it is more straightforward.

Side-channel Distinguishers

of GCM is highly related to coding-theoretic properties wherein the dual distance and the adjusted kissing number are good indicators as we show in Chap. 5 from an information-theoretic perspective. Therefore, we verify our framework on quantifying the information leakage in GCM by HOOD-based attacks.

Redundancy in Code-based Masking Decreases Side-Channel Resistance. We leverage on both information-theoretic and attack-based evaluations to illustrate that the redundancy in sharing can only decrease the side-channel resistance of the corresponding masking schemes.

Compared to the state-of-the-arts, our HOOD-based results challenge the evaluation launched in [START_REF] Chabanne | Linear repairing codes and side-channel attacks[END_REF], but are in accordance with the ones in [START_REF] Costes | Redundant code-based masking revisited[END_REF]. In particular, the authors showed in [START_REF] Chabanne | Linear repairing codes and side-channel attacks[END_REF] that exploiting leakages from more shares does not always lead to more efficient attacks, whereas we show the improvements using leakages from more shares. Moreover, compared to [START_REF] Costes | Redundant code-based masking revisited[END_REF], we extend the state-of-the-art in two directions: 1) we show the best cases of the linear codes, that are recommended to use, and 2) we give the worst cases of the linear codes that are not recommend for practical applications.

Challenges on Practical Use of Probing Model. Consider an (n, t)-sharing in redundant code-based masking, e.g., in (n, t)-SSS based masking, a sensitive variable is split into n shares while any t + 1 shares among n are need to recover the sensitive. As a consequence of redundancy in sharing, increasing n can only decrease the concrete side-channel security given a fixed t. However, different sharings with the same t possess the same side-channel security order under the probing model. Therefore, only preserving security orders in proof-based evaluation of redundant code-based masking is not sufficient: it always has to be completed with the information-theoretic or attack-based evaluations. To verify this, we consider (2, 1) and (3, 1)-SSS based masking, and show that exploiting leakages from all three shares always leads to more efficient attacks than using two shares.

Side-channel Distinguishers

We first recall the side-channel distinguishers in unprotected scenarios (without masking, etc).

Let X ∈ K be the sensitive variable which depends on the secrets in the cryptographic implementations. For instance, the sensitive variable is usually X = S(T ⊕ K), the output of Sbox given a plaintext (or ciphertext) T and a subkey K, e.g., in AES or PRESENT, then we may use X(k) in order to indicating a specific key guess k in generating X.

OPTIMAL ATTACKS IN THE PRESENCE OF CODE-BASED MASKING

Considering simulated measurements, we adopt the common scenario in which the intermediates leak in Hamming weight model with independent additive white Gaussian noise (AWGN).

Therefore, we have L j = w H (X j ) + N j , 1 ≤ j ≤ q for q traces, where w H denotes the Hamming weight function and N j ∼ N (0, σ 2 ) is Gaussian noise with standard deviation σ. The basic setting of side-channel analysis seen as a communication channel is illustrated in Fig. 7.1.

Crypto Channel Attack X K L K T N T

Different Distinguishers

In SCA, a key-recovery attack intends to extract the secret key from q traces by exploiting certain side-channel distinguishers. In particular, a distinguisher takes maximization over all key hypothesis and gives the most possible candidate(s) by:

k = argmax k∈K ∆(k) = argmax k∈K ∆(L, X(k)). (7.1)
Formally, we define the side-channel distinguisher as follows.

Definition 7.1 (Side-Channel Distinguisher [START_REF] Sylvain Guilley | A Key to Success -Success Exponents for Side-Channel Distinguishers[END_REF]). Given a set of side-channel measurements L and known cryptographic inputs (or outputs) T , a side-channel distinguisher returns a theoretical value

∆(k) = ∆(L, X(k)) (7.2)
for any key guesses k ∈ K and the estimator ∆(k) converges to ∆(k) as q → ∞, in the sense that the mean-squared error E (∆(k) -∆(k)) 2 approaches 0 when q → ∞.

Note that we shall simplify X(k) as X by implicitly indicating the link between the sensitive variable and the key hypothesis. In view of Def. 7.1, several classic side-channel distinguishers are presented as follows:

• Difference of Means (DoM): it is the original distinguisher proposed in the seminal work [START_REF] Paul | Differential power analysis[END_REF],

known as Differential Power Analysis (DPA). Let f b (X) be the selection function which returns one specific bit of X, then we have

∆(k) = |E [L|f b (X) = 0] -E [L|f b (X) = 1]|, ∆(k) = q j=1 (1 -f b (X j ))L j q j=1 (1 -f b (X j )) - q j=1 f b (X j )L j q j=1 f b (X j ) , (7.3)

Side-channel Distinguishers

where the absolute value is always considered in maximization for each key hypothesis.

• Correlation Power Analysis (CPA) [START_REF] Brier | Correlation power analysis with a leakage model[END_REF]: in which the distinguisher value is given by computing the Pearson correlation coefficient between the side-channel traces and the hypothetical leakages:

∆(k) = |ρ(L, f (X))| = |Cov(L, f (X))| σ L σ f (X) = |E [Lf (X)] -E [L] E [f (X)]| σ L σ f (X) , ∆(k) = 1 q q j=1 L j f (X j ) -1 q q j=1 L j • 1 q q j=1 f (X j ) 1 q q j=1 (L j ) 2 -( 1 q q j=1 L j ) 2 1 q q j=1 (f (X j )) 2 -( 1 q q j=1 f (X j )) 2 , ( 7.4)
where f (•) denotes the leakage function, e.g., in the Hamming weight leakage model

f (X) = w H (X)
. The absolute value is taken for each key hypothesis.

• Mutual Information Analysis (MIA) [START_REF] Gierlichs | Mutual information analysis[END_REF][START_REF] Veyrat-Charvillon | Mutual Information Analysis: How, When and Why?[END_REF]: the mutual information is used as a metric for assessing the dependency between the side-channel traces and the hypothetical leakages in an information-theoretic sense:

∆(k) = I(L, X) = H(L) -H(L|X), ∆(k) = l x
Pr(L = l, X = x) log 2 Pr(L = l, X = x)

Pr(L = l) Pr(X = x) , (7.5)
• Maximum Likelihood (ML)-based attack [START_REF] Chari | Template attacks[END_REF]84]: when the leakage distribution is known, the optimal strategy for launching such attack is to use the maximum likelihood (ML) approach:

∆(k) = Pr(L|X(k)), ∆(k) = Pr(L, |X(k)) = p j=1 Pr(L j , |X j (k)), (7.6)
where side-channel measurements are assumed to be i.i.d. Therefore, the best key guess is made by:

k = argmax k∈K ∆(k). (7.7)
Note that the ML rule is equivalent to Maximum A Posterior (MAP) rule with equiprobable keys. It is the case as commonly assumed that K is uniformly distributed over K.

Given a side-channel distinguisher, a primary question arises: whether the attack utilizing the distinguisher will be succeed eventually? Therefore, we define the soundness of a distinguisher as follows.

OPTIMAL ATTACKS IN THE PRESENCE OF CODE-BASED MASKING

Definition 7.2 (Soundness of a Distinguisher [START_REF] Sylvain Guilley | A Key to Success -Success Exponents for Side-Channel Distinguishers[END_REF][START_REF] Standaert | A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks[END_REF]). A side-channel distinguisher ∆(k) is said to be sound if the theoretical distinguisher value is maximized at the correct key hypothesis, namely,

∆(k * ) > ∆(k) for any k = k * . (7.8)
Apparently, if a distinguisher is sound, the attack tends to succeed with success rate equal to 100% eventually given enough number of traces (e.g., when q → ∞).

Remark 7.1. For above classic distinguishers, CPA is sound [START_REF] Guilley | Improving Side-Channel Attacks by Exploiting Substitution Boxes Properties[END_REF], so as the DoM, since DoM can be seen as a special case of CPA [START_REF] Sylvain Guilley | A Key to Success -Success Exponents for Side-Channel Distinguishers[END_REF] when q → ∞. MIA is also proved to be sound under Gaussian noise [START_REF] Moradi | A Comparative Study of Mutual Information Analysis under a Gaussian Assumption[END_REF][START_REF] Prouff | Theoretical and practical aspects of mutual information-based side channel analysis[END_REF]. Moreover, ML-based distinguishers are sound by design, where the correct key guess will rank the first given enough amount of side-channel measurements.

Optimal Distinguisher in the Presence of Masking

We focus on code-based masking, which generalizes several existing masking schemes. The communication view in the presence of masking is depicted in Fig. 7.2. Let X ∈ K and Y ∈ K t be respectively the sensitive variable and t random masks. Then the sharing in GCM writes:

Z = XG + Y H ∈ K n , (7.9)
given that t + 1 ≤ n, where G and H are generator matrices of two codes C and D, respectively.

For the sake of simplicity, we concentrate on scenarios in which the sensitive variable is a scalar.

As assumed previously, the sensitive variable is X = S(T ⊕ K). Regarding the simulated measurements, we utilize the Hamming weight model with independent AWGN. For each share Z i , we have

Crypto

Masking Channel Attack K X Z L K T Y N T
L i = w H (Z i ) + N i , 1 ≤ i ≤ n for n shares and N i ∼ N (0, σ 2
) is Gaussian noise with standard deviation σ. Given a dataset of q traces, we further denote all traces as L = (L j i ) for 1 ≤ i ≤ n and 1 ≤ j ≤ q. In our scenario, as the leakage model is assumed to be known, the best strategy for performing key-recovery attacks is to utilize the ML-based approach. Following the principle of ML-based attack, the higher-order optimal distinguisher (HOOD) is known as follows.

Attacks against Non-Redundant Code-based Masking

Lemma 7.1 (Higher-Order Optimal Distinguisher [START_REF] Bruneau | Masks Will Fall Off -Higher-Order Optimal Distinguishers[END_REF]). Given a set of q measurements L = (L j i ) = f (Z j i ) + N j i for 1 ≤ i ≤ n and 1 ≤ j ≤ q such that N j i are i.i.d. across 1 ≤ j ≤ q and independent across 1 ≤ i ≤ n. When the leakage distribution is known (both the leakage function and the noise distribution), the d-th order optimal distinguisher is:

∆(k) = q j=1 y∈K t Pr(Y = y) d i=1 Pr(L j i |Z j i ), (7.10)
where the calculation of Z j i implicitly involves Y = y. Therefore, the key hypothesis is given by

k = argmax k∈K ∆(k). (7.11)
In the sequel, we focus on attack-based evaluation of the generalized code-based masking, particularly we target IPM with n = 2 and n = 3, and (3, 1)-SSS based masking.

Attacks against Non-Redundant Code-based Masking

Considering IPM as an instance of non-redundant code-based making, the generating matrices of C and D are:

G = 1 0 0 • • • 0 H =      α 1 1 0 • • • 0 α 2 0 1 • • • 0 . . . . . . . . . . . . . . . α t 0 0 • • • 1      (7.12)
where n = t + 1 and α i ∈ K\{0} for 1 ≤ i ≤ t. In particular, by taking α i = 1 for 1 ≤ i ≤ t recovers the Boolean masking. As a result, the generator matrix of D ⊥ is:

H ⊥ = (1 α 1 α 2 • • • α t )
with d ⊥ D = t + 1, indicating that IPM with n shares has a security order equal to n -1 under word-probing model [3,[START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF]. We denote α = (1, α 1 , . . . , α t ) the public parameters in IPM.

Optimal Distinguishers

Relying on Lemma 7.1, the HOOD is instantiated in the context of Hamming weight leakage with an AWGN as follows.

∆(k) = q j=1 y∈K n-1 Pr(Y = y) d i=1 Pr(L j i |z j i ) = q j=1 y∈K n-1
Pr(Y = y)

d i=1 N (L j i |w H (z j i ), σ 2 ).
(7.13)

OPTIMAL ATTACKS IN THE PRESENCE OF CODE-BASED MASKING

Since Y is uniformly distributed (Pr(Y = y) = 1 |K n-1 |
) required by a sound masking scheme, it is independent of each key hypothesis and hence has no impact on ∆(k). Taking logarithms further eases the numerical computations (avoiding float overflows), the HOOD is equivalent to the following distinguisher score [START_REF] Chabanne | Linear repairing codes and side-channel attacks[END_REF][START_REF] Costes | Redundant code-based masking revisited[END_REF]:

S(k) = q j=1 log y∈K n-1 d i=1 N (L j i |w H (z j i ), σ 2 ), (7.14)
then the key guess is determined by maximizing S(k).

Formally, thanks to masking, an adversary cannot obtain anything about the sensitive variable if the order d of a HOOD is not greater than the security order t. A prerequisite for launching a successful attack is d > t in our scenario when targeting IPM, which is consistent with coding-theoretic conditions.

IPM with n = 2

Taking n = 2 gives t = 1, resulting that only one parameter in IPM is α 1 and H = (α 1 1).

There are 255 candidates for α 1 as it cannot be zero. In order to facilitate practical applications and fair comparison with the state-of-the-art, we aim at the irreducible polynomial g(X) = X 8 + X 4 + X 3 + X + 1 that is used in AES to generate the field K = F

d ⊥ D = d |{α1}| max {B d } min {B d } d = 2 35 8 1 d = 3 146 6 1 d = 4 74 17 4
As shown in Tab. 7.2, there are only 12 optimal linear codes which maximize d ⊥ D and minimize B d ⊥ D at the same time. 1 We use eqv ≈ to denote that two linear codes with the given parameters are equivalent over F 2 or after the sub-field representation in F 2 , see [37,42] for details. optimal codes as in Fig. 7.4. The primary observation is that those four codes have similar side-channel resistance from an adversary perspective who launches HOOD-based attacks. Note that the fluctuations among those four curves are due to the nature of numerical simulation with certain random seeds. Overall, those four codes perform closely against HOOD-based attacks.

We assume that the leakage distribution is known when launching such attacks, this scenario allows a worst-case evaluation of side-channel resistance of IPM. However, this assumption is usually too radical in practice, where the leakage properties of the device is unknown and the acquisition environment might be various. Furthermore, when other distinguishers are adopted in carrying out attacks, ML-based analysis also provides an upper bound on the success rate. In summary, our worst-case evaluation provides some insights on how successful can an attack be in practice and shows how to select optimal codes when applying IPM.

The Impact of B d ⊥ D . We have showed how to select optimal codes according to both d Summing up, we demonstrate how B d ⊥ D plays a significant role in indicating the side-channel resistance of IPM. More generally, it is integrated with the dual distance as indicators in evaluating side-channel security of non-redundant code-based maskings like DSM and LS, etc.

Linear Codes for IPM with n = 3

Herein we present the classification of the linear codes of 3-share IPM. Taking n = 3, resulting that t = 2 and two free parameters in α = (1, α 1 , α 2 ) are α 1 , α 2 ∈ K\{0}. There are 255×255 = 65025 candidates, where the number of candidates can be dramatically reduced by considering the 7.5 Attacks on Redundant Code-based Masking equivalence of the linear codes [35]. Therefore, we take α 1 ≤ α 2 , which reduces the number of the codes to 32640. As shown in Tab. 7.4, there are only 3 optimal codes which maximize d ⊥ D and minimize B d ⊥ D at the same time. Since the maximized dual distance is d ⊥ D = 8, IPM with those optimal codes should be comparable with the eighth-order BM, namely n = 8 given a certain level noise. In particular, considering the security order in the bit-probing model, the former and the latter share the same security order t b = d ⊥ D -1 = 7. Therefore, it is recommended to apply IPM rather than BM with many more shares since as a rule of thumb, the implementation cost increases at least quadratically with n.

Attacks on Redundant Code-based Masking

In the sequel, we investigate the HOOD-based evaluation on the polynomial masking [77,[START_REF] Prouff | Higher-Order Glitches Free Implementation of the AES Using Secure Multi-party Computation Protocols[END_REF],

where in its central is Shamir's Secret Sharing (SSS) scheme. Taking SSS-based masking as an example of redundant code-based masking, the parameters are denoted as α = (α 1 , α 2 , . . . , α n ) and the condition for α i is that α i = α j for any i = j. Then we have the following generator matrices for the codes C and D, respectively,

G = 1 1 • • • 1 H =      α 1 1 α 1 2 • • • α 1 n α 2 1 α 2 2 • • • α 2 n . . . . . . . . . . . . α t 1 α t 2 • • • α t n      (7.15)

Attacks on Redundant Code-based Masking

Considering the same assumption on leakage distribution, we have:

∆(k) = q j=1 y∈K t Pr(Y = y) d i=1 Pr(L j i |z j i ) = q j=1 y∈K t Pr(Y = y) d i=1 N (L j i |w H (z j i ), σ 2 ). (7.16)
Taking logarithms to ease the numerical computations, the HOOD is therefore equivalent to the following distinguisher score [START_REF] Costes | Redundant code-based masking revisited[END_REF]:

S(k) = q j=1 log y∈K t d i=1 N (L j i |w H (z j i ), σ 2 ). (7.17)
Remark 7.2. Note that the distinguisher proposed in [START_REF] Chabanne | Linear repairing codes and side-channel attacks[END_REF]Eqn. 13] is problematic, which leads to suspicious conclusions. In fact, the summation within the logarithm is over y ∈ K t rather than over y ∈ K n-1 when n > t + 1, namely in redundant cases.

HOOD against (3, 1)-SSS based Masking

Considering n = 3 and t = 1, the generator matrices G and H are as follows.

G = 1 1 1 H = α 1 α 2 α 3 , (7.18)
where α i for 1 ≤ i ≤ 3 are not equal to each other. We can fix α 1 = 1 by utilizing the equivalence of the linear codes. Additionally, we set α 2 < α 3 as in [35] and resulting that there are 32131 To sum up, the optimal choices of public points in SSS-based masking can significantly improve its side-channel resistance that is much higher than 2-share BM. In particular, those optimal codes can even provide comparable security as 3-share BM.

d ⊥ D = d |{(α2, α3)}| max {B d } min {B d } d = 2 11460
Worst Codes for (3, 1)-SSS based Masking. From Tab. 7.6, there are several classes of the linear codes that are worse than 2-share BM, including the three worst cases. The evaluation results are plotted in Fig. 7.8. Interestingly, those worst codes make the SSS-based masking perform worse in full range of noise levels. To the best of our knowledge, we identify, for the first time, the worst cases of public points in SSS-based masking or more generally in the context of secret sharing schemes, when each share leaks certain noisy information. Comparing with the state-of-the-art, our coding-theoretic approach not only provides the optimal cases, but also identifies the worst cases of the public points in SSS-based masking. Both of them are instructive in designing redundant code-based masking in protecting cryptographic implementations in practice.

7.6 Comparisons: How Redundancy Matters?

Comparisons: How Redundancy Matters?

As shown in Chap. 6, the redundancy in code-based masking gives rise to more leakage from an information-theoretic sense when assessed by mutual information. However, more leakage detected by mutual information can not always be exploited by side-channel distinguishers. As a result, it is not clear how much impact can the redundancy have from an attacking perspective.

In this section, we demonstrate from an attack-based evaluation that, adding redundancy in code-based masking can only reduce the side-channel resistance of the corresponding masking scheme. To have a fair comparison, we consider two instances of (3, 1)-SSS based masking and reuse the parameters in 2-share IPM. Specifically, in (3, 1)-SSS based masking, the parameters are α = (1, α 1 , α 2 ), while any 2-out-of-3 element in α gives an instance of IPM and there are three instances in total. Then those four instance of code-based masking are evaluated by HOOD-based attacks (e.g., refer to Eqn. 7.14 and Eqn. 7.17, respectively).

The first group of comparisons is shown in Fig. 7.9, where we have α = ( Another group of comparison is presented in Fig. 7.10 with α = (1,3,[START_REF] Bringer | Orthogonal Direct Sum Masking -A Smartcard Friendly Computation Paradigm in a Code, with Builtin Protection against Side-Channel and Fault Attacks[END_REF]. It is worth noting that, both coding-theoretic parameters are different in SSS-based masking and IPM. Although

(q) BM, n=3, d=3, Bd=8 IPM, =(1,2), d=2, Bd=5 IPM, =(1,4), d=2, Bd=3 IPM, =(2, 4), d=2, Bd=5 SSS, =(1,2,4), d=2, Bd=13 BM, n=2, d=2, Bd=8

OPTIMAL ATTACKS IN THE PRESENCE OF CODE-BASED MASKING

one instance of IPM is even better than the 3-share BM, the instance of SSS-based masking gets much worse with one share of redundancy. In particular, the latter is worse than the worst one among the three instances of IPM. Overall, the attack-based evaluation results verify the impact of redundancy on the concrete security level of code-based masking. At last, we illustrate the impact of redundancy by presenting a comparison between the optimal codes in IPM and SSS-based masking. Those optimal codes are visualized in Fig. 7.11.

In particular, the four (out of twelve) optimal codes for 2-share IPM and three optimal codes for (3, 1)-SSS based masking are already shown in Fig. 7.4 and 7.7, respectively. Apparently, the redundancy can leverage an easier key-recovery attack in the sense of the necessary number of traces to succeed. Those observations made in above two groups of comparison invoke the need of a trade-off 7.7 Revisiting All Codes in the State-of-the-Art between the amount of redundancy and the concrete security level in code-based masking. From a theoretical perspective, more redundancy can lead to more leakage, which is indicated by the two coding-theoretic properties. As a consequence, it is always advantageous to adopt non-redundant masking schemes rather than redundant ones when thwarting side-channel analysis. However, considering fault injection attacks (FIA) in real scenarios, a redundant masking scheme provides a combined countermeasure against both SCA and FIA. More generally, above evaluation results pose a challenge on practical applications of the probing model when assessing the concrete security level of a protected cryptographic implementation. Specifically, given the same side-channel security order (irrespective to word-level or bit-level), adding redundancy will always facilitate the adversaries in recovering secrets, and lower the practical security in the sense of attacks. Therefore, we recommend to further assess the practical security of code-based masking by verifying both the dual distance and the kissing number in practice.

In summary, the attack-based evaluation confirms those theoretical findings in Parts II and III of this thesis. That is, we connect the dots in studying and improving code-based masking schemes. Particularly, we propose a unified framework to quantify the information leakage in code-based masking, and verify extensively by considering both IPM and SSS-based masking as instances of non-redundant and redundant code-based masking.

Revisiting All Codes in the State-of-the-Art

Regarding the state-of-the-art, various instances of code-based masking have been presented in literature, accompanied with specific linear codes (which are tuning parameters) used in them.

We therefore revisit all linear codes in the literature for a thorough comparison.

For the purpose of a fair comparison, we focus on instances of code-based masking in which the codes are generated over F 2 8 by using AES's irreducible polynomial (see Sec. 7.4.2). The results are detailed in Tab. 7.7. In particular, we present the best codes in several cases, along with the corresponding coding-theoretic properties.

The main takeaway point is that those optimal shall be used straightforwardly in practice, for instance, to protect AES implementations. We also provide instructive details for employing those codes in real circuits.

OPTIMAL ATTACKS IN THE PRESENCE OF CODE-BASED MASKING

(237, 175) (2, 1)-SSS 3, 3, 3 4 1, 1, 1 4 1, 1, 1 4 [51]
t = 2 n = 3 Non-redundant (1, 15, 233) (13, 240, 163) IPM (3, 2)-SSS 5 6 1 2 1 2 [2]
(

. Both are equivalent to BM

(1, 23, 71, 167, 235) (5, 2)-SSS 6 36 46 This work. We find only one optimal code by fixing α1 = 1 and α2 = 23

Conclusions

In this chapter, we present an attack-based evaluation on two representative instances of codebased masking, namely IPM and SSS-based masking. The higher-order optimal distinguisher is employed in evaluation. As shown in previous chapters, we highlight that various encodings have significant impacts on the side-channel analysis of the corresponding scheme. Moreover, as an ultimate metric, the success rate of empirical attacks confirm the advantages of applying optimal instances of code-based masking.

Furthermore, our attack-based evaluation completes the assessment of code-based masking in known leakage model. However, this study shall be further verified on practical measurements from real circuits.

Introduction

which has been developed in [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF]84] and adapt it to masking schemes. The overview of the framework is shown in Fig. 8.1 and notations are introduced in the following section.

Notations

In the sequel, uppercase letters (e.g. X) denote random variables where calligraphic letters (e.g., X ) are for sets, lowercase letters (e.g., x) are for realizations and bold letters are for vectors and matrices.

Therefore, as illustrated in Fig. 8.1, we have

• K ∈ F 2 denotes the secret key (typically = 8, e.g., in AES), and K is the output of a side-channel attack

• T ∈ F q 2 denotes plaintexts or ciphertexts of length q

• U is the sensitive variable, say U = S(T ⊕ K) where S denotes a cryptographic operations like the Sbox in AES

• without or with masking:

-V = U if no masking, which is the case for [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF]84] -V = (U ⊕ M, M) if considering e.g., the 1st-order Boolean masking with a random mask M ∈ F q 2 -V = UG + MH if taking the code-based masking [35] where G and H are two generator matrices used in the masking

• X = f (V) is the noiseless leakage, say X = f (V) and f = w H in co-called Hamming weight model
• Y is the noisy leakage, which models q measurements (traces) in practice, say Y = X + N

where N denotes the additive white Gaussian noise: N ∼ N (0, σI). Additionally, the channel is assumed to be memoryless.

Crypto Operations

INFORMATION-THEORETIC BOUNDS ON ATTACKS

As a consequence, assuming T is known, other variables form a Markov chain: K-U-V-X-Y -K. By Markovity, when related to single-letter quantities, we have: I(X; Y|T) ≤ qI(X; Y |T )

as in [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF]. In particular,

• in [57, §3.1], one of the bounds is given by: q ≥ cst I(X;Y |T ) . So I(X; Y |T ) comes naturally from bounds.

• in [37,Theorem 4], the leakage metric is:

I(K; Y |T ) = I(U ; Y |T ), which is implicitly connected to q [24].

Contributions

In this work, we derive security bounds for side-channel attacks in the presence of countermeasures.

First of all, instead of utilizing universal inequality-based bounds on mutual information as in [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF], we use mutual information itself and derive bounds on the success rate by applying Fano's inequality [START_REF] Cover | Elements of Information Theory[END_REF]. Secondly, we suggest to use I(U; Y|T) instead of I(X; Y|T) in masked cases, since the bounds on success rate by the former is much tighter than by the latter. At last, we furnish numerical results in a commonly used side-channel setting which confirm that, our new bound provides more accurate security guarantees in the context of masked cryptographic implementations.

Applying MIs of Different Variables

Links between Different Pairs of MIs

With notations shown in Fig. 8.1, we have following equalities and inequalities with respect to MIs given different pairs of variables in the context of side-channel analysis. Lemma 8.1. By a side-channel setting as in Fig. 8.1, one has

I(K; Y|T) = I(U; Y|T) ≤ I(V; Y|T) = I(X; Y|T). (8.1)
Proof. For I(V; Y|T) = I(X; Y|T), knowing T gives that V -X -Y forms a Markov chain and, since X = f (V) then X -V -Y also forms a Markov chain. Thus I(V; Y|T) = I(X; Y|T). Similarly, we get the first equality.

For I(U; Y|T) ≤ I(V; Y|T), it is straightforward as U -V -Y is a Markov chain. Yet the converse is not true because of the random mask M.

Applying MIs of Different Variables

As a consequence of Lemma 8.1, we only focus on two quantities I(U; Y|T) and I(X; Y|T), where intuitively, the former should give a better bound than the latter. Next, since the ML (Maximum Likelihood)-based distinguishers are optimal [84] in SCAs, we have the following lemma which works for any distinguisher. Proof. Since H(K| K) ≥ H(K| K, T) and K is independent of T, we have

I(K; K|T) = H(K|T) -H(K| K, T) = H(K) -H(K| K, T) ≥ H(K) -H(K| K) = I(K; K).
Secondly, knowing T implies that K is a deterministic function of Y following the ML rule: K = ϕ(Y, T) = argmax k p(y(k)|T = t), which proves equality.

Remark 8.1. The ML rule coincides with MAP (Maximum A Posterior) rule assuming K is uniformly distributed (to maximize its entropy), which is a common setting in SCAs.

Interestingly, we can upper bound I(K; Y|T) as follows. In practice, Lemma 8.3 reflects the fact that the total amount of information any adversary could extract cannot exceed the information carried by the secret key, while the latter is measured by the entropy H(K). This leads us to define the capacity of the side-channel as

Connecting to Capacity

C = max T-X-Y I(X; Y) -I(T; Y) = max T-X-Y I(X; Y|T), (8.5)
where the maximum is taken over all distributions of X given T such that T -X -Y is a

Markov chain. The capacity can be determined from the following lemma.

Lemma 8.5. One has

C = max X I(X; Y) (8.6)
where the maximum is taken over all channel input distributions X.

Proof. From (8.5), one has I(X; Y|T) = E T I(X; Y|T = t) and each I(X; Y|T = t) is maximized taking p(x|t) = p(x), so as to maximize I(X; Y). Since the optimal distribution does not depend on t, it also maximizes the expectation E T I(X; Y|T = t) = I(X; Y|T) and thus max T-X-Y I(X; Y|T) = max X I(X; Y).

Remark 8.2. We can consider the more general situation where the channel also depends on T.

In this case we would have C = E{C T } where C t = max X I(X; Y|T = t).

Bounding Success Rates and Capacity

Upper Bounds on Success Rates

As shown in [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF], the mutual information itself gives the tightest bound on the success rate of a side-channel attack. By combining Lemmas 8.1, 8.2 and 8.3, we have I(K; K) ≤ I(U; Y|T) ≤

H(K).

The probability of success (say success rate) in SCA is defined as:

P s = P( K = K).
Accordingly, the error rate is P e = 1 -P s . Now, we have the following upper bound on P s .

Theorem 8.1. Given a side-channel setting as in Fig. 8.1, we have

f P (P s ) ≤ I(U; Y|T), (8.7
) 1] and denotes the number of bits in K = k.

where f P (p) = H(K) -H 2 (p) -(1 -p) log(2 -1) and H 2 (p) = -p log p -(1 -p) log(1 -p), for p ∈ [2 -,
Proof. By Fano's inequality [START_REF] Cover | Elements of Information Theory[END_REF] and Lemma 8. Lemma 8.6. Given a side-channel setting in Fig. 8.1, we have

I(X; Y|T) ≤ q 2 log(1 + SNR), (8.8)
where SNR is the signal-to-noise ratio and σ 2 denotes the variation of noise.

Proof. I(X;

Y|T) ≤ q • I(X; Y |T ) = q • (H(Y |T ) -H(Y |X)) ≤ q • (H(Y ) -H(Y |X)) ≤ q • C = q 2 log(1 + SNR).
We will show in next section that this upper bound on I(X; Y|T) is very tight in the presence of a Boolean masking.

Applying into Hamming Weight Leakages with Additive Gaussian Noise

By equalities in Lemma 8.1, the only two MIs that need to be evaluated are I(X; Y|T) and I(U; Y|T) 1 . Taking notations from Fig. 8.1, we calculate both MIs in a numerical manner. We have I(X; Y|T) = H(Y|T) -H(Y|X, T),

I(U; Y|T) = H(Y|T) -H(Y|U, T), (8.9)
where H(Y|T) and H(Y|U, T) = H(Y|U) can be estimated by Monte-Carlo simulations and,

H(Y|X, T) = H(Y|X) = H(N) = q • 1 2 log 2πeσ 2 . ( 8
N C →∞ - 1 N C N C j=1 log p(y j |t j ), (8.11)
where each (t j , y j ), for 1 ≤ j ≤ N C , is drawn randomly. The estimation in (8.11) is sound based on the law of large numbers [START_REF] Cover | Elements of Information Theory[END_REF]Chap. 3] and it has been numerically verified in [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF]. Similarly, H(Y|U) can be estimated using Monte-Carlo simulation by

H(Y|U) = -1 N C N C
j=1 log p(y j |u j ).

Convergence in

Applying into Hamming Weight Leakages with Additive Gaussian Noise

In the following, we present different cases of p(y|t) of one draw in both unprotected and masked cases.

Without Masking

The unprotected case corresponds to the one considered in [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF]. Here (t j , y j ), for 1 ≤ j ≤ N C , is drawn according to this process:

• t j ∼ U(F q 2 ),
• k j ∼ U(F 2 ), and

• y j ∼ N (w H (S(t j ⊕ k j )), σ 2 I q ) ∈ R q .
We then have for one draw (t, y): The numerical results of I(X; Y|T) are shown in Fig. 8.3 with different levels of noise (σ 2 ).

p(y|t) = k p(k)p(y|t, k) = k p(k) q i=1 p(y i |t i , k) = k p(k) q i=1 1 (2πσ 2 ) 1/2 e -(y i -w H (S(t i ⊕k))) 2
Note that we take N C = 1, 000, 000 random draws in Monte-Carlo simulation. These bounds are the same as those already plotted in [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF]. Here, plotting the bounds as a function of various values of σ 2 highlights that I(X; Y|T) curves are about homothetic, in that they I(X; Y|T) depends only on q/σ 2 . Said differently, from an attacker perspective, the effort in terms of traces collection scales linearly in the noise variance (for a given value of mutual information).

With a First-order Boolean Masking

Here (t j , y j ), for 1 ≤ j ≤ N C , is drawn i.i.d. according to this process:

• t j ∼ U(F q 2 ),
• m j ∼ U(F q 2 ), • k j ∼ U(F 2 ), and

• y j ∼ N (w H (S(t j ⊕ k j ) ⊕ m j ) + w H (m j ), σ 2 I q ) ∈ R q .
Note that we consider the zero-offset leakage [START_REF] Carlet | Statistical properties of side-channel and fault injection attacks using coding theory[END_REF] where the leakages of each share are summed together (see the sum of two Hamming weights above).

We have for one draw (t, y):

p(y|t) = k p(k)p(y|t, k) = k p(k) q i=1 p(y i |t i , k) = k p(k) q i=1 mi p(m i )p(y i |t i , k, m i ) = k p(k) q i=1 mi p(m i ) e -(y i -f (t i ,k,m i )) 2 2σ 2 (2πσ 2 ) 1/2 , (8.14)
where

f (t i , k, m i ) = w H (S(t i ⊕ k) ⊕ m i ) + w H (m i )

Y|T)

Capacity-based bounds 2 = 0.50 2 = 1.50 2 = 3.00 2 = 5.00 2 = 7.00 2 = 10.00 ). This is justified by a simple scaling argument: if the number of traces for a given set of (T, U) is doubled, then the mutual information is the same as with the nominal number of traces, but with SNR doubled as well.

Bounding Success Rate in Masked Implementations

Relying on Theorem 8.1, we have a upper bound on probability of success P s , which also gives a lower bound on the minimum of q to get a specific P s . Moreover, a linear bound on q is given Comparison of the minimum number of traces qmin to reach Ps ≥ 95% predicted by our new bound, by I(X; Y|T) as in [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF] and also the baseline given by an ML attack.

Extending to Code-based Masking

We have shown the advantages of the code-based masking against side-channel attacks in previous chapters. As the information-theoretic bounds in this chapter are generic, we therefore apply those evaluations into the code-based masking.

The general communication channel framework is the same as in Fig. 8.1, except that the Boolean masking is replaced by a more general masking scheme. Specifically, we say V = UG + MH where G, H are the generator matrices of two codes C and D in code-based

INFORMATION-THEORETIC BOUNDS ON ATTACKS

masking, respectively. For the sake of simplicity, we consider IPM with n = 2, meaning that

V = UG + MH = U 1 0 + M α 1 1 = (U + α 1 M, M), (8.17)
where α 1 is the only public parameter in IPM. As a consequence, different values of α 1 lead to various linear codes in IPM. Considering the Hamming weight leakages under AWGN, the simulation setting is the same as in the Boolean masking, except that:

Bounding Mutual Information

y j ∼ N (w H (S(t j ⊕k j )⊕(α 1 m j ))+w H (m j ), σ 2 I q ) ∈ R q .
Accordingly, Eqn. 8.16 is updated by replacing f

(u i , m) by f (u i , m, α 1 ) = w H (u i ⊕ α 1 m) +
w H (m) for the zero-offset leakage: log p(y|u) = -q -q 2 log 2πσ 2 + log The bound is tight, since given an enough amount of side-channel measures (q), we should have I(U; Y|T) = H(K). Secondly, as already illustrated in Chaps. 4 and 7, different choices of the codes in IPM have distinct impact on the effectiveness of side-channel protection. We herein provide another argument such that α 1 = 23 is one of the optimal codes for 2-share IPM.

Additionally, compared with the state-of-the-art (e.g., [3,37]), we complete the analysis of IPM by I(U; Y|T) rather than I(U ; Y |T ), where the former enables concrete predication of number of traces to launch a successful attack.

Bounding the Probability of Success

In the presence of code-based masking, Fano's inequality also holds, meaning that f P (P s ) ≤ I(U; Y|T). By Theorem 8.1, the success rate P s is straightforwardly linked to I(U; Y|T). Therefore, we derive the same upper bound on P s , the best probability of success an attack can obtain given a set of q measurements. Similarly with the above setting, we can numerically verify the bound on success rate considering the Hamming weight leakage under AWGN. Those numerical results are depicted in Fig. 8.9, where the ML attack follows the maximum likelihood rule.

As shown in Fig. 8.9, first of all, the effectiveness of protection against SCA increases from α 1 = 1 (corresponds to the Boolean masking) to α 1 = 23. It can be explained by the coding-theoretic properties like the dual distance and the kissing number of the code D as IPM is non-redundant. Secondly, with the same noise level (σ 2 ), it is significantly more difficult to attack IPM with α 1 = 23 than the Boolean one. The gap is much larger along with σ 2 increases, as frequently stated in demonstrating the security of masking schemes [START_REF] Prouff | Masking against Side-Channel Attacks: A Formal Security Proof[END_REF].

In above analysis, we derive the success rate of attack given a certain fixed number of traces.

Conversely, given a certain value of P s , we are able to predict the minimum number (lower

Conclusions

We derive security bounds for side-channel attacks in the presence of countermeasures. In this respect, we leverage the seminal framework from Chérisey et al. in TCHES 2019, and extend it to the case of a protection aiming at randomizing the leakage. Interestingly, the generalization allows to improve bounds compared to Chérisey et al's. Also, we improve on the computation method for the security metric, by resorting to a powerful probabilistic information estimation based on importance sampling.

Furthermore, we verify our information-theoretic bounds in the context of code-based masking.

On the one hand, those bounds confirm again the advantages of code-based masking compared to the commonly used Boolean masking, when the former is equipped with optimal codes. On the other hand, those bounds also allow us to predict how successful can an ML-based distinguisher be: evaluated by either an upper bound on the success rate given a set of traces or a lower bound on the number of traces to succeed in recovering the secret key. In summary, our results provide quantitative bounds allowing for the theoretical (i.e., "pre-silicon") evaluation of protections applied on top of a cryptographic algorithm.

Contributions

9.1.1 Information-Theoretic Measures in Side-Channel Analysis

Mutual information has been extensively exploited in evaluating side-channel security of practical cryptographic implementations. Typically, as a theoretical tool, it can be applied as a sidechannel distinguisher [9,[START_REF] Gierlichs | Mutual information analysis[END_REF]84,[START_REF] Moradi | A Comparative Study of Mutual Information Analysis under a Gaussian Assumption[END_REF][START_REF] Veyrat-Charvillon | Mutual Information Analysis: How, When and Why?[END_REF], or a leakage evaluation tool [41,[START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF][START_REF] Standaert | A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks[END_REF]. Interestingly, from a framework of communication channel model, an optimal side-channel distinguisher is derived in [84] in the sense that it can make the best use of leakage. Later on, the same framework is explored in universally upper bounding the success rate of any attacks [41,[START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF], or conversely giving lower bounds on the number of measurements to launch a successful attack (e.g., with a success probability P s ≥ 95%).

However, there is a gap between the success rate of an optimal ML-based attack and the upper bounds given by mutual information, and the gap is even widened when other estimated bounds are adopted [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF]. We will show how the conditional α-information closes the gap and provides an exact bound on attacks in this chapter.

Contributions

In this chapter, we aim at quantifying information leakage by utilizing generalized informationtheoretic measures and provide numerical simulation results in the context of guessing the value of a discrete variable from its side-channel leakage. In this regard, we first show how conditional information-theoretic tools are applied to quantify the amount of information carried by the leakage in a Hamming weight leakage model. We present numerical results in both noiseless and noisy scenarios. The takeaway is that the conditional α-entropy brings different bounds on the information leakage when equipped with various α. In particular, the larger value of α gives a much tighter bound.

Secondly, we present a full spectrum of application α-information in side-channel analysis equipped with different α. In particular, we fully fill the gap between two worlds, namely information-theoretic measures and side-channel attacks by applying conditional α-information.

Notably, it is the first time that we are able to predict exactly the success rate of the maximumlikelihood (ML)-based attack in SCA, or conversely to predict the minimum number of traces to launch a successful key-recovery attack. Furthermore, we also prove that when α approaches positive infinity, the ML-based attack converges to conditional α-information between the leakage and the sensitive variable. Therefore, this conditional α-information will provide the best upper bound on the success rate of any attacks. We first present several definitions. Let p(x) and p(y) be the probability distributions (e.g., in discrete case) or probability density functions (e.g., in continuous case) of X and Y , respectively.

We recall the definition of Rényi entropy as follows.

Definition 9.1 (Rényi entropy [START_REF] Rényi | On measures of entropy and information[END_REF]). The α-entropy, or Rényi entropy of order α ≥ 0 is defined for 0 < α < +∞ and α = 1 as • Shannon entropy: taking α → 1 recovers H 1 (X) = E log 1 p(X) = Σ p(x) log 1 p(x) = H(X).

H α (X) = 1 1 -α log E p(X) α-1 = 1 1 -α log p(x) α . ( 9
• Min-entropy: taking α → ∞ leads to H ∞ (X) = log 1 sup p where the notation sup p denotes the ∞-norm p ∞ . In discrete case, we have H ∞ (X) = log

1 maxx p(x) .
Then defining the conditional α-entropy H α (X|Y ) implies an expectation over Y . We use in this chapter the Arimoto's conditional α-entropy as it is attributed with some good properties: Definition 9.2 (Conditional Arimoto-Rényi Entropies [1]). The conditional α-entropy or conditional Arimoto-Rényi entropy of order α ≥ 0 is defined for 0 < α < +∞ and α = 1 as

H α (X|Y ) = α 1 -α log E p(•|Y ) α = α 1 -α log y p(y) x p(x|y) α 1/α . (9.2)
Remark 9.2. Similarly, we shall recover conditional version of above entropies as follows.

• Conditional max-entropy (conditional 0-entropy): taking α → 0 gives H 0 (X|Y ) = sup y H 0 (X|Y = y) = log sup y SuppX|Y = y where the sup y is the infinity norm as above.

• Conditional Shannon entropy (conditional 1-entropy): taking α → 1 gives Shannon's conditional entropy: H 1 (X|Y ) = H(X|Y ).

• Conditional min-entropy (conditional ∞-entropy): taking α → ∞ leads to H ∞ (X|Y ) = log 1 Ey sup x p(x|y) where the sup x is the infinity norm as above.

We aim at characterizing the leakages by utilizing the (conditional) guessing entropy and

Rényi entropies [START_REF] Sason | Improved bounds on lossless source coding and guessing moments via Rényi measures[END_REF][START_REF] Van Erven | Rényi divergence and Kullback-Leibler divergence[END_REF], then build quantitative connections and upper/lower bounds between the entropies and the success rates (SR). In particular, for quantifying the information that Y brings on X, we focus on following four metrics.

• Guessing entropy

• Conditional Shannon entropy

• Conditional Arimoto-Rényi entropies (the α-entropy [START_REF] Verdú | α-mutual information[END_REF])

• Success rate (or success probability)

Assume that the discrete variable X ∈ F 2 is uniformly distributed over X with cardinality |X | = M and N = 0 in noiseless scenario, the marginal and joint distributions are:

P(X = x) = 2 -= 1 M , P(Y = y) = |f -1 (y)| M , P(X, Y ) = 1 M • 1 y=f (x) . (9.
3)

The conditional probability distributions are as follows.

P(Y |X) = 1 if y = f (x) 0 otherwise , P(X|Y ) = P(Y |X)P(X) P(Y ) = 1 |f -1 (y)| if y = f (x) 0 otherwise . (9.4)
Next, the maximum probability of success is defined as follows.

P s (X) = max x p(x). (9.5)
For any leakage function f , we have:

P s (X|Y ) = E y max x p(x|Y ) = y p(y)• 1 |f -1 (y)| = y 1 M = M M ≥ 1 M
, where M = |Y| and M = |X |. In the following, we assume that the sensitive variable X leaks the Hamming weight model, which is the well-studied leakage model in side-channel analysis. The reason is that, hardware implementations leak bits in parallel, hence the leakage is the sum of the registers state bits, that is the Hamming weight of the register contents. The schematic is shown in Fig. 9.1, where we have f = w H for Hamming weight leakages. We focus on quantifying the reduction of uncertainty of X knowing its Hamming weight leakages Y . The four metrics are then calculated as follows.

• Conditional guessing entropy.

G(X|Y ) = y P(y) x x • P(x|y) = y y 2 wx=y 1 y • x = 1 2 + 1 2 +1
2 .

(9.7)

• Conditional Shannon entropy.

H(X|Y ) = - x, y p(x, y) log p(x|y) = 2 - y y • log y . (9.8)
• Conditional Arimoto-Rényi Entropies.

H α (X|Y ) = α 1 -α log y p(y) x p(x|y) α 1 α = α α -1 -log y y 1 α . ( 9.9)
• Conditional success probability.

P s (X|Y ) = E Y max x p(x|Y ) = M M = + 1 2 . ( 9.10)
By using the upper bound from Fano's inequality [START_REF] Fano | Class notes for transmission of information[END_REF] and the lower bound H(X|Y ) ≥ ϕ * (P s (X|Y )) where

ϕ * (s) = 1 s s 1 s -1 log 1 s + 1 -1 s s 1 s -1 log 1 s , (9.11)
and

H α (X|Y ) ≥ α 1-α log φ * α (P s (X|Y )), where φ * α (s) = 1 s s -1 1 s 1/α + 1 - 1 s 1 s s -1 1 s 1-α α (9.

TOWARDS EXACT ASSESSMENT OF SIDE-CHANNEL LEAKAGE

mimic the effect of many random processes.

We assume that N = ϕ(z) ∼ N (0, σ 2 ) and ϕ(z) = 1 √ 2πσ 2 e -z 2 2σ 2 which is a nonincreasing function of |z|. Then, we have:

P(X = x) = 1 M , P(Y = y) = x p(x) • p(y|x) = 1 M x ϕ(y -f (x)), P(y|x) = ϕ(y -f (x)) , P(x|y) = p(y|x)p(x) p(y) = ϕ(y -f (x))
x ϕ(yf (x ))

.

(9.13)

In addition, the maximum conditional probability of success is computed as follows.

P s = E max x p(x|Y ) = 1 M x ϕ(y -f (x )) × ϕ(min x |y -f (x)|) x ϕ(y -f (x )) dy = 1 M ϕ(min x |y -f (x)|) dy = 1 M ϕ(y -f (x * (y))) dy (where x * (y) = arg min x |y -f (x)|) = M M -2 M -1 M Q ∆/2 σ , (9.14)
where M is the cardinality of f (x) and Q(x) = 1 2 erfc x √ 2 , ∆ equals the regularly spaced distance of f (x), for instance ∆ = 1 in the Hamming weight model. Thus, we calculate the conditional Shannon and Arimoto-Rényi entropies as follows.

• Conditional Shannon entropy. Given I(X

; Y ) = H(X) -H(X|Y ) = h(Y ) -h(Y |X)
and the differential entropy of Gaussian variable Y is h(Y ) = 1 2 log(2πeσ 2 ), the conditional Shannon entropy is:

H(X|Y ) = H(X) -h(Y ) + h(Y |X) = log M + log(2πeσ 2 ) 2 -p(y) log 1 p(y) dy. (9.15)
• Conditional Arimoto-Rényi entropies.

H α (X|Y ) = α 1 -α log y p(y) x∈X p(x|y) α 1/α = α 1 -α log y p(y) x∈X p(x|y) α 1/α dy = α 1 -α log y x∈X p(x, y) α 1/α dy = α 1 -α log 1 M y x∈X ϕ(y -f (x))
(s) = 1 s s -1 1 s 1/α + 1 - 1 s 1 s s -1 1 s 1-α α , (9.18)
and it does not depend on M .

With noise level σ ∈ [0.05, 5.00], the conditional Shannon entropies with different M are as in Fig. 9.4. Specially note that for M = 4 and noise level σ = 0.05, the lower bound is 0.5, while the conditional Shannon entropy is 0.5000000000000003, which is very close but greater than the lower bound.

From the Fig. 9.4, the conditional Shannon entropy is increasing along with M , which in fact impacts the success probability P s . In the noisy scenarios, adding noise increases the difficulty of guessing, resulting in that the conditional entropy is increasing along with noise level and approaching H(X). As a result, the numerical results are consistent with theoretical analysis.

With the same setting of noise level, the conditional Arimoto-Rényi entropies with different α are plotted as in Fig. 9.5. It is interesting to show that with greater α, the upper bounds are tighter. This result is the same as in Fig. 9.3. The conditional Arimoto-Rényi entropies are increasing along with noise level σ as expected. But the shape of the conditional entropies curve changed from concave to convex, and approaching to lower bound with an increase of α.

With observations from Fig. 9.5, we recommend to use Arimoto-Rényi entropies with larger α under the Hamming weight leakages. It is worthy noting that H 1/2 is highly related to guessing entropy [START_REF] Marios | Back to massey: Impressively fast, scalable and tight security evaluation tools[END_REF], and can be utilized to estimate the bounds for key ranking in a fast and scalable way.

Good Definition of α-Information

We extend our investigation to α-information1 . It is well-known that α-information is related to α-divergence. Therefore, we first recall the definition of the latter. Explicitly, the closed-form formula for Sibson's α-information is:

I α (X; Y ) = α α -1 log y x p(x)p α (y|x) 1/α . (9.22)
Definition 9.5 (Sibson's Identity [START_REF] Sibson | Information radius[END_REF][START_REF] Verdú | α-mutual information[END_REF]). On the basis of above definition, we have Sibson's identity:

I α (X; Y ) = D α (p Y |X q Y |p X ) -D α (q * Y q Y ) (9.23)
for any probability distribution q Y , where q * Y is the minimizing probability distribution such that

I α (X; Y ) = min q Y D α (p Y |X q Y |p X ) = D α (p Y |X q * Y |p X ).
It is worth mentioning that Sibson's α-information satisfies the following basic properties [START_REF] Polyanskiy | Arimoto channel coding converse and Rényi divergence[END_REF][START_REF] Rioul | A primer on alpha-information theory with application to leakage in secrecy systems[END_REF], which are seamlessly connected to Shannon mutual information.

• Shannon mutual information: taking α → 1 recovers Shannon's mutual information:

I 1 (X; Y ) = I(X; Y ).
• Independence Characterization: I α (X; Y ) ≥ 0 with equality iff X ⊥ ⊥ Y .

Good Definition of α-Information

Definition 9.7 (Conditional α-Information, Closed-Form Definition [START_REF] Liu | On Conditional α-Information and its Application to Side-Channel Analysis[END_REF]). The α-information between random variables X and Y knowing Z is:

I α (X; Y |Z) = α α -1 log E Z E Y |Z p X|Y Z p X|Z α = α α -1 log E Y Z p X|Y Z p X|Z α . (9.26)
More explicitly, it is equivalent to:

I α (X; Y |Z) = α α -1 log p(z) p(x|z)p α (y|x, z) dµ X (x) 1 α dµ Y (y) dµ Z (z). (9.27)
To the best of our knowledge, this definition has not been considered elsewhere.

Interestingly, we have the following property for the impact of order α in conditional α-information.

Lemma 9.1. Given fixed distributions of X, Y given Z, I α (X, Y |Z) is non-decreasing in α, in particular, In the following, we present some important properties of this conditional α-information.

I 0 (X; Y |Z) ≤ I 1 (X; Y |Z) = I(X; Y |Z) ≤ I 2 (X; Y |Z) ≤ I ∞ (X; Y |Z), (9.28

Basic Properties

The conditional α-information in Def. 9.7 enjoys three important properties, namely consistency, UEP and DPI. Note that we refer the interested reader to [START_REF] Liu | On Conditional α-Information and its Application to Side-Channel Analysis[END_REF] for detailed proofs of above properties.

Property 1 (Consistency of Conditional α-Information w.r.t. α-Information [START_REF] Liu | On Conditional α-Information and its Application to Side-Channel Analysis[END_REF]). [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF][START_REF] Éloi De Chérisey | An informationtheoretic model for side-channel attacks in embedded hardware[END_REF]84]. We shall therefore expect that conditional α-information will bring some insights in practical scenarios.

If Z is independent of (X, Y ) then I α (X; Y |Z) = I α (X; Y ). Property 2 (UEP for Conditional α-Information [99]). If U ∼ U(M ) is uniformly distributed independent of Z, then I α (U ; Y |Z) = H α (U ) -H α (U |Y Z) = log M -H α (U |Y Z). ( 9

Applications in Side-channel Analysis

As we have demonstrated in previous chapters, side-channel analysis (SCA) is a very powerful attacks against cryptographic implementation. In 2009, Standaert et al. establish a connection between side-channel analysis and information theory for the first time [START_REF] Standaert | A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks[END_REF]. Then it is exploited by [84] to derive the optimal distinguisher and by [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF] to obtain generic and universal bounds on how successful an optimal distinguisher can be in context of SCA. In this section we will generalize the results of [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF] by Rényi information measures, particularly the conditional α-information, and deduce new upper bounds for the probability of success of side-channel attacks.

Side-Channel in a Communication Channel View

Recall that the secret key is denoted as K, and the plaintext or ciphertext is T , which is the input or output of the cryptographic implementation. By cryptographic operations, K and T are "encoded", and processed by some leakage function, producing a sensitive variable X.

Then X is leaked along with inherent noise N in the channel, denoted as the noisy leakage Y .

From a perspective of an adversary, she exploits Y to recover the key by certain side-channel distinguishers, resulting in K as a guess of K.

The communication channel view of side-channel analysis is shown in Fig. 9.6: In particular, we assume that, • K is uniformly distributed over

K = F 2 = {0, . . . , 2 -1}. Denote M = |K| = 2 .
• T is independent with K, which is assumed to be available, e.g., in a key-recovering attack.

• the leakage function is a deterministic function, but not necessarily known to the attacker.

Based on this model, we have the following observation.

Lemma 9.2 (Conditional Markov Chains [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF]). The communication channel we described above admits the following Markov chains when given T :

K → Y → K; K → X → Y (9.31)
Proof. When T is known, it is clear that p( k|y, k) = p( k|y) and p(y|x, k) = p(y|x).

Upper Bounding the Success of Probability for Any Attacks

Considering the communication channel framework in Fig. 9.6, we have the following lemma.

Lemma 9.3.

I α (K, Y |T ) = I α (X, Y |T ) (9.32)
Proof. Since K → X → Y is a Markov chain given T , using Eqn. 9.30 we have

I α (K, Y |T ) ≤ I α (X, Y |T ).
Conversely, when T is known, X is a deterministic function of K, which means X → K → Y also forms an Markov chain given T . Again from Eqn. 9.30, we have

I α (K, Y |T ) ≥ I α (X, Y |T ).
In order to build a connection between α-information and the probability of success, we introduce the generalized Fano's inequality as follows.

I α (X; Y ) ≥ d α P s (X|Y ) P s (X) (9.33) where d α (p q) = 1 α-1 log p α q 1-α + (1 -p) α (1 -q) 1-α (9.34)
denotes binary α-divergence.

TOWARDS EXACT ASSESSMENT OF SIDE-CHANNEL LEAKAGE

Therefore, we derive the main result as follows.

Theorem 9.1 (Generic Upper Bound on Success Rate [START_REF] Liu | On Conditional α-Information and its Application to Side-Channel Analysis[END_REF]). Given a side-channel setting as in Fig. 9.6, we have

d α (P s 1 M ) ≤ I α (K, Y |T ). (9.35)
Proof. Given Eqn. 9.32, it is enough to prove

I α (K, Y |T ) ≥ d α (P s 1
M ). Since K -Y -K forms an Markov chain given T , by DPI in Eqn. 9.30, we have

I α (K; Y |T ) ≥ I α (K; K|T ).
Using UEP in Eqn. 9.29, one has

I α (K; K|T ) = log M -H α (K| K, T ) ≥ log M -H α (K| K) = I α (K; K)
, where the inequality holds since conditioning reduces α-entropy [1,[START_REF] Fehr | On the conditional Rényi entropy[END_REF]. Then by Rioul's Fano inequality (Lemma 9.4), we have

I α (K; K) ≥ d α (P s 1 M ).
By applying binary α-divergence as in Eqn. 9.34, we have

d α (P s 1 M ) = 1 α -1 log P α s M 1-α + (1 -P s ) α ( M -1 M ) α-1 = log M M -1 + 1 α -1 log (M -1) α-1 P α s + (1 -P s ) α , where d α (P s 1
M
) is an increasing function of P s when P s ≥ 1 M , as illustrated in Fig. 9.7. Note that we have P s ≥ 1 M because if there is no leakage, e.g., when q = 0, then an adversary can only guess k randomly. Therefore, the probability of success is 1 M .

0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 ) is a monotonous function of P s , it provides a lower bound on I α (X, Y|T) by Theorem 9.1 given a specific P s . As a result, it enables us to derive a lower bound on the number of traces to achieve that success rate P s as I α (X, Y|T) ≤ qI α (X, Y |T ) where 9.5 Applications in Side-channel Analysis X = (X 1 , X 2 , . . . , X q ) and X i are i.i.d., the same with Y and T. More precisely, given a set of leakages with length q, I α (X, Y|T) involves q itself, which should be more tighter than

q ≥ dα(Ps 1 M )
Iα(X,Y |T ) . Inversely, given a fixed set of leakages with length q gives a fixed I α (X, Y|T), then Theorem In summary, Theorem 9.1 allows us to derive twined bounds in two directions, namely an upper bound on P s and a lower bound on q. In the sequel, we illustrate applications of this theorem by numerical experiments.

Maximal Information Meets ML-based Attacks

In view of Lemma 9.1, given a fixed distribution for corresponding variables, conditional αinformation is non-decreasing with respect to the order α, and ∞-information with α → ∞ is the maximal one. Considering the communication channel model shown in Fig. 9.6, we shall apply this maximal information to side-channel analysis.

Recall that in the maximum-likelihood based distinguisher in Chap. 7 (see Eqn.

TOWARDS EXACT ASSESSMENT OF SIDE-CHANNEL LEAKAGE

It is worth mentioning that ML-based distinguisher is sound by design, implying the best key guess will be the true key used in the cipher with a success rate P s given enough number of side-channel measurements. Therefore, we have the following theorem which bridges the maximum α-information to the ML-based distinguisher.

Theorem 9.2 (Exact Upper Bound on Success Rate by Maximal Information). Given a side-channel setting as in Fig. 9.6, we have

d ∞ (P s|ML 1 M ) = I ∞ (K, Y |T ) (9.37)
when I ∞ (K, Y |T ) denotes the (conditional) maximal information, and P s|ML is the success rate achieved by a maximum-likelihood based distinguisher.

Proof. By definition, we have

I α (K; Y |T ) = α α -1 log p(t) p(k|t)p α (y|k, t) dµ K (k) 1 α dµ Y (y) dµ T (t) = α α -1 log t p(t) k p(k|t)p α (y|k, t) 1 α dµ Y (y) = α α -1 log t p(t) k p(k)p α (y|k, t) 1 α dµ Y (y) = α α -1 log E Y,T k p(k)p α (y|k, t) 1 α p(y|t) = α α -1 log E Y,T k p(k)p α (y|k, t) 1 α k p(k)p(y|k, t) = log M + α α -1 log E Y,T k p α (y|k, t) 1 α k p(y|k, t) . ( 9

.38)

The equality in p(k|t) = p(k) holds since T is independent of K and p(k) = 1 M as it is uniformly distributed. Moreover, k p α (y|k, t)

1 α is the α-norm of p(y|k, t). Therefore, we obtain k p α (y|k, t)

1 α = max k {p(y|k, t)} = P s|ML when α → ∞, resulting that I ∞ (K; Y |T ) = log M + log E Y,T P s|ML k p(y|k, t) . ( 9

.39)

In other words, P s|ML is the exact success rate (e.g., evaluated by hundreds or more repetitions) given by the ML-based distinguisher. Conversely, inserting the same P s|ML and α → ∞ into d α gives equality in Eqn. 9.37.

Intuitively, Theorem 9.2 coincides with the fact that if the distinguisher is sound, then the probability of success for the correct key guess will exceed all other wrong key guesses. Indeed, the infinity norm in α-information when α → ∞ exactly fits with the ML-based distinguisher 9.6 Applications to Hamming Weight Leakage with AWGN by which it returns the most possible key guess. Still, it gives an upper bound for the success rate, implying that Theorem 9.2 leads to an exact bound achievable by using the optimal distinguishers (e.g., the ML-based one).

As we will show in the sequel, the derivatives in Eqn. 9.38 are easy to be implemented and evaluated by Monte-Carlo simulations. We shall simplify the notation P s|ML to P s when there is no ambiguity.

Remark 9.3. It is worth mentioning that Theorem 9.2 will recover the conditional maximal leakage proposed in [START_REF] Issa | An Operational Approach to Information Leakage[END_REF]Def. 6]. However, the maximum is considered not only over Pr(K = k), but also over Pr(T = t), resulting in a larger value than our α-information when α tends to infinity.

Applications to Hamming Weight Leakage with AWGN

Let K ∈ F 2 be the secret key and T ∈ F 2 be the plaintext or ciphertext, where typically = 8, e.g., in AES. Therefore, in side-channel analysis, an adversary aims to recover the secret key by exploiting several (many) side-channel measurements, say q traces. That is, considering the commonly used Hamming weight leakage model, the side-channel leakage can be generated by:

Y i = w H (S(T i ⊕ K)) + N i , (9.40)
where w H is the Hamming weight function, S denotes certain cryptographic operation within a cipher and N i are i.i.d ∼ N (0, σ 2 ) for 1 ≤ i ≤ q.

Applying the definition of I α (X, Y|T) as in Def. 9.7, we have:

I α (X, Y|T) = I α (K, Y|T) = α α -1 log t p(t) Y k p(k|t)p α (y|t, k) 1 α dµ Y (y) = α α -1 log Y t p(y, t) k p(k|t)p α (y|t, k) 1 α p(y|t) dµ Y (y) . (9.41)
Next, Eqn. 9.41 can be estimated by using Monte-Carlo simulation by the law of large numbers. Indeed, we have

exp α -1 α I α (X, Y|T) ≈ lim N C →∞ 1 N C N C j=1 k p(k|t j )p α (y j |t j , k) 1 α p(y j |t j ) = lim N C →∞ 1 N C N C j=1 k p(k)p α (y j |t j , k) 1 α k p(k)p(y j |t j , k) , (9.42)

TOWARDS EXACT ASSESSMENT OF SIDE-CHANNEL LEAKAGE

where t j ∼ U(F q 2 ) and y j ∼ N (f (t j , k j ), σ 2 I q ) ∈ R q by choosing k j ∼ U(F 2 ) and f (t j , k j ) = w H (S(t j ⊕ k j )).

Considering independent Gaussian noise in each y j , we can simplify (9.42) and insert into (9.41), therefore,

I α (X, Y|T) ≈ + α α -1 log 1 N C N C j=1 k p α (y j |t j , k) 1 α k p(y j |t j , k) = + α α -1 log 1 N C N C j=1 k e -α 2σ 2 ||y j -f (t j ,k)||2 1 α k e -1 2σ 2 ||y j -f (t j ,k)||2 , (9.43)
given a larger enough N C .

Hereafter, we depict I α (X, Y|T) with different choices of α.

Evaluation of I α (X, Y|T) with Different α

We first consider the lower level of Gaussian noise with σ 2 = 1.00 and 2.00. The results are depicted in Fig. 9.9 by using q = 50 side-channel traces in total. As the first observation, I α (X, Y|T) is non-decreasing in α, which confirms Lemma 9.1. Note that for the sake of clarity on comparison at beginning, we ignore the first point when q = 0, which gives I α (X, Y|T) = 0.

Secondly, we push forward our evaluation into scenarios with high noise levels as shown in Fig. 9.10. For instance, σ 2 = 8.00 corresponds to SNR = 0.25 in Fig. 9.10(b). Therefore, the second observation is that the gap between larger and smaller orders enlarges when the variance of noise increases. Intuitively, I α (X, Y|T) with a larger order α should be more relevant in side-channel analysis. The reason is that a larger value of α makes this measure be more sensitive to key guesses that have higher probabilities, which is exactly the case when a sound distinguisher [START_REF] Sylvain Guilley | A Key to Success -Success Exponents for Side-Channel Distinguishers[END_REF][START_REF] Standaert | A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks[END_REF] is adopted in corresponding attacks.

Bounding the Probability of Success

Relying on Theorem 9.1, we derive upper bounds on the probability of success P s . For the sake of clarity, the bounds of P s given by applying the generalized Fano's inequality is plotted in Fig. 9.11 and then the numerical results on the success rate are shown in Fig. 9.12 for different pairs of α in I α (X, Y|T).

The main takeaway from Fig. 9.12 is that, larger orders in I α (X, Y|T) enable to derive better bounds on the success rate. Specifically, taking α = 100.00 as an example, it almost pushes to the limit of supremum. However, smaller orders, e.g., taking α < 1.0, only provide loose upper bounds on P s .

Next, we compare those upper bounds given by I α (X, Y|T) with empirical success rate from ML-based attacks (using optimal distinguishers [84]). The numerical results under different noise levels are shown in Fig. 9.12 and 9.13 for q max = 50 and 200 traces, respectively. The most significant observation is that when the order is larger enough, the information-theoretic bounds provide exact upper bound on P s , or conversely, the empirical success rate of the ML-based attack will converge to the upper bound by I α (X, Y|T). Compared with the state-of-the-art bound [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF] given by Shannon mutual information I(X, Y|T), our new bounds with large orders α are significantly better in a sense of tight upper bounds. To summing up, we present the full spectrum of upper bounds when applying I α (X, Y|T)

in bounding the success rate of the optimal attacks in SCA. Particularly, we shown that a larger order of I α (X, Y|T) will give a tighter bound. When pushing to the limit, I ∞ (X, Y|T)

would lead to the best upper bound on P s , since I ∞ (X, Y|T) is increasing in α as proved in Lemma 9.1. At last, the optimality of the ML-based distinguisher indicates that there is no distinguisher better than it. In other words, the success rate of utilizing other distinguishers like CPA, DPA and MIA will not exceed that of ML-based distinguishers. As a consequence, the bound by I ∞ (X, Y|T) is truly the supremum of success rate of any attacks, which confirms our theoretical derivatives shown in Theorem 9.2.

As applications, the bound given by I ∞ (X, Y|T) bridges two worlds: the one is the information-theoretic evaluation of side-channel leakage and the other is the exploitability of those leakage. Additionally, it should also bring us a deeper understanding on the precise security level of real devices in practice.

Predicting the Minimum Number of Traces for an Attack

As another application of Theorem 9.1, we shall derive lower bounds on the number of traces q min to achieve a given success rate P s , since q is implicitly involved in I α (X, Y|T). The lower bounds on q min are shown in Fig. 9.14, where in each figure, one pair of values of order α are added for comparison. Specifically, two groups of α are: 2.00 vs 0.50 and 100.00 vs 0.01.

In particular, α = 2 corresponds to collision information (or collision entropy H 2 (X, Y|T)). Moreover, we consider α = 100.00 as a large enough order in α-information. Note than the empirical success rate given by ML-based attack is obtained by 400 repetitive experiments, while N C = 1, 000, 000 random draws are used in Monte-Carlo evaluation of I α (X, Y|T) to get a good convergence.

As expected, lower bounds given by I α (X, Y|T) with larger values of α are tighter than those with smaller values of α. In particular, the order α = 100.00 gives an almost exact prediction on the minimum number of traces to achieve P s ≥ 95%. Additionally, we shall predict that I ∞ (X, Y|T) will provide us the exact number of traces to achieve such a success rate, since the success rate of ML attack will converge to the bound given by the maximal information.

Part VI

Conclusions and Perspectives

CHAPTER 10

Conclusions and Perspectives

Conclusion

Measuring the concrete side-channel security is in the center of designing and evaluating cryptographic implementations in practice, which is still an active and dynamic research area.

This problem is all the more important for evaluating masked implementations to understand and enhance their practical security. In this thesis, we contribute to this problem in two aspects.

On the one hand, we present a unified and generic information leakage quantification framework for the code-based masking, which allows us to assess the side-channel resistance of all instances of code-based masking. On the other hand, we explore possibilities of applying more general information-theoretic tools in side-channel analysis. Next, in the third part, we investigate the exploitability of those information leakages. We consider the higher-order optimal distinguisher as it is the most powerful one based on the maximum-likelihood rule. We first verify our theoretical framework from a perspective of attack-based evaluation. The experimental results fairly confirm those theoretical findings and demonstrate the advantages of employing code-based masking in practice. Another takeaway is that redundancy can only reduce the side-channel resistance as expected, implying that a tradeoff must be considered in designing code-based masking against both side-channel analysis and fault injection attack simultaneously. Second, by utilizing traditional information-theoretic tools, we provide several theoretical bounds in attacking protected cryptographic implementations, in the presence of code-based masking.

Finally, in the fourth part, we devote ourselves to applying general information-theoretic measures for tighter universal bounds on how successful can any side-channel attack achieve. This is of special importance in understanding and defeating side-channel analysis in practice.

In this respect, we propose to utilize α-information featured with an order α and investigate several relevant properties in the context of side-channel analysis. Interestingly, with various choices of α, we obtain a full spectrum of upper bounds on the success rate of the optimal attacks (distinguishers), from the loosest one to the tightest one. In particular, we prove that the success rate of the optimal attack converges to the upper bound given by α-information, indicating that our new bounds are exactly tight. As a straightforward application, we verify our theoretical bounds in side-channel analysis by considering the common Hamming weight leakages. The simulation results exactly match with theoretical predictions.

Relying on above progresses made in this study, we put forth the evaluation tools and pave the way to measurable side-channel security, especially in the presence of protections. From a perspective of protection, we also provide the best-practice guideline for applying code-based masking in practical cryptographic chips.

Further Perspectives

In view of topics studied and some progresses made in this thesis, we shall investigate the following aspects in the future.

Further Perspectives

Efficient Construction of Optimal Linear Codes. We showed in this thesis that different linear codes have significant impact on the side-channel resistance of a specific code-based masking. Thanks to our unified leakage quantification framework, we provided use-cases for several masking schemes with lower number of shares (e.g., n ≤ 5) [35,37]. However, it is still an open problem to construct those optimal codes rather than enumerate all possible candidates exhaustively, which would be infeasible soon when n increases [START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF]. A possible approach is to construct linear codes by adding small blocks recursively in a greedy fashion. This approach can be very efficient but the output of this approach might not be the global optimum. Moreover, it will be interesting to consider algebraic codes with certain good structures as well, which we shall explore more in the near future.

Generic Construction of Masked Gadgets against Both SCA and FIA. Devising combined countermeasures against both side-channel analysis and fault injection attacks (FIA) is always a very active topic in this field. Considering the intrinsic nature of a linear code, it can detect (or correct) errors provided that the number of erroneous "digits" is smaller than the minimum distance (or half of the minimum distance) of the code. Therefore, a question arising in code-based masking is, whether it can be extended to counteract both SCA and FIA. In this respect, an interesting construction of gadgets is proposed in [START_REF] Wang | Efficient and Private Computations with Code-Based Masking[END_REF], which presents several generic and efficient gadgets against SCA, while not all of them are applicable to thwart FIA. As a consequence, our interest particularly lies in constructing generic and efficient gadgets against both SCA and FIA for future study.

Practical Applications of Code-based Masking. We have demonstrated significant benefits of utilizing code-based masking from a security perspective and also provided evidence of its efficiency when implemented in practice. Our theoretical derivatives have been verified by numerical simulation experiments. However, it still remains to be validated in real devices. In particular, it is still non-trivial to devise a secure masked implementation, considering various physical defaults (like couplings, etc) and glitches in practical circuits (chips), which usually ruin the security guarantees provided by protections. In the case of code-based masking, we shall push forward the practical evaluation by considering various settings and platforms in practice.

Moreover, it is also interesting to apply code-based masking in protecting implementations of post-quantum cryptographic schemes and algorithms. x, y∈D ⊥ ,x+y∈C ⊥ P (x) P (y) = where C, D are not necessary to be complementary codes and |C||D| = 2 t ≤ 2 n . Indeed, since C is linear, c∈C (-1) (x+y)•c is null when x + y does not belong to C ⊥ and equals the size of C if it does, and the same with D. Note that x, y ∈ D ⊥ and x + y ∈ C ⊥ which implies x + y ∈ C ⊥ ∩ D ⊥ . In summary, we have the following result for E E [P (Z)|X]

2 . This appendix provides the details about the three non-equivalent optimal codes identified by Alg. 1 and reported in the last line of Tab. 4.2.

E E [P (Z)|X]

Extension of the first optimal code from F 256 to F 2 . The generating matrix for the expanded code spanned by 1 α 8 from F 256 on the base field F 2 is:

H ⊥ 1 =            
1 0 0 0 0 0 0 0 1 0 1 1 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0 1 1 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0 1 1 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0 1 1 1 0 0 0 0 1 0 0 0 1 0 1 1 0 0 1 1 0 0 0 0 0 1 0 0 1 1 1 0 0 0 0 1 0 0 0 0 0 0 1 0 1 1 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 1 1 0 0 1 0 0

            ∈ F 8×16 2 .
Extension of the second optimal code from F 256 to F 2 . The generating matrix for the expanded code spanned by 1 α 126 from F 256 on the base field F 2 is:

H ⊥ 2 =            
1 0 0 0 0 0 0 0 1 0 1 1 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0 1 1 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0 1 1 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0 1 1 1 0 0 0 0 1 0 0 0 1 0 1 1 0 0 1 1 0 0 0 0 0 1 0 0 1 1 1 0 0 0 0 1 0 0 0 0 0 0 1 0 1 1 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 1 1 0 0 1 0 0 1 0 0 0 0 0 0 0 1 0 1 1 1 0 0 0 0 0 1 0 0 0 1 0 1 0 0 0 0 0 0 0 1 0 1 1 1 0 0 1 0 1 0 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0 1 1 1 0 1 1 1 0 1 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0 1 1 1 0 1 1 1 0 1 1 0 0 0 0 1 0 0 0 1 0 1 1 0 0 1 1 0 0 1 1 1 0 1 0 0 0 0 0 1 0 0 1 1 1 0 0 0 0 1 1 0 1 0 0 1 0 0 0 0 0 0 0 1 0 1 1 0 0 1 0 0 0 1 1 1 0 1 0 1 0 0 0 0 0 0 0 1 0 1 1 0 0 1 0 0 0 1 1 1 0 1 0 More importantly, the superiority of GCM can be fully unleashed by choosing appropriate codes. In this respect, our leakage quantitation approach is a simple, generic and effective way to choose the optimal codes for GCM. Titre : Qu'est ce que l'information permet de deviner ? Vers une quantification des fuites d'informations dans l'analyse de canaux auxiliaires Mots cl és : Analyse des canaux auxiliaires ; Contre-mesure ; Quantification des fuites ; L'informations alpha R ésum é : Les algorithmes cryptographiques jouent un r ôle pr édominant pour établir une connectivit é s écuris ée dans notre soci ét é num érique actuelle. Ces calculs traitent des informations sensibles telles que des cl és de chiffrement, qui sont g én éralement tr ès expos ées lors de la manipulation. Dans le domaine de la s écurit é des syst èmes embarqu és, l'analyse des canaux auxiliaires est l'une des techniques les plus puissantes contre les impl émentations cryptographiques. Globalement, cette th èse se compose de deux sujets. L'un est la quantification des fuites de la forme la plus g én érale de masquage équip é des codes lin éaires ; l'autre est l'exploration de l'application de mesures d'information plus g én ériques dans un contexte d'analyse de canaux auxiliaires. Pour ce qui concerne le premier sujet, nous proposons un cadre th éorique de codage unifi é pour mesurer la fuite d'informations dans le masquage bas é sur les codes. Plus pr écis ément, notre cadre établit des connexions formelles entre les propri ét és de codage et les m étriques de fuite dans l'analyse des canaux auxiliaires. Ces connexions formelles nous permettent de faire avancer l' évaluation quantitative sur la fac ¸on dont les codes lin éaires peuvent affecter la s écurit é concr ète de tous les sch émas de masquage bas és sur les codes. Concernant le deuxi ème sujet, nous proposons d'utiliser une mesure plus g én érale du point de vue de la th éorie de l'information, à savoir l'information alpha (alpha-information). Ce qui est remarquable, c'est qu'avec des choix appropri és, l'information alpha fournit des bornes tr ès proches de la r éalit é ; en particulier, lorsque alpha tend vers l'infini (positif), les limites seront exactes. En fait, les distingueurs bas és sur le maximum de vraisemblance convergeront vers les limites. En r ésum é, notre étude dans cette th èse fait avancer l' évaluation et la consolidation de la s écurit é des canaux auxiliaires des impl émentations cryptographiques. Du point de vue de la protection, nous fournissons un guide des meilleures pratiques pour l'application du masquage bas é sur le code. Du point de vue de l' évaluation, l'application de l'alphainformation permet aux évaluateurs et concepteurs (d éveloppeurs) d'avoir une estimation plus pr écise (voire exacte) du niveau de s écurit é concret des canaux auxiliaires émanant de leurs puces cryptographiques.

            ∈ F 8×16
            ∈ F 8×24
Title : What Can Information Guess ? Towards Information Leakage Quantification in Side-Channel Analysis Keywords : Side-Channel Analysis ; Code-based Masking ; Leakage Quantification ; Alpha-Information Abstract : Cryptographic algorithms are nowadays prevalent in establishing secure connectivity in our digital society. Such computations handle sensitive information like encryption keys, which are usually very exposed during manipulation. In the field of embedded systems security, side-channel analysis is one of the most powerful techniques against cryptographic implementations. Overall, this thesis consists of two topics. One is the leakage quantification of the most general form of masking equipped with the linear codes, so-called code-based masking ; the other one is exploration of applying more generic information measures in a context of side-channel analysis. Regarding the former, we propose a unified codingtheoretic framework for measuring the information leakage in code-based masking. Specifically, our framework builds formal connections between coding properties and leakage metrics in side-channel analysis. Those formal connections enable us to push forward the quantitative evaluation on how the linear codes can affect the concrete security of all codebased masking schemes.

Regarding the latter, we present a full spectrum of application of alpha-information, a generalization of mutual information, for assessing side-channel security. With proper choices, alpha-information provides very tight bounds, in particular, when alpha approaches to positive infinity, the bounds will be exact. As a matter of fact, maximum-likelihood based distinguishers will converge to the bounds when alpha approaches to positive infinity. Therefore, we demonstrate how the two world, information-theoretic measures (bounds) and maximum-likelihood based side-channel attacks, are seamlessly connected in side-channel analysis. In summary, our study in this thesis pushes forward the evaluation and consolidation of side-channel security of cryptographic implementations. From a protection perspective, we provide a best-practice guideline for the application of code-based masking. From an evaluation perspective, the application of alphainformation enables practical evaluators and designers to have a more accurate (or even exact) estimation of concrete side-channel security level of their cryptographic chips.

Institut Polytechnique de Paris 91120 Palaiseau, France

1 Introduction 3 1. 1 3 1. 2 5 1. 4 6 1. 4 . 1 6 1. 4 . 2 7 1. 5 9 1. 5 . 1 9 1. 5 . 2 10 1. 6 2 13 2. 1

 1313254641642759519521062131 Cryptography & Cybersecurity . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Root of Security & the Chain of Security . . . . . . . . . . . . . . . . . . . . 4 1.3 Side-Channel Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Protections and Code-based Masking . . . . . . . . . . . . . . . . . . . . . . . . . Masking Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Generalizing to Code-based Masking . . . . . . . . . . . . . . . . . . . . . Towards Measurable Side-Channel Security . . . . . . . . . . . . . . . . . . . . . Information Leakage Quantification . . . . . . . . . . . . . . . . . . . . . Information Leakage Exploitation by Attacks . . . . . . . . . . . . . . . . Measuring Leakage in a General Context . . . . . . . . . . . . . . . . . . . . . . . 11 Contributions Empowering Inner Product Masking by Optimal Codes . . . . . . . . . . . . . . 13 2.2 Leakage Quantification of the Code-based Masking . . . . . . . . . . . . . . . . . 14 xi LIST OF FIGURES 4.5 Numerical simulation of mutual information I(L; X) between leakages and the sensitive variable X ∈ F 2 8 of all linear codes in IPM, and a BKLC code of parameters [16, 8, 5]. The blue curve is the one with L 2 = 0 corresponding to unprotected case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6 Numerical simulation of mutual information I(L; X) between leakages and the sensitive variable X ∈ F 2 8 in IPM where all codes have d ⊥ D = 2 but different B d ⊥ D . 4.7 Numerical simulation of mutual information I(L; X) of IPM codes with d ⊥ D = 3 but different B d ⊥ D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.8 Numerical simulation of mutual information I(L; X) of IPM codes with d ⊥ D = 4 but different B d ⊥ D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.9 Comparing seven codes of IPM and one BKLC code of parameters

4. 10 2 .

 102 Connections between IPM, LS and DSM from a generalization perspective. . . . 4.11 Comparison of the impact of two irreducible polynomials (of the finite field) on the best linear codes for IPM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1 Overview of code-based masking schemes. In particular, all intersections I, II, III, and IV mean that n = t + 1 in SSS-based masking, where the two codes C and D are complementary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 Numerical calculation and approximation of I(L; X) between leakage L and the sensitive variable X in (3, 1)-SSS based masking. The three public points are α 1 = α i , α 2 = α j , α 3 = α k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3 An information-theoretic evaluation of the leakages L and the sensitive variable X in (3, 1)-SSS based masking. We choose seven codes with different values of d ⊥ D and/or B d ⊥ D . The three public points are α 1 = α i , α 2 = α j , α 3 = α k . . . . . 5.4 An information-theoretic evaluation of the leakages L and the sensitive variable X ∈ F 2 4 . Six codes are chosen with different d ⊥ D2 and/or B d ⊥ D . . . . . . . . . . 6.1 More shares leak more information, two study-cases on (3, 1)-SSS based masking,

112 7. 8 112 7. 9 114 8. 1 124 8. 3 126 8. 4 127 8. 5

 112811291141124312641275 5.1). Note that the blue curves are for the Boolean masking. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii LIST OF FIGURES 7.1 Side-channel seen as a communication channel. . . . . . . . . . . . . . . . . . . . 98 7.2 Side-channel seen as a communication channel in the presence of masking. . . . . 100 7.3 Attack-based evaluation of IPM with n = 2 shares. Taking two codes in each group with different d ⊥ D and/or B d ⊥ D . . . . . . . . . . . . . . . . . . . . . . . . . . 104 7.4 Comparison of four instances of optimal codes for 2-share IPM, according to the best coding-theoretic properties given by d ⊥ D = 4 and B d ⊥ D = 4. . . . . . . . . . . 105 7.5 Illustrating the impact of B d ⊥ D given the same d ⊥ D in 2-share IPM. . . . . . . . . . 106 7.6 Attack-based evaluation of (3, 1)-SSS based masking. Taking two codes in each group with different d ⊥ D and/or B d ⊥ D . . . . . . . . . . . . . . . . . . . . . . . . . . 111 7.7 The optimal codes for (3, 1)-SSS based masking, in which d ⊥ D is maximized and B d ⊥ D is minimized given a specific d ⊥ D = 4. . . . . . . . . . . . . . . . . . . . . . . The worst codes for (3, 1)-SSS based masking, where d ⊥ D is minimized and B d ⊥ D is maximized given a specific d ⊥ D = 2. . . . . . . . . . . . . . . . . . . . . . . . . . . Illustrating the impact of redundancy by comparing 2-share IPM with (3, 1)-SSS based masking, using α = (1, 2, 4) in the latter. . . . . . . . . . . . . . . . . . . . 113 7.10 Illustrating the impact of redundancy by comparing 2-share IPM with (3, 1)-SSS based masking, using α = (1, 3, 17) in the latter. . . . . . . . . . . . . . . . . . . 114 7.11 Illustrating the impact of redundancy by comparing 2-share IPM with (3, 1)-SSS based masking, using α = (1, 3, 17) in the latter. . . . . . . . . . . . . . . . . . . Representation of side-channel analysis of a masked cryptographic operation as a communication channel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 8.2 Monte-Carlo simulation with various N C draws where σ 2 = 10.00. . . . . . . . . Evolution of I(X; Y|T) with the number of traces under different levels of noise in the unprotected case without masking, N C = 1, 000, 000. . . . . . . . . . . . . Bounding on I(X; Y|T) by Shannon's channel capacity in masked cases, N C = 1, 000, 000. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Evolution of mutual information I(U; Y|T) with the number of traces under different levels of noise in masked cases, N C = 1, 000, 000. Note that I(U; Y|T) is upper bounded by H(K) = 8 bits. . . . . . . . . . . . . . . . . . . . . . . . . . 128 xix LIST OF FIGURES 8.6 Application and comparison of bounds on success rate. We present six instances

1 M 1 M 162 B. 1

 111621 attack. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8 Numerical results of I(U; Y|T) under different choices of α 1 in IPM. Note that α 1 = 1 corresponds to Boolean masking as shown in Fig. 8.5 for other levels of noise. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.9 Bounds on success rate P s by I(U; Y|T) under different choices of α 1 in IPM. . . 8.10 Prediction of q min achieving P s ≥ 95% under different choices of α 1 in IPM. Note that the number of traces are in log 2 scale. . . . . . . . . . . . . . . . . . . . . . 8.11 Prediction of q min achieving P s ≥ 95% under different choices of α 1 in IPM. . . . 9.1 Leakage model: the sensitive variable X and the leakage Y with some noise N . . 9.2 Conditional Shannon entropy of guessing X knowing Y . . . . . . . . . . . . . . . 9.3 Conditional Rényi entropies of guessing X knowing Y with different α. . . . . . . 9.4 Conditional Shannon entropies of guessing X knowing Y with different M , which indicating different probabilities of P s (X|Y ). . . . . . . . . . . . . . . . . . . . . 9.5 Conditional Arimoto-Rényi entropies of guessing X knowing noisy Y with different α ∈ [0.25, 0.50, 2.00, 4.00], and also different noise level. . . . . . . . . . . . . . . . 9.6 A communication channel view of side-channel analysis. . . . . . . . . . . . . . . 9.7 Illustration of d α (P s ) as a function of P s with different α, where M = 2 8 . . . 9.8 Illustration of the inverse of d α (P s ) with different α where M = 2 8 . . . . . . 9.9 Numerical comparison of Shannon mutual information I(X, Y|T) and α-information I α (X, Y|T) with different α in a side-channel analysis context, with q = 50 traces.157 9.10 Numerical comparison of Shannon mutual information I(X, Y|T) and α-information I α (X, Y|T) with different α in a side-channel analysis context, with q = 200 traces.158 9.11 Comparison of applying the Rioul's generalized Fano inequality on P s in αinformation I α (X, Y|T) with different α in a side-channel analysis context, with q = 50 traces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xx LIST OF FIGURES 9.12 Comparison of upper bounds on success rate P s given by Shannon mutual information I(X, Y|T) and α-information I α (X, Y|T) with different α in a side-channel analysis context, with q = 50 traces. . . . . . . . . . . . . . . . . . . . . . . . . . 160 9.13 Comparison of upper bounds on success rate P s given by Shannon mutual information I(X, Y|T) and α-information I α (X, Y|T) with different α in a side-channel analysis context, with q = 200 traces. . . . . . . . . . . . . . . . . . . . . . . . . . 161 9.14 Comparison of lower bounds on the number of traces q min to reach P s ≥ 95%. . . Comparing 1-D and 2-D MI on different linear codes where the sum and joint distribution are used to combine the bivariate leakages, respectively. Note that the blue curves are for the Boolean masking. . . . . . . . . . . . . . . . . . . . . 179 C.1 Bivariate leakage distribution of 2-share Boolean masking under the Hamming weight model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 C.2 Bivariate leakage distribution of 2-share IPM under the Hamming weight model, with α 1 = α 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 C.3 Bivariate leakage distribution of 2-share IPM under the Hamming weight model, with α 1 = α 5 , which is one of the optimal case. . . . . . . . . . . . . . . . . . . . 184 C.4 Bivariate leakage distribution of 2-share DSM over bits under the Hamming weight model, with BKLC code [8, 4, 4] involved. . . . . . . . . . . . . . . . .

CHAPTER 1 Introduction 1 . 1 3 1. 2 4 1. 3 5 1. 4 6 1. 4 . 1 6 1. 4 . 2 7 1. 5 9 1. 5 . 1 9 1. 5 . 2

 11132435464164275951952 Contents Cryptography & Cybersecurity . . . . . . . . . . . . . . . . . . . . The Root of Security & the Chain of Security . . . . . . . . . . . Side-Channel Analysis . . . . . . . . . . . . . . . . . . . . . . . . . Protections and Code-based Masking . . . . . . . . . . . . . . . . Masking Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Generalizing to Code-based Masking . . . . . . . . . . . . . . . . . . Towards Measurable Side-Channel Security . . . . . . . . . . . . Information Leakage Quantification . . . . . . . . . . . . . . . . . . Information Leakage Exploitation by Attacks . . . . . . . . . . . . . 10 1.6 Measuring Leakage in a General Context . . . . . . . . . . . . . . 11

Figure 1 . 1 :

 11 Figure 1.1: Various proposals of masking schemes with corresponding constructions, security assessment, and some variants.

Figure 1 . 2 :

 12 Figure 1.2: Illustration of an instance of redundant masking. In an (n, t)-SSS based polynomial masking, the sensitive variable X = f (0) is encoded into n shares with a security order t.

Figure 2 . 1 :

 21 Figure 2.1: Illustration of information-theoretic bounds on success rate 2 by Shannon mutual information and α-information of order α = 100.00 in an unprotected AES cases, with Gaussian noise of variance σ 2 = 10.00.

Figure 2 . 2 :

 22 Figure 2.2: The overall structure of this thesis.

Corollary 3 . 1 .

 31 For a linear code C, we have d ⊥ C = d C ⊥ .

Definition 3 . 7 (

 37 Complementary Vector Space). Two subspaces C and D are complementary in direct sum (denoted by C

Lemma 3 . 4 .

 34 Let C and D two complementary vector spaces, namely: C ∩ D = {0}, and C ⊕ D = K n . Then we have: C ⊥ ∩ D ⊥ = {0}.

P

  denoted by deg(P ) equals: deg(P ) := d = max{w H (I)|β I = 0}. Definition 3.10 (Fourier Transform [22, §2.2]

Proposition 3 . 1 (

 31 Involution Property [22, §2.2]). P (z) = |K n |P (z) = 2 n P (z), ∀z ∈ K n . Proposition 3.2 (Inverse Fourier Transform [22, §2.2]). P (z) = 2 -n y∈K n P (y)(-1) y•z , ∀z ∈ K n . Proposition 3.3 (Fourier Transform and Convolution [22, §2.2, Prop. 8

Figure 4 . 1 :

 41 Figure 4.1: Systematic investigation of linear codes of IPM over F 2 4 grouped by d ⊥ D and B d ⊥ D , and one BKLC code (Best Known Linear Code 2 ).

4. 4

 4 Quantifying Leakages of IPM via SNRAs the first step, we clarify the leakage model of a device and the attack strategy of an adversary in practical scenarios. An illustration is provided in Fig.4.2. Taking noisy leakage

Figure 4 . 2 :

 42 Figure 4.2:Overview of the attacker's strategy in the higher-order (moments) side-channel attacks to extract the secret key k * , using side-channel leakages and the plain/cipher-text T .

Theorem 4 . 2 .

 42 If d • P < d ⊥ D , the attack exploiting leakage function P fails (i.e., SNR = 0), thus the security order of IPM scheme in the bounded moment model is t = d ⊥ D -1.

1 2 2n σ 2 total 1 .

 21 x∈D ⊥ \{0} P (x) 2 = 0. Hence, the security order t in bounded moment model equals d ⊥ D -Let us assume that the attacker builds its attack by tweaking P . For example, if the device leaks the sensitive variable Z through a noisy leakage function φ, the attacker can choose to use P = φ or P = φ 2 , . . ., or P = φ d (see illustration in Fig. 4.2), or actually any composition P = ψ • φ. Therefore the security order is the minimum value of d • P such that SN R = 0. Although the Theorem 4.2 is essentially the same as [123, Proposition 1], we obtain this theorem in a different way. More importantly, by combining with Theorem 4.1, the quantitative leakages can be assessed straightforwardly. In practice, we can directly compare, for a given leakage model, two countermeasures: if SN R 1 < SN R 2 , then the first countermeasure is more secure than the second one. With Theorem 4.2, we directly link the dual distance d ⊥ D of codes D in IPM to the security order in bounded moment model. Furthermore, the quantitative expression in Theorem 4.1 allows designers to assess easily the security order of an IPM scheme by using properties of 4.4 Quantifying Leakages of IPM via SNR the code D. Since IPM is the generalization of Boolean masking, Theorem 4.1 & 4.2 are also applicable to the Boolean masking and other variants [165].

(4. 11 )

 11 We have φ I (y) = 0 for y with w H (y)≥ d ⊥ D = t + 1 > d (recall the proof of Theorem 4.2). Thus by combining Eqn. 4.11 with Eqn. 4.7, we have the following equation for V [E [P (Z)|X]]:

  which is exactly the Theorem 4.3. In summary, by Corollary 4.1, the SNR of IPM scheme under affine leakage model depends only on the two parameters of D and the leakage model β. In practice, β is fixed for a given device and mainly depends on the device itself that an adversary has no control on. Hence the special interest is that designers can choose optimal codes D for IPM with maximized side-channel resistance by simply selecting optimal d ⊥ D and B d ⊥ D . Numerical Comparison with codes by SNR in Theorem 4.3. First, we show the SNR of different codes for IPM in Tab. 4.2. We omit the full table of all codes with different B d ⊥ D , but only showing codes with the maximal and the minimal values of B d ⊥ D . The last column of Tab. 4.2 shows the possible candidates of α 2 in IPM, by which the generator matrix of corresponding code D is H = (α 2 , 1).

Proposition 4 . 1 . 1 .

 411 The maximal number of linearly independent columns of the generator matrix H of the code D is d ⊥ D -It is a well-known theorem in error-correcting codes [101, Theorem 10]. Hence, if the attacker probes up to d < d ⊥ D (inclusive) wires, the sensitive variable X is encoded as a codeword in F n 2

There are 15 candidates for α 2 ∈

 2 F 16 \{0}. All codes have the same word-level security since t w = 1 (d w = 2). While for bit level security, we have t b = 1 (d b = 2) for 7 candidates and t b = 2 (d b = 3) for 8 candidates

  3 and 4.4, it is noteworthy that reducing B d ⊥ D allows both to reduce the SNR and the MI, which demonstrates our intuition for the impact of B d ⊥ D on the concrete security level of IPM. In summary, two parameters that determine the leakages of IPM are depicted in Fig. 4.3: -the slope in the log-log representation of the MI versus the noise standard deviation is all the more steep as d ⊥ D is higher, -the vertical offset is adjusted by B d ⊥ D : the smaller B d ⊥ D is, the smaller the MI.When the noise variance σ 2 tends to infinity, I(L; X) is converging to the dominating term in the expansion given in Eqn. 4.19. Hence, there is an affine law in the log-log representation, in which the slope equals to the negative order of the first nonzero moment of random variable L|X, namely the least order of key-dependent moments.

4 .

 4 MEASURING THE LEAKAGES IN IPM AND OPTIMAL CODES Reduce B d ⊥ D Increase d ⊥ D Noise variance: σ 2 MI: I(L; X)

Figure 4 . 3 :

 43 Figure 4.3: Two concomitant objectives to reduce the mutual information.

Figure 4 . 4 : 4 .

 444 Figure 4.4: Numerical calculation and approximation of I(L; X) between leakages and the sensitive variable X ∈ F 2 4 in IPM. The BKLC code [8, 4, 4] cannot be used in IPM. We put it here to show the code with d ⊥ D = 4.

4. 6 A

 6 Unified Leakage Assessment Framework for IPM Obviously, d ⊥ D and B d ⊥ D clearly indicate the concrete security level of IPM as measured by MI. Furthermore, our estimation of MI by Eqn. 4.19 is in accordance with the numerical calculations.

Framework 1 (

 1 We introduce a unified framework, consisting in the two parameters d ⊥ D and B d ⊥ D of code D, to quantify the linear (e.g., Hamming weight) and affine leakages of IPM. By Theorem 4.3 and Corollary 4.1, we propose the unified framework for assessing the leakages of IPM as follows: Unified Leakage Assessment Framework for IPM). The leakages of IPM with a linear code D can be quantified by the assessment framework consisting of two defining parameters of D, namely its dual distance d ⊥ D and the coefficient B d ⊥ D in its weight enumerator (recall Theorem 4.3). In summary, when the leakage model is Hamming weight or affine model, the side-channel resistance of IPM scheme is straightforwardly related to two defining parameters of the selected code D, namely d ⊥ D and B d ⊥ D , which are core ingredients of our unified framework. From the attacker's perspective, the only way to compromise a countermeasure is to perform attacks with order no less than d ⊥ D . From the other side of the coin, designers can use this framework in practice, namely to enhance the side-channel security of IPM by choosing appropriate d ⊥ D and B d ⊥ D

  From above, two ingredients of our unified framework are d ⊥ D and B d ⊥ D of the code D. Since our framework straightforwardly indicates the concrete security order of IPM, we propose an algorithm to choose optimal code for IPM as Alg. 1.

Algorithm 1 : 1 D

 11 Conceptional Selection of Optimal Code for IPM Input : All codes of D ⊥ generated by H ⊥ Output : Code(s) with Optimized d ⊥ D and B d ⊥ D ← all codes D with D ⊥ : [n, 1, n] 2 over F 2 ; // Optimize d w in word-level,

  d b , D ∈ D} ; // Only keep codes with maximized d ⊥ D 5 B min ← min{B d ⊥ D | D ∈ D } ; 6 D = {D| B d ⊥ D = B min , D ∈ D } ; // Only keep codes with minimized B d ⊥ D 7 return D ; For n = 2 and n = 3 shares for 4 & 8-bit variables, the best IPM codes and BKLC codes are tabulated in Tab. 4.3.

  ⊥ D and parameter B d ⊥ D of code D: • regarding SNR, whatever the value of σ -refer to Theorem 4.3 for the Hamming weight leakages and Corollary 4.1 for the affine leakages; moreover, for general leakages, e.g., nonlinear leakages, refer to Theorem 4.1; • regarding MI, when σ is large and the leakage model is Hamming weight -refer to Theorem 4.4. Furthermore, equivalent codes feature the same SNR and MI when the leakage model is Hamming weight, since permuting coordinates does not change the Hamming weight. So, we have that the MI of two equivalent codes is the same whatever the value of σ when the leakage model is Hamming weight. But the converse does not hold, as shown in Tab. 4.4.It is interesting to notice that for n = 2 and = 4, all codes (1, α 2 ) 2 represented in F 2 with the same weight enumerator are equivalent 6 as shown in Tab. 4.5. Note that the codes in the same rows are equivalent, so they have the same MI.

Figure 4 . 5 :

 45 Figure 4.5: Numerical simulation of mutual information I(L; X) between leakages and the sensitive variable X ∈ F 2 8 of all linear codes in IPM, and a BKLC code of parameters[START_REF] Brier | Correlation power analysis with a leakage model[END_REF] 8, 5]. The blue curve is the one with L2 = 0 corresponding to unprotected case.

2

 2 However, we observe that there exist distinct differences in each of classes categorized by d ⊥ D , which are affected by B d ⊥ D . Hereafter, we investigate each group of IPM codes with the same dual distances by further studying the other code property B d ⊥ D . 4.7.1 IPM Codes with d ⊥ D = As the first investigation, we move into the IPM codes with d ⊥ D = 2 shown in Fig. 4.6. There are fifteen codes that can be classified into eight classes, each of which have two equivalent codes with same B d ⊥ D . Recall that the IPM codes are determined by α 2 , thus we search α 2 as α 2 = α i and we get i ∈ {0, 1, 2, 3, 4, 5, 6, 7, 248, 249, 250, 251, 252, 253, 254}. Correspondingly, the B d ⊥ D are in the set {8, 7, 6, 5, 4, 3, 2, 1, 1, 2, 3, 4, 5, 6, 7}. The best two codes are equivalent and have

Figure 4 . 6 :.

 46 Figure 4.6: Numerical simulation of mutual information I(L; X) between leakages and the sensitive variable X ∈ F 2 8 in IPM where all codes have d ⊥ D = 2 but different B d ⊥ D .

Figure 4 . 7 :

 47 Figure 4.7: Numerical simulation of mutual information I(L; X) of IPM codes with d ⊥ D = 3 but different B d ⊥ D .

Figure 4 . 8 :

 48 Figure 4.8: Numerical simulation of mutual information I(L; X) of IPM codes with d ⊥ D = 4 but different B d ⊥ D .

4 .

 4 MEASURING THE LEAKAGES IN IPM AND OPTIMAL CODES non-equivalent codes), in which the d ⊥ D equals to 4 is maximized while B d ⊥ D equals to 3 is minimized among all possible codes in the 2-share IPM.

Figure 4 . 9 :

 49 Figure 4.9: Comparing seven codes of IPM and one BKLC code of parameters [16, 8, 5] where all codes have different d ⊥ D and B d ⊥ D

Figure 4 . 10 :

 410 Figure 4.10: Connections between IPM, LS and DSM from a generalization perspective.

  2 8 to F 2 , which determines the linear codes over F 2 . As a result, the optimal choices of the linear code for IPM may vary for different irreducible polynomials. Taking above two polynomials as an example, the best achievable values of B d ⊥ D with d ⊥ D = 4 for 2-share IPM are different, where the best B d ⊥ D for g 1 (α) and g 2 (α) are 4 and 3, respectively. Moreover, an information-theoretic comparison on side-channel resistance of the corresponding IPM is shown in Fig. 4.11, which shows a slight advantage of using g 2 (α). However, the different irreducible polynomials have marginal impact on the best linear codes with respect to d ⊥ D and B d ⊥ D . For instance, the possible values for d ⊥ D are the same for both g 1 (α) and g 2 (α), and the difference on the best values of B d ⊥ D is only one when other g 1 (α) or g 2 (α) is deployed.

Figure 4 . 11 :

 411 Figure 4.11: Comparison of the impact of two irreducible polynomials (of the finite field) on the best linear codes for IPM.

Fig. 5 .Figure 5 . 1 :

 551 Fig. 5.1, where the four intersecting areas are:

  and β I ∈ R and deg(P ) = max{w H (I) | β I = 0}.

Proposition 5 . 1 .

 51 The GCM is secure at the order t = d ⊥ D -1 under the bounded moment model and the probing model if deg(P ) < d ⊥ D .

  However, E [P (Z)|X] = E [P (Z)] if the masking is perfect. But there exists a d > 1 such that for some x, E P (Z) d |X = x = E P (Z) d .5.5 Quantifying Hamming Weight Leakages

  which consists in products of < d bits of z, as z J = i∈{1,...,n } s.t. Ji>0 z i , • z I where I ∈ {0, 1} n , w H (I) = d which consists in products of d bits of z, as z I = i∈{1,...,n } s.t. Ii=1 z i .

. 10 ) 2 .Definition 5 . 2 (

 10252 where B d denotes the adjusted coefficient in weight enumerator which is defined in Def. 5.Before diving into the proof ofLemma 5.2, we define the parameter B d ⊥ D which count the number of codewords under certain conditions in C ⊥ and D ⊥ . Adjusted coefficient in weight enumerator). Let C and D denote two linear codes. The adjusted coefficient B d is defined as:

2 . 5 .

 25 total ∝ σ 2d with deg(P ) = d. Proof. Obviously, substituting the expression of V [E [P (Z)|X]] in Theorem 5.1 by Lemma 5.2 gives the proof. The takeaway point is, the Hamming weight leakages, in which deg(P ) = 1, are quantified by Theorem 5.2, in which the two parameters that have an impact on SNR are the dual distance d ⊥ D and the coefficient B d ⊥ D . Therefore, the two parameters also affect the concrete security level of GCM. As a straightforward application of Theorem 5.2, the side-channel resistance of GCM can be optimized by increasing d ⊥ D and/or decreasing B d ⊥ D QUANTIFYING LEAKAGE IN CODE-BASED MASKING 5.5.3 MI-based Information-Theoretic Leakage Quantification

Figure 5 . 2 :

 52 Figure 5.2: Numerical calculation and approximation of I(L; X) between leakage L and the sensitive variable X in (3, 1)-SSS based masking. The three public points are α1 = α i , α2 = α j , α3 = α k .

. 20 )

 20 Considering the common "Hamming weight + Gaussian noise" model, the side-channel leakages are simulated as follows. Let L = (L 1 , L 2 , L 3 ) be 3-D leakages whereL i = φ P (Z i ) + N i = w H (Z i ) + N i for 1 ≤ i ≤ 3 and N i ∼ N (0, σ 2 )is the Gaussian noise. To combine the 3-D leakages, other sum or joint distribution are applied wherein ϕ P (L) =3 i=0 L i is called 1-D leakages or ϕ P (L) = (L 1 , L 2 , L 3 ) is called 3-D leakages, respectively.The results are shown in Fig.5.3(a) and 5.3(b) are 1-D MI and 3-D MI, respectively (more results over F 2 4 are in Fig.5.4). The first observation is that the 3-D MI utilizing joint distribution exploits more key-dependent information existed in leakages, therefore the attack is more efficient when using the joint distribution of leakages[START_REF] Bruneau | Masks Will Fall Off -Higher-Order Optimal Distinguishers[END_REF]. Secondly, the numerical results in Fig. 5.3 are in accordance with the Theorem 5.2 and 5.3, where the two parameters d ⊥ D and B d ⊥ D in codes play a significant role in determining the side-channel resistance of GCM.

  d ⊥ D and/or to minimize the conditioned number of codewords B d ⊥ D

Figure 5 . 3 :

 53 Figure 5.3: An information-theoretic evaluation of the leakages L and the sensitive variable X in (3, 1)-SSS based masking. We choose seven codes with different values of d ⊥ D and/or B d ⊥ D

  Unprotected case d D =2, B dD =14: i,j,k=0,1,2 d D =2, B dD =6: i,j,k=0,1,4 d D =2, B dD =1: i,j,k=0,5,8 d D =3, B dD =43: i,j,k=0,4,10 d D =3, B dD =43: i,j,k=0,5,9 d D =3, B dD =40: i,j,k=0,5,10 (b) 3-D MI on 4-bit case.

Figure 5 . 4 :

 54 Figure 5.4: An information-theoretic evaluation of the leakages L and the sensitive variable X ∈ F 2 4 . Six codes are chosen with different d ⊥ D 2 and/or B d ⊥ D 2

[ 8 , 6 , 1 ] 1 .

 8611 and D ⊥ is of parameters[8, 4, 2]. We haved ⊥ D = d D ⊥ = 2 and B 2 = 1 for D ⊥ . Therefore, there is only one codeword u = [1, 1, 0, 0, 0, 0, 0, 0] ∈ D ⊥ such that w H (u) = 2. Since u is also in C ⊥ ,which indicates that B 2 equals 0. As a consequence, applying Theorem 5.2 gives that SNR equals 0 for deg(P ) = d ⊥ D = 2 under Hamming weight leakages (e.g., P (Z) = w H (Z)) and then the security order is at least equal to d ⊥ D , rather than d ⊥ D -More generally, taking Theorem 5.1 gives the same conclusion for any leakage function P with deg(P ) = 2.

. 3 ) 2 .

 32 For all possible values of α 1 , α 2 , α 3 ∈ F 28 , we study the dual distance d ⊥ D and the coefficient B d ⊥ D at both word-level and bit-level. As expected, all codes have the same weight enumerator at word-level (they are all MDS codes and optimal at word-level). However, there are three possible values for d ⊥ D at bit-level, namely d ⊥ D2 ∈ {2, 3, 4}. Hence, for each possible d ⊥ D2 , we further study the possible values for the other parameter B d ⊥ D In particular, for each case of d ⊥ D2 , we show two or three codes with maximal and minimal values of B d ⊥ D 2

  .1(b) and 6.1(c) where the minimum of dual distances are 2 and 3, respectively. Secondly, when the codes in SSS and its truncated variants have the same dual distance, the parameter B d ⊥ D plays a role in side-channel resistance. More precisely, smaller B d ⊥ D brings improved concrete security for GCM. Two instances are shown in Fig. 6.1(a) and 6.1(d) where

  : d D =2, Bd D =7: i,j=0,1 2-share: d D =2, Bd D =5: i,j=0,3 2-share: d D =2, Bd D =6: i,j=1,3 (3,1)-SSS: d D =2, B dD =18: i,j,k=0,1,3

  : d D =2, Bd D =1: i,j=0,7 2-share: d D =4, Bd D =7: i,j=0,15 2-share: d D =4, Bd D =3: i,j=7,15 (3,1)-SSS: d D =2, B dD =1: i,j,k=0,7,15(b) α i , α j , α k = 1, α 7 , α 15 . : d D =4, Bd D =3: i,j=0,8 2-share: d D =4, Bd D =6: i,j=0,79 2-share: d D =3, Bd D =1: i,j=8,79 (3,1)-SSS: d D =3, B dD =1: i,j,k=0,8,79 (c) α i , α j , α k = 1, α 8 , α 79 . : d D =4, Bd D =6: i,j=0,72 2-share: d D =4, Bd D =6: i,j=0,80 2-share: d D =4, Bd D =3: i,j=72,80 (3,1)-SSS: d D =4, B dD =44: i,j,k=0,72,80 (d) α i , α j , α k = 1, α 72 , α 80 .

Figure 6 . 1 :

 61 Figure 6.1: More shares leak more information, two study-cases on (3, 1)-SSS based masking, where the three public points are: α1 = α i , α2 = α j , α3 = α k .

F 2 4 40 Table 6 . 3 : 32 Table 6 . 4 : 4 l = 6 , r = 12 j = 1 , k = 4 l = 6 , r = 11 j = 1 , k = 2 l = 3 , r = 11 j = 3 , k = 6 l = 9 , r = 12 j = 1 , k = 3 l = 5 ,

 4406332644612146111231136912135 generated by Eqn. 5.20. Note that we take α1 = α i = 1, α2 = α j and α3 = α k . Exhibiting different codes in (5, 2)-SSS scheme over F 2 8 . Note that we fix α1 = α i = 1, α2 = α 8 and enumerate all possible α3 = α k , α4 = α l and α5 = α r . Exhibiting different codes in (5, 2)-SSS scheme over F 2 4 . Note that we take α1 = α i = 1, α2 = α j , α3 = α k , α4 = α l and α5 = α r . j = 1, k =

  will be the same as Hamming weight model with deg(P ) = 1 if w = 0. Otherwise, there exists a different amount of second-order leakages indicated by w where the degree of P equals 2. The MI results on four candidates of w are shown in Fig.6.2 for 4-bit and 8-bit variables, respectively. It is worthwhile to note that in 2-share settings with n = 2 and t = 1, the SSS-based masking can be transformed into IPM by changing the way of involving public parameters α i for 1 ≤ i ≤ n. Essentially, the two schemes are different because of the structure of G and H as in Tab. 5.1, but are comparable from a side-channel perspective.

  ,j=0,0; d D =2, Bd D =4 masked: i,j=0,5; d D =3, Bd D =3 (a) = 4 for 4-bit case.

  ,j=0,0; d D =2, Bd D =8 masked: i,j=0,24; d D =3, Bd D =7 masked: i,j=0,8; d D =4, Bd D =3 (b) = 8 for 8-bit case.

Figure 6 . 2 :

 62 Figure 6.2:The intra-share independence issue: the existence of higher-order leakages decreases the security of the corresponding masking scheme (two public parameters are α1 = α i , α2 = α j as in Tab. 5.1). Note that the blue curves are for the Boolean masking.

  of [51] correspond to different d ⊥ D and/or B d ⊥ D . However, we stress that the three codes for (2, 1)-SSS in the same figure are not equivalent to each other but have the same d ⊥ D equal to 4 and closely distributed B d ⊥ D ∈ {11, 8, 8}.Moreover, this work presents a systematic way to select optimal codes for SSS-based masking and GCM, which is out of the scope of[START_REF] Costes | Redundant code-based masking revisited[END_REF].

6. 4

 4 Related Worksenumerator are the two drivers for security improvements. Essentially, we stick to the definition of GCM (recall the rightmost column in Tab. 5.1), and propose an effective way to tune the underlying codes.

Figure 7 . 1 :

 71 Figure 7.1: Side-channel seen as a communication channel.

Figure 7 . 2 :

 72 Figure 7.2: Side-channel seen as a communication channel in the presence of masking.

2 8 .

 8 As shown in Chaps. 4, the two coding-theoretic properties that indicate the side-channel resistance of IPM are the dual distance d ⊥ D and the kissing number B d ⊥ D . Herein, we first investigate the statistical properties of d ⊥ D and B d ⊥ D among all linear code candidates. The distribution of d ⊥ D are enumerated in Tab. 7.1 and the corresponding choices of the codes with given d ⊥ D and B d ⊥ D are in Tab. 7.2, while in the latter we are only interested in the linear codes with the maximal and minimal values of B d ⊥ D for each d ⊥ D .

7 .

 7 OPTIMAL ATTACKS IN THE PRESENCE OF CODE-BASED MASKING 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 5.5 6.0 6.5 7.0 7.5 , d=3, B d =8 IPM, =(1,23), d=4, B d =4 IPM, =(1,29), d=4, B d =17 IPM, =(1,15), d=3, B d =1 IPM, =(1,83), d=3, B d =6 IPM, =(1,115), d=2, B d =1 IPM, =(1,2), d=2, B d =5 BM, n=2, d=2, B d =8 (a) Number of traces in normal scale. , d=3, B d =8 IPM, =(1,23), d=4, B d =4 IPM, =(1,29), d=4, B d =17 IPM, =(1,15), d=3, B d =1 IPM, =(1,83), d=3, B d =6 IPM, =(1,115), d=2, B d =1 IPM, =(1,2), d=2, B d =5 BM, n=2, d=2, B d =8 (b) Number of traces in log 2 scale.

Figure 7 . 3 :

 73 Figure 7.3: Attack-based evaluation of IPM with n = 2 shares. Taking two codes in each group with different d ⊥ D and/or B d ⊥ D .

7. 4

 4 Attacks against Non-Redundant Code-based Masking 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 5.5 6.0 6.5 7.0 7.5 8.0 Noise level: 2 Number of traces 1e4 BM, n=3, d=3, B d =8 IPM, =(1,23), d=4, B d =4 IPM, =(1,46), d=4, B d =4 IPM, =(1,51), d=4, B d =4 IPM, =(1,54), d=4, B d =4 BM, n=2, d=2, B d =8 (a) Number of traces in normal scale. , d=3, B d =8 IPM, =(1,23), d=4, B d =4 IPM, =(1,46), d=4, B d =4 IPM, =(1,51), d=4, B d =4 IPM, =(1,54), d=4, B d =4 BM, n=2, d=2, B d =8 (b) Number of traces in log 2 scale.

Figure 7 . 4 :

 74 Figure 7.4: Comparison of four instances of optimal codes for 2-share IPM, according to the best coding-theoretic properties given by d ⊥ D = 4 and B d ⊥ D = 4.

  ⊥ D and B d ⊥ D , yet the solo role of B d ⊥ D is not explicitly investigated. In the following, we compare several instances of the linear code in IPM with the same d ⊥ D while different B d ⊥ D . As shown in Fig. 7.5, we set d ⊥ D = 2 and B d ⊥ D ∈ {1, 2, 3, 5, 8} where 2-share BM being a special case of IPM has B d ⊥ D = 8. Apparently, reducing B d ⊥ D leads to a more difficult attack in the sense of the necessary number of traces to launch a successful attack. In addition, since we 7. OPTIMAL ATTACKS IN THE PRESENCE OF CODE-BASED MASKING choose d ⊥ D = 2, all those codes will not outperform 3-share BM in full range of noise levels. 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 5.5 6.0 6.5 7.0 7.5 , d=3, B d =8 IPM, =(1,115), d=2, B d =1 IPM, =(1,70), d=2, B d =2 IPM, =(1,4), d=2, B d =3 IPM, =(1,2), d=2, B d =5 BM, n=2, d=2, B d =8 (a) Number of traces in normal scale. , d=3, B d =8 IPM, =(1,115), d=2, B d =1 IPM, =(1,70), d=2, B d =2 IPM, =(1,4), d=2, B d =3 IPM, =(1,2), d=2, B d =5 BM, n=2, d=2, B d =8 (b) Number of traces in log 2 scale.

Figure 7 . 5 :

 75 Figure 7.5: Illustrating the impact of B d ⊥ D given the same d ⊥ D in 2-share IPM.

Table 7 . 3 :

 73 The distribution of d ⊥ D are enumerated in Tab. 7.3 and the choices of the codes under given d ⊥ D and B d ⊥ D are in Tab. 7.4. Note again that in Tab. 7.4 we only focus on the maximal and minimal values of B d ⊥ D . Distribution of d ⊥ D for IPM with n = 3. d ⊥ D = d |{(α1, α2)}| max {B d } min {B d }

  candidates (instead of 2731135 codes for any pairwise different α 1 , α 2 and α 3 ). The distribution of d ⊥ D are exhausted in Tab. 7.5 and the choices of the codes under given d ⊥ D and B d ⊥ D are in Tab. 7.6 in which we only focus on the maximal and minimal values of B d ⊥ D as above.

Remark 7 . 3 .. 7 . 5

 7375 In SSS-based masking, we should use the adjusted kissing number B d ⊥ D instead of B d ⊥ D . Typically, we have B d ⊥ D ≥ B d ⊥ D in SSS-based masking as pointed out in [35]. However, we use B d ⊥ D here since it follows the same trend as B d ⊥ D . Note that given a specific C, different choices of D with the same B d ⊥ D may lead to different B d ⊥ D Attacks on Redundant Code-based Masking 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 5.5 6.0 6.5 7.0 7.5 , d=2, B d =8 BM, n=3, d=3, B d =8 SSS, =(1,51,54), d=4, B d =37 SSS, =(1,29,37), d=4, B d =73 SSS, =(1,7,111), d=3, B d =1 SSS, =(1,6,137), d=3, B d =19 SSS, =(1,3,17), d=2, B d =1 SSS, =(1,2,141), d=2, B d =13 (a) Number of traces in normal scale. , d=2, B d =8 BM, n=3, d=3, B d =8 SSS, =(1,51,54), d=4, B d =37 SSS, =(1,29,37), d=4, B d =73 SSS, =(1,7,111), d=3, B d =1 SSS, =(1,6,137), d=3, B d =19 SSS, =(1,3,17), d=2, B d =1 SSS, =(1,2,141), d=2, B d =13 (b) Number of traces in log 2 scale.

Figure 7 . 6 :

 76 Figure 7.6: Attack-based evaluation of (3, 1)-SSS based masking. Taking two codes in each group with different d ⊥ D and/or B d ⊥ D .

7 .

 7 OPTIMAL ATTACKS IN THE PRESENCE OF CODE-BASED MASKING , d=2, Bd=8 BM, n=3, d=3, Bd=8 SSS, =(1,51,54), d=4, Bd=37 SSS, =(1,102,228), d=4, Bd=37 SSS, =(1,108,198), d=4, Bd=37 (a) Number of traces in normal scale. , d=2, Bd=8 BM, n=3, d=3, Bd=8 SSS, =(1,51,54), d=4, Bd=37 SSS, =(1,102,228), d=4, Bd=37 SSS, =(1,108,198), d=4, Bd=37 (b) Number of traces in log 2 scale.

Figure 7 . 7 :

 77 Figure 7.7: The optimal codes for (3, 1)-SSS based masking, in which d ⊥ D is maximized and B d ⊥ D

  , d=2, Bd=13 SSS, =(1,141,203), d=2, Bd=13 (a) Number of traces in normal scale. , d=2, Bd=8 SSS, =(1,2,4), d=2, Bd=13 SSS, =(1,2,141), d=2, Bd=13 SSS, =(1,141,203), d=2, Bd=13 (b) Number of traces in log 2 scale.

Figure 7 . 8 :

 78 Figure 7.8: The worst codes for (3, 1)-SSS based masking, where d ⊥ D is minimized and B d ⊥ D is maximized given a specific d ⊥ D = 2.

  . The first observation is that adding one share of redundancy always reduces the concrete side-channel security of code-based masking. Secondly, given the same security order under the word-probing model, IPM always outperforms SSS-based masking. The more redundancy can only further reduce the security level. Interestingly, as three instances of IPM have the same security order under the bit-probing model, a major difference exists in B d ⊥ D . Put differently, given the same d ⊥ D over F 2 , more redundancy leads to a greater value of B d ⊥ D , indicating a lower security level. n=3, d=3, Bd=8 IPM, =(1,2), d=2, Bd=5 IPM, =(1,4), d=2, Bd=3 IPM, =(2,4), d=2, Bd=5 SSS, =(1,2,4), d=2, Bd=13 BM, n=2, d=2, Bd=8(a) Number of traces in normal scale.

( b )

 b Number of traces in log 2 scale.

Figure 7 . 9 :

 79 Figure 7.9: Illustrating the impact of redundancy by comparing 2-share IPM with (3, 1)-SSS based masking, using α = (1, 2, 4) in the latter.

  , d=3, Bd=8 IPM, =(1,3), d=3, Bd=6 IPM, =(1,17), d=2, Bd=1 IPM, =(3, 17), d=3, Bd=1 SSS, =(1,3,17), d=2, Bd=1 BM, n=2, d=2, Bd=8 (a) Number of traces in normal scale. 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 5.5 6.0 6.5 7.0 7.5 , d=3, Bd=8 IPM, =(1,3), d=3, Bd=6 IPM, =(1,17), d=2, Bd=1 IPM, =(3, 17), d=3, Bd=1 SSS, =(1,3,17), d=2, Bd=1 BM, n=2, d=2, Bd=8 (b) Number of traces in log 2 scale.

Figure 7 . 10 :

 710 Figure 7.10: Illustrating the impact of redundancy by comparing 2-share IPM with (3, 1)-SSS based masking, using α = (1, 3, 17) in the latter.

  Number of traces in log 2 scale.

Figure 7 . 11 :

 711 Figure 7.11: Illustrating the impact of redundancy by comparing 2-share IPM with (3, 1)-SSS based masking, using α = (1, 3, 17) in the latter.

  Scheme

Figure 8 . 1 :

 81 Figure 8.1: Representation of side-channel analysis of a masked cryptographic operation as a communication channel.

Lemma 8 . 2 .

 82 Considering any distinguisher, including the optimal one (namely the ML-based one), one hasI(K; K) ≤ I(K; K|T) = I(K; Y|T). (8.2)where K = ϕ(y, t) = argmax k p(Y = y(k)|T = t) follows the distinguisher rule in SCAs.

Lemma 8 . 3 .

 83 Given the same setting as in Fig. 8.1, one has I(K; Y|T) ≤ H(K). (8.3) Proof. The inequality holds in the side-channel setting of Fig. 8.1, since I(K; Y|T) = H(K|T) -H(K|Y, T) = H(K) -H(K|Y, T) ≤ H(K) where H(K|Y, T) ≥ 0.

Lemma 8 . 4 .

 84 Considering the same setting as in Fig.8.1, one hasI(X; Y) -I(T; Y) = I(X; Y|T) ≥ 0. (8.4) Proof. Since T -X -Y forms a Markov chain, we have H(Y|X, T) = H(Y|X) 1 . Hence I(X; Y|T) = H(Y|T) -H(Y|X, T) = H(Y|T) -H(Y|X) = H(Y) -H(Y|X) -H(Y) -H(Y|T) = I(X; Y) -I(T; Y).8. INFORMATION-THEORETIC BOUNDS ON ATTACKSIn fact, I(X; Y) -I(T; Y) ≥ 0 is also a direct consequence of the data processing inequalitywhere T -X -Y forms a Markov chain.

Figure 8 . 2 :

 82 Fig. 8.2, the estimation of I(X; Y|T) (in unprotected case, cf Sec. 8.5.2) gets more accurate by using larger N C . In particular, this estimation on I(X; Y|T) is accurate enough by using only N C = 100, 000 draws. However, we use N C = 1, 000, 000 throughout this chapter (e.g., in Fig. 8.3, 8.4 and 8.5) to have a more stable estimation.

2σ 2 . 2 .

 22 (8.12) Since K ∈ F 2 is uniformly distributed, (8.12) gives log p(y|t) = logk i -w H (S(t i ⊕k))) i -w H (S(t i ⊕k))) 2 2σ

Figure 8 . 3 :

 83 Figure 8.3: Evolution of I(X; Y|T) with the number of traces under different levels of noise in the unprotected case without masking, NC = 1, 000, 000.

15 )

 15 is the zero-offset leakage under Hamming weight model. Again, taking K ∈ F 2 uniformly, and considering that all masks are i.i.d. ∼ U(F 2 ), we have log p(y|t) = -(q + 1) -The numerical results of I(X; Y|T) are depicted in Fig.8.4. It clearly appears that the effect of masking is to relax the values of I(X; Y|T), which motivates for the fact that a bound based 8.5 Applying into Hamming Weight Leakages with Additive Gaussian Noise on I(X; Y|T) will be very loose. This motivates for the shifting to focus on I(U; Y|T). Back to Fig.8.4, the dotted black lines show the upper bounds given by Lemma 8.6. The takeaway observation is that the bounds are all the tighter as the noise level increases.

Figure 8 . 4 :

 84 Figure 8.4: Bounding on I(X; Y|T) by Shannon's channel capacity in masked cases, NC = 1, 000, 000.

8. 6 s

 6 Extending to Code-based Masking 0 200400 800 1200 1600 2000 2400 2800 3200 3600 4000 4400 4800 Number of traces: q Our new bounds by I(U; Y|T)

Figure 8 . 6 :

 86 Figure 8.6: Application and comparison of bounds on success rate. We present six instances with different noise levels by using qmax = 4800 traces. Note that we omit the bounds given by I(X; Y|T) as they are invisible when plotted together with bounds given by I(U; Y|T).

Figure 8 . 7 :

 87 Figure 8.7: Comparison of the minimum number of traces qmin to reach Ps ≥ 95% predicted by our new bound, by I(X; Y|T) as in[START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF] and also the baseline given by an ML attack.

From a high

  abstract view of communication channel, utilizing code-based masking satisfies the same inequality as in Lemmas 8.1, 8.2 and 8.3. Therefore, we have that I(K; K) ≤ I(U; Y|T) ≤ H(K), an information-theoretic upper bound for I(K; K) by the entropy of K, for instance, H(K) = under the uniform assumption.

2 . ( 8 . 18 )

 2818 i -w H (u i ⊕f (u i ,m,α 1 )) 2 2σ After inserting Eqn. 8.18 into Eqn. 8.11, we launch the Monte-Carlo simulation and the numerical results are shown in Fig. 8.8. The takeaways from Fig. 8.8 are twofold. Firstly, I(U; Y|T) is well-bounded by H(K) = 8.

Figure 8 . 8 :

 88 Figure 8.8: Numerical results of I(U; Y|T) under different choices of α1 in IPM. Note that α1 = 1 corresponds to Boolean masking as shown in Fig. 8.5 for other levels of noise.

Figure 8 . 10 :

 810 Figure 8.10: Prediction of qmin achieving Ps ≥ 95% under different choices of α1 in IPM. Note that the number of traces are in log 2 scale.

  by I(U; Y|T) Bound by I(X; Y|T) (a) α 1 = 1. by I(U; Y|T) Bound by I(X; Y|T) (b) α 1 = 17. by I(U; Y|T) Bound by I(X; Y|T) (d) α 1 = 23.

Figure 8 . 11 :

 811 Figure 8.11: Prediction of qmin achieving Ps ≥ 95% under different choices of α1 in IPM.

9 .

 9 TOWARDS EXACT ASSESSMENT OF SIDE-CHANNEL LEAKAGE 9.3 Quantifying Hamming Weight Leakages by Rényi Entropy Considering two random variables X and Y , where Y denotes the general leakage from the sensitive variable X. For instance, Y is the side-channel leakage of sensitive variables during its computation, storage, or even some micro-architectural caching information. An abstract overview of the leakage model is illustrated in Fig. 9.1, in which f can be any deterministic or probabilistic function on X and N denotes some additive noises.

Figure 9 . 1 :

 91 Figure 9.1: Leakage model: the sensitive variable X and the leakage Y with some noise N .

. 1 )

 1 Remark 9.1. Considering different choices of α, we shall recover various entropies [137]: • Hartley's entropy (max-entropy): taking α → 0 gives H 0 (X) = log |SuppX| where |SuppX| = Σ p(x)>0 1 denotes the volume/cardinality of the support of the distribution.

9 .

 9 TOWARDS EXACT ASSESSMENT OF SIDE-CHANNEL LEAKAGE 9.3.1 Guessing with Noiseless Leakages Let f (X) = w H (X) where N = 0 and |X | = M = 2 for the sake of calculation. Hence,

12 )(

 12 proposed by Sason et al.[START_REF] Sason | Improved bounds on lossless source coding and guessing moments via Rényi measures[END_REF]), we numerically show the conditional Shannon and Rényi entropies of X as Fig.9.2 and Fig.9.3. Specifically, the upper bound of Rényi entropy is highly dependent on the α. With α much larger than 1.0, the marked region is much smaller than the region with α < 1.0.

  )where I(X; Y |Z) is the Shannon mutual information, and we call I 2 (X; Y |Z) the quadratic α-information as in convention. Additionally, we callI ∞ (X; Y |Z) the (conditional) maximal information 1 as α → ∞. Proof. Since α-divergence is non-decreasing in α, if α < β, then D α (P XY Z P X|Z Q Y Z ) < D β (P XY Z P X|Z Q Y Z )given a distribution of X, Y and Z. By the conditional Sibson's identity, we have that I α (X; Y |Z) ≤ D α (P XY Z P X|Z Q Y Z ) ≤ D β (P XY Z P X|Z Q Y Z ). Finally, taking Q * Y Z for minimization gives D β (P XY Z P X|Z Q * Y Z ) = I β (X; Y |Z).

Figure 9 . 6 :

 96 Figure 9.6: A communication channel view of side-channel analysis.

Lemma 9 . 4 (

 94 Rioul's Generalized Fano Inequality [137, Thm. 1]).

Figure 9 . 7 : 8 .

 978 Figure 9.7: Illustration of dα(Ps 1 M ) as a function of Ps with different α, where M = 2 8 .

9 . 1 leads 1 d 1 M 1 d 1 d of d α (P s 1 M

 9111111 to an upper bound on P s . In particular, let f -be the inverse of d α (P s ) of P s , then we haveP s ≤ f -1 d (I α (X, Y|T)). Note that f -is also monotonous in its valid domain, e.g., the range is determined by 1 M ≤ P s ≤ 1.0. The inverse function f -)

Figure 9 . 8 :

 98 Figure 9.8: Illustration of the inverse of dα(Ps 1 M ) with different α where M = 2 8 .

7 . 6

 76 and 7.7), the best key guess is made by k = argmax k∈K ∆(k) = argmax k∈K p(Y |k, T ).(9.36)

9. 6

 6 Applications to Hamming Weight Leakage with AWGN 5 Y|T) I (X; Y|T) with = 0.20 I (X; Y|T) with = 0.25 I (X; Y|T) with = 0.50 I (X; Y|T) with = 0.80 I (X; Y|T) with = 2.00 I (X; Y|T) with = 4.00 I (X; Y|T) with = 8.00 I (X; Y|T) with = 100.00 (a) σ 2 = 1.00. Y|T) I (X; Y|T) with = 0.20 I (X; Y|T) with = 0.25 I (X; Y|T) with = 0.50 I (X; Y|T) with = 0.80 I (X; Y|T) with = 2.00 I (X; Y|T) with = 4.00 I (X; Y|T) with = 8.00 I (X; Y|T) with = 100.00 (b) σ 2 = 2.00.

Figure 9 . 9 :

 99 Figure 9.9: Numerical comparison of Shannon mutual information I(X, Y|T) and α-information Iα(X, Y|T) with different α in a side-channel analysis context, with q = 50 traces.

  Y|T) I (X; Y|T) with = 0.20 I (X; Y|T) with = 0.25 I (X; Y|T) with = 0.50 I (X; Y|T) with = 0.80 I (X; Y|T) with = 2.00 I (X; Y|T) with = 4.00 I (X; Y|T) with = 8.00 I (X; Y|T) with = 100.00 (a) σ 2 = 4.00. Y|T) I (X; Y|T) with = 0.20 I (X; Y|T) with = 0.25 I (X; Y|T) with = 0.50 I (X; Y|T) with = 0.80 I (X; Y|T) with = 2.00 I (X; Y|T) with = 4.00 I (X; Y|T) with = 8.00 I (X; Y|T) with = 100.00 (b) σ 2 = 8.00.

Figure 9 . 10 :

 910 Figure 9.10: Numerical comparison of Shannon mutual information I(X, Y|T) and α-information Iα(X, Y|T) with different α in a side-channel analysis context, with q = 200 traces.

ss

  Bounds by I (X; Y|T) with < 1.00 Bounds by I(X; Y|T) Bounds by I (X; Y|T) with > 1Bounds by I (X; Y|T) with < 1.00 Bounds by I(X; Y|T) Bounds by I (X; Y|T) with > 1

Figure 9 . 11 :

 911 Figure 9.11: Comparison of applying the Rioul's generalized Fano inequality on Ps in αinformation Iα(X, Y|T) with different α in a side-channel analysis context, with q = 50 traces.

ss

  Bounds by I (X; Y|T) with < 1.00 Bounds by I(X; Y|T) Bounds by I (X; Y|T) with > 1Bounds by I (X; Y|T) with < 1.00 Bounds by I(X; Y|T) Bounds by I (X; Y|T) with > 1

Figure 9 . 12 :

 912 Figure 9.12: Comparison of upper bounds on success rate Ps given by Shannon mutual information I(X, Y|T) and α-information Iα(X, Y|T) with different α in a side-channel analysis context, with q = 50 traces.

  The first two parts of this thesis focus on quantifying information leakage in code-based masking. Because of the generalization, the leakage quantification framework works for all code-based masking instances like the simplest Boolean masking, inner product masking, direct sum masking, Shamir's secret sharing based masking, etc. Technically, our framework formally binds the coding-theoretic properties of the corresponding linear codes to two leakage metrics, namely signal-to-noise ratio (SNR) and mutual information (MI). Particularly in the case of the Hamming weight leakage model, we find that both SNR and MI depend exclusively on the dual distance and the kissing number of the linear codes used in the masking. Those theoretical 10. CONCLUSIONS AND PERSPECTIVES derivatives enable us to enhance the code-based masking by providing optimal linear codes for it in the sense of side-channel resistance.

P 2 .Proof.

 2 PROOFS, LEMMAS AND DISCUSSIONS Next, we derive formulas for both sub-terms E [E [P (Z)|X]] and E E [P (Z)|X] 2 and their proofs are in Appendix A.1.2 and A.1.3, respectively. Lemma 1.3. E [E [P (Z)|X]] = 1 2 n x∈(C⊕D) ⊥ P (x). Lemma 1.4. E E [P (Z)|X] (x) P (y).Particularly, when two codes C and D are complementary, we can simplify above two lemmas as follows, which is exactly the case for IPM (recall Lemmas 4.1 and 4.2).Lemma 1.5.E [E [P (Z)|X]] = 1 2 n P (0). Proof. Given that C ⊕ D = F 2 n , then we obtain (C ⊕ D) ⊥ = {0}. Therefore, E [E [P (Z)|X]] = 1 2 n x∈(C⊕D) ⊥ P (x) = 1 2 n P (0). Lemma 1.6. E E [P (Z)|X] 2 = 12 2n x∈D ⊥ P (x) Given that C and D are complementary, then C ∩ D = {0}, so as C ⊥ ∩ D ⊥ = {0}. Therefore, the conditional codewords x, y ∈ D ⊥ and x + y ∈ C ⊥ gives x + y = 0, or equivalently x = y. As a result, Lemma 1.4 becomes E E [P (Z)|X]

2 .

 2 Therefore, relying on the two lemmas, the proof of Lemma 5.1 is as follows.Proof of Lemma 5.1. From Lemma 4.1, we compute E [E [P (Z)|X]]2 as follows:E [E [P (Z)|X]] (C ⊥ ∩D ⊥ )P (x) P (y).

(A. 1 ) 2 )n 2 Pn 2 P

 1222 Finally, we obtain V [E [P (Z)|X]] by combining Lemma 4.2 and Eqn. A.1 as follows.V[E [P (Z)|X]] = E E [P (Z)|X] 2 -E [E [P (Z)|X]]Due to Lemma 3.3, we have C ⊥ ∩ D ⊥ = (C ⊕ D) ⊥ in SSS-based polynomial masking, where ⊕ denotes the direct sum operation. Notice that {(x, y)∈ K n × K n |x, y ∈ D ⊥ , x + y ∈ C ⊥ } ⊇ A. FURTHER PROOFS, LEMMAS AND DISCUSSIONS (x) P (y)(-1) (x+y)•c+x•d+y•d (x) P (y)(-1) (x+y)•c (-1) x•d (-1) y•d = 1 2 2n • |C| • |D| 2x, y∈D ⊥ ; x+y∈C ⊥ P (x) P (y), (A.7)

  ⊥ ; x+y∈C ⊥ P (x) P (y).

(A. 8 )

 8 APPENDIX BGenerator Matrices for Some Optimal Linear Codes B.1 Optimal Codes for IPM with n = 2

2 .B. 3

 23 Comparison of MI on 1-D and n-D LeakagesH 3 = α 0 α 8 α 183 =

2 B. 3

 23 Comparison of MI on 1-D and n-D LeakagesWe add more results on MI to compare the efficiency of different combination functions ϕ P in exploiting information leakages. In Fig.5.3, we show the advantages to use joint distribution in trivariate leakages. In addition, we compare the two combination function in 2-share cases by plotting MI curves together. As shown in Fig.B.1, the combination by using joint distribution is more efficient than the one by using sum in bivariate leakages scenarios. Moreover, this is true for n-variate leakages.

  , Bd D =4: i,j=0,0 d D =3, Bd D =4: i,j=0,4 d D =3, Bd D =3: i,j=0,5 (a) 1-D vs. 2-D MI on 4-bit case.

  , Bd D =8: i,j=0,0 d D =3, Bd D =7: i,j=0,24 d D =4, Bd D =15: i,j=0,59 d D =4, Bd D =3: i,j=0,8 (b) 1-D vs. 2-D MI on 8-bit case.

Figure B. 1 :

 1 Figure B.1: Comparing 1-D and 2-D MI on different linear codes where the sum and joint distribution are used to combine the bivariate leakages, respectively. Note that the blue curves are for the Boolean masking.

Figure C. 1 :Figure C. 2 :Figure C. 3 :Figure C. 4 :

 1234 Figure C.1: Bivariate leakage distribution of 2-share Boolean masking under the Hamming weight model.

  Although attack-based evaluation allows us a more accurate characterization on the concrete side-channel security, it is much more relying on the expertise of evaluators and measurement environment (acquisition equipment, set-ups, etc). Moreover, compared to empirical attacks, the bounds on the success rate given by information-theoretic tools are usually very loose, even much looser when the noise level is high or the leakage model is not accurate (with model mismatches). To the best of our knowledge, it is still an open problem: how to narrow down or even bridge the gap between theoretical bounds and success rate in practical?

	1.6 Measuring Leakage in a General Context
	can help including the signal-to-noise ratio (SNR) for leakage detection and success rate as an
	ultimate attacking metric.

Table 1 .

 1

1: Summary of evaluation strategies in assessing side-channel resilience of cryptographic devices (implementations).

  c ) where d H denotes the Hamming distance. In particular, d C equals to the minimum weight of its nonzero codewords.

	Given a linear code C with parameters [n, k, d C ], its weight enumerator is defined as follows.
	Definition 3.2 (Weight Enumerator [101, §5.2]). The weight enumerator of a linear code
	specifies the number of codewords C of each possible Hamming weight in C. Specifically, we have

  and w H (•) denotes the Hamming weight function. In particular, B d C is called the kissing number of C.

	Lemma 3.1. Basic properties of B i ∈ N:

  meaning the kissing number is nonzero,• B n = 1 if and only if the code C has a codeword with all ones (e.g., [1, . . . , 1]).

	Note that two linear codes are said to be equivalent if one can be obtained from the
	other by a series of operations of the following two types: 1) an arbitrary permutation of the
	coordinate positions and, 2) in any coordinate position, multiplication by any nonzero scalar.
	Straightforwardly, equivalent linear codes have the same weight enumerator.
	Definition 3.3 (Dual Code [101, §1.8]). The dual code of C is the linear code

  this thesis, we consider two classes of linear codes: [n, k, d w ] 2 and [n , k , d b ] 2 with minimal distances d w and d b at word-and bit-level, respectively. More precisely, the latter is the expanded code of the former from F 2 into F 2 . Indeed, if z is a codeword of the former code, then the corresponding codeword [z] 2 of the latter code is obtained by replacing each term in z by its coordinates with respect to some fixed basis (e 1 , . . . , e ) of F 2 over F 2 . Let (b 1 , . . . , b k ) be a basis of the former code, then a basis of the latter code is ([e i b j ] 2 ) i=1,..., ; j=1,...,k .

  are decomposed over F 2 . Consider a generating matrix of a linear code of size k × n in F 2 . It becomes a generating matrix of size k × n in F 2 . Any linear codes of parameters [n, k] 2 contain (2 ) k = 2 k codewords, hence is turned into a [n , k ] 2 linear code in F 2 . The latter code is called the expansion code of the former.

	Definition 3.5 (Sub-field representation [101, §7.7]). Let x ∈ F 2 , the sub-field representation of x is [x] 2 ∈ F 2 .
	Definition 3.6 (Code Expansion [101, §7.7]). By using sub-field representation, the elements
	in F 2

Table 4 . 1 :

 41 Summary of side-channel security analysis on IPM.

		Security Orders	Code Parameters	Metrics	Comments
	Balasch et al. [2]	t w	-	MI	MI varies for different L vectors
	Wang et al. [165]	t b	d ⊥ D	MI	O min (= d ⊥ D ) was used (the lowest key-dependent statistical moment)
	Poussier et al. [123]	t w , t b	d ⊥ D	MI
	Balasch et al. [3]	t w , t b	-	MI	t bound (= t b + 1) is in the bounded moment model
	Carlet et al. [24]	t w , t b	d ⊥ D	MI, SR	SR of the optimal attack [18]
	This work	t w , t b	d ⊥ D , B d ⊥ D	SNR, MI, SR	A unified framework to analyze all IPM codes by closed-form expression
	* Here t w , t b are word-and bit-level security orders, where t w = n-1. Bit-level security order t b
	equals to d ⊥ D -1 as in

Table 4 . 2 :

 42 Demonstration of categorizing codes in IPM by SNR and MI.

  2374 {α18 , α 39 , α 43 , . . .} 2

	4	max B 4 =15 min B 4 =3	0 0	0 0	0 0	33.750 0.0494 6.7500 0.0392	{α	{α 59 , α 60 }

8

, α

126

, α 127 } In Tab. 4.2, the green part shows where SNR equals 0 given different d ⊥ D . Clearly, given a d ⊥ D for IPM codes, the SNR of the corresponding IPM decreases along with B d ⊥ D . Moreover, the MI decreases when d ⊥ D increases and/or B d ⊥ D decreases. As a result, the code with the maximized d ⊥ D and minimized B d ⊥ D

Table 4 . 4

 44

: Example of Non-equivalent IPM codes with n = 3, = 4 that have the same weight enumerator but different MI (noiseless).

Table 4 . 5 :

 45 The weight enumerators of IPM codes with m = 2, = 4 and MI in a noiseless case.

	α 2	d ⊥ D	B d ⊥ D	Weight Enumerators	I(Z; X)
	α 0 (Boolean masking)	2	4	[ (0, 1), (2, 4), (4, 6), (6, 4), (8, 1) ]	1.151963
	α 1 , α 14	2	3	[ (0, 1), (2, 3), (3, 2), (4, 3), (5, 4), (6, 1), (7, 2) ] 0.380288
	α 2 , α 13	2	2	[ (0, 1), (2, 2), (3, 3), (4, 3), (5, 4), (6, 2), (7, 1) ] 0.287149
	α 3 , α 12	2	1	[ (0, 1), (2, 1), (3, 4), (4, 3), (5, 4), (6, 3) ]	0.199569
	α 4 , α 6 , α , α 8 , α 9 , α 11	3	4	[ (0, 1), (3, 4), (4, 5), (5, 4), (6, 2) ]	0.181675
	α 5 , α 10	3	3	[ (0, 1), (3, 3), (4, 7), (5, 4), (7, 1) ]	0.246318
	4.7 Categorizing Linear Codes of 2-Share IPM over F 2 8

  equal to 4 as shown in next subsection. In order to show the differences between IPM codes with different B d ⊥ D , we choose one code for 4.7 Categorizing Linear Codes of 2-Share IPM over F 2 8

	2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2	2 4 2 3 2 2 2 1 2 0	2 1	2 2 Noise level: 2 2 3 2 4	2 5	2 6	2 7	2 8	2 9	2 10 2 11
	4.7.3 IPM Codes with d ⊥ D = 4
	As the last part, we investigate the rest of IPM codes with d ⊥ D = 4 where there are 94 codes (40
	non-equivalent codes).

Interestingly, there are 12 candidates of B d ⊥ D in set {3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 14, 15}.

Table 5 . 1 :

 51 Encodings in IPM, LS, DSM, SSS-based masking and GCM, revisited.

	IPM	LS 1	DSM	SSS-based masking	GCM
	[2, 3]	[23]	[17, 123]	[77, 131]	[164]
	Conditions
	on C and D

Table 6 . 2 :

 62 Exhibiting different codes in (3, 1)-SSS scheme over

Table 7 . 1 :

 71 Distribution of d ⊥ D for IPM with n = 2.

Table 7 . 5

 75

: Distribution of d ⊥ D for (3, 1)-SSS based masking.

Table 7 . 7 :

 77 Revisiting all linear codes used in literature over F 2 8 , with redundancy when n > t + 1 while no redundancy when n = t + 1.

  . Note that α = (237, 175)

							is optimal
		(1, 23), (1, 46), (1, 51), . . .	IPM	4, 4, 4, . . . 4, 4, 4, . . . 4, 4, 4, . . .	This work. 12 optimal code in total, see Tab. 7.2
		(5, 221, 198)		3	1	1
	n = 3	(237, 175, 221)	(3, 1)-SSS	3	3	3	[51]
		(237, 221, 198)		4	6	6
		(1, 51, 54), (1, 102, 228), (1, 108, 198)	(3, 1)-SSS	4, 4, 4	37, 37, 37	53, 53, 53	This work. Only 3 optimal codes, see Tab. 7.6
		(5, 237, 221, 198)		3	10	10
	n = 4	(237, 175, 221, 198)	(4, 1)-SSS	3	12	12	[51]
		(12, 80, 176, 237)		3	19	53
	n = 5	(5, 237, 175, 221, 198)	(5, 1)-SSS	2	2	2	[51]

  Applying into Hamming Weight Leakages with Additive Gaussian NoiseSince f P (p) is strictly increasing for p ∈ [2 -, 1] [56, §A], Theorem 8.1 not only provides an upper bound on P s , but also gives a lower bound on the number of traces q to obtain a specific P s in SCAs, where q is involved in I(U; Y|T). Apparently, we have I(U; Y|T) ≤ q • I(U ; Y |T ).Remark 8.3. It is trivial to have a much loose bound on P s as: f P (P s ) ≤ I(X; Y|T). However, as we will show later, this bound is too loose and is out of use in evaluating masked implementations. Furthermore, I(X; Y|T) cannot be bounded by H(K) (recall Lemma 8.3) and it increases linearly in q.

	8.5 8.4.2 Bounding I(X; Y|T) by Shannon's Channel Capacity
	As mentioned in Remark 8.3, I(X; Y|T) will not be bounded by H(K) in protected cryptographic
	implementations. But still, it is upper bounded by the capacity defined in (8.5) as in the following
	lemma.

2, we have:

f P (P s ) = H(K) -H 2 (P s ) -(1 -P s ) log(2 -1) ≤ I(K; K) ≤ I(U; Y|T).

  .10)1 We use log 2 to have mutual information and entropy expressed in bits.

	8. INFORMATION-THEORETIC BOUNDS ON ATTACKS
	8.5.1 Importance Sampling in Monte-Carlo Simulation
	Monte-Carlo simulation is a well-known method to estimate expectations of a function under
	certain distribution by repeated random sampling, where the importance sampling can be used
	to improve the efficiency and speedup the convergence procedure [100, Chap. 29].
	By Monte-Carlo simulation, we can estimate the first term H(Y|T) in subtractions (8.9) by
	randomly drawing N C samples. Particularly, equipped with importance sampling, we have
	H(Y|T) =	y t	p(y, t) log	1 p(y|t)	dy
	≈ lim
				123

  With function scipy.integrate.quad in Python, we numerically investigate the remaining information of X with knowing noisy Hamming weight leakages Y where the noise is the additive Gaussian noise. Specifically, for conditional Shannon entropy, its upper bound is given by Fano's inequality and lower bound is: H(X|Y ) ≥ ϕ * (P s (X|Y )) where

	9.4 Good Definition of α-Information
	ϕ * (s) = 1 s s 1 s -1 log 1 s + 1 -1 s s 1 s -1 log 1 s .	(9.17)
	While for conditional Arimoto-Rényi entropies, the upper bound and lower bound are given by
	Sason et al. [142]. Particularly, H α (X|Y ) ≥ α 1-α log φ * α (P s (X|Y )), where
	φ * α
	(9.16)

α 1/α dy .

  .29)9. TOWARDS EXACT ASSESSMENT OF SIDE-CHANNEL LEAKAGEWe say that a sequence of random variables forms a conditional Markov chain given some random variable T if it is Markov for any T = t.

	Property 3 (DPI for Conditional α-Information [99]). If W -X -Y -Z forms a conditional Markov chain given T , then
	I α (X; Y |T ) ≥ I α (W ; Z|T ).	(9.30)
	It is noteworthy that, firstly, the consistency property provides a continuous connection to
	unconditional Sibson's α-information. Secondly, we are especially interested in UEP since in
	cryptographic applications, the sensitive variable is usually discrete and uniformly distributed,

say X ∼ U(M ). Therefore, it enables us to derive some straightforward but non-trivial bounds on how much information an adversary could infer knowing certain leakages. At last, DPI allows us to apply the conditional α-information to several communication channel-based frameworks

Eurosmart, https://www.eurosmart.com/2019-shipments-and-2020-outlook/

In the sequel, we call the code-based masking in the most general scenario for simplicity.

Note that the success rate is evaluated 10, 000 times to be more accurate and the curve is much smoother.

CONTRIBUTIONS

Note that the only criteria is the highest minimum Hamming distance[158].

Note that Equ. 5 in[START_REF] Poussier | Connecting and Improving Direct Sum Masking and Inner Product Masking[END_REF] contains a mistake, namely G should be (I , 0, . . . , 0), and not (1, . . . , 1, 0, . . . , 0).

It is worth noting that Pearson correlation coefficient is invariant under affine transformation, although authors used the centered product in[START_REF] Prouff | Statistical Analysis of Second Order Differential Power Analysis[END_REF] to launch the correlation power analysis (CPA).

This code corresponds to the Boolean masking where α

= α 0 = 1 and H = (1, 1).2 There are

codes (including equivalent codes) with d ⊥ D = 3 and min B 3 = 1[START_REF] Cheng | Optimal Linear Codes for IPM[END_REF].

The normalization by ln 2 allows the mutual information expressed in bits instead of nats.

From viewpoint of coding theory as described in Sec. 3.1.

As an example, this irreducible polynomial is used to construct the optimal codes in[33].

MEASURING THE LEAKAGES IN IPM AND OPTIMAL CODES

We consider the improved IPM[2] rather than the original one[4], since firstly, there exist some first-order information leakages in the latter[START_REF] Prouff | On the Practical Security of a Leakage Resilient Masking Scheme[END_REF], and secondly the performance of the latter is much lower than the former, which makes it impractical.

As a special case of IPM, a Boolean masking can be obtained by taking α i = 1 for 1 ≤ i ≤ t in Tab. 5.1.

In[START_REF] Wang | Efficient and Private Computations with Code-Based Masking[END_REF], a special case is presented with t > d ⊥ D -1. However, we always have t = d ⊥ D -1 if the optimal codes are used in GCM. Especially, the equality holds for all RS codes in SSS-based masking.

The normalization by ln

allows the mutual information to be expressed in unit of bits.

The data in Tab. 6.1 is formally verified by Magma [158]. Moreover, the scripts for calculating B d are also available on Github[START_REF] Cheng | Open-source: Quantifying Information Leakages in GCM[END_REF].

= 8,

637, 487, 551 candidates in total). In addition, the reason for taking α 2 = α 8 is that (1 α 8 ) ∈ F 2 2 8 is one of the optimal code for (2, 1)-SSS based masking.

We use H for entropy of both discrete and continuous variables, although h is used more frequently for differential entropy of a continuous variable.

We remove "mutual" in α-information since in general: Iα(X; Y ) = Iα(Y ; X).

We use term maximal information to highlight the essential meaning of "information" in reducing uncertainty, e.g., in guessing games, side-channel analysis, etc. Another similar notion proposed in[START_REF] Issa | An Operational Approach to Information Leakage[END_REF] is called maximal leakage. In a nutshell, maximal leakage shall be larger than maximal information in conditional scenarios.

Acknowledgments

My special thanks to the Chinese Scholarship Council (CSC) and Télécom Paris. CSC offered me a scholarship which covered my living expenses for three years. Moreover, Télécom

LIST OF FIGURES

Part IV

Masked Cryptographic Implementations: Attacks and Information-Theoretic Bounds CHAPTER 7

Optimal Attacks in the Presence of Code-based Masking

In this chapter, we present the results of higher-order optimal attacks against protected cryptographic implementations by the code-based masking. Part of work presented in this chapter is under submission (see [CGD21] in publication list). As mentioned previously, the simulated traces are L = (L j i ) for 1 ≤ i ≤ n and 1 ≤ j ≤ q where L j i = w H (Z j i ) + N j i denotes the leakage of i-th share in j-th trace. The evaluation metric is the minimum number of traces achieving P s ≥ 95%, which integrates the success rate along with different noise levels. The main takeaway point from Fig. 7.3 is that, IPM with the linear code of the maximized dual distance d ⊥ D and the minimized kissing number B d ⊥ D indeed has the best achievable sidechannel resistance. The attack-based evaluation also confirms: 1) all 2-share IPM are better than the first-order Boolean masking (with n = 2); 2) good choices of linear codes of 2-share IPM can even be better than the second-order Boolean masking (with n = 3) when the noise level is σ 2 > 1.0. The reason is that in IPM, the best cases of d ⊥ D is larger and B d ⊥ D is smaller than that in the second-order Boolean masking, respectively; 3) it is also advantageous to adopt 2-share IPM rather than 3-share BM from a performance perspective. For instance, the clock cycles are 157, 196 vs 160, 357 as reported in [3] for an AES-128 implementations on an AVR architecture protected by the former and the latter, respectively.

Optimal Codes for 2-Share IPM. According to Tab. 7.2, there are only 12 optimal codes with the best coding-theoretic properties. For the sake of brevity, we present four cases of [START_REF] Brier | Correlation power analysis with a leakage model[END_REF], (1,[START_REF] Bringer | Orthogonal Direct Sum Masking -A Smartcard Friendly Computation Paradigm in a Code, with Builtin Protection against Side-Channel and Fault Attacks[END_REF], (1,[START_REF] Cheng | Open-source: Quantifying Information Leakages in GCM[END_REF], (1,[START_REF] Cheng | Optimal Linear Codes for IPM[END_REF], (1,[START_REF] Duc | Unifying Leakage Models: From Probing Attacks to Noisy Leakage[END_REF], (1,[START_REF] Kerckhoffs | La cryptographie militaire (1)[END_REF], (1,[START_REF] Nisan | On the degree of boolean functions as real polynomials[END_REF], (1,[START_REF]Data Encryption Standard[END_REF], . . .} d = 4 [START_REF] Rivain | Higher-Order Masking and Shuffling for Software Implementations of Block Ciphers[END_REF][START_REF] Rivest | A Method for Obtaining Digital Signatures and Public-Key Cryptosystems[END_REF], (246, 247)} [START_REF] Bhasin | Side-Channel Leakage and Trace Compression using Normalized Inter-Class Variance[END_REF], (1,[START_REF] Bruneau | Masks Will Fall Off -Higher-Order Optimal Distinguishers[END_REF], (1,[START_REF] Cagli | Convolutional Neural Networks with Data Augmentation Against Jitter-Based Countermeasures -Profiling Attacks Without Pre-processing[END_REF], (1,[START_REF] Camurati | Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers[END_REF], (1,[START_REF] Cardoso | Dependence, Correlation and Gaussianity in Independent Component Analysis[END_REF], (1,[START_REF] Chari | Towards Sound Approaches to Counteract Power-Analysis Attacks[END_REF], (1,41), (1,42), . . .} d = 5 (2,[START_REF] Wang | Efficient and Private Computations with Code-Based Masking[END_REF], (5,[START_REF] Schindler | A Stochastic Model for Differential Side Channel Cryptanalysis[END_REF], (8,[START_REF] Amedeo | On conditional sibson's α-mutual information[END_REF], (8,232), [START_REF] Bhasin | Analysis and improvements of the DPA contest v4 implementation[END_REF][START_REF] Bhasin | Analysis and improvements of the DPA contest v4 implementation[END_REF], [START_REF] Chabanne | Linear repairing codes and side-channel attacks[END_REF]232), [START_REF] Hanley | Correlation Power Analysis of Large Word Sizes[END_REF][START_REF] Rivest | A Method for Obtaining Digital Signatures and Public-Key Cryptosystems[END_REF]} [START_REF] Carlet | Achieving side-channel high-order correlation immunity with leakage squeezing[END_REF], (1,[START_REF] Chari | Template attacks[END_REF], (1,[START_REF] Clavier | Differential Power Analysis in the Presence of Hardware Countermeasures[END_REF], (1,[START_REF] Cooper | Test Vector Leakage Assessment (TVLA) Methodology in Practice[END_REF], (1,[START_REF] Gierlichs | Templates vs. Stochastic Methods[END_REF], (1,77), (1,[START_REF] Lipp | Meltdown: Reading Kernel Memory from User Space[END_REF], (1,[START_REF] Mather | Does my device leak information? an a priori statistical power analysis of leakage detection tests[END_REF], . . .} d = 6 [START_REF] Prouff | Theoretical and practical aspects of mutual information-based side channel analysis[END_REF][START_REF] Prouff | Theoretical and practical aspects of mutual information-based side channel analysis[END_REF]} where α i for 1 ≤ i ≤ n are also called public points in SSS-based masking. The corresponding scheme is also denoted as (n, t)-SSS based masking.

OPTIMAL ATTACKS IN THE PRESENCE OF CODE-BASED MASKING

From a coding-theoretic perspective, the SSS scheme is connected to the Reed-Solomon (RS) code. Given the two generator matrices as in Eqn. 7.15, the rank of H equals t, so the dual distance of D is t + 1 [35]. Accordingly, the side-channel security order in the word-probing model is t w = t.

Optimal Distinguishers

Recall the form of H in Eqn. 7.15 that, there are n public points to be determined in SSS-based masking. However, the masking itself is in the t-th order.

Similarly as in IPM, the optimal distinguisher is determined by applying the ML rule. (7,[START_REF] Csiszár | Generalized cutoff rates and Rényi's information measures[END_REF], (7,[START_REF] Moradi | A Comparative Study of Mutual Information Analysis under a Gaussian Assumption[END_REF], (7,[START_REF] Sibson | Information radius[END_REF], (7,198), [START_REF] Cheng | Detecting Faults in Inner Product Masking Scheme -IPM-FD: IPM with Fault Detection[END_REF]84), [START_REF] Cheng | Detecting Faults in Inner Product Masking Scheme -IPM-FD: IPM with Fault Detection[END_REF][START_REF] Paul | Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems[END_REF], [START_REF] Cheng | Detecting Faults in Inner Product Masking Scheme -IPM-FD: IPM with Fault Detection[END_REF][START_REF] Abe | DPA Contest[END_REF]

OPTIMAL ATTACKS IN THE PRESENCE OF CODE-BASED MASKING

Experimental Results

With the same setting as in evaluation of IPM, the simulated traces are L = (L j i ) for 1 ≤ i ≤ n and 1 ≤ j ≤ q where L j i = w H (Z j i ) + N j i denotes the leakage of i-th share in j-th trace. For linear codes of different d ⊥ D shown in Tab. 7.6, we choose both the minimum and the maximum of B d ⊥ D . The evaluation results of (3, 1)-SSS based masking are shown in Fig. 7.6 by using up to q = 100, 000 traces. Moreover, we include Boolean masking (BM) with n = 2 and n = 3 shares in comparison.

From Fig. 7.6, the most important takeaway point is that the public points in (3, 1)-SSS based masking make a significant difference in side-channel resistance of the corresponding masking scheme. Furthermore, we can observe that: 1) with dedicated selection of good linear codes, the side-channel resistance of the scheme can be improved significantly; 2) comparing with the attack-based evaluation on 2-share IPM, the side-channel security of (3, 1)-SSS based masking is degraded because of the redundancy, which is consistent with our information-theoretic evaluation in Chap. 6; 3) similarly as in 2-share IPM, the best codes can provide comparable security level as 3-share BM when the noise level is higher enough (e.g., σ 2 ≥ 5.0); 4) for the first time, we show that with bad choices of the code, the security level of (3, 1)-SSS based masking can be continuously lower than 2-share BM.

In the sequel, we further leverage the last two points by providing more instances of the optimal and the worst codes for (3, 1)-SSS based masking, respectively.

Optimal Codes for (3, 1)-SSS based Masking. According to Tab. 7.6, there are only three cases of optimal codes. The evaluation results are depicted in Fig. 7.7. It is more obvious CHAPTER 8

Information-Theoretic Bounds on Attacks

Measuring the information leakage is critical for evaluating practical security of cryptographic devices against side-channel analysis. More straightforwardly, it is interesting to have an upper bound on success rate of any attack given a (fixed) number of side-channel measurements.

Or conversely, we wish to derive a lower bound on the number of queries for a given success rate of optimal attacks. In this chapter, we derive several bounds in both directions by using information-theoretic tools, particularly for cryptographic implementations protected by masking schemes. We show that a generic upper bound on the probability of success, irrespective of specific attacks, is linked to mutual information between side-channel measurements and the secret. Moreover, our numerical evaluation confirms that, the success rate of optimal maximum likelihood distinguishers is tightly bounded given a fixed number of measurements.

Part of results shown in this chapter has been presented in [41] (preprint on ArXiv).

Introduction

Since the seminal work by Kocher et al. [START_REF] Paul | Differential power analysis[END_REF], side-channel analyses (SCAs) have been one of the most powerful attacks against cryptographic devices in practice. They exploit physical observable information leakages like instantaneous power consumption [START_REF] Paul | Differential power analysis[END_REF] or electromagnetic radiation [START_REF] Gandolfi | Electromagnetic analysis: Concrete results[END_REF] to recover the secrets used in cryptosystems. From an adversary's perspective, many attacks (distinguishers) have been proposed to exploit various leakages and there are several metrics to compare them in a fair way [START_REF] Standaert | A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks[END_REF]. However, bounding how (any) side-channel attack succeeds

is still an open problem. In other words, given a set of side-channel measurements, we seek a generic upper bound on the success rate of any attack. In this respect, Chérisey et al. [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF] propose several bounds on the key extraction success rate by using information-theoretic tools, which are tight in assessing unprotected cryptographic implementations.

To counteract SCAs, many countermeasures are proposed wherein masking is a wellestablished one which provides provable security [86,[START_REF] Prouff | Masking against Side-Channel Attacks: A Formal Security Proof[END_REF]. Indeed, the number of measurements for a successful attack against masked implementations is exponential to the masking order (e.g., the number of random masks per sensitive variable) provided with a sufficient amount of noise [START_REF] Duc | Making Masking Security Proofs Concrete -Or How to Evaluate the Security of Any Leaking Device[END_REF]. However, the lower bounds proposed in [START_REF] Duc | Making Masking Security Proofs Concrete -Or How to Evaluate the Security of Any Leaking Device[END_REF][START_REF] Prouff | Masking against Side-Channel Attacks: A Formal Security Proof[END_REF] are demonstrated by approximations and inequalities, resulting in loose bounds on the number of traces needed for a given success rate. Moreover, as we will show in this chapter, those bounds on success rate given in [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF] by using mutual information (MI) for several measurements are also very loose when targeting protected cryptographic implementations.

In this chapter, we aim at providing tight bounds on the success rate of any SCA by leveraging information-theoretic tools. To do so, we consider a similar communication-channel framework We apply Theorem 8.1 into the masked case. Numerical results are shown in Fig. 8.6 where we present several instances with different levels of Gaussian noises. In particular, the ML attacks utilize the higher-order distinguishers which have been demonstrated to be optimal in the presence of masking [START_REF] Bruneau | Masks Will Fall Off -Higher-Order Optimal Distinguishers[END_REF]. In order to evaluate P s of ML attacks, each attack is repeated 200 times to have a more accurate success rate.

As shown in Fig. 8.6, the bound given by I(U; Y|T) is very tight. Indeed, a commonly used metric on attacks is the minimum number of traces to reach P s ≥ 95%. Considering σ 2 = 3.00 in Fig. 8.6, we set P s = 95% and the ML attack needs around q = 800 traces, where our new bound gives q = 720, while the bound proposed in [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF] by using I(X; Y|T) only gives q = 12.

Furthermore, the latter bound would be much looser when the noise level continues to increase.

A more detailed comparison is depicted in Fig. 8.7, which shows the predicted minimum numbers of traces reaching P s ≥ 95% given by both I(U; Y|T) and I(X; Y|T). These curves show that our new bound is much tighter than the previous one from the state-of-the-art, as it captures the masking scheme (recall from Fig. 8.1 that the masking countermeasure step is between U and Y but not between X and Y). bound) of traces needed to achieve this P s . The twined problems are unified by Theorem 8.1, knowing the one direction gives the bound for the other one. Accordingly, inverse to Fig. 8.9, we can plot the predicted number of traces to achieve P s ≥ 95% as in Fig. 8.10. We also add the prediction by I(X; Y|T) [START_REF] Éloi De Chérisey | Best Information is Most Successful -Mutual Information and Success Rate in Side-Channel Analysis[END_REF][START_REF] Éloi De Chérisey | An informationtheoretic model for side-channel attacks in embedded hardware[END_REF] in comparison. Note that several points in Fig. 8.10(c) and 8.10(d) are missing since q min are already exceed 5000 in corresponding noise levels.

As shown in Fig. 8.10, the lower bound on q min given by I(U; Y|T) is much tighter than that given by I(X; Y|T). Consequently, It is recommended to utilize the bound given by I(U; Y|T) rather than I(X; Y|T) in the presence of masking.

In order to show the exponential properties, we depict in Fig. 8.11 with the number of traces in normal scale. More apparently from Fig. 8.11, the inherent properties of higher algebraic complexity in IPM significantly improve the side-channel resistance when empowered by optimal linear codes. When moving to redundant code-based masking, for instance in SSS-base masking, those optimal codes also achieve the best protection against SCA, while bad codes may degrade the protection as already demonstrated in Chap. 7.

Part V

Generic Information-Theoretic Measures and Applications to Side-Channel Analysis

Guessing with Noisy Leakages

In fact, noise is the intrinsic part in the side-channel leakages, like in the power consumption and electromagnetic radiations. Thus we consider the noisy leakages in a classic way by assuming the noise is the additive white Gaussian noise (AWGN), which is a common noise model to Definition 9.3 (Rényi Divergence [START_REF] Rényi | On measures of entropy and information[END_REF][START_REF] Rioul | A primer on alpha-information theory with application to leakage in secrecy systems[END_REF][START_REF] Van Erven | Rényi divergence and Kullback-Leibler divergence[END_REF]). Let p, q be distributions such that p q is well defined. The α-divergence, or Rényi divergence of order α ≥ 0 is defined for 0 < α < +∞ and α = 1 as

where X ∼ p(x). In particular, if p and q are binary distributions, say (p, 1p) and (q, 1q), respectively, then the binary α-divergence is:

Then we present Sibson's α-information and identity.

Definition 9.4 (Sibson's α-Information [START_REF] Csiszár | Generalized cutoff rates and Rényi's information measures[END_REF][START_REF] Sibson | Information radius[END_REF][START_REF] Verdú | α-mutual information[END_REF]). Let p, q be distributions such that p q is well defined as above. The Sibson's α-information of order α ≥ 0 is defined for 0 < α < +∞ and α = 1 as

TOWARDS EXACT ASSESSMENT OF SIDE-CHANNEL LEAKAGE

• Uniform expansion property (UEP): if X is discrete uniformly distributed (p(x) = 1 M ), we obtain I α (X; Y ) = log M -H α (X|Y ). This links α-information to conditional α-entropy.

• Data processing inequality (DPI): if X -Y -Z forms a Markov chain, we have the data "postprocessing" inequality (post-processing cannot increase information): I α (X; Z) ≤ I α (X; Y ), and the data "pre-processing inequality" (pre-processing cannot increase information):

In summary, Sibson's α-information provides a continuous extension from Shannon mutual information to the parametric one by order α for α > 0 and α = 1. However, in the context of side-channel analysis, an adversary usually is allowed to know some public information, for instance plaintexts or ciphertexts when targeting cryptographic algorithms or implementations.

Therefore, it is critical to define the conditional version of α-information.

Extending to Conditional α-Information

As a natural continuation of the definitions in the preceding section, we define the conditional αinformation with a "log-expectation" closed-form expression, obtained by taking the expectation over the conditional variable inside the logarithm in Eqn. 9.22, the expression of Sibson's (unconditional) α-information.

Rényi entropy and divergence are well-known generalizations of Shannon's entropy and Kullback-Leibler divergence: Definition 9.6 (Compact Representation of Rényi Entropy and Divergence [START_REF] Liu | On Conditional α-Information and its Application to Side-Channel Analysis[END_REF]). Assume that either 0 < α < 1 or 1 < α < +∞. The α-entropy of a probability distribution P and α-divergence of P from Q are defined as

where we have used the special notation:

with the following convention: All considered probability distributions P, Q possess a dominating measure µ such that P µ and Q µ, the corresponding lower-case letters p, q are densities of P, Q with respect to µ.

Therefore, we shall have the following definition for α-information.

Conclusions

In this chapter, we aim at measuring information leakage by utilizing more general informationtheoretic measures instead of Shannon information measures. We show first how the Hamming weight leakage is assessed by conditional α-entropy in both noiseless and noisy cases. In particular, we illustrate that the leakage quantification will be more accurate when the order α is larger enough.

More importantly, we present how the conditional α-information is applied in assessing the side-channel leakage. In this respect, we show a full spectrum of bounds given by conditional α-information with different orders. The outputs are twofold. On one hand, the success rate of any key-recovering attack is upper bounded by the conditional α-information between the sensitive variable and the corresponding leakage. We therefore, for the first time, provide a supremum of empirical success rate of any attacks. On the other hand, the minimum number of traces that achieves a specific success rate is lower bounded by the conditional α-information.

Again, the bound is tight when the order α is larger enough, meaning that optimal attacks can reach this bound, e.g., by utilizing maximum-likelihood based distinguishers.

APPENDIX A

Further Proofs, Lemmas and Discussions

A.1 Detailed Proofs

Before presenting these proofs, we recall below two well-known properties of Fourier transform.

We omit the proofs for the sake of brevity and refer to [START_REF] Carlet | Boolean Functions for Cryptography and Error Correcting Codes: Chapter of the monography Boolean Models and Methods in Mathematics[END_REF] for details. • For any variable X, we have that:

V