Rina Zeitoun

Agathe Beaugrand

Jean-Sébastien Coron

Marc Gourjon

Loïc Masure

Charles Momin

Maximilian Orlt

Emmanuel Prouff

Jürgen Pulkus

Rafael Carrera

Louiza Khati

Ange Martinelli

The masking countermeasure is among the most potent countermeasures to counteract sidechannel attacks. Leakage models have been exhibited to theoretically reason on the security of such masked implementations. So far, the most widely used leakage model is the probing model, but it has been recently challenged as it does not fully capture the capabilities of a side-channel adversary. To capture a broader class of attacks, another model was introduced, referred to as the random probing model. From a leakage parameter p, each wire of the circuit leaks its value with probability p. The random probing model enjoys practical relevance thanks to a reduction to the noisy leakage model, which is admitted as the suitable formalization for power and electromagnetic side-channel attacks. In addition, the random probing model is much more convenient than the noisy leakage model to prove the security of masking schemes.

In this thesis, we study more closely the random probing model and define the first framework dedicated to it. We formalize a composition property for secure random probing gadgets and exhibit its relation to the strong non-interference (SNI) notion used in probing security. We then revisit the expansion idea proposed by Ananth, Ishai, and Sahai (CRYPTO 2018) and introduce a compiler that builds a random probing secure circuit from small base gadgets, achieving a random probing expandability (RPE) property. We then provide an in-depth analysis of the RPE security notion, allowing us to obtain much more efficient instantiations of the expansion technique, with constructions tolerating a leakage probability of up to 2 -7 , against 2 -26 for the previous construction and an improved complexity of O(κ 3.2 ) against O(κ 7.87 ) for the previous constructions, where κ is the security parameter. We also show that our constructions achieve a quadratic complexity in κ asymptotically as the number of shares grows. Further attempts to optimize constructions include generalizing the RPE approach by considering a dynamic choice of the base gadgets at each step in the expansion. We show that such techniques can further reduce the complexity from quadratic to quasi-linear while tolerating good leakage rates.

Finally, we introduce IronMask, a new versatile verification tool for masking security. Iron-Mask is the first to verify standard simulation-based security notions in the probing model and recent notions in the random probing model. It supports any masking gadgets with linear randomness (e.g., addition, copy, and refresh gadgets) as well as quadratic gadgets (e.g., multiplication gadgets) that might include non-linear randomness (e.g., by refreshing their inputs) while providing complete verification results for both types of gadgets.

We conclude this thesis by discussing other research projects in the random probing model and suggestions for future works. lots of second-degree jokes. Jules, although not always fruitful, your attempt at making jokes is much appreciated. I finally thank Lucas Ottow for the fun moments during Journées C2.

Moreover, I am thankful to Camille Mutschler, a fellow PhD student I met at the beginning of my journey, and we instantly clicked. Having started working in the side-channel field simultaneously, we have had the opportunity to share many conferences, collaborate on exciting projects, and share memorable moments as friends, not just colleagues. It is rare to find lasting friendships, and I am grateful for this one.

My research is the fruit of collaboration with researchers I was grateful to meet throughout my PhD. I sincerely thank François-Xavier Standaert again for hosting me in his lab and teaching me many things about the practical side of side-channel attacks. Working with him was a great pleasure. I am also thankful to Gaëtan Cassiers for our collaborations

Résumé

La contre-mesure de masquage fait partie des contre-mesures les plus puissantes contre les attaques par canaux auxiliaires. Des modèles de fuite ont été introduits pour raisonner théoriquement sur la sécurité de telles implémentations masquées. Jusqu'à présent, le modèle de fuite le plus largement utilisé est le modèle nommé "probing", mais il a été récemment remis en question car il ne rend pas pleinement compte des capacités d'un adversaire par canaux auxiliaires. Ainsi, un autre modèle a été introduit, appelé "random probing". Dans ce modèle, à partir d'un paramètre de fuite p, chaque fil du circuit fuit sa valeur avec probabilité p. Le modèle random probing est pratique grâce à sa réduction au modèle "noisy leakage", qui est admis comme la formalisation appropriée pour la fuite pendant les attaques par canaux auxiliaires. De plus, le modèle random probing est bien plus pratique que le modèle noisy leakage pour prouver la sécurité des implémentations masquées.

Dans cette thèse, nous étudions de plus près le modèle random probing et définissons le premier cadre qui lui est dédié. Nous formalisons une propriété de composition pour les gadgets sécurisés dans ce modèle et montrons sa relation avec la notion de non-interférence forte (SNI) utilisée dans le modèle de sécurité "probing". Nous revisitons ensuite l'idée d'expansion proposée par Ananth, Ishai et Sahai (CRYPTO 2018) et introduisons un compilateur qui construit un circuit sécurisé dans le modèle random probing à partir de petits gadgets de base. Nous proposons ensuite une analyse approfondie, permettant d'obtenir des instanciations beaucoup plus efficaces de la technique d'expansion, avec des constructions tolérant une probabilité de fuite allant jusqu'à 2 -7 , contre 2 -26 pour les constructions précédentes et une complexité améliorée de O(κ 3.2 ) contre O(κ 7.87 ) pour les constructions précédentes, où kappa est le paramètre de sécurité. Nous montrons également que nos constructions atteignent une complexité quadratique en κ asymptotiquement en augmentant le nombre de partages pendant le masquage. D'autres tentatives d'optimisation des constructions incluent la généralisation de l'approche en considérant un choix dynamique des gadgets de base à chaque étape de l'expansion. Nous montrons que de telles techniques peuvent réduire davantage la complexité du quadratique au quasi-linéaire tout en tolérant de bons taux de fuite.

Enfin, nous présentons IronMask, un nouvel outil de vérification polyvalent pour la sécurité des circuits masqués. IronMask est le premier à vérifier les notions de sécurité standard basées sur la simulation dans le modèle probing et les notions récentes du modèle random probing. Il prend en charge tous les gadgets masqués qui utilisent des variables aléatoires de façon linéaire (par exemple, les gadgets d'addition et de copie) ainsi que les gadgets quadratiques (par exemple, les gadgets de multiplication) qui peuvent inclure des variables aléatoires non linéaires, tout en fournissant des résultats de vérification complets. pour les deux types de gadgets.

Nous concluons cette thèse en discutant d'autres projets de recherche dans le modèle random probing et en suggérant des travaux futurs.

It is a privilege in this world to be able to dream, to laugh, to love. It is a privilege to sleep in peace without worrying about when all of it could vanish. It is a privilege to have an ambition, a goal, and people who love and support you along the road. I am privileged to have had the opportunity to pursue and finish a PhD, and I couldn't have done it alone.

First, I would like to thank Sebastian Faust and Svetla Nikova for reviewing my manuscript. I would also like to thank Benjamin Grégoire, François-Xavier Standaert, and Rina Zeitoun for accepting to be the examiners of my jury.

Then, I would like to thank my PhD director, Damien Vergnaud, who started as my teacher and then my internship advisor before allowing me to do a PhD and guiding me to CryptoExperts. I owe him this success, and I sincerely appreciate his humane and fatherly side, in addition to the professionalism that I got to see.

I would also like to thank my advisors at CryptoExperts, Matthieu Rivain, and Sonia Belaïd, who have taught me so much and trusted me with many projects during the past three and a half years. It always felt like collaborative work with them, not an advisorstudent relationship, which made everything more efficient and productive. I would also like to thank them for their emotional support. I thank Sonia for her encouraging messages after every accomplishment or supportive messages whenever things are slightly derailed. I thank Matthieu for never doubting me for a second. I can't help but think of the amount of trust he gave me during the CRY.ME project, which I valued very much. But I also thank both of them for the exciting scientific and social discussions we always had and the fun we shared during many team buildings (It's not every day that you get to do a karaoké with your supervisors!).

Next, I would like to thank my past and present colleagues at CryptoExperts, with whom I shared lunches, bars, or fun moments at team buildings. We taught each other about our different cultures, which always made a place for interesting discussions. I think of Ryad Benadjila, Nicolas Bon, Thibauld Feneuil, Bruno Gonzalez, Louis Goubin, Darius Mercadier, Viet-Sang Nguyen, Pascal Paillier, Ronan Thoraval, Matthias Trannoy, Aleksei Udovenko, Junwei Wang (and of course, Matthieu and Sonia).

I am lucky to have had two teams of colleagues, the ones at CryptoExperts and the ones at ALMASTY and LIP6. I had exceptional moments with my ALMASTY team, enjoying board games, conferences, retreats, and much more. Of course, I thank Damien Vergnaud as my director. But I also thank Ahmed Khulaif Alharbi, whom I met at the end of my Ph.D. and who has already shown me so much kindness. I thank Florette Martinez for her help whenever I needed it, Ambroise Fleury for his adventurous spirit, and Charles Bouillaget for the insightful discussions. I thank Mickaël Hamdad and Julia Sauvage, whom I first met as students before becoming ALMASTY colleagues, which is a transition that I much appreciated. I thank Andersson Calle Viera, with whom I shared terrific moments at conferences and a common interest in the side-channel field. I thank Orel Cosseron for the shared culinary passion we have. Finally, I thank Samuel Bouaziz-Ermann and Jules Maire for the second-degree jokes, I already had experience in the research field before my Ph.D. I thank Alice Othmani for my first-ever scientific publication, which has already taught me so much about how to write good papers. I also thank Professor Noboru Kunihiro for being my supervisor during my exchange program in Tokyo, which was my first research experience in the side-channel field. I thank him for his interest in my PhD work and inviting me to talk in his seminars and workshops.

I couldn't have achieved anything without some close people constantly being by my side. My mother, sister, and two brothers, I love you, and thank you for being by my side. Through the ups and downs, we have always made the best out of it. Knowing someone is always there to catch me if I fall is comforting. I cherish our moments together and hope that we stay united no matter what. My father, I dedicate all this success and hard work to your soul. You have looked out for us and helped us get to where we are now. I hoped you would see me now, but life had other plans. You are always with us and in our hearts. I am thankful for my long-lasting friendship with Talal Afyouni. I am blessed to have someone in my life whom I don't have to fake any feeling around, who sees my angriness, happiness, sadness, and craziness and still takes the whole package. It was relieving that I could be myself around him during my moments of defeat or despair, where I had to force a smile around others. We have grown together, learned together, and were reunited again in another country, only to prove that we are meant to last. I will always be short of words to describe our relationship, so I can only say thank you.

I am also profoundly thankful to Arij Riabi. We met during our bachelor's but quickly bonded and developed a solid, hard-to-break friendship. Our shared struggle of studying abroad only made us stronger. Our bad jokes that only we find funny are one of our pillars. We are different yet have much in common, and our mutual trust and feelings are indestructible. It is one of those friendships you know will never fade away, the ones you live and thrive for. For that, I am always indebted. I thank Quentin Bernier for always being there and looking out for me. I thank him for putting up with me whenever I struggled. I also thank him for our pleasant moments and shared interests. I am happy to have another good one in my circle and wish that our bond only grows stronger. Quentin, as I unintentionally stole your thunder by having my defense on your birthday, I wish you a very happy birthday and a year full of success.

I also thank Ivana and François Garlot for being good friends and sharing great evenings with me. It was my means of escape from work and anxiety on several occasions. Finally, I thank Snookie for being an extremely annoying and adorable cat.

Chapter 1

Introduction

Cryptography Then and Now

We all have secrets, and we all look for privacy. This constant desire for protection gave birth to cryptography, the art of message encryption. Cryptography protects information and communications through codes, hiding a message from anyone who is not supposed to read it. It existed way before the emergence of computers. The ancient Greeks, for instance, are believed to have used the scytale as a method of transposition cipher during military campaigns. The scytale is a cylinder with a strip of parchment wound around it. To encrypt a message into a ciphered one, one can write it on the leather piece wrapped around the rod and then unwrap it. To decrypt the ciphered message (i.e. retrieve the original message), one needs the rod with the correct diameter to wind the strip and read the message. If an incompatible cylinder is used, the message appears as a set of randomly chosen letters. As simple as the technique may seem, it proves that humans have always looked for ways to secure communications.

Like everything else, cryptography has evolved into a much broader field, especially with the rise of technology and modern computers. In the digital world, modern cryptography is a branch of applied mathematics and computer science. It implements encryption algorithms as programs relying on mathematical tools. These algorithms should prevent attackers and eavesdroppers from breaching the privacy of communications. Modern cryptographic algorithms and protocols follow Kerckhoff's law by being public, with a secret parameter called the key being the only secret element. Essentially, anyone with access to this secret key is authorized to participate and read the communication, while it is computationally impossible for someone without the key to do the same. The computational impossibility is a widely admitted principle in the conception of modern cryptography. This impossibility is because cryptosystems rely on mathematical problems that are difficult to solve in a reasonable time without access to the secret parameter. In this case, one can only hope to break such a cryptosystem using an exhaustive key search (or brute force attack), which comes with exponential complexity in the security parameters and becomes quickly impossible to use. Nowadays, cryptography aims at providing confidentiality, integrity, and authentication. Confidentiality means no one can read private messages except for authorized parties, while integrity ensures that unauthorized parties can not modify the data. Finally, authentication allows the receiver to check the identity of the sender of a message. In addition to all of these properties, digital signatures of electronic documents can ensure non-repudiation like a handwritten signature: the author of a signature cannot deny it afterward. With the development of modern cryptography, many other security features were rendered possible such as secure multiparty computations, group signatures, etc.

From Black-Box to Gray-Box Security

Cryptographic primitives are considered secure based on the hardness of the mathematical problems they use. This security is considered in what we call the black-box setting, where an adversary only has access to the inputs and outputs of the algorithm. However, these algorithms are implemented on physical devices vulnerable to side-channel attacks as revealed in the late nineties [START_REF] Paul | Timing attacks on implementations of Diffie-Hellman, RSA, DSS, and other systems[END_REF]. These attacks allow an adversary to measure physical quantities emanating from the device, revealing information about sensitive data in many cases. Such observations are made in the gray-box setting and can be the execution time, device temperature, power consumption, or electromagnetic radiations during the algorithm execution. In the gray-box model, one must analyze the implementation of a cryptosystem on the considered device, including data representation, function calls, and data manipulation.

Attacking the physical implementation of cryptosystems has gained much popularity since the discovery of side-channel attacks. More generally, we identify a family of physical attacks ranging from passive attacks, such as side-channel attacks as mentioned earlier, and more active attacks, such as fault attacks, where an attacker can tamper with the physical device and inject faults to alter the execution of the algorithm, potentially resulting in the reveal of secret information.

Masking Against Side-Channel Attacks

Since the discovery of side-channel attacks, several countermeasures have been studied to protect cryptographic algorithms. Among the different approaches, one of the most widely used is known as masking, simultaneously introduced by Chari, Jutla, Rao, and Rohatgi [START_REF] Chari | Towards sound approaches to counteract power-analysis attacks[END_REF], and by Goubin and Patarin [START_REF] Goubin | DES and differential power analysis (the "duplication" method)[END_REF] in 1999. It consists in splitting a sensitive variable x into n random shares, among which any combination of n -1 shares does not reveal any secret information. This can be achieved by generating n-1 shares uniformly at random x 1 , . . . , x n-1 and computing the last share x n so that x = x 1 * . . . * x n-1 * x n according to some group law * . We call n the number of shares and n -1 the masking order. When working on F 2 , we refer to the masking as Boolean masking and use the operation +. The masking order refers to the value n -1. The motivation of masking is to make it more difficult for an attacker to recover a secret by manipulating the shares instead of the sensitive value. Since each observation comes with noise, increasing the number of shares makes it harder to recover the secret, under some hypotheses on the leaking device. We optimally would like the security level to increase as we increase the number of shares n. Meanwhile, proving or validating such security levels in practice is not trivial.

When manipulating variables as n shares, one needs to adapt operations to preserve the security under the masking scheme while avoiding recombinations of shares. Indeed, such recombinations can sometimes lead to more revealed information about the secrets. Let us take an example of a simple addition + operation over some group and n-shared variables (x 1 , . . . , x n ) and (y 1 , . . . , y n ). Originally, to get the result of the addition, one performs x + y. An attacker observing side-channel measurements then tries to target the moment the value x + y is computed during the leakage trace. When dealing with the shared variables, we can compute the addition as a shared variable (z 1 , . . . , z n ) such that the recombination of the shares gives the desired result x + y, that is z 1 + . . . + z n = x + y. For instance, we can compute the addition sharewise as z 1 = x 1 + y 1 , . . . , z n = x n + y n .

In this case, an attacker must target the computation of each sharewise addition to retrieve the result x + y. A less secure way to compute this addition is, for instance, by doing z 1 = x 1 + . . . + x n , z 2 = y 1 + y 2 , z 3 = y 3 , . . . , z n = y n .

Although the shared result still gives z 1 +. . .+z n = x+y, an attacker that can retrieve the value of the first share z 1 from the leakage traces already learns the value of the secret input x. The examples above showcase the importance of careful usage of the masking countermeasure as a misusage can sometimes reduce the security a masked implementation is intended to achieve.

Constructing non-linear computations on shared variables becomes even more complex while trying to avoid share recombinations. For instance, to compute an n-shared multiplication between (x 1 , . . . , x n ) and (y 1 , . . . , y n ), cross-products of the input shares can be performed, resulting in n 2 terms that then must be compressed back into an n-shared result.

In addition, this analysis of masked operations does not consider some physical defaults that can occur on a computing device. For instance, transitions occurring on memory buses or CPU registers between a previously processed value z i-1 and the current one z i usually leak some information correlated to z i-1 ⊕ z i . Such defaults can also lower the initial security level of a masked implementation. The technical difficulties mentioned above give rise to the need for proper and rigorous ways to reason about the security of masked implementations.

Proven Security Against Side-Channel Attacks: Leakage Models

Providing security guarantees against side-channel attacks is generally tricky, and many works try to tackle this issue [START_REF] Duc | Making masking security proofs concrete -or how to evaluate the security of any leaking device[END_REF][START_REF] Journault | Very high order masking: Efficient implementation and security evaluation[END_REF][START_REF] Grégoire | Vectorizing higher-order masking[END_REF][START_REF] Bronchain | Breaking masked implementations with many shares on 32-bit software platforms: Or when the security order does not matter[END_REF]. When dealing with masked implementations, an empirical approach tries to assess the leakage given a certain number of leakage traces, mount well-known attacks, and check that the security is still guaranteed in the considered environment. This technique, however, does not provide a proven security level for a masked implementation. To reason about the security of such implementations in theory and provide security bounds for any circuit, the leakage is generally formalized in so-called leakage models. Ishai, Sahai, and Wagner (ISW) [START_REF] Ishai | Private circuits: Securing hardware against probing attacks[END_REF] first introduced the t-probing model for t < n, where a circuit is secure if the exact values of any set of t intermediate variables do not reveal any information on the secrets. This definition is supposed to reflect the security of masking by assuming that as t grows, an attacker would need more leakage traces to recover the secret, and since leakage traces come with noise, it becomes much more challenging to recover sensitive information. Variants of this model include the robust probing model [START_REF] Faust | Composable masking schemes in the presence of physical defaults & the robust probing model[END_REF] in hardware scenarios, which considers wider leakage to model physical effects such as glitches and transitions. In this scenario, t observations might reveal more than t intermediate computation variables.

Since its introduction, the probing model has been widely used by the community [START_REF] Schramm | Higher order masking of the AES[END_REF][START_REF] Rivain | Provably secure higher-order masking of AES[END_REF][START_REF] Coron | Higherorder side channel security and mask refreshing[END_REF][START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF][START_REF] Coron | High order masking of look-up tables with common shares[END_REF], thanks to it being very convenient to build security proofs. However, it raised several concerns regarding its relevance in practice [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF][START_REF] Groß | Firstorder masking with only two random bits[END_REF]. For instance, the authors of [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF] show that the repeated manipulation of identical values can be exploited to retrieve the secrets in the context of horizontal side-channel attacks. These issues motivated the formalization of the noisy leakage model [START_REF] Prouff | Masking against side-channel attacks: A formal security proof[END_REF]. This model well captures the reality of embedded devices by assuming that each intermediate variable leaks a noisy function of its value. A circuit or implementation is secure in the noisy leakage model if the adversary cannot recover the secrets from a noisy function of each intermediate variable of the implementation. Unfortunately, proving the security of a masking scheme in this model is rather tedious. Duc, Dziembowski, and Faust [START_REF] Duc | Unifying leakage models: From probing attacks to noisy leakage[END_REF] proposed in 2014 a reduction from the noisy model to the t-probing model. The reduction relies on an intermediate leakage model, the random probing model. The latter benefits from a tighter reduction with the noisy leakage model, which becomes independent of the size of the circuit. In a nutshell, it assumes that every wire in the circuit leaks with some constant leakage probability. This leakage probability is related to the amount of side-channel noise in practice. Then, a masked circuit is secure if there is a negligible probability that these leaking wires reveal information about the secrets.

Probing Model: Security and Composition

Proving security properties in the probing and random probing models amounts to exploring a combinatorial number of possible sets of probes and checking that they do not reveal any information about the secrets. For instance, a circuit using n-shared variables is t-probing secure for t < n if the exact values of at most t leaking variables are independent of the secret. Such proofs come in two flavors: generic or exhaustive. Generic proofs are handwritten proofs that reason on the different forms of probes that can occur on the considered circuit. Generic proofs then check that we can not reveal information about the secrets for any considered form of probes. Such proofs do not exhaust all the possible sets of probes but "group" them into categories that can have a common effect on security. Meanwhile, exhaustive proofs, as their name indicates, rely on exhausting all possible sets of probes on the circuit and checking that no information on the secrets is revealed for each such set. When dealing with probing security and uniform input sharings, checking a set of probes is often done by computing the distribution of these probes and checking that it is independent of the distribution of the secrets.

Even in the simple probing model, proving the security of large masked circuits is a challenging problem using generic or exhaustive proofs. The most common solution is to build circuits from smaller sub-circuits named gadgets that implement a simple computation on masked data. Then, these gadgets can be composed to implement more complex computations, and the security proof only needs to care about the properties of the gadgets and their composition. In their seminal work [START_REF] Ishai | Private circuits: Securing hardware against probing attacks[END_REF], ISW introduced such gadgets for Boolean AND and NOT gates. These gadgets can be arbitrarily composed, but this scheme requires masking with n = 2t+1 shares. For performance reasons, the follow-up works primarily focused on using the optimal number of shares n = t + 1. For instance, the type-system of Barthe et al. [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF] makes it possible to securely compose small gadgets that are proven to be (strong) non-interferent. These notions rely on the concept of simulatability. In a nutshell, the simulatability notion consists in constructing an algorithm called the simulator, which can simulate the distribution of a set of probes using some subset of the input shares of each input sharing. For instance, the t-non-interference (NI) notion imposes that the distribution of any set of at most t probes on a circuit or gadget can be simulated using at most t input shares of each n-shared input (with t < n). Observe that this notion does not necessarily suppose the uniformity of the input sharings and that if the latter are uniform sharings, then t-NI automatically implies t-probing security.

The t-strong non-interference (SNI) property is stronger than t-NI and imposes that any set of probes formed of t 1 probes on intermediate variables and t 2 probes on output variables of the gadget such that t 1 + t 2 ≤ t can be simulated using at most t 1 input shares of each input sharing. This property implies t-NI and allows for more efficient composition, especially for multiplication gadgets. However, SNI gadgets for affine operations could be more efficient. This issue was solved by the t-PINI definition (at the expense of slightly less efficient multiplication) [START_REF] Cassiers | Trivially and efficiently composing masked gadgets with probe isolating non-interference[END_REF].

Another direction to improve efficiency is to drop the requirement of arbitrary composition: while direct application of the ISW construction with n = t + 1 is not secure [START_REF] Rivain | Provably secure higher-order masking of AES[END_REF], it can be fixed by adding refresh gadgets (which implement the identity function but re-randomize the sharings). This has been proposed in [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF] with the maskComp tool that can compose weaker non-interferent (NI) gadgets by inserting SNI refresh gadgets (which can be derived from the ISW multiplication) in the circuit. Later, Belaïd, Goudarzi, and Rivain [START_REF] Belaïd | Tight private circuits: Achieving probing security with the least refreshing[END_REF] introduced tight private circuits (TPC), another variant of the ISW scheme with n = t + 1 and additional refresh gadgets. The set of refresh gadgets inserted by their tightProve tool is tight in the sense that removing one of these gadgets is guaranteed to break t-probing security.

A more potent version of the probing model has been considered in the literature, known as the region probing model [START_REF] Andrychowicz | Circuit compilers with O(1/ log(n)) leakage rate[END_REF]. In this model, the adversary is not limited to t probes on the circuit but gets t probes per gadget (or region) of the circuit. This model is relevant in practice as being closer to actual side-channel leakages (providing information on all the gadgets of an implementation) and provides a tighter reduction to the noisy leakage model [START_REF] Duc | Unifying leakage models: From probing attacks to noisy leakage[END_REF] than the probing model. In a recent work [START_REF] Goudarzi | Probing security through input-output separation and revisited quasilinear masking[END_REF], Goudarzi, Prest, Rivain, and Vergnaud introduce the input-output separation (IOS) notion for simple composition in the region probing model. This notion acts as probing-composition scissors: the circuit is divided into regions separated by IOS gadgets whose probes can then be simulated separately.

Another extension of the t-probing model is the t-robust probing model. In the former, the exact values of t circuit variables are supposed to leak independently. However, in practice, physical defaults might generate a leakage of values carried by several wires simultaneously. In that case, a circuit secure in the t-probing model might only be secure in the t -robust probing model for t < t. Typical examples of physical defaults include transitions and glitches, and probes can be extended accordingly. For instance, in glitches, probes might reveal all the variables carried by coming wires up to the last synchronization point. Such probes thus include not only one but a set of wires. Similarly, pairs of values that are successively stored in the same memory cell may leak at once (when the second variable replaces the first one). Therefore, in transition-based leakage, probes are generally assumed to include specific pairs of wires. Hence, in the t-robust probing model, a set of t probes is replaced by a set of t extended probes, which can reveal the exact values of more than t variables. A circuit is then secure in this model if any set of t so-called extended probes is independent of the secret inputs.

A complementary line of research has been considering the optimization of the masked gadgets themselves. This culminated in the design of a (n -1)-NI multiplication gadget with randomness usage n 2 /4+O(n) [START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF] (while the ISW multiplication is (n-1)-SNI and has n 2 /2+ O(n) randomness usage) and a (n -1)-SNI refresh gadget with complexity O(n log n) [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF]. Besides these arbitrary-order gadgets, there have also been many optimizations for low-order gadgets.

Random Probing Model: Security and Composition

Compared to the probing model, the random probing model is closer to the noisy leakage model and, in particular, captures horizontal attacks, which exploit the repeated manipulations of variables throughout the implementation. Classical probing secure schemes are also secure in the random probing model, but the tolerated leakage probability (a.k.a. leakage rate) might decrease with the masking order, which is not satisfactory from a practical viewpoint. Indeed, in practice, the leakage probability translates to some side-channel noise amount that the implementer might not be able to customize. Before this thesis, only a few works have studied constructions in the random probing model. In [START_REF] Ajtai | Secure computation with information leaking to an adversary[END_REF][START_REF] Andrychowicz | Circuit compilers with O(1/ log(n)) leakage rate[END_REF], the authors provide constructions in the random probing model based on expander graphs. The problem with these constructions is that they are conceptually involved, and their practical instantiation is complex. Also, the tolerated probability is not made explicit. Then, in [START_REF] Ananth | Private circuits: A modular approach[END_REF], the authors provide constructions based on multi-party computation (MPC) protocols and an expansion strategy. Their idea is to recursively apply an MPC protocol on a base circuit several times to achieve a desired security level in the random probing model. The authors provide an instantiation based on the Maurer MPC protocol [START_REF] Ueli | Secure multi-party computation made simple (invited talk)[END_REF], and explain that the complexity of the expansion for a circuit with |C| gates is O(|C| • poly(κ)) for some parameter κ but neither the polynomial nor the tolerated leakage probability are made explicit.

Automatic Verification Tools

As discussed in Section 1.5, exhaustive proofs for (random) probing security consist of enumerating a combinatorial number of probes and checking that they are independent of the secret inputs (with simulation-based notions, we must be able to perfectly simulate their distributions without the knowledge of the secret inputs). The manual verification of such properties on small gadgets is very error-prone [START_REF] Coron | Higherorder side channel security and mask refreshing[END_REF]. Therefore, automatic tools are regularly built to apply formal verification on software and hardware masked implementations.

In 2012, Moss et al. [START_REF] Moss | Compiler assisted masking[END_REF] designed the first automatic type-based masking compiler to provide first-order security against DPA. Following this seminal work, Bayrak et al. [START_REF] Galip Bayrak | Sleuth: Automated verification of software power analysis countermeasures[END_REF] investigated the SMT-based method to evaluate the statistical independence between leakage and secrets. Eldib, Wang, and Schaumont [START_REF] Eldib | Formal verification of software countermeasures against side-channel attacks[END_REF] extended it to verifying higher-order targets using a similar notion to non-interference. Nevertheless, the complexity of their model counting approach restricts it to small masking orders.

Barthe et al. [START_REF] Barthe | Verified proofs of higher-order masking[END_REF] then formalized the connection between the security of masked implementation and probabilistic non-interference. While their method does not entirely prevent the combinatorial explosion of observation sets for high orders, it helps gain several orders of magnitude and provides non-negligible complexity improvements. The resulting tool, maskVerif, thus verifies circuits at reasonable masking orders. After several improvements in the past few years [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF][START_REF] Barthe | maskVerif: Automated verification of higher-order masking in presence of physical defaults[END_REF], maskVerif includes the verification of most probing-like security notions for different leakage models, including the robust probing model in the presence of glitches. Its extension into scVerif [START_REF] Cassiers | Towards tight random probing security[END_REF] captures even more advanced hardware side effects [START_REF] Barthe | Masking in fine-grained leakage models: Construction, implementation and verification[END_REF]. In the same line of work, checkMasks [START_REF] Coron | Formal verification of side-channel countermeasures via elementary circuit transformations[END_REF] offers the same functionalities with a more extensive scope (e.g., verification of Boolean to arithmetic masking conversion) and a polynomial time verification on selected gadgets. In the same vein, Zhang et al. use abstraction-refinement techniques to improve scalability and precision with their tool SCInfer [START_REF] Zhang | Scinfer: Refinement-based verification of software countermeasures against side-channel attacks[END_REF] whose complexity remains significant. Bordes and Karpman [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF] also try to improve accuracy with their tool matverif.

In a parallel sequence of works, Rebecca [START_REF] Bloem | Formal verification of masked hardware implementations in the presence of glitches[END_REF] was designed to verify the probing security in the presence of glitches on Verilog implementations. It preceded the similar improvement on maskVerif to also handle hardware implementations. One step further, Coco [START_REF] Gigerl | Coco: Co-design and co-verification of masked software implementations on CPUs[END_REF] was designed to check masked software implementations given any possible architectural side effects. Inspired by Rebecca, it analyzes a CPU design as a hardware circuit and investigates several shares' potential leaks. Finally, SILVER [START_REF] Knichel | SILVER -statistical independence and leakage verification[END_REF] offers the verification of the classical probinglike security properties for hardware implementations with a method based on the analysis of probability distributions.

It is worth noting that before this thesis, no tools existed to verify security in the more realistic random probing model.

Contributions of the Thesis

This thesis focuses on secure and verified masked cryptographic implementations in the random probing model. Our contributions can be summarized as follows.

Security & Composition [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF]. First, we introduce a composition security property to make gadgets composable in a global random probing secure circuit. We exhibit the relation between this new random probing composability (RPC) notion and the strong non-interference (SNI) notion, which is widely used in the context of probing security [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF]. We also define a verification method to automatically exhibit the random probing security parameters of any small circuit whose variables leak with some probability p. In a nutshell, a circuit is (p, f )random probing secure if it leaks information on the secret with probability f (p), where f (p) is the failure probability function. While it is limited to small circuits by complexity, the state-of-the-art shows that verifying those circuits can be particularly useful in practice (see e.g. the maskVerif tool [START_REF] Barthe | Verified proofs of higher-order masking[END_REF]), for instance, to verify gadgets and then deduce global security through composition properties and low-order masked implementations. Following our work, the authors of a recent work [START_REF] Cassiers | Towards tight random probing security[END_REF] provide tighter composition notions to compose gadgets secure in the random probing model by computing probe distribution tables (PDTs). In a nutshell, a probe distribution table computes a different function f (p) for each leaking set of input shares and output shares. While their representation allows for tighter composition than the RPC notion, the latter is used by our expansion strategy, which helps achieve arbitrarily large levels of security in the random probing model.

Expanding Compiler [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF][START_REF] Belaïd | On the power of expansion: More efficient constructions in the random probing model[END_REF]. Second, we revisit the modular approach of Ananth, Ishai, and Sahai [START_REF] Ananth | Private circuits: A modular approach[END_REF], which uses an expansion strategy to get random probing security from a multiparty computation protocol. We introduce the powerful expanding compiler that builds random probing secure circuits from small base gadgets. We formalize the notion of random probing expandability (RPE) and show that a base gadget satisfying this notion can be securely used in the expanding compiler to achieve arbitrary/composable random probing security. The advantage of this approach is that it enables bootstrapping small gadgets (defined for a small number of shares) into a circuit, achieving arbitrary security in the random probing model while tolerating a constant and quantified leakage probability. We provide a detailed complexity analysis of our strategy and show that it depends on the size of the gadgets and a parameter that we define as the amplification order. In a nutshell, the amplification order refers to the size of the smallest set of probes in a gadget that reveals information about the secret inputs. We prove bounds on the optimal amplification orders achievable by any gadget. Then, we compare our approach with previous works, specifically the ISW construction and the modular approach from [START_REF] Ananth | Private circuits: A modular approach[END_REF], and show that our expansion strategy is much more efficient and achieves better security levels in the random probing model. We also implement a proof-of-concept expanding compiler that can take any base gadgets as input and give the expanded gadgets as output (i.e., gadgets on which we applied the expansion strategy). We additionally implement a protected AES implementation, which uses these output gadgets to benchmark the performance on a real-life secure implementation. The source code of these implementations is publicly available at: https://github.com/CryptoExperts/poc-expanding-compiler Optimal Expanding Compilers [START_REF] Belaïd | On the power of expansion: More efficient constructions in the random probing model[END_REF][START_REF] Belaïd | Dynamic random probing expansion with quasi linear asymptotic complexity[END_REF]. Third, we provide an in-depth analysis of our expansion strategy and the expandability notion. We introduce generic constructions of gadgets achieving RPE for any number of shares and with nearly optimal parameters. We namely show how to construct addition, copy, and multiplication gadgets approaching these optimal parameters and then instantiate these constructions for concrete gadgets on a small number of shares with a quadratic complexity with respect to the number of shares n. We also push the random probing expansion strategy one step further by analyzing a dynamic choice of the base gadgets. We consider a dynamic approach in which a new compiler is selected at each expansion step from a family of base compilers {CC i } i . This approach is motivated by the previously mentioned generic gadget constructions, which achieve the RPE property for any number of shares n. While the asymptotic complexity of the expanding compiler decreases with n, the tolerated leakage probability p also gets smaller with n, which makes those constructions only practical for small values of n. We show that using our dynamic approach, we can get the best of both worlds: our dynamic expanding compiler enjoys the best tolerated probability and the best asymptotic complexity from the underlying family of RPE compilers {CC i } i . This dynamic approach further motivates the design of asymptotic RPE gadgets to achieve better complexity. To improve on the previously constructed gadgets with quadratic complexity, we introduce new constructions achieving quasi-linear complexity. The addition and copy gadgets are based on the refresh gadget from Battistello, Coron, Prouff, and Zeitoun [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF]. While for the multiplication gadget, we obtain a construction with a linear number of multiplications by tweaking the probing-secure multiplication gadget from Belaïd, Benhamouda, Passelègue, Prouff, Thillard, and Vergnaud [START_REF] Belaïd | Private multiplication over finite fields[END_REF]. As in the original construction, our RPE gadget imposes some constraints on the underlying finite field. We demonstrate that for any number of shares, there exists a (possibly large) finite field on which our construction can be instantiated, and we provide some concrete instantiations for some small number of shares. These new gadgets finally enable us to achieve nearly optimal complexity for the expanding compiler. [START_REF] Belaïd | Ironmask: Versatile verification of masking security[END_REF]. Finally, in a first attempt to verify security properties in the random probing model, we implement a verification tool VRAPS, which verifies random probing composition and expansion properties by computing the random probing security parameters as mentioned earlier with the failure function f (p). VRAPS is the first tool to verify security properties in the random probing model. The source code of VRAPS is publicly available 1 . Later, we extend this tool into a more sophisticated one called IronMask, a versatile verification tool for masking security. IronMask is the first to verify standard simulationbased security notions in the probing model and composition and expandability notions in the random probing model introduced through our works. It supports any masking gadgets with linear randomness (e.g. addition, copy, and refresh gadgets) as well as quadratic gadgets (e.g. multiplication gadgets) that might include non-linear randomness (e.g. by refreshing their inputs) while providing complete verification results for both types of gadgets. We achieve this complete verifiability by introducing a new algebraic characterization for such quadratic gadgets and exhibiting a complete method to determine the sets of input shares necessary and sufficient to perform a perfect simulation of any set of probes. We report various benchmarks which show that IronMask is competitive with state-of-the-art verification tools in the probing model. IronMask is also several orders of magnitude faster than VRAPS -the only previous tool verifying random probing composability and expandability-as well as SILVER -the only previous tool providing complete verification for quadratic gadgets with non-linear randomness. Thanks to this completeness and increased performance, we obtain better bounds for the tolerated leakage probability of state-of-the-art random probing secure compilers. IronMask is open-source and publicly available at:

Automatic Verification Tool

Other Contributions

Other results were obtained during the thesis but are not discussed in this manuscript.

In [START_REF] Belaïd | Unifying freedom and separation for tight probing-secure composition[END_REF], we unify and extend existing probing composition notions. Namely, we show that the composition approach of tight private circuits (TPC) introduced in [START_REF] Belaïd | Tight private circuits: Achieving probing security with the least refreshing[END_REF] requires a stronger notion than the SNI initially considered by the authors. The required notion is the free SNI notion introduced by Coron and Spignoli in [START_REF] Coron | Secure wire shuffling in the probing model[END_REF]. In a nutshell, the free SNI notion requires that the non-simulated output shares of a gadget be uniformly distributed and mutually independent of the simulated wires. We analyze and generalize the free SNI notion, show how to use it to correct and generalize the TCP proof from [START_REF] Belaïd | Tight private circuits: Achieving probing security with the least refreshing[END_REF] and show strong connections between the free SNI notion and the IOS notion introduced in [START_REF] Goudarzi | Probing security through input-output separation and revisited quasilinear masking[END_REF] for easy composition in the region probing model. We also investigate gadget constructions under the strong unified notions of free SNI and IOS and propose generic constructions of gadgets achieving these notions from simpler building blocks. To validate our proofs, we provide an efficient automatic verification method for these notions and integrate it into the IronMask tool. Finally, we extend the IOS composition framework proposed in [START_REF] Goudarzi | Probing security through input-output separation and revisited quasilinear masking[END_REF] using our generalized framework to obtain a more efficient composition in the region probing model.

In [START_REF] Belaïd | A methodology to achieve provable side-channel security in real-world implementations[END_REF], we present a complete methodology describing the steps to turn an abstract circuit into a physical implementation satisfying provable security against side-channel attacks in practice. We propose new tools to enforce or relax the physical assumptions the ideal noisy leakage model relies on and provide novel ways of including them in a physical implementation. We also highlight the design goals for an embedded device to reach high levels of proven security, discussing the limitations and open problems of the practical usability of the leakage models. Our goal is to show that it is possible to bridge theory and practice and to motivate further research to fully close the gap and get practical implementations proven secure against side-channel attacks on a physical device without any ideal assumption about the leakage.

Chapter 2

Preliminaries

In this chapter, we give the necessary preliminary notations and definitions used in the rest of this manuscript.

In the following, K shall denote a finite field. For any n ∈ N, we shall denote [n] the integer set [n] = [1, n] ∩ Z. For any tuple x = (x 1 , . . . , x n ) ∈ K n (sometimes denoted x depending on the context, we use x for a vector of variables and x for a sharing) and any set I ⊆ [n], we shall denote x| I = (x i ) i∈I . Also, for some x = ( x 1 , . . . , x ) ∈ (K n ) , we denote by I a collection of sets I = (I 1 , . . . , I ) with

I 1 ⊆ [n], . . . , I ⊆ [n]. We then denote x| I = ( x 1 | I 1 , . . . , x | I ) where x i | I i ∈ K |I i | is the tuple as defined earlier, i.e. x i | I i = (x i,j ) j∈I i .
Finally, any two probability distributions D 1 and

D 2 are said ε-close, denoted D 1 ≈ ε D 2 , if their statistical distance is upper bounded by ε, that is SD(D 1 ; D 2 ) := 1 2 x |p D 1 (x) -p D 2 (x)| ≤ ε ,
where p D 1 (•) and p D 1 (•) denote the probability mass functions of D 1 and D 2 .

Circuit Compilers

We call an arithmetic circuit over a field K a labeled directed acyclic graph whose edges are wires and vertices are arithmetic gates processing operations over K. We consider three types of arithmetic gates:

• an addition gate, of fan-in 2 and fan-out 1, computes an addition over K,

• a multiplication gate, of fan-in 2 and fan-out 1, computes a multiplication over K,

• a copy gate, of fan-in 1 and fan-out 2, outputs two copies of its input.

A randomized arithmetic circuit is equipped with an additional type of gate:

• a random gate, of fan-in 0 and fan-out 1, outputs a fresh uniform random value of K.

A (randomized) arithmetic circuit is further formally composed of input gates of fan-in 0 and fan-out 1 and output gates of fan-in 1 and fan-out 0. Evaluating an -input m-output circuit C consists in writing an input x ∈ K in the input gates, processing the gates from input gates to output gates, then reading the output y ∈ K m from the output gates. This is denoted by y = C(x). During the evaluation process, each wire in the circuit is assigned a value on K.

We call the tuple of all these wire values a wire assignment of C (on input x).

Remark 1. We sometimes consider additional types of gates, such as multiplication by a constant value. For simplicity, we introduce such gates only in the sections where needed.

Definition 1 (Circuit Compiler).

A circuit compiler is a triplet of algorithms (CC, Enc, Dec) defined as follows:

• CC (circuit compilation) is a deterministic algorithm that takes as input an arithmetic circuit C and outputs a randomized arithmetic circuit C.

• Enc (input encoding) is a probabilistic algorithm that maps an input x ∈ K to an encoded input x ∈ K .

• Dec (output decoding) is a deterministic algorithm that maps an encoded output y ∈ K m to a plain output y ∈ K m .

These three algorithms satisfy the following properties:

• Correctness: For every arithmetic circuit C of input length , and for every x ∈ K , we have

Pr Dec C( x) = C(x) x ← Enc(x) = 1 , where C = CC(C).
• Efficiency: For some security parameter λ ∈ N, the running time of CC(C) is poly(λ, |C|), the running time of Enc(x) is poly(λ, |x|) and the running time of Dec y is poly(λ, | y|), where poly(λ, q) = O(λ k 1 q k 2 ) for some constants k 1 , k 2 .

Linear Sharing and Gadgets

In the following, the n-linear decoding mapping, denoted LinDec, refers to the function n K n → K defined as

LinDec : (x 1 , . . . , x n ) → x 1 + • • • + x n ,
for every n ∈ N and (x 1 , . . . , x n ) ∈ K n . We shall further consider that, for every n, ∈ N, on input ( x 1 , . . . , x ) ∈ (K n ) the n-linear decoding mapping acts as LinDec : ( x 1 , . . . , x ) → (LinDec( x 1 ), . . . , LinDec( x )) .

Let us recall that for some tuple x = (x 1 , . . . , x n ) ∈ K n and for some set I ⊆ [n], the tuple

(x i ) i∈I is denoted x| I .
Definition 2 (Linear Sharing). Let n, ∈ N. For any x ∈ K, an n-linear sharing of x is a random vector x ∈ K n such that LinDec( x) = x. It is said to be uniform if for any set

I ⊆ [n] with |I| < n the tuple x| I is uniformly distributed over K |I| . A n-linear encoding is a probabilistic algorithm LinEnc which on input a tuple x = (x 1 , . . . , x ) ∈ K outputs a tuple x = ( x 1 , . . . , x ) ∈ (K n ) such that x i is a uniform n-sharing of x i for every i ∈ [ ].
In the following, we shall call an (n-share, -to-m) gadget, a randomized arithmetic circuit that maps an input x ∈ (K n ) to an output y ∈ (K n ) m such that x = LinDec( x) ∈ K and y = LinDec( y) ∈ K m satisfy y = g(x) for some function g, which can be any arithmetic function over K. In most cases (unless specified otherwise), we shall consider gadgets for three types of functions corresponding to the three types of gates: the addition g : (x 1 , x 2 ) → x 1 +x 2 , the multiplication g : (x 1 , x 2 ) → x 1 • x 2 and the copy g : x → (x, x). We shall generally denote such gadgets G add , G mult and G copy respectively. We also make use of the refresh gadget denoted G refresh , which takes as input an n-sharing x and outputs a new sharing y such that x 1 + . . . + x n = y 1 + . . . + y n . In other words, G refresh is similar to G copy , except that it corresponds to the identity function g : x → x. As for the other gates (e.g. multiplication by a constant), we introduce the notation for the corresponding gadgets when needed.

Definition 3 (Standard Circuit Compiler).

Let λ ∈ N be some security parameter and let n = poly(λ). Let B = {g : K → K m } be an arithmetic circuit basis with sharing order n and base gadgets {G g } g∈B . Typically when we consider B with the three types of gates introduced earlier (addition, multiplication and copy), we consider the gadgets G add , G mult , G copy respectively. The standard circuit compiler with arithmetic basis B, sharing order n, and base gadgets {G g } g∈B is the circuit compiler (CC, Enc, Dec) satisfying the following:

1. The input encoding Enc is an n-linear encoding.

2. The output decoding Dec is the n-linear decoding mapping LinDec.

The circuit compilation CC consists in replacing each gate in the original circuit by an

n-share gadget with corresponding functionality (G g for a gate implementing the function g), and each wire by a set of n wires carrying an n-linear sharing of the original wire. If the input circuit is a randomized arithmetic circuit, each of its random gates is replaced by n random gates, which duly produce an n-linear sharing of a random value.

For such a circuit compiler, the correctness and efficiency directly holds from the correctness and efficiency of the gadgets {G g } g∈B .

(Strong) Non-Interference in the Probing Model

In the t-probing model, an adversary can choose a set of t probes on the wires in the target circuit. The adversary can then observe the exact values carried by the probes. An n-share circuit is then t-probing secure for t ≤ n -1 if any such set of t probes is independent of the sensitive input shares, assuming all input sharings are uniform.

Proving the security of large masked circuits is a challenging problem. Hence, we usually build such circuits from smaller blocks called gadgets. However, the definition of t-probing security does not allow composition of gadgets. In other words, connecting t-probing secure gadgets does not necessarily give a t-probing secure circuit [START_REF] Coron | Higherorder side channel security and mask refreshing[END_REF]. Hence, stronger notions are required to ensure this composition property. In [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF], the authors introduce such notions. To do so, they rely on the simulatability property of sets of probes. Given an -to-m n-share gadget with input x, a set of probes W is said to be t-simulatable if there exists a collection of sets I = (I 1 , . . . , I ) such that |I i | ≤ t, ∀i ∈ [ ], and there exists an algorithm called simulator that can generate a simulation of the probes in W which have the same distribution as the probes in W , using only the knowledge of the input shares x| I . In other words, given a fixed input sharing x, the simulator only needs access to the values of x| I and can perfectly simulate the distribution of the probes in W . When t ≤ n -1 and the input sharings are all uniform, and each set of t probes is t-simulatable, this implies t-probing security as the probes are independent of the input values not given to the simulator. Note that a trivial simulator always exists by setting

I = ([n], . . . , [n]).
Based on this simulatability notion, the authors of [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF] introduce the non-intereference (NI) and strong non-interference (SNI) composition properties.

Definition 4 (Non-Interference (NI)). Let n, and t be positive integers. An n-share gadget G : (K n ) → K n is t-NI if there exists a deterministic algorithm Sim G 1 and a probabilistic algorithm Sim G 2 such that for every set J ⊆ [n] and subset W of wire labels from G satisfying |W | + |J| t, the following random experiment with any x ∈ (K n )

I ← Sim G 1 (W, J) out ← Sim G 2 x| I yields |I 1 | t, . . . , |I | t (2.1)
and

out id = AssignWires(G, W, x) , y| J (2.2)
where I = (I 1 , . . . , I ) and y = G( x).

We can observe that t-NI is stronger than t-probing security and that t-NI does not suppose the uniformity of the input sharings. Indeed, t-NI with the uniformity of the input sharings imply t-probing security.

Next, t-SNI gadgets guarantee independence between the input and output shares in the presence of a t-probing adversary.

Definition 5 (Strong Non-Interference (SNI)). Let n, and t be positive integers. An nshare gadget G : (K n ) → K n is t-SNI if there exists a deterministic algorithm Sim G 1 and a probabilistic algorithm Sim G 2 such that for every set J ⊆ [n] and subset W of wire labels from G satisfying |W | + |J| t, the following random experiment with any x ∈ (K n )

I ← Sim G 1 (W, J) out ← Sim G 2 x| I yields |I 1 | |W |, . . . , |I | |W | (2.3)
and

out id = AssignWires(G, W, x) , y| J (2.4)
where I = (I 1 , . . . , I ) and y = G( x).

The authors of [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF] show that building secure circuits from t-NI and t-SNI gadgets is possible by carefully inserting t-SNI refresh gadgets where needed.

Gadgets from the Literature

In this section, we introduce some widely used gadgets from the literature that we will use for our constructions in the rest of this manuscript.

ISW Construction

ISW Multiplication Gadget. The ISW multiplication gadget was introduced in [START_REF] Ishai | Private circuits: Securing hardware against probing attacks[END_REF] as a gadget that achieves security in the probing model. The gadget is proven to achieve (n -1)probing security for any number of shares n. Later, the gadget was also proven to satisfy the stronger (n -1)-SNI notion in [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF]. The ISW multiplication algorithm has quadratic complexity O(n 2 ) and uses n(n + 1) 2 fresh random variables. It is described in Algorithm 1.

Algorithm 1: ISW Multiplication Input : (a 1 , . . . , a n ),(b 1 , . . . , b n ) input sharings, {r ij } 1≤i<j≤n random values Output: (c 1 , . . . , c n ) sharing of a • b 1 for i ← 1 to n do 2 c i ← a i • b i ; 3 end 4 for i ← 1 to n do 5 for j ← i + 1 to n do 6 c i ← c i + r ij ; 7 r ji ← (a i • b j + r ij ) + a j • b i ; 8 c j ← c j + r ji ; 9 end 10 end 11 return (c 1 , . . . , c n );
ISW Refresh Gadget. The ISW refresh gadget can be seen as an ISW multiplication between the input sharing and the n-tuple (1, 0, . . . , 0). This is formally depicted in Algorithm 2. Trivially, the gadget is also (n -1)-SNI in the probing model.

Algorithm 2: ISW Refresh Input : (a 1 , . . . , a n ) input sharing, {r ij } 1≤i<j≤n random values Output: (c 1 , . . . , c n ) such that c 1 + • • • + c n = a 1 + • • • + a n 1 for i ← 1 to n do 2 c i ← a i ; 3 end 4 for i ← 1 to n do 5 for j ← 1 to i -1 do 6 c i ← c i + r ji ; 7 end 8 for j ← i + 1 to n do 9 c i ← c i + r ij ; 10 end 11 end 12 return (c 1 , . . . , c n ); 2.4.2 O(n log n) Refresh Gadget
In [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF], the authors introduce a new construction for a refresh gadget that benefits from quasilinear complexity. Namely, the n-share gadget has complexity in O(n log n). The authors prove that the gadget satisfies the strong notion (n -1)-SNI in the probing model, which makes it composable and secure in the probing model for any number of shares n. The description of the gadget is given in Algorithm 3.

Algorithm 3: QuasiLinearRefresh Input : (a 1 , . . . , a n ) input sharing Output: (d 1 , . . . , d n ) such that d 1 + • • • + d n = a 1 + • • • + a n 1 if n = 1 then return a 1 ; 2 if n = 2 then 3 r ← $; 4 return (a 1 + r, a 2 -r); 5 end 6 for i ← 1 to n/2 do 7 r ← $; 8 b i ← a i + r; 9 b n/2 +i ← a n/2 +i -r; end if n mod 2 = 1 then b n ← a n ; (c 1 , . . . , c n/2 ) ← QuasiLinearRefresh(b 1 , . . . , b n/2 ); (c n/2 +1 , . . . , c n ) ← QuasiLinearRefresh(b n/2 +1 , . . . , b n ); for i ← 1 to n/2 do r ← $; d i ← c i + r; d n/2 +i ← c n/2 +i -r; end if n mod 2 = 1 then d n ← c n ; return (d 1 , . . . , d n ); Chapter 3

Random Probing Security

In this chapter, we recall the definition of random probing security from the literature. Then, we discuss the contributions of this thesis in the following sections. Namely, we introduce the random probing composability notion, which allows us to securely compose small gadgets into a circuit with global random probing security. After that, we present our technique for computing the security parameters of a circuit in the random probing model. In a nutshell, a circuit is (p, ε)-random probing secure if any set of leaking wires, where each wire is added independently with probability p, can be perfectly simulated without knowing the secrets with probability 1 -ε. In Section 3.3, we present our contributions on how to compute this failure probability as a function of the leakage probability p, which allows us to automatically verify the security of circuits in the random probing model using automatic verification tools like our tool IronMask discussed later in Chapter 7. The contributions in this chapter are published in [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF].

Definition of Random Probing Security

Let p ∈ [0, 1] be some constant leakage probability parameter. This parameter is sometimes called leakage rate in the literature. Informally, the p-random probing model states that during the evaluation of a circuit C, each wire leaks its exact value with probability p and leaks nothing with probability 1 -p. Such leakage event is defined on each wire in the circuit, independently of all the other wires. For instance, the probability that all s wires of a circuit C leak their exact values is p s , while only t ≤ s wires leak their values with probability p t • (1 -p) s-t .

Notice that when a wire leaks, it gives the adversary the exact value it carries without any noise. This is not the case in real-life acquisitions where some noise perturbs the signal corresponding to a leaked value. Recall that in the t-probing model, at most t wires can leak their exact values, based on the assumption that retrieving secrets from noisy traces becomes exponentially hard when the noise becomes more important. In the random probing model, we have more flexibility than the probing model. Namely, we can represent this noise level by the leakage probability p, which increases as the noise level decreases.

In order to formally define the random probing leakage of a circuit, we shall consider two probabilistic algorithms:

• The leaking-wires sampler takes as input a randomized arithmetic circuit C and a probability p ∈ [0, 1], and outputs a set W , denoted as

W ← LeakingWires(C, p) ,
where W is constructed by including each wire label from the circuit C with probability p to W (where all the probabilities are mutually independent), except for the output wire labels. In other words, the output wires of C (i.e. the wires incoming output gates) are excluded by the LeakingWires sampler, whereas the input wires of C (i.e. the wires connecting input gates to subsequent gates) are included. Namely, W does not include any output wire label of C. This is because when composing several circuits (or gadgets), the output wires of a circuit are the input wires in the following circuit. This also relates to the widely admitted only computation leaks assumption [START_REF] Micali | Physically observable cryptography (extended abstract)[END_REF]: the processing of a gate leaks information on its input values (and information on the output can be captured through information on the input).

• The assign-wires sampler takes as input a randomized arithmetic circuit C, a set of wire labels W (subset of the wire labels of C), and an input x ∈ K , and it outputs a

|W |-tuple w ∈ (K ∪ {⊥}) |W | , denoted as w ← AssignWires(C, W, x) ,
where w corresponds to the assignments of the wires of C with label in W for an evaluation on input x.

We can now formally define the random probing leakage of a circuit.

Definition 6 (Random Probing Leakage). The p-random probing leakage of a randomized arithmetic circuit C on input x is the distribution L p (C, x) obtained by composing the leakingwires and assign-wires samplers as

L p (C, x) id = AssignWires(C, LeakingWires(C, p), x) .
Definition 7 (Random Probing Security). A randomized arithmetic circuit C with • n ∈ N input gates (for inputs of n shares) is (p, ε)-random probing secure with respect to encoding Enc if there exists a simulator Sim such that for every x ∈ K : We can slightly tweak the definition above to consider simulation with abort as in [START_REF] Ananth | Private circuits: A modular approach[END_REF]. The difference is that instead of considering that the distribution of Sim(C) is ε-close to that of L p (C, Enc(x)), we consider that the simulator either outputs an identical distribution or aborts (or fails) with probability ε. Formally, for any leakage probability p ∈ [0, 1], the simulator Sim is defined as

Sim(C) ≈ ε L p (C, Enc(x)) . ( 3
Sim(C) = SimAW(C, LeakingWires(C, p)) (3.2)
where SimAW, the wire-assignment simulator, either returns ⊥ (simulation failure) or a perfect simulation of the requested wires. Formally, the experiment

W ← LeakingWires(C, p) out ← SimAW(C, W ) leads to Pr[out = ⊥] = ε and out | out = ⊥ id = AssignWires(C, W, Enc(x)) | out = ⊥ . (3.3)
It is not hard to see that if we can construct such a simulator SimAW for a randomized arithmetic circuit C, then this circuit is (p, ε)-random probing secure. This tweaked definition will be useful when we express ε as a function of p later in Section 3.3.

Composition in the Random Probing Model

It is challenging to construct an arbitrarily large secure circuit, especially with no prior knowledge of the structure of the circuit. To circumvent this issue, we usually build secure circuits from small building blocks that we call gadgets. For each type of operation (or gate) involved in the circuit, we construct an n-share gadget with the same functionality as the latter operation. Then, we transform our base circuit starting from the input gates: we replace each input wire with n wires carrying a sharing of the original wire. Also, each input random wire is replaced by n input random wires. Then, we replace each internal gate of the circuit with the corresponding gadget. A standard circuit compiler performs these transformations on the original circuit. A 2-share example is given in Figure 3.1. Secure gadgets must satisfy a security notion that guarantees a global security level after composition. In the t-probing model, many security properties for composition have been introduced (t-SNI, t-PINI, etc.). In the random probing model, we introduce the random probing composability notion for a gadget.

Definition 8 (Random Probing Composability

). Let n, , m ∈ N. An n-share gadget G : (K n ) → (K n ) m is (t, p, ε)-random probing composable (RPC) for some t ∈ N and p, ε ∈ [0, 1]
if there exists a deterministic algorithm Sim G 1 and a probabilistic algorithm Sim G 2 such that for every input x ∈ (K n ) and for every set collection

J = (J 1 , . . . , J m ) such that ∀i ∈ [m], J i ⊆ [n] and |J i | ≤ t, the random experiment W ← LeakingWires(G, p) I = (I 1 , . . . , I ) ← Sim G 1 (W, J ) out ← Sim G 2 x| I yields Pr (|I 1 | > t) ∨ . . . ∨ (|I | > t) ≤ ε (3.4)
and out id = AssignWires(G, W, x) , y| J where J = (J 1 , . . . , J m ) and y = G( x).

In the above definition, the first-pass simulator Sim G 1 determines the necessary input shares (through the returned collection of sets I) for the second-pass simulator Sim G 2 to produce a perfect simulation of the leaking wires defined by the set W together with the output shares defined by the collection of sets J . Note that there always exists such a collection of sets I since I = ([n], . . . , [n]) trivially allows a perfect simulation whatever W and J . However, the goal of Sim G 1 is to return a collection of sets I with cardinals at most t. The idea behind this constraint is to keep the following composition invariant: for each gadget we can achieve a perfect simulation of the leaking wires plus t shares of each output sharing from t shares of each input sharing. We shall call failure event the event that at least one of the sets I 1 , . . . , I output of Sim G 1 has cardinality greater than t. When (t, p, ε)-RPC is achieved, the failure event probability is upper bounded by ε according to (3.4). A failure event occurs whenever Sim G 2 requires more than t shares of one input sharing to be able to produce a perfect simulation of the leaking wires (i.e. the wires with label in W ) together with the output shares in y| J . Whenever such a failure occurs, the composition invariant is broken. In the absence of failure event, the RPC notion implies that a perfect simulation can be achieved for the full circuit composed of RPC gadgets. This is formally stated in the next theorem.

Theorem 1 (Composition). Let t ∈ N, p, ε ∈ [0, 1],
and CC be a standard circuit compiler with (t, p, ε)-RPC base gadgets. For every (randomized) arithmetic circuit C composed of |C| gadgets, the compiled circuit CC(C) is (p, |C| • ε)-random probing secure. Equivalently, the standard circuit compiler CC is (p, ε)-random probing secure.

Proof. We suppose that all gadgets have two input and one output sharings for simplicity of notations, but the proof can be trivially generalized to more inputs and outputs. Let W denote the leaking wires of the randomized circuit CC(C) with probability p for each wire. We now build a simulator Sim taking as inputs CC(C) and W , and that perfectly simulates W with probability at least (1 -|C| • ε) from the simulators of the (t, p, ε)-RPC base gadgets. We start with splitting set W into |C| distinct subsets W i for i ∈ {1, . . . , |C|} such that each W i stands for the output of LeakingWires when applied to the i th gadget G i of CC(C) with probability p. We first describe how Sim executes Sim G i 1 for all gadgets in the compiled circuit. Namely, we start with gadgets whose outputs coincide with the circuit's outputs (called end gadgets). We execute their Sim G i 1 with W i and J i = ∅, to get both sets I i,1 , I i,2 of required inputs. Then, we target their parents, that are gadgets whose outputs are inputs of end gadgets. For instance, for an end gadget G i , its first input sharing is connected to the output sharing of a parent gadget G j , and its second output sharing is connected to the output sharing of a second parent gadget G k . Then, we execute Sim G j 1 with W j and J j = I 1,i , and we execute Sim G k 1 with W k and J k = I 2,i . Both executions give us new sets I of required inputs, which are correspondingly connected to output sharings of higher parent gadgets. The simulation goes through the circuit from bottom to top by applying the Sim G 1 simulators to get the W i and I/J sets. The simulation fails if at least one set I is of cardinal greater than t. For |C| gadgets, this happens with probability 1-(1-ε) |C| ≤ |C|•ε. Otherwise, the final top execution of simulators Sim G i 1 for gadgets G i which are directly connected to the input sharings of the circuit CC(C) gives us the last collection of sets I on the input sharings. Finally, the global simulator Sim runs the Sim G 2 simulators from top to bottom by randomly picking the initial x| I . This completes the construction of our global simulator Sim.

Expressing ε as a function of p

In this section, we show how all of the previously seen failure probabilities ε can be expressed as functions of the leakage probability p. The functional representation of ε will be instrumental in introducing the idea of Random Probing Expansion, which allows for arbitrarily reducing the failure event probability of any compiled circuit. In addition, this representation will be helpful to automatically verify the security of gadgets and circuits in the random probing model since computing the failure probability then amounts to computing coefficients of a polynomial in p.

We first derive an upper bound on the simulation failure probability as a function of the leakage probability p. We consider a compiled circuit C composed of s wires labeled from 1 to s and a simulator SimAW as defined in Section 3.1. For any sub-set W ⊆ [s] we denote by δ W the value defined as follows:

δ W = 1 if SimAW( C, W ) = ⊥, 0 otherwise.
The simulation failure probability ε in (3.3) can then be explicitly expressed as a function of p. Namely, we have ε = f (p) with f defined for every p ∈ [0, 1] by:

f (p) = W ⊆[s] δ W • p |W | • (1 -p) s-|W | . (3.5)
Letting c i be the number of subsets W ⊆ [s] of cardinality i for which δ W = 1, namely for which the simulation fails, we have c i = |W |=i δ W and hence (3.5) simplifies to

f (p) = s i=1 c i • p i • (1 -p) s-i . (3.6)
For any circuit C achieving t-probing security, the values δ W with |W | ≤ t are equal to zero. Indeed, a circuit which is t-probing secure means that any set of at most t intermediate computations is independent of the secret values involved in the circuit. In other words, a simulator can perfectly simulate such a set without access to the secret values. Therefore, the corresponding c i 's are equal to zero, which implies the following simplification:

f (p) = s i=t+1 c i • p i • (1 -p) s-i .
Moreover, by definition, the coefficients c i satisfy:

c i s i (3.7)
since we have exactly s i sets of wire labels of size i from a total of s wire labels. This observation finally leads to the following upper-bound for f (p):

f (p) s i=t+1 s i • p i • (1 -p) s-i .
An obvious goal is to try to construct circuits (p, ε)-random probing secure for ε as small as possible and p as big as possible. The circuit can then tolerate a large amount of leakage, which would still be independent of the secret values. From the expression in x, we need to minimize the coefficients c i in f (p) to get small failure probabilities.

For any compiled circuit C and any simulator defined as in Section 3.1, the computation of the function f (p) for any probability p essentially amounts to computing the values of the coefficients c i 's appearing in (3.6). If no assumption is made on the circuit, this task seems complicated to carry out by hand. It may be checked that exhaustive testing of all the possible tuples of wires for a gadget with s wires has complexity lower bounded by 2 s . For now, we suppose we have access to algorithms that allow us to efficiently and automatically compute the coefficients of the function ε = f (p). We will discuss automatic verification tools in more detail later in Chapter 7. Let us take an example to illustrate such a function. We consider the well-known ISW multiplication gadget for n = 2 shares. The full description of the gadget is given in Algorithm 1 in Chapter 2.This gadget takes at input the 2-sharings (a 1 , a 2 ) and (b 1 , b 2 ) of a and b respectively, and outputs the 2-sharing

(c 1 , c 2 ) = (a 1 • b 1 + r 1,2 , a 2 • a 2 + r 1,2 + a 1 • b 2 + a 2 • b 1 )
where r 1,2 is a random value. The processing is composed of the following intermediate results, where each variable is assigned a wire:

m 1,1 = a 1 * b 1 m 1,2 = a 1 * b 2 m 2,1 = a 2 * b 1 m 2,2 = a 2 * b 2 tmp = m 1,2 + r 1,2 r 2,1 = tmp + m 2,1 c 1 = m 1,1 + r 1,2 c 2 = m 2,2 + r 2,1
Recall that when the same variable is involved as input of several operations, a copy gadget (with 1 input and 2 output wires) is applied to duplicate it. Consequently, each new use of the same variable as input of an operation adds 2 wires to the final count of overall wires.

We can check that the circuit corresponding to the 2-share ISW gadget comprises 21 intermediate wires, excluding the 2 output wires c 1 and c 2 . Since the gadget is 1-SNI (c.f. [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF]) but not 2-SNI, every set with a single wire can be perfectly simulated without knowing the secrets. However, it is only the case for some pairs of wires. For instance, the set composed of two wire labels corresponding to variables {a 1 , a 2 } cannot be perfectly simulated without knowing the secret a since the latter can be obtained from the combination of both share values. 51 such pairs of wires cannot be simulated. If we continue the test for the sets of cardinality from 3 to 21, we get the following list of 21 coefficients, computed with the IronMask verification tool described in Chapter 7:

[0, [START_REF] Gigerl | Coco: Co-design and co-verification of masked software implementations on CPUs[END_REF]754,4827,18875,52994,115520,203176,293844,352702,352715,293930,203490,116280,54264,20349,5985,1330,210,[START_REF] Belaïd | Ironmask: Versatile verification of masking security[END_REF][START_REF] Ajtai | Secure computation with information leaking to an adversary[END_REF].

We can directly inject these coefficients in (3.6) to get the expression of f (p) for the 2-share ISW multiplication gadget. This gadget is (p, f (p))-random probing secure for the computed function f (p). Figure 3.2 shows the evolution of the value of f (p) for an increasing p. For example, for a leakage rate of p = 0.5, we can check that a simulator has almost a 99.7% chance of being unable to perfectly simulate a leaking set of wires during the execution of the circuit. For a leakage rate of p = 0.05, this failure chance decreases to about 10%. Clearly, the higher the leakage rate, the more difficult it is to guarantee the independence of the leaking wires from the secret inputs, which is logical since more sensitive leakage gives more information about the secrets. The speed at which the failure probability increases with the increase of the leakage rate depends on the security of the constructed circuit and the underlying ε.

Failure function for Random Probing Composability

Recall the definition of (t, p, ε)-random probing composability (Definition 8). In this definition, we can express ε in the same way as a function of the leakage rate p. We need to consider a set of wire labels and a set of t output wires for each circuit output. Namely, for each possible collection of sets J = (J 1 , . . . , J m ) such that ∀ i ∈ [m], J i ⊆ [n] and |J i | ≤ t, and each set W of internal wire labels, we need to consider the simulation of the wires in W and y| J . An additional constraint is that the simulator must be able to perfectly simulate all the wires involved while having access to at most t shares of each input sharing. If we denote c J i the number of such sets W for which the simulation of W along with y| J fails, then we obtain the expression as follows:

f (p) = s i=1 max J c J i • p i • (1 -p) s-i . (3.8)
Interestingly, we can demonstrate that n-share gadgets satisfying the t-SNI notion for t < n are also random probing composable for specific values we explicit in the following proposition.

Proposition 1. Let n, and t be positive integers and let G be a gadget from

(K n ) to K n . If G is t-SNI,
then it is also ( t/2 , p, ε)-RPC for any probability p and ε satisfying:

ε ≤ s i= t 2 +1 s i p i (1 -p) s-i , (3.9)
where s is the number of wires in G.

Proof. Since G is t-SNI, there exist two simulators Sim G 1 and Sim G 2 satisfying (2.3) and (2.4) for any J ⊆ [n] and any W satisfying |W | + |J| t. This is in particular true for every W and every J both of cardinality lower than or equal to t/2 . For every set W such that |W | > t/2 and every set J such that |J| t/2 , we consider the worst case. We modify simulator Sim G 1 to return the full set of input indices (i.e. I = [n] ). Then, the second simulator Sim G 2 is simply augmented to perfectly simulate (AssignWires(G, W, x) , y| J ) from the full knowledge of the gadget inputs (which is trivially possible). By construction, for any J with |J| t/2 , the output I = (I 1 , . . . , I ) of Sim G 1 (W, J) contains at least one I j with cardinality greater than t/2 only when W has cardinality strictly greater than t/2 (and in this case all the I j 's have full cardinality [n]). Hence, the probability Pr (|I 1 | > t/2 ) ∨ . . . ∨ (|I | > t/2 ) , when J is a given set with |J| t/2 and W is the output of LeakingWires(G, p), satisfies (3.9), which concludes the proof.

As an illustration of the proposition, let us consider again the 3-share ISW multiplication gadget satisfying 2-SNI. Recall that the gadget has 57 internal wires, excluding the 3 output wires. From Proposition 1, this gadget is also (1, p, ε)-RPC for any probability p and such that

ε ≤ 57 i=2 s i p i (1 -p) 57-i .
Using a verification tool like IronMask (we will discuss automatic verification tools in more detail later in Chapter 7), we get a tighter representation of the function as

ε = 415 • p 2 • (1 -p) 55 + O(p 3 ) .
Remark 2. In a follow-up work to our results [START_REF] Cassiers | Towards tight random probing security[END_REF], the authors introduce a tighter composition approach in the random probing model, which splits the failure function f (p) into several failure functions for each possible set of leaking output wires and input wires for the simulation. The authors reason on the nature of the composition, i.e., parallel or sequential composition, and can get better security bounds by composing these PDTs. Meanwhile, the sizes of the PDTs increase exponentially with the circuit size, unlike our RPC notion. In addition, their composition approach is not yet extended to the random probing expansion approach, which we will introduce in the next chapter. An interesting future work would be integrating their composition approach using PDTs with our expansion technique.

Conclusion

In this chapter, we recalled the definition of random probing security and proposed a way of composing different RP secure gadgets into a circuit with global RP security. The composition requires that the gadgets satisfy the RP composability notion. In addition, we presented a practical way of computing the failure event probability of RP security as a function of the leakage probability p, which allows for automatic verification of gadgets' security in the random probing model.

While the RP composability ensures global RP security in any circuit, it does not help to increase this security level. Ideally, we would like a circuit to tolerate the highest leakage rate possible p with the lowest simulation failure probability ε. In the next chapter, we tackle this problem by introducing the random probing expansion strategy, which helps achieve any desired security level regarding the failure event probability at the expense of a complexity overhead, which we also analyze.

Chapter 4

Random Probing Expansion

Constructing random probing secure circuits is a challenging task. We want to achieve the highest security level possible, in other words, tolerate the maximum leakage probability p with the lowest failure probability ε. Indeed, for a fixed number of shares n, a secure gadget can only achieve a bounded value for the failure probability. A solution would be to increase the number of shares, meaning that the gadgets' construction should be generic and scale well with the number of shares in the circuit. In addition, we want to quantify the exact failure probability achieved for a given n, which can be done either by getting generic formulas for ε or by using automatic verification tools. Both solutions are difficult to handle when we have complex and large gadgets. This chapter discusses a powerful tool: the random probing expanding compiler. The expanding compiler allows for achieving arbitrarily large security levels in the random probing model, starting from small gadgets using the expansion strategy. We will see later that small gadgets for small numbers of shares tend to tolerate better leakage probabilities but have higher failure probabilities than larger gadgets. The expansion strategy aims to take the best of both worlds: use small gadgets which tolerate high leakage rates and expand them into larger gadgets which tolerate the same leakage rates but have much smaller failure probabilities.

In [START_REF] Ananth | Private circuits: A modular approach[END_REF], Ananth, Ishai and Sahai first proposed constructing random probing secure circuit compilers with a gadget expansion strategy. Such a strategy was previously used in multiparty computation (MPC) with different but close security goals [START_REF] Cohen | Efficient multiparty protocols via log-depth threshold formulae -(extended abstract)[END_REF][START_REF] Hirt | Player simulation and general adversary structures in perfect multiparty computation[END_REF]. Note that such an approach is called composition in [START_REF] Ananth | Private circuits: A modular approach[END_REF] since it roughly composes a base circuit compiler several times. We prefer the terminology of expansion to avoid confusion with the usual notion of composition for gadgets in the masking literature.

Our works introduce an instantiation of the expansion strategy relying on atomic gadgets leading to simple and efficient constructions. In contrast, the construction of [START_REF] Ananth | Private circuits: A modular approach[END_REF] relies on a t-out-n secure MPC protocol in the passive security model. We introduce a security notion we call random probing expandability, allowing gadgets to be used in the expanding compiler. We show that this notion can be easily verified using automatic verification tools, making it convenient to test gadgets for a reasonable order. We provide a detailed analysis and discussion about this strategy, its security in the random probing model and its asymptotic complexity. Finally, we show how we can construct generic gadgets that achieve the best trade-offs between complexity and security levels and instantiate them for a small number of shares to demonstrate actual security levels achieved for some cryptographic algorithms like the AES encryption scheme as a proof-of-concept.

In the following, we mostly focus on gadgets with at most 2 inputs and 2 outputs, which already covers addition, multiplication, copy and random generation gadgets, allowing us to model any circuit with basic operations. The contributions in this chapter are published in [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF][START_REF] Belaïd | On the power of expansion: More efficient constructions in the random probing model[END_REF].

Expansion Strategy

The basic principle of the gadget expansion strategy is as follows. Assume we have an arithmetic circuit basis B = {g : K → K m } of arithmetic operations composing any circuit (in most cases, we consider B to consist of addition, multiplication and copy gates). Assume that we also have the corresponding n-share gadgets G g for g ∈ B and denote CC the standard circuit compiler for these base gadgets. We can derive new n 2 -share gadgets by simply applying CC to each gadget:

G (2) g = CC(G g ) for each g ∈ B.
Let us recall that this process simply consists in replacing each gate g in the original gadget by G g , and by replacing each wire by n wires carrying a sharing of the original wire. Doing so, we obtain n 2 -share gadgets for each base gate in B over K. This process can be iterated an arbitrary number of times, say k, to an input circuit C:

C CC ---→ C 1 CC ---→ • • • CC ---→ C k .
The first output circuit C 1 is the original circuit in which each gate is replaced by a base gadget G g . The second output circuit C 2 is the original circuit C in which each gate is replaced by an n 2 -share gadget G

(2) g as defined above. Equivalently, C 2 is the circuit C 1 in which each gate is replaced by a base gadget. In the end, the output circuit C k is hence the original circuit C in which each gate has been replaced by a k-expanded gadget and each wire has been replaced by n k wires carrying an (n k )-linear sharing of the original wire. The underlying compiler is called expanding circuit compiler which is formally defined hereafter. Definition 9 (Expanding Circuit Compiler). Let CC be the standard circuit compiler for an arithmetic circuit basis B = {g : K → K m } with sharing order n and base gadgets {G g } g∈B .

The expanding circuit compiler with expansion level k and base compiler CC is the circuit compiler (CC (k) , Enc (k) , Dec (k) ) satisfying the following:

1. The input encoding Enc (k) is an (n k )-linear encoding.

2. The output decoding Dec is the (n k )-linear decoding mapping.

The circuit compilation is defined as

CC (k) (•) = CC • CC • • • • • CC k times (•)
The goal of the expansion strategy in the context of random probing security is to replace the leakage probability p of a wire in the original circuit by the failure event probability ε in the subsequent gadget simulation. If this simulation fails then one needs the full input sharing for the gadget simulation, which corresponds to leaking the corresponding wire value in the base case. The security is thus amplified by replacing the probability p in the base case by the probability ε (assuming that we have ε < p). If the failure event probability ε can be upper bounded by some function of the leakage probability: ε < f (p) for every leakage probability p ∈ [0, p max ] for some p max < 1, then the expanding circuit compiler with expansion level k shall result in a security amplification as

p = ε 0 f --→ ε 1 f --→ • • • f --→ ε k = f (k) (p) ,
which for an adequate function f (e.g. f : p → p 2 ) provides exponential security. In order to get such a security expansion, the gadgets must satisfy a stronger notion than the composability notion introduced in Chapter 3, which we call random probing expandability; see Section 4.2 below.

Since in our case, we focus on addition, multiplication and copy gadgets, we limit our definitions to ≤ 2 and m ≤ 2 for the sake of simplicity, but all notions can be generalized to any and m.

Expansion Security

In evaluating random probing composability, let us recall that the failure event in the simulation of a gadget means that more than t shares from one of its inputs are necessary to complete a perfect simulation. For a gadget to be expandable, we need slightly stronger notions than random probing composability. As a first requirement, a two-input gadget should have a failure probability independent for each input. This is because, in the base case, each input wire to a gate leaks independently. On the other hand, in case of a failure event in the child gadget during the expansion, the overall simulator (of the k-expanded gadget) should be able to produce a perfect simulation of the entire output (that is, the entire input for which the failure occurs). Hence, the overall simulator is given the clear output (obtained from the base case simulation) plus any set of n -1 output shares. In this case, whenever the set J is of cardinal greater than t, the gadget simulator can replace it with any set J of cardinal n -1. More details are given hereafter.

Definition 10 (Random Probing Expandability for 2-to-1 gadgets). Let f : R → R. An n-share gadget G :

K n × K n → K n is (t, f )-random probing expandable (RPE) if there exists a deterministic algorithm Sim G
1 and a probabilistic algorithm Sim G 2 such that for every input ( x, y) ∈ K n × K n , for every set J ⊆ [n] and for every p ∈ [0, 1], the random experiment

W ← LeakingWires(G, p) (I 1 , I 2 , J ) ← Sim G 1 (W, J) out ← Sim G 2 (W, J , x| I 1 , y| I 2 ) ensures that 1. the failure events F 1 ≡ |I 1 | > t and F 2 ≡ |I 2 | > t verify Pr(F 1 ) = Pr(F 2 ) = ε and Pr(F 1 ∧ F 2 ) = ε 2 (4.1)
with ε = f (p) (in particular F 1 and F 2 are mutually independent),

2. J is such that J = J if |J| ≤ t and J ⊆ [n] with |J | = n -1 otherwise, 3. the output distribution satisfies out id = AssignWires(G, W, ( x, y)) , z| J (4.2)
where z = G( x, y).

The RPE notion can be simply extended to gadgets with 2 outputs: the Sim G 1 simulator takes two sets J 1 ⊆ [n] and J 2 ⊆ [n] as input and produces two sets J 1 and J 2 satisfying the same property as J in the above definition (w.r.t. J 1 and J 2 ). The Sim G 2 simulator must then produce an output including z 1 | J 1 and z 2 | J 1 where z 1 and z 2 are the output sharings. The RPE notion can also be simply extended to gadgets with a single input: the Sim G 1 simulator produces a single set I so that the failure event (|I| > t) occurs with probability lower than ε (and the Sim G 2 simulator is then simply given x| I where x is the single input sharing). For the sake of completeness, we provide the RPE definition for the 1-to-2 case below, but we only focus on 2-to-1 and 1-to-2 gadgets.

Definition 11 (Random Probing Expandability for 1-to-2 gadgets). Let f = R → R. An n-share gadget G : K n → K n × K n is (t, f )-random probing expandable (RPE) if there exists a deterministic algorithm Sim G 1 and a probabilistic algorithm Sim G 2 such that for every input x ∈ K n , for every pair of sets J 1 ⊆ [n] and J 2 ⊆ [n], and for every p ∈ [0, 1], the random experiment

W ← LeakingWires(G, p) (I, J 1 , J 2 ) ← Sim G 1 (W, J 1 , J 2 ) out ← Sim G 2 (W, J 1 , J 2 , x| I )
ensures that 1. the failure event probability satisfies

Pr |I| > t ≤ ε with ε = f (p), 2. the set J 1 is such that J 1 = J 1 if |J 1 | ≤ t and J 1 ⊆ [n] with |J 1 | = n -1 otherwise, 3. the set J 2 is such that J 2 = J 2 if |J 2 | ≤ t and J 2 ⊆ [n] with |J 2 | = n -1 otherwise,
4. the output distribution satisfies

out id = AssignWires(G, W, x) , y| J 1 , z| J 2 (4.3)
where ( y, z) = G( x).

It is not hard to check that the above expandability notions are stronger than the composability notion introduced in Section 3.2. Formally, we have the following reduction.

Proposition 2. Let f = R → R and n ∈ N. Let G be an n-share gadget with ≤ 2 inputs. If G is (t, f )-RPE then G is (t, f )-RPC, with f (•) = • f (•).
Proof. We consider a (t, f )-RPE n-share gadget G : K n ×K n → K n . The (t, 2•f )-random composability property is directly implied by the (t, f )-random probing expandability by making use of the exact same simulators and observing that

Pr (|I 1 | > t) ∨ (|I 2 | > t) ≤ Pr(|I 1 | > t) + Pr(|I 2 | > t) = 2 • ε.
The case of = 1 input gadgets is even more direct. Definition 10 (and Definition 11) of random probing expandability is valid for base gadgets. For level-k gadgets G (k) = CC (k-1) (G) where G ∈ {G g } g∈B is a base gadget, we provide a generalized definition of random probing expandability.

Adequate subsets of [n k

]. We first define the notion of "adequate" subsets of [n k ], instead of only bounded subsets. For this we define recursively a family S k ∈ P([n k ]), where P([n k ]) denotes the set of all subsets of [n k ], as follows:

S 1 = {I ∈ [n], |I| ≤ t} S k = {(I 1 , . . . , I n ) ∈ (S k-1 ∪ [n k-1 ]) n , I j ∈ S k-1 ∀ j ∈ [1, n] except at most t}
In other words, a subset I belongs to S k if among the n subset parts of I, at most t of them are full, while the other ones recursively belong to S k-1 ; see Figure 4.1 below for an illustration with n = 3 and t = 1. Generalized definition of Random Probing Expandability. We generalize Definition 10 as follows. At level k the input sets I 1 and I 2 must belong to S k , otherwise we have a failure event. As in Definition 10, the simulation is performed for an output subset J with

∈ S 1 ∈ S 1 ∈ S 1 ∈ S 2 ∈ S 2 ∈ S 2
J = J if J ∈ S k , otherwise J = [n k ] \ {j } for some j ∈ [n k ]. Definition 12 (Random Probing Expandability with {S k } k∈N ). Let f : R → R and k ∈ N. An n k -share gadget G : K n k × K n k → K n k is (S k , f )-random probing expandable (RPE) if there exists a deterministic algorithm Sim G
1 and a probabilistic algorithm Sim G 2 such that for every input ( x, y) ∈ K n k × K n k , for every set J ∈ S k ∪ [n k ] and for every p ∈ [0, 1], the random experiment

W ← LeakingWires(G, p) (I 1 , I 2 , J ) ← Sim G 1 (W, J) out ← Sim G 2 (W, J , x| I 1 , y| I 2 )
ensures that 1. the failure events

F 1 ≡ I 1 / ∈ S k and F 2 ≡ I 2 / ∈ S k verify Pr(F 1 ) = Pr(F 2 ) = ε and Pr(F 1 ∧ F 2 ) = ε 2 (4.4)
with ε = f (p) (in particular F 1 and F 2 are mutually independent), 2. the set J is such that J = J if J ∈ S k , and J = [n k ]\{j } for some j ∈ [n k ] otherwise, 3. the output distribution satisfies

out id = AssignWires(G, W, ( x, y)) , z| J (4.5)
where z = G( x, y).

The notion of random probing expandability from Definition 12 naturally leads to the statement of the following main theorem.

Theorem 2. Let n ∈ N and f : R → R. Let {G g } g∈B be n-share gadgets for g ∈ B over K, where each g ∈ B is of at most 2 inputs and 2 outputs. Let CC be the standard circuit compiler with sharing order n and base gadgets {G g } g∈B . Let CC (k) be the expanding circuit compiler with base compiler CC. If the base gadgets {G g } g∈B , are (t, f )-RPE then, G (k) g = CC (k-1) (G g ) for g ∈ B are (S k , f (k) )-RPE, n k -share gadgets for the addition, multiplication and copy on K.

Proof. The proof of the theorem relies on what we shall call the assignment expansion property. Throughout the proof we shall denote ε k = f (k) (p). We call level-k gadget a gadget that has been expanded k -1 times G (k) = CC (k-1) (G) where G is a base gadget (or a level-1 gadget) among G g for g ∈ B.

We proceed by induction to show that the level-k gadgets are (S k , f (k) )-RPE. The base case is one of the theorem hypotheses, namely the base gadgets {G g } g∈B (i.e. the level-1 gadgets) are (t, f )-RPE, which is equivalent to (S 1 , f )-RPE. We must then show the induction step: assuming that the level-k gadgets are (S k , f (k) )-RPE, show that the level-(k + 1) gadgets are (S k+1 , f (k+1) )-RPE. For the sake of simplicity, we depict our proof by assuming that all the gadgets are 2-to-1 gadget (which is actually not the case for copy gadgets). The proof mechanism for the general case is strictly similar but heavier on the form.

In order to show that G (k+1) is (S k+1 , f (k+1) )-RPE we must construct two simulators Sim G (k+1) 1 and Sim G (k+1) 2 that satisfy the conditions of Definition 28 for the set of subsets S k+1 . More precisely, we must construct two simulators Sim G (k+1) 1 and Sim G (k+1) 2 such that for every ( x * , y * ) ∈ K n k+1 × K n k+1 , and for every set J * ∈ S k+1 ∪ [n k+1 ], the random experiment

W * ← LeakingWires(G (k+1) , p) (I * 1 , I * 2 , J * ) ← Sim G 1 (W * , J * ) out ← Sim G 2 (W * , J * , x * | I * 1 , y * | I * 2 ) ensures that 1. the failure events F * 1 ≡ I * 1 / ∈ S k+1 ) and F * 2 ≡ I * 2 / ∈ S k+1 ) verify Pr(F * 1 ) = Pr(F * 2 ) = ε k+1 and Pr(F * 1 ∧ F * 2 ) = ε 2 k+1 (4.6)
2. the set J * is such that J * = J * if J * ∈ S k+1 and J * = [n k+1 ] \ {j } otherwise, where z = G (k+1) ( x, y).

We distinguish two cases: either J * ∈ S k+1 (normal case), or J * = [n k+1 ] (saturated case).

Normal case: J * ∈ S k+1 . By definition of the expanding compiler, we have that a level-(k+1) gadget G (k+1) is obtained by replacing each gate of the base gadget by the corresponding level-k gadget and by replacing each wire of the base gadget by n k wires carrying a (n k )-linear sharing of the original wire. In particular G (k+1) has n k+1 output wires which can be split in n groups of n k wires, each group being the output of a different G (k) gadget. We split the set J * accordingly so that

J * = J * 1 ∪ • • • ∪ J * n
, where each set J * i pertains to the ith group of output wires. By definition of S k , since J * ∈ S k+1 , we must have J * i ∈ S k for all 1 ≤ i ≤ n, except at most t of them for which J * i = [n k ]. We define J base as the set of indexes i such that

J * i / ∈ S k . Therefore we must have |J base | ≤ t.
We first describe the simulator Sim G (k+1)

1 that takes the leaking wires W * and the output wires J * ∈ S k+1 to be simulated and produce the sets

I * 1 ⊆ [n k+1 ] and I * 2 ⊆ [n k+1
] of required inputs. The simulator Sim G (k+1) 1 starts by defining a set W base which is initialized to ∅; this will correspond to the set of leaking wires for the base gadget. Then the simulation goes through all the level-k gadgets composing G (k+1) from bottom to top i.e. starting with the level-k gadgets producing the output sharing up to the level-k gadgets processing the input sharings.

Let us denote by {G (k) j } j these level-k gadgets. For each G (k) j , one runs the simulator Sim 1 from the (S k , f (k) )-RPE property on input W j and J j defined as follows. The set of leaking wires W j is defined as the subset of W * corresponding to the wires of G (k) j . For the gadgets G (k) j on the bottom layer, the set J j is set to one of the J * i (with indices scaled to range in [n k ]). For all the other gadgets G (k) j (which are not on the bottom layer), the set J is defined as the set I 1 or I 2 output from Sim 1 for the child gadget G (k) j (for which Sim 1 has already been run).

Whenever a failure event occurs for a G (k) j gadget, namely when the set I (either I 1 or I 2 ) output from Sim 1 is such that I / ∈ S k , we add the index of the wire corresponding to this input in the base gadget G to the set W base . Once the Sim 1 simulations have been run for all the G (k) j gadgets, ending with the top layers, we get the final sets I corresponding to the input shares. Each of these sets corresponds to an n k -sharing as input of a G (k) j gadget, which corresponds to a wire as input of the base gadget among the 2 • n wires carrying the two input n-sharings of the base gadget. We denote by I * 1,1 , . . . , I * 1,n and I * 2,1 , . . . , I * 2,n the corresponding sets so that defining

I * 1 = I * 1,1 ∪ . . . ∪ I * 1,n and I * 2 = I * 2,1 ∪ . . . ∪ I * 2,n , (4.8)
the tuple x * | I * 1 and y * | I * 2 contains the shares designated by the final I sets. At the end of the Sim G (k+1) 1 simulation, the set W base contains all the labels of wires in the base gadget G for which a failure event has occurred in the simulation of the corresponding G (k) j gadget. Thanks to the (S k , f (k) )-RPE property of these gadgets, the failure events happen (mutually independently) with probability ε k which implies

W base id = LeakingWires(G, ε k ) (4.9)
Recall that |J base | ≤ t. We can then run Sim G 1 to obtain:

(I 1,base , I 2,base ) = Sim G 1 (W base , J base ) . (4.10)
For all 1 ≤ i ≤ n, if i ∈ I 1,base , we force I * 1,i ← [n k ], so that the corresponding i-th input wire of the base gadget can be computed from the corresponding input wires in I * 1,i . The simulator Sim G (k+1) 1 then returns (I * 1 , I * 2 ) as output. The (t, f )-RPE property of the base gadget G implies that the base failure events |I 1,base | = n and |I 2,base | = n are ε k+1 -mutually unlikely, where ε k+1 = f (ε k ). We argue that for all ). We deduce that the failure events F * 1 and F * 2 are also ε k+1 -mutually unlikely, as required by the (S k+1 , f (k+1) )-RPE property of G (k+1) .

1 ≤ i ≤ n, I * 1,i / ∈ S k ⇐⇒ i ∈ I 1,
We now describe the simulator Sim G (k+1) 2 that takes as input x * | I * 1 and y * | I * 2 and produces a perfect simulation of AssignWires(G (k+1) , W * , ( x * , y * )), z| J * where z = G (k+1) ( x, y). Let x b and y b denote the n-linear sharings obtained by applying the linear decoding to each group of n k shares in x * and y * , so that the elements of x b and y b correspond to the input wires in the base gadget G. The assignment expansion property implies that a perfect assignment of the wires of G (k+1) on input x * and y * can be derived from an assignement of the wires of the base gadget G on input x b and y b . The simulator makes use of this property by first running The simulator then goes through all the G (k) j gadgets from input to output and for each of them runs the simulator Sim 2 of the RPE property on inputs W j , J j , x| I 1 and y| I 2 where W j and J j are the sets from the first phase of the simulation for the gadget G in the evaluation of G (k+1) ( x * , y * ). Provided that the partial inputs x| I 1 and y| I 2 are perfectly simulated, this call to Sim 2 produces a perfect simulation of AssignWires(G (k) j , W j , ( x, y), z| J j where z = G (k) j ( x, y). In order to get perfect simulations of the partial inputs x| I 1 and y| I 2 , the simulator proceeds as follows. For the top layer of G (k) gadgets (the ones processing the input shares) the shares x| I 1 and y| I 2 can directly be taken from the inputs x * | I * 1 and y * | I * 2 . For the next gadgets the shares x| I 1 and y| I 2 match the shares z| J output from the call to Sim 2 for a parent gadget. The only exception occurs in case of a failure event.

out base ← Sim G 2 (W base , J base , x b | I 1,
In that case the simulation needs the full input x = (x 1 , . . . , x n k ) (and/or y = (y 1 , . . . , y n k )), while we have set |I 1 | = n k -1 (and/or |I 2 | = n k -1) to satisfy the RPE requirements of the parent gadget in the first simulation phase. Nevertheless, for such cases a perfect simulation of the plain value x = LinDec( x) (and/or y = LinDec( y)) is included to out base by construction of W base . We can therefore perfectly simulate the missing share from the n k -1 other shares and the plain value x (or y). We thus get a perfect simulation of AssignWires(G (k) j , W j , ( x, y), z| J j for all the level-k gadgets G (k) j which gives us a perfect simulation of AssignWires(G (k+1) , W * , ( x * , y * )), z| J * . Saturated case: J * = [n k+1 ]. The saturated case proceeds similarly. The difference is that we must simulate all n k+1 output shares of the level-(k + 1) gadget, except for one share index j * that can be chosen by the simulator.

The simulator Sim G (k+1) 1 is defined as previously. Since J * = [n k+1 ], we must define

J base = [1, n]. Moreover we have J * i = [n k ] for all 1 ≤ i ≤ n.
This implies that for the gadgets G (k) j on the output layer, the sets J j are all equal to [n k ] as well. The set W base is defined as previously, and the simulator Sim G (k+1) 1 returns (I * 1 , I * 2 ) as previously. The failure events F * 1 and F * 2 are still ε k+1 -mutually unlikely, as required by the (S k+1 , f (k+1) )-RPE property of G (k+1) .

The simulator Sim G (k+1) 2 is defined as previously. In particular, from the running of the base gadget simulator Sim G 2 , we obtain a perfect simulation of the output wires z b | J base for some J base with |J base | = n -1. Combined with the perfect simulation of the output wires corresponding to the output sets J j from the gadgets G (k) j on the output layer, with |J j | = n k -1, we obtain a subset J of output wires for our level-(k + 1) gadget with |J | = n k+1 -1 as required. Eventually this gives us a perfect simulation of AssignWires(G (k+1) , W * , ( x * , y * )), z| J . This terminates the proof of Theorem 2.

The random probing security of the expanding circuit compiler can then be deduced as a corollary of the above theorem together with Proposition 2 (RPE ⇒ RPC reduction) and Theorem 1 (composition theorem).

Corollary 1. Let B be an arithmetic circuit basis B = {g : K → K m } such that , m ≤ 2 for any g ∈ B. Let n ∈ N and f : R → R. Let {G g } g∈B be n-share gadgets on K. Let CC be the standard circuit compiler with sharing order n and base gadgets {G g } g∈B . Let CC (k) be the expanding circuit compiler with base compiler CC. If the base gadgets G g are (t, f )-RPE then CC (k) is (p, 2 • f (k) (p))-random probing secure.

How to compute f (p) for RPE ?

The requirement of the RPE property that the failure events F 1 and F 2 are mutually independent might seem too strong. In practice it might be easier to show or verify that some gadgets satisfy a weaker notion. We say that a gadget is (t, f )-weak random probing expandable (wRPE) if the failure events verify Pr(F 1 ) ≤ ε, Pr(F 2 ) ≤ ε and Pr(F 1 ∧ F 2 ) ≤ ε 2 instead of (A.3) in Definition 10. Although being easier to achieve and to verify, this notion is actually not much weaker as the original RPE. We have the following reduction of RPE to wRPE.

Proposition 3. Let f = R → [0, 0.14]. Let G : K n × K n → K n be an n-share gadget. If G is (t, f )-wRPE then G is (t, f )-RPE with f (•) = f (•) + 3 2 f (•) 2 .
Proof. Let Sim G 1 be the simulator from the (t, f )-wRPE property. This simulator outputs I 1 and I 2 such that

Pr(F 1 ) = ε 1 ≤ ε , Pr(F 2 ) = ε 2 ≤ ε and Pr(F 1 ∧ F 2 ) = ε 12 ≤ ε 2 , (4.13)
where

F 1 ≡ (|I 1 | > t) and F 2 ≡ (|I 2 | > t).
We show how to construct Sim G 1 which outputs I 1 and I 2 such that

Pr(F 1 ) = Pr(F 2 ) = ε and Pr(F 1 ∧ F 2 ) = (ε ) 2 with ε = ε + 3 2 ε 2 (4.14)
where

F 1 ≡ (|I 1 | > t) and F 2 ≡ (|I 2 | > t)
and such that I 1 ⊆ I 1 and I 2 ⊆ I 2 . In particular, the latter implies that we can keep the same Sim G 2 simulator since it is always given the same input shares plus additional input shares to achieve the same simulation as before.

The simulator Sim G 1 first calls the simulator Sim G 1 to get I 1 and I 2 . Whenever |I 1 | and |I 2 | are both lower than t, i.e. no failure event occurs, which happens with probability for some δ 1 , δ 2 , δ 12 ≥ 0 such that δ 1 + δ 2 + δ 12 ≤ p succ . We hence get

p succ = 1 -(ε 1 + ε 2 -ε 12 ), Sim G 1 outputs (I 1 , I 2 ) =            ([n], I 2 ) with probability p 1 = δ 1 /p succ (I 1 , [n])
Pr(F 1 ) = ε 1 + δ 1 + δ 12 Pr(F 2 ) = ε 2 + δ 2 + δ 12 Pr(F 1 ∧ F 2 ) = ε 12 + δ 12
We must now fix δ 1 , δ 2 , δ 12 ≥ 0 to satisfy Equation 4.14, with ε = ε+3•ε 2 /2 and δ 1 +δ 2 +δ 12 ≤ p succ = 1 -(ε 1 + ε 2 -ε 12 ). We fix δ 12 = (ε ) 2 -ε 12 ; this gives Pr(F 1 ∧ F 2 ) = (ε ) 2 , and from Equation 4.13 we obtain δ 12 ≥ 0 as required. We let:

δ 1 := ε -ε 1 -δ 12
which gives Pr(F 1 ) = ε as required. Moreover we obtain using Equation 4.13:

δ 1 = ε + 3 2 ε 2 -ε 1 -(ε + 3 2 ε 2 ) 2 -ε 12 ≥ 3 2 ε 2 -ε 2 + 3ε 3 + 9 4 ε 4 ≥ ε 2 • 1 2 -3ε - 9 4 ε 2 ≥ 0 for ε ≤ 0.14.
We obtain similar conditions for δ 2 := ε -ε 2 -δ 12 . Finally, we have

δ 1 + δ 2 + δ 12 = ε -ε 1 -δ 12 + ε -ε 2 -δ 12 + δ 12 = 2ε -ε 1 -ε 2 -(ε ) 2 + ε 12 = p succ + 2ε -(ε ) 2 -1 ≤ p succ + 2ε -1 ≤ p succ for ε ≤ 0.14.
as required. Note that the upper bound ε ≤ 0.14 is reasonable and is satisfied by all of the constructions we consider which have a much lower failure event probability.

Assume that we can show or verify that a gadget is wRPE with the following failure event probabilities

Pr(F 1 ) = f 1 (p) , Pr(F 2 ) = f 2 (p) and Pr(F 1 ∧ F 2 ) = f 12 (p) ,
for every p ∈ [0, 1]. Then the above proposition implies that the gadget is (p, f )-RPE with

f : p → f max (p) + 3 2 f max (p) 2 with f max = max(f 1 , f 2 , f 12 ) .
The computation of f for wRPE can be split into two steps that we first describe for the case of addition and multiplication gadgets with fan-in 2 and fan-out 1.

In a first step, we compute f to check the (t, f )-wRPE property for output sets of shares of cardinal at most t. For 2-input gadgets, this step leads to the computation of coefficients c i corresponding to three failure events F 1 , F 2 , and F 1 ∧ F 2 as defined above but restricted to output sets of shares of cardinal less than t. The process is very similar to the verification of random probing composability but requires to separate the failure events counter into failure events for the first input (|I

1 | > t), for the second input (|I 2 | > t) or for both ((|I 1 | > t) ∧ (|I 2 | > t)).
In the following, we denote the three functions formed from the corresponding coefficients as f

(1) 1 , f (1)
2 , and f

(1) 12 .
Then, in a second step, we check that there exists at least one set of n -1 shares for each output, such that the simulation failure is limited by f (p) for some probability p ∈ [0, 1]. In that case, we still loops on the possible output sets of shares (of cardinal n -1) but instead of computing the maximum coefficients, we determine whether the simulation succeeds for at least one of such sets. A failure event is recorded for a given tuple if no output sets of cardinal n -1 can be simulated together with this tuple from at most t shares of each input. We record the resulting coefficients for the three failure events to obtain functions f

(2) 1 , f (2)
2 , and f

(2) [START_REF] Barthe | Masking in fine-grained leakage models: Construction, implementation and verification[END_REF] . From these two steps, we can deduce f such that the gadget is (t, f )-wRPE:

∀p ∈ [0, 1], f (p) = max(f 1 (p), f 2 (p), f 12 (p)) with f α (p) = max(f (1) α (p), f (2) α (p)) for α ∈ {1, 2, 12}
The computation of f for a gadget to satisfy (t, f )-weak random probing expandability is a bit trickier for copy gadgets which produce two outputs. Instead of two verification steps considering both possible ranges of cardinals for the output set of shares J, we need to consider four scenarios for the two possible features for output sets of shares J 1 and J 2 . In a nutshell, the idea is to follow the first verification step described above when both J 1 and J 2 have cardinal equal or less than t and to follow the second verification step described above when both J 1 and J 2 have greater cardinals. This leads to functions f (1) and f (2) . Then, two extra cases are to be considered, namely when (|J 1 | ≤ t) and (|J 2 | > t) and the reverse when (|J 1 | > t) and (|J 2 | ≤ t). To handle these scenarios, our tool loops over the output sets of shares of cardinal equal or less than t for the first output, and it determines whether there exists a set of n -1 shares of the second output that a simulator can perfectly simulate with the leaking wires and the former set. This leads to function f (12) and reversely to function f (21) . From these four verification steps, we can deduce f such that the copy gadget is (t, f )-wRPE: (1) (p), f (2) (p), f (12) (p), f (21) (p)).

∀p ∈ [0, 1], f (p) = max(f
Once gadgets have been proven (t, f )-weak RPE, they are also proven to be (t, f )-RPE from Proposition 3 with f : p → f (p) + 3 2 f (p) 2 . Similarly to RP and RPC, we suppose we have access to algorithms that allow us to efficiently and automatically compute the coefficients of the function f (p) for (w)RPE. We will discuss automatic verification tools in more detail later in Chapter 7, and provide results of such computation in the following sections. But before, let us the discuss the complexity of the expansion strategy.

Expansion Complexity

In this section we show that the asymptotic complexity of a compiled circuit

C = CC (k) (C) is | C| = O |C| • κ e
for a security parameter κ and some constant e that we explicit below.

Let us denote by N = (N g 1 , . . . , N g |B| ) T the column vector of gate counts for some base gadget G, where N g i stands for the number of g i gates for g i ∈ B. We have B different such vectors

N Gg i = (N Gg 1 ,g 1 , . . . , N Gg |B| ,g |B| ) T
for the gate counts respectively in the base gadget G g i for each g i ∈ B. Let us define the |B| × |B| square matrix M as

M = N Gg 1 | . . . | N Gg |B|
It can be checked that applying the standard circuit compiler with base gadgets {G g } g∈B to some circuit C with gate-count vector N C gives a circuit C with gate-count vector N C = M • N C . It follows that the k th power of the matrix M gives the gate counts for the level-k gadgets as:

M k = M • M • • • M k times = N (k) Gg 1 | . . . | N (k) Gg |B| where N (k) i
are the gate-count vectors for the level-k gadgets G (k)

g i respectively. Let us denote the eigen decomposition of M as M = Q • Λ • Q -1 , we get M k = Q • Λ k • Q -1 with Λ k =    λ k 1 . . . λ k |B|   
where λ i are the eigenvalues of M . We then obtain an asymptotic complexity of

| C| = O |C| • (λ k 1 + . . . + λ k |B| ) = O |C| • N k max with N max = max i (λ i ) . (4.15)
for a compiled circuit C = CC (k) (C) (where the constant in the O(•) depends on Q and shall be fairly small).

Specialization to addition, copy, multiplication and random gates. We now consider B to contain 4 gates that we consider in our circuits: addition, copy and multiplication gates, as well as randomness gates which simply generate a fresh uniform random value (i.e. with zero input and one output). In this case, we have the 4 gate count vectors

N G add = (N G add ,a , N G add ,c , N G add ,m , N G add ,r ) T N G mult = (N G mult ,a , N G mult ,c , N G mult ,m , N G mult ,r ) T N Gcopy = (N Gcopy,a , N Gcopy,c , N Gcopy,m , N Gcopy,r ) T
for the three base gadgets G add , G mult and G copy respectively (where a, c, m, r stand for addition, copy, multiplication and random gates respectively). We also have

N rand = (0, 0, 0, n) T
which holds from the fact that the standard circuit compiler simply replaces each random gate by n random gates. Then, we can construct the matrix M as

M = N G add | N Gcopy | N G mult | N rand
Interestingly, if multiplication gates are solely used in the multiplication gadget (i.e. N G add ,m = N Gcopy,m = 0) which is the case in the constructions we usually consider, it can be checked that (up to some permutation) the eigenvalues satisfy

(λ 1 , λ 2 ) = eigenvalues(M ac ) , λ 3 = N k G mult ,m and λ 4 = n k
where M ac is the top left 2 × 2 block matrix of M i.e.

M ac = N G add ,a N Gcopy,a N G add ,c N Gcopy,c . (4.16)
We finally get

| C| = O |C| • N k max with N max = max(eigenvalues(M ac ), N G mult ,m ) . (4.17)
Complexity and security level. In order to reach some security level ε = 2 -κ for some target security parameter κ and assuming that we have a security expansion p → f (k) (p), the expansion level k must be chosen so that f

(k) (p) ≤ 2 -κ . In practice, the function f is of the form f : p → i≥d c i p i ≤ (c d + O(p)) p d .
where O(p) is to be interpreted as p tends to 0. We shall say that such a function has amplification order d.

Definition 13 (Amplification Order). We define the amplification order of a function and the amplification order of a gadget.

• Let f : R → R which satisfies

f (p) = c d p d + O(p d+ε )
as p tends to 0, for some c d > 0 and ε > 0. Then d is called the amplification order of f .

• Let t > 0 and G a gadget. Let d be the maximal integer such that G achieves (t, f )-RPE for f : R → R of amplification order d. Then d is called the amplification order of G (with respect to t).

We stress that the amplification order of a gadget G is defined with respect to the RPE threshold t. Namely, different RPE thresholds t are likely to yield different amplification orders d for G (or equivalently d can be thought of as a function of t).

The upper bound

f (p) ≤ c d p d with c d = c d + O(p) implies f (k) (p) < (c d p) d k .
Hence, to satisfy the required security f (k) (p) ≤ 2 -κ while assuming c d p < 1, the number k of expansions must satisfy:

k log d (κ) -log d (-log 2 (c d p)) .
We can then rewrite (4.15) (and also (4.17)) as

| C| = O |C| • κ e with e = log N max log d . (4.18)
In addition, we recall that for the expansion strategy to be useful, we must have ε = f (p) < p. We call the maximum tolerated leakage probability of a gadget, the maximal value

0 ≤ p max ≤ 1 such that f (p max ) < p max .
Two crucial parameters determine the complexity of the expanding compiler: N max and d. The value of N max depends on the number of gates in the gadgets (i.e. complexity of the gadgets), while the amplification order depends on the associated failure functions for RPE property. In order to get the best expanding compilers in terms of asymptotic complexity, we need to find gadgets with the least gates and the highest amplification order.

Bounding the Amplification Order

As recalled above, the amplification order of a gadget is a crucial parameter of its random probing expandability. The higher the amplification order, the lower the asymptotic complexity of the expanding compiler, ceteris paribus. A natural question is to determine the best amplification order that can be hoped for given the different parameters of a gadget. In this section, we exhibit concrete upper bounds on the amplification order that can be achieved by a gadget depending on its input-output dimensions ( , m), its number of shares n, and its RPE threshold t.

Before giving the bounds let us make a key observation on the amplification order of a gadget. Let G be a 2-to-1 n-share gadget achieving (t, f )-RPE. A subset W of the wires of G is said to be a failure set with respect to the first input (resp. the second input) if there exists a set J ⊆

[n] such that (I 1 , I 2 , J ) ← Sim G 1 (W, J) implies |I 1 | > t (resp. |I 2 | > t)
, namely if a leaking set W implies the failure event F 1 (resp. F 2 ) in the definition of RPE ( Definition 10). One can check that G has amplification order d ≤ d up if one of the two following events occurs: We start by exhibiting a generic upper bound for the amplification order and then look at the particular case of what we shall call a standard multiplication gadget.

Generic Upper Bound. In the following we will say that a function g : K → K m is complete if at least one of its m outputs is functionally dependent on the inputs. Similarly, we say that a gadget G is complete if its underlying function g is complete. The following lemma gives our generic upper bound on the amplification order.

-) • (n -t)). 3
Proof. The first part of the bound on the amplification order d ≤ (t + 1) is immediate since by probing t + 1 shares of any input, the considered set will be a failure set of cardinality t + 1.

We then consider two cases depending on the number of inputs:

1. 1-input gadgets ( = 1): We show that we can exhibit a failure set of size 2(n -t). Let us denote the output shares z 1 , . . . , z n (for two-output gadgets, i.e. m = 2, z 1 , . . . , z n can be any of the output sharings). In the evaluation of the (t, f )-RPE property, t shares among the z i 's (corresponding to the set J) must be simulated. Without loss of generality, let z 1 , . . . , z t be those shares (i.e. J = [t]). By including both input gates of each of the remaining output shares z t+1 , . . . , z n in the set W , the distribution to be simulated requires the knowledge of the full input (by completeness of the gadget). The set W is thus a failure set with 2(n -t) elements.

2. 2-input gadgets ( = 2): Considering the same failure set as in the above case, the simulation of out in the RPE definition requires the full two input sharings. Hence W is a failure set of size 2(n -t) with respect to the two inputs, and so the amplification order satisfies d ≤ (n -t).

We hence conclude that d ≤ min((t + 1), 2(n -t)) for one-input gadgets, and d ≤ min((t + 1), (n -t)) for two-input gadgets.

Corollary 2 (One-input gadget). The amplification order d of a one-input gadget achieving (t, f )-RPE is upper bounded by

d ≤ 2(n + 1) 3 .
The above corollary directly holds from Lemma 1 for a RPE threshold t = 2n-1

3

(which balances the two sides of the min).

Corollary 3 (Two-input gadget). The amplification order d of a two-input gadget achieving (t, f )-RPE is upper bounded by

d ≤ n + 1 2 .
The above corollary directly holds from Lemma 1 for a RPE threshold t = n-1

2

(which balances the two sides of the min).

We deduce from the two above corollaries that for a circuit composed of addition, multiplication and copy gadgets, the amplification order is upper bounded

d ≤ min 2(n + 1) 3 , n + 1 2 = n + 1 2 ,
which can only be achieved for an odd number of shares by taking t = n-1 2 as RPE threshold.

Upper Bound for Standard Multiplication Gadgets. The generic bound exhibited above is not tight in the special case of a standard multiplication gadget which computes cross products between the input shares, such as the ISW multiplication gadget [START_REF] Ishai | Private circuits: Securing hardware against probing attacks[END_REF]. We exhibit hereafter a tighter bound for such gadgets.

Formally, a n-share multiplication gadget G is a standard multiplication gadget, if on input ( x, y) ∈ (K n ) 2 , G computes the cross products x i • y j for 1 ≤ i, j ≤ n. Our upper bound on the amplification order for such gadgets is given in the following lemma.

Lemma 2. Let f : R → R and n ∈ N. Let G be an n-share standard multiplication gadget achieving (t, f )-RPE. Then its amplification order d is upper bounded by

d ≤ min t + 1 2 , (n -t) .
Proof. The second part of the bound (n -t) holds directly from Lemma 1. We now prove the bound (t + 1)/2 by exhibiting a failure set of size t + 1 with t output shares, which will be a failure on both inputs. Let {m ij } 0≤i,j≤n denote the cross products such that m ij = x i • y j . Consider a set W made of t + 1 such variables {m ij } for which the indices i and j are all distinct. Specifically,

W = {x i 1 • y j 1 , . . . , x i t+1 • y j t+1 } such that {i } 1≤ ≤t+1 and {j } 1≤ ≤t+1
are both sets of (t + 1) distinct indices. Clearly, such a set is a failure set for both inputs x and y since it requires t + 1 shares of each of them to be perfectly simulated (even without considering the output shares to be also simulated). We hence have a double failure set of cardinality t + 1 which implies the (t + 1)/2 upper bound on the amplification order.

The above lemma implies that the highest amplification order for standard multiplication gadgets might be achieved for a RPE threshold t = 2n-1 3 which yields the following maximal upper bound:

d ≤ n + 1 3 ,
which is lower than the generic upper bound for 2-to-1 gadgets exhibited in Corollary 3. This loss suggests that better amplification orders could be achieved for multiplication gadgets that do not compute direct cross products of the input shares. We actually provide such constructions in later chapters (c.f. Chapter 5).

About 2-share gadgets. Thanks to Corollary 3, we know that the highest amplification order achievable for 2 inputs 2-share gadgets is equal to 1. For such a gadget, the failure function for RPE would then be equal to

f (p) = c 1 • p + O(p 2 ), with c 1 > 0.
Recall that an amplification order strictly greater than one guarantees that there exists a probability p max ∈ [0, 1] such that ∀p ≤ p max , f (p) ≤ p, which is necessary to benefit from the expansion. It is not the case for 2-share expanding compilers that use 2 inputs gadgets such as addition and multiplication. We thus restrict our investigation in the following to n-share gadgets, with n ≥ 3 to instantiate the expanding compiler.

RPE Compiler Parameters

When constructing an expanding compiler as in Definition 9, the complexity depends on the parameters of the worst case gadget. In other words, the amplification order and the tolerated leakage rate will be associated to the worst failure function f (p) among the functions associated to the base RPE gadgets. We can give the following general definition of the expanding compiler including the way we define the amplification order and the tolerated leakage rate associated to it. given an expansion level k as defined in Definition 9. Moreover,

• the expanding function of CC is the function f defined as

f : p → max g f Gg (p)
• the amplification order of CC is the integer d defined as

d = min g d Gg
where d Gg is the amplification order of f Gg ,

• the gadget complexity of CC is the integer s defined as

s = max g |G g |
where |G g | denotes the number of wires in the gadget G g ,

• the tolerated leakage rate of CC is the real number q ∈ [0, 1) such that f (p) < p for every p < q.

A First 3-share RPE Construction

In this section, we exhibit and analyze small (1, f )-wRPE gadgets for the addition, multiplication, and copy (on any base field K) with n = 3 shares to instantiate the RPE circuit compiler. These gadgets are sound in the sense that their function f has amplification order strictly greater than one. For 2-input gadgets, f is defined as the maximum between f 1 , f 2 , and √ f 12 (c.f. Section 4.3). Therefore, the constraint on the amplification order also applies to the functions f 1 , f 2 , and √ f 12 . For the function f 12 , this means that the amplification order should be strictly greater than two.

The constructions in this section do not achieve the best parameters regarding security and complexity. The addition and copy constructions achieve the maximal amplification order for 3 shares (i.e. d = 2), while the multiplication construction only achieves an amplification order of d = 3/2. These constructions were the first attempt at the expanding compiler construction from [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF]. Nevertheless, this section aims to present a first working example with concrete security and complexity bounds. In addition, Section 4.6 shows that this non-optimal construction still outperforms previous constructions in the state-of-the-art. In Chapter 5 and Chapter 6, our primary goal will be to achieve the best security and complexity bounds while discussing the benefits and limitations of the expansion strategy.

In the upcoming gadget descriptions, notice that variables r i are fresh random values, operations are processed with the usual priority rules and the number of implicit copy gates can be deduced from the occurrences of each intermediate variable such that s occurrences require s -1 implicit copy gates (i.e. a total of 2 • s -1 wires assigned with the same variable expression). Also, the function expression below each gadget corresponds to the function obtained from IronMask, computed as discussed in Section 4.3. It implies that the gadget is (t, f )-wRPE for t = 1 except when defined otherwise.

Addition gadget. The most classical masked addition schemes are share-wise additions which satisfy the simpler probing security property. Basically, given two input n-sharings x and y, such an addition computes the output n-sharing z as

z 1 ← x 1 + y 1 , z 2 ← x 2 + y 2 , . . . , z n ← x n + y n .
Unfortunately, such elementary gadgets do not work in our setting. Namely, consider an output set of shares J of cardinality t. Then, for any n, there exists sets W of leaking wires with |W | = 1 such that no sets (I 1 , I 2 ) (on inputs x and y respectively) both of cardinalities ≤ t can point to input shares that are enough to simulate both the leaking wire and the output shares of indices in J. For instance, given a set J = {1, . . . , t}, if W contains x t+1 , then no set I 1 (on input x) of cardinal ≤ t can define a set of input shares from which we can simulate both the leaking wire and z 1 , . . . , z t . Indeed, each z i for 1 ≤ i ≤ t requires both input shares x i and y i for its simulation. Thus, I 1 and I 2 would contain at least {1, . . . , t}, and I 1 additionally contains t + 1 for the simulation of the leaking wire. I 1 would thus be of cardinal t + 1, representing a failure event in the random probing expandability definition. Consequently, such an n-share addition gadget could only be (t, f )-RPE, where f has a first coefficient c 1 strictly positive. In other words, f would be of amplification order one such that ∀p ∈ [0, 1], f (p) ≥ p.

In the following, we introduce a 3-share addition gadget, which is (1, f )-wRPE with f of amplification order strictly greater than one. Basically, in our addition gadget, both inputs are refreshed with a circular refreshing gadget as originally introduced in [START_REF] Barthe | Parallel implementations of masking schemes and the bounded moment leakage model[END_REF], while simply rearranging the order of the refreshing variables:

G add : z 1 ← x 1 + r 1 + r 5 + y 1 + r 2 + r 4 z 2 ← x 2 + r 2 + r 6 + y 2 + r 3 + r 5 f max (p) = √ 69p 2 + O(p 3 ) z 3 ← x 3 + r 3 + r 4 + y 3 + r 1 + r 6 log 2 (p max ) = -4, 41
x and y are the input sharings and z the output sharing; f max additionally reports the maximum of the first non-zero coefficient of the three functions f 1 , f 2 , and f 12 , as defined in Section 4.3. p max reports the maximum tolerated leakage rate as defined in Section 4.4. Both are computed using IronMask. Note that G add is built with 15 addition gates and 6 implicit copy gates.

Copy gadget. We exhibit a 3-share (1, f )-wRPE copy gadget with f of amplification order strictly greater than one. The gadget also relies on two calls to the circular refreshing from [START_REF] Barthe | Parallel implementations of masking schemes and the bounded moment leakage model[END_REF] on the input:

w 1 ← x 1 + r 1 + r 2 ; z 1 ← x 1 + r 4 + r 5 w 2 ← x 2 + r 2 + r 3 ; z 2 ← x 2 + r 5 + r 6 f max (p) = 33p 2 + O(p 3 ) w 3 ← x 3 + r 3 + r 1 ; z 3 ← x 3 + r 6 + r 4 log 2 (p max ) = -5, 88
This gadget is made of 12 addition gates and 9 implicit copy gates. x is the input sharing, while w and z are the output sharings.

Multiplication gadget. As shown in Lemma 2, the maximum amplification order for multiplication gadgets performing a direct products between input shares, is equal to one for n = 3 shares. Hence, standard 3-share multiplication gadgets cannot be used as base gadgets of our compiler. To circumvent this issue, we build a 3-share multiplication gadget, by first refreshing both input sharings, before any multiplication is performed:

u 1 ← x 1 + r 6 + r 7 ; u 2 ← x 2 + r 7 + r 8 ; u 3 ← x 3 + r 8 + r 6 v 1 ← y 1 + r 9 + r 10 ; v 2 ← y 2 + r 10 + r 11 ; v 3 ← y 3 + r 11 + r 9 z 1 ← u 1 • v 1 + r 1 + u 1 • v 2 + r 2 + u 1 • v 3 + r 3 z 2 ← u 2 • v 1 + r 2 + u 2 • v 2 + r 5 + u 2 • v 3 + r 4 z 3 ← u 3 • v 1 + r 3 + u 3 • v 2 + r 4 + u 3 • v 3 + r 1 + r 5 f max (p) = √ 32p 3/2 + O(p 2 ) log 2 (p max ) = -7.09
Complexity and tolerated probability. This corresponds to the maximum value p for which we have f (p) < p which is a necessary and sufficient condition for the expansion strategy to apply with (t, f )-RPE gadgets. For instance, for level k = 9 the number of gates in the compiled gadgets is around 10 13 . For the latter level and assuming a leakage probability of p = 2 -7.09 (which is the maximum we can tolerate), we achieve a security of ε ≈ 2 -47 . If the considered leakage rate is slightly lower, for instance p = 2 -8 , we achieve a security ε ≈ 2 -10( for the same expansion level k = 9.

Comparison with Previous Works

In this section, we compare our scheme to previous constructions. Specifically, we first compare it to the well-known Ishai-Sahai-Wagner (ISW) construction and discuss the instantiation of our scheme from the ISW multiplication gadget. Then we exhibit the asymptotic complexity (and tolerated leakage probability) of the Ananth-Ishai-Sahai compiler and compare their results to our instantiation.

Comparison with ISW

The classical ISW construction [START_REF] Ishai | Private circuits: Securing hardware against probing attacks[END_REF] is secure in the t-probing model when the adversary can learn any set of t intermediate variables in the circuit, for n = 2t + 1 shares. This can be extended to t probes per gadget, where each gadget corresponds to a AND or XOR gate in the original circuit. Using Chernoff bound, security in the t-probing model per gadget implies security in the p-random probing model, where each wire leaks with probability p, with p = O(t/|G|), where |G| is the gadget size. Since in ISW each gadget has complexity O(t 2 ), this gives p = O(1/t). Therefore, in the p-random probing model, the ISW construction is only secure against a leakage probability p = O(1/n), where the number of shares n must grow linearly with the security parameter κ in order to achieve security 2 -κ . This means that ISW does not achieve security under a constant leakage probability p; this explains why ISW is actually vulnerable to horizontal attacks [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF], in which the adversary can combine information from a constant fraction of the wires.

ISW-based instantiation of the expanding compiler. In our instantiation, we choose to construct a new 3-share multiplication gadget instead of using the ISW multiplication gadget from [START_REF] Ishai | Private circuits: Securing hardware against probing attacks[END_REF]. In fact, ISW first performs a direct product of the secret shares before adding some randomness, while we proved in Section 4.4.1 that no such 3-share multiplication gadget made of direct products could satisfy (1, f )-RPE with amplification order strictly greater than one (c.f. Lemma 2). Therefore the ISW gadget is not adapted for our construction with 3 shares. Table 4.1 displays the output of the VRAPS verification tool [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF] when run on the ISW multiplication gadget for up to 7 shares with different values for t. It can be seen that an amplification order strictly greater than one is only achieved for t > 1, with 4 or more shares. And an order of 3/2 is only achieved with a minimum of 4 shares for t = 2, whereas we already reached this order with our 3-share construction for t = 1. Actually, we observe through the table that the ISW multiplication gadget achieves the maximal amplification order for a multiplication gadget performing direct cross-products of input shares (c.f. Lemma 2). We prove generic bounds on the amplification order achievable by the ISW multiplication gadget and study linear constructions based on the ISW refresh gadget later in Chapter 5.

If we use the 4 share ISW gadget with appropriate 4-share addition and copy gadgets instead of our instantiation, the overall complexity of the compiler would be greater, while the amplification order would remain the same, and the tolerated leakage probability would be worse (recall that our instantiation tolerates a maximum leakage probability p ≈ 2 -7.09 , while the 4-share ISW multiplication tolerates p ≈ 2 -9.83 ). Clearly, the complexity of the 4-share ISW gadget (N a , N c , N m , N r ) = [START_REF] Belaïd | A methodology to achieve provable side-channel security in real-world implementations[END_REF][START_REF] Bronchain | Breaking masked implementations with many shares on 32-bit software platforms: Or when the security order does not matter[END_REF][START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF][START_REF] Barthe | maskVerif: Automated verification of higher-order masking in presence of physical defaults[END_REF] is higher than that of our 3-share multiplication gadget (N a , N c , N m , N r ) = [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF][START_REF] Belaïd | Dynamic random probing expansion with quasi linear asymptotic complexity[END_REF][START_REF] Barthe | Verified proofs of higher-order masking[END_REF][START_REF] Barthe | Parallel implementations of masking schemes and the bounded moment leakage model[END_REF]. In addition, using 3-share addition and copy gadgets (as in our case) provides better complexity than 4-share gadgets. Hence to reach an amplification order of 3/2, a 4-share construction with the ISW gadget would be more complex and would offer a lower tolerated leakage probability. Table 4.1: Complexity, amplification order and maximum tolerated leakage probability of the ISW multiplication gadgets. Some leakage probabilities were not computed accurately by VRAPS [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF] for performances reasons. An interval on these probabilities is instead given by evaluating lower and upper bound functions f inf and f sup of f (p).

# shares

Complexity (N a , N c , N m , N r ) t Amplification

Complexity of the Ananth-Ishai-Sahai Compiler

The work from [START_REF] Ananth | Private circuits: A modular approach[END_REF] provides a construction of circuit compiler (the AIS compiler) based on the expansion strategy described in Section 4.1 with a (p, ε)-composable security property, analogous to our (t, f )-RPE property. To this purpose, the authors use an (m, c)-multi-party computation (MPC) protocol Π. Such a protocol allows to securely compute a functionality shared among m parties and tolerating at most c corruptions. In a nutshell, their composable circuit compiler consists of multiple layers: the bottom layer replaces each gate in the circuit by a circuit computing the (m, c)-MPC protocol for the corresponding functionality (either Boolean addition, Boolean multiplication, or copy). The next k -1 above layers apply the same strategy recursively to each of the resulting gates. As this application can eventually have exponential complexity if applied to a whole circuit C directly, the top layer of compilation actually applies the k bottom layers to each of the gates of C independently and then stitches the inputs and outputs using the correctness of the XOR-encoding property. Hence the complexity is in

O(|C| • N k g ) , (4.20)
where |C| is the number of gates in the original circuit and N g is the number of gates in the circuit computing Π. The authors of [START_REF] Ananth | Private circuits: A modular approach[END_REF] prove that such compiler satisfies (p, ε)-composition security property, where p is the tolerated leakage probability and ε is the simulation failure probability. Precisely:

ε = N c+1 g • p c+1 (4.21)
Equations (4.20) and (4.21) can be directly plugged into our asymptotic analysis of Section 4.4, with N g replacing our N max and where c+1 stands for our amplification order d. The obtained asymptotic complexity for the AIS compiler is

O |C| • κ e with e = log N g log c + 1 . (4.22)
This is to be compared to e = log Nmax log d in our scheme. Moreover, this compiler can tolerate a leakage probability

p = 1 N 2 g .
The authors provide an instantiation of their construction using an existing MPC protocol due to Maurer [START_REF] Ueli | Secure multi-party computation made simple (invited talk)[END_REF]. From their analysis, this protocol can be implemented with a circuit of

N g = (4m -c) • m-1 c 2 + 2m m c
gates. They instantiate their compiler with this protocol for parameters m = 5 parties and c = 2 corruptions, from which they get N g = 5712. From this number of gates, they claim to tolerate a leakage probability p =1 5712 2 ≈ 2 -25 and our asymptotic analysis gives a complexity of O |C| • κ e with e ≈ 7.87 according to (4.22).

Complexity [START_REF] Ueli | Secure multi-party computation made simple (invited talk)[END_REF] of the Maurer MPC protocol. In the following we compute the complexity and the value of N g in the instantiation of the AIS compiler [START_REF] Ananth | Private circuits: A modular approach[END_REF]. First, using this compiler, given a circuit C to compile, each gate G is implemented using a functionality F associated to the MPC protocol. Such a functionality F receives m shares of each input and then reconstructs them to obtain original values. This reconstruction can be done with 2(m -1) addition gates. Then after computing the gate G, m additive shares of the output are computed twice. This step consists of one gate for G, and 2(m -1) gates for the additive sharing along with 2(m -1) random gates. 1 So each gate G to compile is replaced by 6m -5 gates, each computed jointly by the m parties in the MPC protocol. Next, we state the complexity of the protocol from [START_REF] Ueli | Secure multi-party computation made simple (invited talk)[END_REF]. Each gate in a functionality F is jointly computed by all m parties. In the beginning, each party holds one share of each input.

The first step consists in a k-secret sharing of each input share where k = m c . For an input of m shares, each party will hold a total of m m-1 c shares. For two inputs, this step has a complexity of m(2k -2).

The second step is either performing an addition or a multiplication, depending on the gate G associated to the functionality. An addition simply means each party locally adding all its shares, holding a complexity of m m-1 c . In case of a multiplication gate, each party will locally compute the sum of the product of the shares of both inputs, and then share its local result using a secret sharing scheme as in the first step. This procedure holds a complexity of m-1 c

2 for computing the result, m(2k -2) for the secret sharing, and 2k 2 copy gates. Clearly, the cost of the second step is more important for the multiplication and can be upper bounded by

2 m -1 c 2 + m • (2k -2) + 2k 2 .
In the final step, every party broadcasts its shares to all other parties, and then adds all the shares it receives. The complexity of this step is m c . Considering the cost of replacing each gate G in the circuit to compile by 6m -5 gates, and the cost to compute each of these gates using the protocol Π, the total number of gates N g is upper bounded by

(6m -5) • m -1 c 2 + m(2k -2) + 2k 2 .
Using the parameters m = 5 and c = 2 from the AIS compiler instantiation [START_REF] Ananth | Private circuits: A modular approach[END_REF], we get N g = 8150. This yields a tolerated leakage probability of p ≈ 2 -26 and an exponent e = log(8150)/log(3) ≈ 8.19 in the asymptotic complexity O |C| • κ e of the AIS compiler.

These results are to be compared to the p ≈ 2 -7.09 and e ≈ 7.5 achieved by our construction. In either case (N g = 5712 as claimed in [START_REF] Ananth | Private circuits: A modular approach[END_REF] or N g = 8150 according to our analysis), our construction achieves a slightly better complexity while tolerating a much higher leakage probability. We stress that further instantiations of the AIS scheme (based on different MPC protocols) or of our scheme (based on different gadgets) could lead to better asymptotic complexities and/or tolerated leakage probabilities.

A Proof-of-Concept Secure AES Implementation

In this section, we describe and report the performances of a proof-of-concept implementation of the RPE compiler with the base gadgets from Section 4.5 as well as a protected AES implementation. The source code of these implementations is publicly available at: https://github.com/CryptoExperts/poc-expanding-compiler All implementations were run on a laptop computer (Intel(R) Core(TM) i7-8550U CPU, 1.80GHz with 4 cores) using Ubuntu operating system and various C, python and sage libraries.

Circuit Compiler

First, we developed an implementation in python of a compiler CC, that given three n-share gadgets G add , G mult , G copy and an expansion level k, outputs the compiled gadgets G

(k) add , G (k) copy ,G (k)
mult , each as a C function. The variables' type is given as a command line argument. Table 4.2 shows the complexity of the compiled gadgets from Section 4.5 using the compiler with several expansion levels k, as well as their execution time in milliseconds when run in C on randomly generated 8-bit integers. For the generation of random variables, we consider that an efficient external random number generator is available in practice, and so we simply use the values of an incremented counter variable to simulate random gates. It can be observed that both the complexity and running time grow by almost the same factor with the expansion level, with multiplication gadgets being the slowest as expected. Base gadgets with k = 1 roughly take 10 -4 ms, while these gadgets expanded 2 times (k = 3) take between 10 -2 and 10 -1 ms. The difference between the linear cost of addition and copy gadgets, and the quadratic cost of multiplication gadgets can also be observed through the gadgets' complexities.

G (k) add , G (k) copy , G (k) mult from Section 4.5 implemented in C. k # shares Gadget Complexity (N a , N c , N m , N r ) Execution time 1 3 G (

AES Implementation

We describe hereafter a proof-of-concept AES implementation protected with our instantiation of the RPE compiler. We start by describing the underlying AES circuit (over K = GF(256)), followed by an analysis of the implementation in C of the complete algorithm.

AES circuit. We first describe the non-linear part of the AES, namely the sbox computation. For the field exponentiation (x → x 254 over GF(256)), we use the circuit representation of the processing proposed in [START_REF] Damgård | Secure multiparty AES[END_REF] and presented in Figure 4.4. It corresponds to the addition chain [START_REF] Ajtai | Secure computation with information leaking to an adversary[END_REF][START_REF] Albrecht | MiMC: Efficient encryption and cryptographic hashing with minimal multiplicative complexity[END_REF][START_REF] Andrychowicz | Circuit compilers with O(1/ log(n)) leakage rate[END_REF][START_REF] Barthe | Improved parallel mask refreshing algorithms: generic solutions with parametrized non-interference and automated optimizations[END_REF][START_REF] Barthe | Verified proofs of higher-order masking[END_REF][START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF][START_REF] Belaïd | Tornado: Automatic generation of probing-secure masked bitsliced implementations[END_REF][START_REF] Marios | Efficient multivariate statistical techniques for extracting secrets from electronic devices[END_REF][START_REF] Grégoire | Vectorizing higher-order masking[END_REF][START_REF] Rivain | Provably secure higher-order masking of AES[END_REF]127,254) and it has been chosen due to its optimality regarding the number of multiplications (11 in total). Each time an intermediate result had to be reused, a copy gate (marked with ) has been inserted.

For the second part of the sbox, the affine function is implemented according to the following equation: with the necessary copy gates. Similarly, the inverse of the affine function is implemented for the sbox inversion as follows:

Affine(x) = (((((((207x) 2 + 22x) 2 + 1x) 2 + 73x) 2 + 204x) 2 + 168x) 2 + 238x) 2 + 5x + 99 x × × × × × × × × × × × 1 2
Affine -1 (x) = (((((((147x) 2 + 146x) 2 + 190x) 2 + 41x) 2 + 73x) 2 + 139x) 2 + 79x) 2 + 5x + 5
The rest of the operations (MixColumns, ShiftRows, AddRoundKey) are considered as in a standard AES, while adding the necessary copy gates.

Gate count. Table 4.3 displays the gate count vectors for AES-128 encryption/decryption procedures as well as for their building blocks. The sbox (resp. sbox inversion) gate count vector was computed as the sum of the gate count vectors of both the exponentiation and affine (resp. affine inversion) functions. We recall that N a , N c , N m , N r stand for the number of addition gates, copy gates, multiplication gates, and random gates, respectively. Table 4.3: AES operations complexity. ShiftRows Inversion (for all rows) (0, 0, 0, 0) AES-128 decryption (2392 , 4936 , 4484 , 0 )

AES Operation Complexity

(N a , N c , N m , N r ) AddRoundKey (for 1 byte) (1, 0, 0, 0) SubBytes (for 1 byte) (8,
Using the gadgets G add , G mult and G copy proposed in Section 4.5 for the compilation of the AES algorithm, we obtain the instantiation given in Equation (4.19) of the matrix M introduced in Section 4.4. Applying the same complexity analysis done previously on the gate count vectors, we display in Figure 4.5 the total number of gates in the AES-128 encryption/decryption procedures as functions of the level k. For instance, for the same security level of 2 -76 exhibited in Section 4.5 for the gadgets of Figure 4.2, the AES-128 would have to be compiled at a level k = 9, and would count around 10 16 gates.

Implementation in C.

An n-share AES-128 implementation was developed in C from the above description. Compiled gadgets from Section 4.7.1 were used for basic operations (addition, multiplication, copy), as generated using our circuit compiler described in Section 4.7.1. We chose the C 8-bit unsigned integer type, and considered operations in GF(256). For the generation of random values, we assume the availability of an efficient (pseudo)random number generator, and so we simply considered the values of an incremented counter variable to simulate the cost. Table 4.4 shows the AES-128 execution time on a 16-byte message with 10 pre-computed sub-keys, using compiled gadgets G

2(k) add , G 1(k) copy , G 1(k)
mult , with respect to the expansion level k and sharing order n = 3 k . It can be seen that the execution time increases with the expansion level with a similar growth as in Table 4.2. This is because the complexity of the AES circuit strongly depends on the gadgets that are used to replace each gate in the original arithmetic circuit. For example, with our 3-share gadgets that tolerate a leakage probability of p ≈ 2 -8 , a 27-share (k = 3) AES-128 takes almost 200 milliseconds to encrypt or decrypt a message.

Conclusion

In this chapter, we introduced the powerful concept of random probing expansion and provided security-complexity trade-offs on practical implementations inspired by the original work on expansion using multi-party computation. We compared our constructions to the previous ones and showed that we achieved better results in terms of security and complexity. We also showed the result of the expansion on a real-life AES circuit to exhibit the the approach. Indeed, the obtained performance is not usable in practice yet. The implementation is a proofof-concept to show the current advantages and limitations of constructing circuits with proven security levels in the random probing model. This construction opens the door for many future works that try to optimize constructions in the random probing model until we can construct real-life implementations with proven security levels and good performance.

In the following chapters, we exhibit many improvements that offer better trade-offs. We dive more profoundly into the random probing expansion analysis to test its limits and achieve higher security levels with better tolerated leakage rates and lower complexities.

Chapter 5

Generic RPE Constructions

In this chapter, we provide an in-depth analysis of the random probing expandability security notion discussed in the previous chapter. We show that the RPE notion can be made tighter, and we exhibit strong relations between RPE and the strong non-interference (SNI) composition notion for probing-secure gadgets.

From these results, we introduce the first generic constructions of gadgets achieving RPE for any number of shares and with nearly optimal amplification orders. These generic gadgets are derived from the widely known Ishai-Sahai-Wagner (ISW) construction. We show that the obtained expanding compiler can approach a quadratic complexity depending on the leakage probability that must be tolerated: the smaller the leakage probability, the closer the complexity to O(κ 2 ). We further introduce a new multiplication gadget achieving the optimal amplification order, which allows us to improve the convergence to a quadratic complexity.

Finally, we provide new concrete constructions of copy, addition, and multiplication gadgets achieving maximal amplification orders for small numbers of shares. These gadgets yield much more efficient instantiations than all the previous schemes (including the analysed ISW-based constructions). While slightly decreasing the tolerated leakage probability to p = 2 -7.5 , our 3-share instantiation achieves a complexity of O(κ 3.9 ). Moreover, our 5-share instantiation drops the complexity to O(κ 3.2 ). The contributions in this chapter are published in [START_REF] Belaïd | On the power of expansion: More efficient constructions in the random probing model[END_REF].

A Closer Look at Random Probing Expandability

In this section, we give a closer look at the RPE notion. We first show that it naturally splits into two different notions, that we shall call RPE1 and RPE2, and further introduce a tighter variant which will be useful for our purpose. We then study the relations between (tight) RPE and the Strong Non-Interference (SNI) notion used for probing security. We exhibit strong connections between (tight) RPE1 and SNI, which will be very useful for our construction results depicted in later sections.

Splitting RPE

From Definition 10, we can define two sub-properties which are jointly equivalent to RPE. In the first one, designated by RPE1, the set J is constrained to satisfy |J| ≤ t and J = J (the simulator does not choose J ).

Definition 15 (Random Probing Expandability 1). Let f : R → R. An n-share gadget G :

K n × K n → K n is (t, f )-RPE1 if there exists a deterministic algorithm Sim G
1 and a probabilistic algorithm Sim G 2 such that for every input ( x, y)

∈ K n × K n , for every set J ⊆ [n],
such that |J| ≤ t, and for every p ∈ [0, 1], the random experiment

W ← LeakingWires(G, p) (I 1 , I 2 ) ← Sim G 1 (W, J) out ← Sim G 2 (W, J, x| I 1 , y| I 2 ) ensures that 1. the failure events F 1 ≡ |I 1 | > t and F 2 ≡ |I 2 | > t verify Pr(F 1 ) = Pr(F 2 ) = ε and Pr(F 1 ∧ F 2 ) = ε 2 (5.1)
with ε = f (p) (in particular F 1 and F 2 are mutually independent), 2. the output distribution satisfies

out id = AssignWires(G, W, ( x, y)) , z| J (5.2)
where z = G( x, y).

In the second definition, designated by RPE2, J is chosen by the simulator such that J ⊆ [n] with |J | = n -1 (and J does not matter anymore).

Definition 16 (Random Probing Expandability 2). Let f : R → R. An n-share gadget G : K n × K n → K n is (t, f )-RPE2 if there exists a deterministic algorithm Sim G
1 and a probabilistic algorithm Sim G 2 such that for every input ( x, y) ∈ K n × K n , for every p ∈ [0, 1], the random experiment

W ← LeakingWires(G, p) (I 1 , I 2 , J) ← Sim G 1 (W ) out ← Sim G 2 (W, J, x| I 1 , y| I 2 ) ensures that 1. the failure events F 1 ≡ |I 1 | > t and F 2 ≡ |I 2 | > t verify Pr(F 1 ) = Pr(F 2 ) = ε and Pr(F 1 ∧ F 2 ) = ε 2 (5.3) with ε = f (p) (in particular F 1 and F 2 are mutually independent), 2. J is such that J ⊆ [n] with |J| = n -1 3. the output distribution satisfies out id = AssignWires(G, W, ( x, y)) , z| J (5.4)
where z = G( x, y).

This split is somehow a partition of the RPE notion since we have:

G is (t, f )-RPE ⇐⇒ G is (t, f )-RPE1 and G is (t, f )-RPE2
for any gadget G. As a result of the above equivalence, we can show that a gadget achieves RPE1 and RPE2 independently in order to obtain RPE for this gadget. Formally, we use the following lemma.

Lemma 3. An n-share gadget G : K n × K n → K n which is (t, f 1 )-RPE1 and (t, f 2 )-RPE2 is also (t, f )-RPE with f (p) ≥ max(f 1 (p), f 2 (p)) for every p ∈ [0, 1].
We can refine the upper bounds on the amplification order introduced in Section 4.4.1 with respect to this split. In Lemma 1, the bound d ≤ t + 1 applies to both RPE1 and RPE2, while the bound d ≤ (3 -) • (n -t) only applies to RPE1. Similarly, in Lemma 2, the bound d ≤ (t + 1)/2 applies to both RPE1 and RPE2, while the bound d ≤ (n -t) only applies to RPE1.

Tightening RPE

We introduce a tighter version of the RPE security property. The so-called tight random probing expandability (TRPE) is such that a failure occurs when the simulation requires more than t input shares (as in the original RPE notion) but also whenever this number of shares is greater than the size of the leaking set W . Formally, the failure event F j is defined as

F j ≡ |I j | > min(t, |W |) for every j ∈ [ ].
We give a formal definition in Definition 17. The text in blue points to the differences from the original RPE definition (i.e. Definition 10).

Definition 17 (Tight Random Probing Expandability). Let f : R → R. An n-share gadget G : K n × K n → K n is (t, f )-tight random probing expandable (TRPE) if there exists a deterministic algorithm Sim G
1 and a probabilistic algorithm Sim G 2 such that for every input ( x, y) ∈ K n × K n , for every set J ⊆ [n] and for every p ∈ [0, 1], the random experiment

W ← LeakingWires(G, p) (I 1 , I 2 , J ) ← Sim G 1 (W, J) out ← Sim G 2 (W, J , x| I 1 , y| I 2 )
ensures that 1. the failure events where z = G( x, y),

F 1 ≡ |I 1 |> min(t, |W |) and F 2 ≡ |I 2 |> min(t, |W |) verify Pr(F 1 ) = Pr(F 2 ) = ε and Pr(F 1 ∧ F 2 ) = ε 2 (5.
This tighter security property will be instrumental in the following to obtain generic RPE constructions. Similarly to the original RPE property, the TRPE property can be split into two intermediate properties, namely TRPE1 and TRPE2.

Definition 18 (Tight Random Probing Expandability 1). Let

f : R → R. An n-share gadget G : K n × K n → K n is (t, f )-tight random probing expandable (TRPE) if there exists a deterministic algorithm Sim G
1 and a probabilistic algorithm Sim G 2 such that for every input ( x, y) ∈ K n × K n , for every set J ⊆ [n], such that |J| ≤ t, and for every p ∈ [0, 1], the random experiment

W ← LeakingWires(G, p) (I 1 , I 2 ) ← Sim G 1 (W, J) out ← Sim G 2 (W, J, x| I 1 , y| I 2 )
ensures that 1. the failure events

F 1 ≡ |I 1 |> min(t, |W |) and F 2 ≡ |I 2 |> min(t, |W |) verify Pr(F 1 ) = Pr(F 2 ) = ε and Pr(F 1 ∧ F 2 ) = ε 2 (5.7)
with ε = f (p) (in particular F 1 and F 2 are mutually independent), 2. the output distribution satisfies

out id = AssignWires(G, W, ( x, y)) , z| J (5.8)
where z = G( x, y),

Definition 19 (Tight Random Probing Expandability 2). Let f : R → R. An n-share gadget G : K n × K n → K n is (t, f
)-tight random probing expandable (TRPE) if there exists a deterministic algorithm Sim G 1 and a probabilistic algorithm Sim G 2 such that for every input ( x, y) ∈ K n × K n , for every p ∈ [0, 1], the random experiment

W ← LeakingWires(G, p) (I 1 , I 2 , J) ← Sim G 1 (W ) out ← Sim G 2 (W, J, x| I 1 , y| I 2 )
ensures that 1. the failure events where z = G( x, y), Lemma 3 also applies to the case of TRPE. Moreover the upper bounds on the amplification order for RPE in Lemma 1 and Lemma 2 further apply to the amplification order for TRPE (which holds by definition). We show hereafter that the TRPE notion is actually equivalent to the RPE notion if and only if the function f is of maximal amplification order t + 1.

F 1 ≡ |I 1 |> min(t, |W |) and F 2 ≡ |I 2 |> min(t, |W |) verify Pr(F 1 ) = Pr(F 2 ) = ε and Pr(F 1 ∧ F 2 ) = ε 2 (5.
Lemma 4. Let t ∈ N, let f : R → R of amplification order d. Let G be a gadget. 1. If G achieves (t, f )-TRPE, then it achieves (t, f )-RPE for some f : R → R of amplifi- cation order d ≥ d.
2. If G is of amplification order d with respect to t (i.e. d is the max amplification order of a function f for which G is (t, f )-RPE), then for all f : R → R for which G achieves (t, f )-TRPE, f is of amplification order d ≤ d. As for the second point, the proof is similar: if G achieves an amplification of d in the RPE setting, then it achieves an amplification order of at most d in the TRPE setting, since a failure in the RPE setting i.e. |I j | > t immediately implies a failure in the TRPE setting |I j | > min(t, |W |). But also, even if there is no failure for a leaking set of wires W in the RPE setting we might still have a failure in the TRPE setting for the same set W . This is mainly the case where W can be simulated with sets of input shares We assume by contradiction that there exists J and W implying a TRPE failure which is not an RPE failure, that is a set I j satisfying |W | < |I j | ≤ t. We then show that there exists a leaking set W of size |W | < t + 1 for which an RPE failure always occurs, which implies an amplification order strictly lower than t + 1 and hence contradicts the lemma hypothesis. This set W is constructed as W = W ∪ I j for some set

I j such that |W | < |I j | ≤ t,
I j ⊂ [n] \ I j such that |I j | = t + 1 -|I j |.
The simulation of W and J then requires the input shares from I j ∪ I j . However, we have

|I j ∪ I j | = |I j | + |I j | = t + 1
implying an RPE failure, and

|W | = |W ∪ I j | ≤ |W | + |I j | = |W | + t + 1 -|I j | < |W | + t + 1 -|W | = t + 1.
Thus, we have built a failure set W of size strictly less than the amplification order t + 1, which contradicts the hypothesis and hence concludes the proof.

The above proof also applies to the case of the split notions, specifically for ((t, f )-RPE1, (t, f )-TRPE1) and for ((t, f )-RPE2, (t, f )-TRPE2).

Unifying (Tight) RPE and SNI

Strong non-interference (SNI) is a widely used notion to compose probing-secure gadgets [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF]. In Section 3.3.1, we exhibit a relation between the SNI and the random probing composability (RPC) property ( Proposition 1). Here, we study the relation between SNI and (T)RPE. We state hereafter some equivalence results between the (T)RPE1 and SNI notions, up to some constraints on the parameters. We first formally show that (T)RPE1 implies SNI. Lemma 5. Let t ∈ N and f : R → R of amplification order t + 1. Let G be a gadget which achieves (t, f )-TRPE1. Then G is also t-SNI.

Proof. By definition of TRPE1 and by hypothesis on the amplification order, there exist input sets I 1 , . We now show that SNI implies TRPE1 up to some constraints on the parameters. Lemma 6. Let τ, ∈ N. Let G be an -to-1 gadget which achieves τ -SNI. Then G satisfies (t, f )-TRPE1 for some f : R → R with an amplification order of no condition remains to rule out simulation failures and one could actually get a failure for every input. In the latter case, the amplification order would equal 1 min(t + 1, n -t), but in all generality it could be higher (i.e. this value is a lower bound).

d ≥ 1 min(t + 1, τ -t + 1) . Proof. Since G is τ -SNI,
We give an illustrative summary of the relations between RPE1, TRPE1 and SNI in Figure 5.1 (d denotes the amplification order of the function f ). We hence observe an equivalence between the three notions up to some constraints on the parameters t, d, τ and . Relation and separation between (T)RPE2 and SNI. For a given n-share gadget G, the (T)RPE2 notion exclusively focuses on the simulation of a set of leaking intermediate variables together with a chosen set of (n -1) output shares. If G is τ -SNI for τ < n -1, then nothing can be claimed on the simulation of the latter sets. But if G is (n -1)-SNI, then any set of (n -1) output shares can be perfectly simulated without the knowledge of any input share. Concretely, it implies that G is (t, f )-(T)RPE2 of amplification order at least 1 as a chosen output set of (n -1) shares alone can be perfectly simulated without any additional knowledge on the input shares. Namely, we have

τ -SNI (t, f )-TRPE1 (t, f )-RPE1 d ≥ 1 min(t + 1, τ -t + 1) τ = t iff d = t + 1
(n -1)-SNI ⇒ (t, f )-(T)RPE2 of amplification order at least 1.
Nevertheless, there is no relation from τ -SNI to (t, f )-(T)RPE2 for amplification orders strictly greater than 1 as (T)RPE2 would then consider leaking sets of size larger than or equal to n (for n-share gadgets, τ < n). On the other side, there is no direct implication either from (t, f )-(T)RPE2 to τ -SNI since the former property does not consider all possible output sets of size (n -1), but only a chosen one.

Generic Constructions: Addition and Copy Gadgets

In Section 4.5, we exhibited the first construction of RPE gadgets explicitly designed for a small number of shares, namely n = 3. The constructed addition and copy gadgets achieved the maximal amplification order for 3-shares construction, while the multiplication gadget only achieved an amplification order of 3/2. A natural open question is the definition of RPE gadgets with good amplification orders, typically achieving or approaching the upper bounds exhibited in Section 4.4.1, for any number of shares n.

As intuitively proposed in [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF] for small gadgets, copy and addition gadgets can be naturally derived from a refresh gadget. Such a gadget takes one sharing as input and outputs a new refreshed sharing of the same value. In this section, we exhibit generic constructions of addition and copy gadgets based on refresh gadgets and show that these gadgets can achieve maximal amplification orders if the underlying refresh gadget satisfies specific properties that we detail later. We also prove that the well-known ISW [START_REF] Ishai | Private circuits: Securing hardware against probing attacks[END_REF] and O(n log n) [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF] refresh gadgets can be used to construct addition and copy gadgets with maximal amplification orders for any number of shares.

Generic Copy Gadgets

Algorithm 4 displays the generic construction for the copy gadget from a refresh gadget. It simply consists in refreshing the input sharing twice to obtain two fresh copies.

Algorithm 4: Copy gadget G copy

Input : (a 1 , . . . , a n ) input sharing Output: (e 1 , . . . , e n ), (f 1 , . . . , f n ) fresh copies of (a 1 , . . . , a n )

1 (e 1 , . . . , e n ) ← G refresh (a 1 , . . . , a n ); 2 (f 1 , . . . , f n ) ← G refresh (a 1 , . . . , a n );
We have the following lemma.

Lemma 7. Let G refresh be an n-share (t, f )-TRPE refresh gadget of amplification order d. Then, the copy gadget

G copy displayed in Algorithm 4 is (t, f )-TRPE of amplification order d = d.
Proof. To prove that G copy is TRPE achieving the same amplification order d as the underlying refresh gadget G refresh , we need to prove that any set of leaking wires W such that |W | ≤ d -1 can be perfectly simulated together with any sets of outputs wires J 1 , J 2 ⊆ [n] (such that J 1 refers to the first output e and J 2 to the second output f ) from a set of input wires I such that |I| ≤ min(t, |W |). In addition, we know from Lemma 1 that the maximal amplification order achievable in the TRPE setting is d max ≤ min(t + 1, 2(n -t)). Since we consider sets

W of size at most |W | ≤ d -1 ≤ min(t + 1, 2(n -t)) -1 ≤ t then we need to prove that |I| ≤ min(t, |W |) = |W |.
The leaking set W can be split into two distinct subsets W 1 and W 2 such that W = W 1 ∪W 2 where W 1 (resp. W 2 ) is the set of leaking wires of G refresh for the output e (resp. f ). Let J 1 , J 2 ⊆ [n]. We consider four cases:

• |J 1 | ≤ t, |J 2 | ≤ t: since |W | ≤ d -1, then |W 1 |, |W 2 | ≤ d -1.
| = |J 2 | = n-1. Since we have W = W 1 ∪ W 2 such that |W 1 | ≤ d -1, |W 2 | ≤ d -1,
|I| ≤ |I 1 | + |I 2 | ≤ min(|W 1 |, t) + min(|W 2 |, t) ≤ |W | = min(|W |, t) • |J 1 | ≤ t, |J 2 | > t: Since |J 1 | ≤ t,
|I| ≤ |I 1 | + |I 2 | ≤ min(|W 1 |, t) + min(|W 2 |, t) ≤ |W | = min(|W |, t) • |J 1 | > t, |J 2 | ≤ t:
the proof is exactly the reflect of the previous one.

Hence in the four cases, there is no failure tuple W of size |W | < d. In addition, since the refresh gadget is of amplification order d, then we know that a failure of size d exists. Then the gadget G copy achieves an amplification order of d, which concludes the proof.

As a consequence of this result, a TRPE refresh gadget directly yields a TRPE copy gadget achieving with the same amplification order. Both gadgets can then reach the upper bound for 1-input gadgets whenever t + 1 = 2(n -t) implying an amplification order d = 2(n+1) 3 .

Generic Addition Gadgets

Algorithm 5 displays the generic construction for the addition gadget from a refresh gadget. It simply consists in refreshing both input sharings before adding them.

Algorithm 5: Addition Gadget G add Input : (a 1 , . . . , a n ), (b 1 , . . . , b n ) input sharings Output: (c 1 , . . . , c n ) sharing of a + b 1 (e 1 , . . . , e n ) ← G refresh (a 1 , . . . , a n ); 2 (f 1 , . . . , f n ) ← G refresh (b 1 , . . . , b n ); 3 (c 1 , . . . , c n ) ← (e 1 + f 1 , . . . , e n + f n );
We have the following lemma. Lemma 8. Let G refresh be an n-share refresh gadget and let G add be the corresponding addition gadget displayed in Algorithm 5. Then if G refresh is (t, f )-RPE (resp. (t, f )-TRPE) of amplification order d, then G add is (t, f )-RPE (resp. (t, f )-TRPE) for some f of amplification order d ≥ d 2 . Proof. We need to prove that when G refresh is (t, f )-RPE (resp. (t, f )-TRPE) of amplification order d, then G add is (t, f )-RPE (resp. (t, f )-TRPE) of amplification order at least d 2 . We will prove the property for the RPE setting, and the proof for the TRPE setting will be exactly the same except for the notion of failure event which changes. This amounts to proving that: We proceed by building the necessary simulators for G add from the simulators that already exist for G refresh . Concretely, we split each set W of leaking wires, into four subsets

W = W r 1 ∪ W a 1 ∪ W r 2 ∪ W a 2 where W r 1 (resp. W r 2 ) is the set of leaking wires during the computation of G refresh (a 1 , . . . , a n ) (resp. G refresh (b 1 , . . . , b n )), and W a 1 (resp. W a 2 ) is the set of leaking wires of (e 1 , . . . , e n ) (resp. (f 1 , . . . , f n )).
From these notations, we build a leaking set W which contains W r 1 and W r 2 and also each input or pair of inputs of gates whose output is a wire in W a 1 or W a 2 . We have that

|W | ≤ |W r 1 | + |W r 2 | + 2|W a 1 | + 2|W a 2 | ≤ 2|W |.
The new set W can be split into two subsets W 1 and W 2 such that W 1 (resp. W 2 ) contains only leaking wires during the computation of G refresh (a 1 , . . . , a n ) (resp. G refresh (b 1 , . . . , b n )).

We now demonstrate how we can simulate W when the output set J is of size less that t ((T)RPE1) and when it is of size strictly more than t ((T)RPE2).

• if |J| ≤ t ((T)RPE1): we prove both properties 1 and 2:

1. we assume that |W | < d 2 . Then we consider the set W = W 1 ∪ W 2 (as previously defined) such that

|W | ≤ 2|W | < 2 d 2 ≤ d and hence, |W 1 | < d and |W 2 | < d.
From the (t, f )-RPE property of G refresh and its amplification order, there exists an input set of shares of a I ) and a set of output shares e i J 1 of size n-1 such that the input shares of I 1 perfectly simulate the wires designated by W 1 and J 1 . Similarly, as both instances of G refresh are identical, the same set I 2 but of input shares b perfectly simulates W 2 (defined as the equivalent of W 1 on the second instance) and J 2 which points to the same output shares than J 1 but on f i instead of e i . We thus have two input sets I 1 and I 2 of size less than t (less than min(t, |W |) for TRPE2) whose shares perfectly simulate the wires W and the elements e i + f i of a set J of size n -1 with i ∈ J 1 = J 2 . That concludes the proof for the first property.

we now assume that

d 2 ≤ |W | < d. Then we consider the set W = W 1 ∪ W 2 such that |W | ≤ 2|W | < 2d.
Without loss of generality, let us consider that |W 1 | < d (the proof is similar in the opposite scenario). From the (t, f )-RPE ((t, f )-TRPE in the TRPE setting) property of G refresh and its amplification order, there exists a set J 1 such that We thus proved that G add achieves an amplification order greater than or equal to d 2 for RPE2 ( for TRPE2 in the TRPE setting).

|J 1 | = n -
Since G add has an amplification order greater than or equal to d 2 for RPE1 and RPE2 (resp. TRPE1 and TRPE2), then G add is a (t, f )-RPE (resp. (t, f )-TRPE) addition gadget for some function f of amplification order d ≥ d 2 , which concludes the proof. The above lemma shows that a (T)RPE refresh gadget of amplification order d directly yields a (T)RPE addition gadget of amplification order at least d 2 . If the refresh gadget achieves the optimal d = 2(n+1) 3 , then the generic addition gadget has an amplification order at least n 3 , which is not far from the upper bound for two-input gadgets of n+1 2 . In order to fill this gap, we introduce a new property which, when satisfied by its inherent refresh gadget G refresh , makes the addition gadget TRPE with the same amplification order as G refresh . We refer to this property as strong TRPE2.

Definition 20 (t-Strong TRPE2). Let G be an n-share 1-input gadget. Then G is t-Strong TRPE2 (abbreviated t-STRPE2) if and only if for any set J of output shares indices and any set W of internal wires of G such that |W | + |J | ≤ t, there exists a set J of output share indices such that J ⊆ J and |J| = n -1 and such that the assignment of the wires indexed by W together with the output shares indexed by J can be perfectly simulated from the input shares indexed by a set I of cardinality satisfying

|I| ≤ |W | + |J |.
This new property directly implies the TRPE2 property with maximal amplification order. Recall that G is t-TRPE2 with maximal amplification order if and only if for any set W of probed wires such that |W | < t + 1 (recall that the bound n -t on the amplification order only applies to the TRPE1 property), there exists a set J of output shares indices such that |J| = n -1 and such that an assignment of the wires indexed by W and the output shares indexed by J can be jointly perfectly simulated from input shares indexed in a set I such that |I| ≤ |W |. This is recalled in the following corollary for the sake of completeness.

Corollary 4. Let G be an n-share 1-input gadget. If G is t-Strong TRPE2 (abbreviated t- STRPE2), then G is (t, f )-TRPE2 for some f of amplification order t + 1.
Having a refresh gadget which satisfies the property from Definition 20 results in tighter constructions for generic addition gadgets as stated in Lemma 9.

Lemma 9. Let G refresh be an n-share refresh gadget and let G add be the addition gadget described in Algorithm 5. Then for any t

≤ n -1, if G refresh is (t, f )-TRPE of amplification order d ≥ min(t + 1, n -t) and G refresh is (n -1)-STRPE2, then G add is (t, f )-TRPE for any t ≤ n -1 for some f of amplification order min(t + 1, n -t).
Proof. Let G refresh be a (t, f )-TRPE refresh gadget for any t ≤ n -1 with amplification order d ≥ min(t + 1, n -t) and which satisfies Definition 20. We will prove that the construction of G add using G refresh described in Algorithm 5 is (t, f )-TRPE for any t ≤ n -1 of amplification order min(t + 1, n -t). This amounts to proving that: Indeed, this amplification order being the maximum one achievable by 2-input addition gadgets, it would conclude the proof.

We will denote (e 1 , . . . , e n ) = G refresh (a 1 , . . . , a n ) and (f 1 , . . . , f n ) = G refresh (b 1 , . . . , b n ). Then the gadget G add consists in the sharewise addition (e 1 + f 1 , . . . , e n + f n ) as described in Algorithm 5. We proceed by building the necessary simulators for G add from the simulators that already exist for G refresh . Concretely, we split each set W of leaking wires, into four subsets

W = W r 1 ∪ W a 1 ∪ W r 2 ∪ W a 2 where W r 1 (resp. W r 2 ) is the set of leaking wires during the computation of G refresh (a 1 , . . . , a n ) (resp. G refresh (b 1 , . . . , b n )), and W a 1 (resp. W a 2 ) is the set of leaking wires of (e 1 , . . . , e n ) (resp. (f 1 , . . . , f n )). We can see that W r 1 ∪ W a 1 (resp. W r 2 ∪ W a 2 ) contains only leaking wires during the computation of G refresh (a 1 , . . . , a n ) (resp. G refresh (b 1 , . . . , b n )).
We now demonstrate how we can simulate W when the output set J is of size less that t ((T)RPE1) and when it is of size strictly more than t ((T)RPE2).

• if |J| ≤ t ((T)RPE1): we prove both properties 1 and 2:

1. we assume that |W | < min(t + 1, n -t). We construct a new set of probes on (e 1 , . . . , e n ) that we denote J e such that

J e = W a 1 ∪ {e i | i ∈ J}. Similarly, we construct the set of probes on (f 1 , . . . , f n ), J f = W a 2 ∪ {f i | i ∈ J}. It is clear that if we can perfectly simulate W r 1 , W r 2
, J e and J f , then we can perfectly simulate W , and J (for each i ∈ J, we can perfectly simulate e i in J e and f i in J f so we can perfectly simulate e i + f i ). We denote

|W a 1 | = m and |W a 2 | = m . We have |W r 1 | ≤ min(t + 1, n -t) -1 -m , |J e | ≤ t + m and |W r 2 | ≤ min(t + 1, n -t) -1 -m , , |J f | ≤ t + m
From the (t, f )-TRPE property of G refresh for any t ≤ n -1 and specifically for t = t + m with amplification order at least d = min(t + 1 + m, n -t -m), and since

|W r 1 | ≤ min(t + 1, n -t) -1 -m ≤ d -1, then there exists an input set of shares of a I 1 such that |I 1 | ≤ min(t + m, |W r 1 |) = |W r 1 | ≤ |W | and I 1 perfectly simulates W r
1 and J e . Similarly, there exists an input set of shares of b I 2 such that

|I 2 | ≤ min(t + m , |W r 2 |) = |W r 2 | ≤ |W |
and I 2 perfectly simulates W r 2 and J f . From these definitions, I 1 and I 2 together perfectly simulate W and J and are both of size less than min(t, |W |), which proves the first property in this scenario.

we now assume that min

(t + 1, n -t) ≤ |W | < 2 min(t + 1, n -t). Without loss of generality, let us consider that |W r 1 ∪ W a 1 | < min(t + 1, n -t) ≤ t (the proof
is similar in the opposite scenario). As in the first property, we construct a new set of probes on (e 1 , . . . , e n ) that we denote J e such that J e = W a 1 ∪ {e i | i ∈ J}. We fix the set of input shares I 2 on b as I 2 = [n], so we can perfectly simulate all probes in W r 2 and W a 2 using the full input b. Next, we need to prove that we can perfectly simulate all probes in W r 1 and J e similarly as before. We denote

|W a 1 | = m. We have |W r 1 | ≤ min(t + 1, n -t) -1 -m , |J e | ≤ t + m
From the (t, f )-TRPE property of G refresh for any t ≤ n -1 and specifically for t = t + m with amplification order at least d = min(t + 1 + m, n -t -m), and since

|W r 1 | ≤ min(t + 1, n -t) -1 -m ≤ d -1, then there exists an input set of shares of a I 1 such that |I 1 | ≤ min(t + m, |W r 1 |) = |W r 1 | ≤ |W | and I 1 perfectly simulates W r
1 and J e . From these definitions, I 1 and I 2 together perfectly simulate W and J (J is simulated by perfectly simulating each i ∈ J by using e i in J e and simulating f i using the full input b), and we only have a failure on at most one of the inputs (b in this case). This concludes the proof for the second property.

At this point, we proved that G add achieves an amplification order greater than or equal to min(t + 1, n -t) for TRPE1. Since this amplification order is the maximum achievable by 2-input addition gadgets, then G add achieves an amplification order exactly equal to min(t + 1, n -t).

• if |J| > t ((T)RPE2): we prove both properties 1 and 2:

1. we assume that |W | < min(t + 1, n -t). As before, we split W as

W = W r 1 ∪ W a 1 ∪ W r 2 ∪ W a 2 . We consider J = {i | e i ∈ W a 1 } ∪ {i | f i ∈ W a 2 } so we have |J | ≤ |W a 1 | + |W a 2 |.
We also construct the set W r which contains the set of leaking wires on the first instance of G refresh (on input a) in W r 1 , and all the wires that are leaking within the second instance of G refresh in W r 2 . Hence, we have that

|W r | ≤ |W r 1 ∪W r 2 | < min(t+1, n-t)
. Hence, we have |W r |+|J | ≤ min(t+1, n-t) ≤ n-1, so by Definition 20 satisfied by G refresh , there exists a set of output shares indices J such that J ⊆ J and |J| = n -1 such that W r and J can be perfectly simulated from a set of input shares indices I such that |I| ≤ |W r | + |J |. Thus, we can fix I 1 on a and I 2 on b such that I 1 = I 2 = I and we fix the set of n -1 output shares indices on G add as the same indices in J. Hence, we can perfectly simulate all wires in W r and J, so we can perfectly simulate all wires in W r 1 and W r 2 and W a 1 and W a 2 as well as n -1 output shares of G add using I 1 and I 2 such that

|I 1 | = |I 2 | ≤ |W r | + |J | ≤ |W | = min(t, |W |).
That concludes the proof for the first property.

2. we now assume that min(t + 1, n -t) ≤ |W | < 2 min(t + 1, n -t). Without loss of generality, let us consider that |W r 1 ∪ W a 1 | < min(t + 1, n -t) (the proof is similar in the opposite scenario). We fix I 2 = [n] on input b, which allows us to perfectly simulate all wires and output shares on G refresh instance with input sharing (b 1 , . . . , b n ), including W a 2 and W r 2 . Next, we set

J = {i | e i ∈ W a 1 }. Since |W r 1 | + |J | ≤ n -1
, by Definition 20 satisfied by G refresh , there exists a set of output shares indices J such that J ⊆ J and |J| = n -1 such that W r 1 and J can be perfectly simulated from a set of input shares indices

I 1 on a such that |I 1 | ≤ |W r 1 | + |J | ≤ |W r 1 | + |W a 1 | ≤ |W |.
Thus, we can fix the set of n -1 output shares indices on G add as the same indices in J. We can perfectly simulate all output shares indexed in J since for each i ∈ J, we can perfectly simulate e i using I 1 and f i using the full input b in I 2 , so we can perfectly simulate e i + f i . Hence, we can perfectly simulate all wires in W as well as n -1 output shares of G add using I 1 and We thus proved that G add achieves an amplification order greater than or equal to min(t + 1, n -t) for TRPE2. Since min(t + 1, n -t) is the maximum order achievable for TRPE2 for a 2-input gadget, then G add achieves exactly the order min(t + 1, n -t).

I 2 such that |I 1 | ≤ |W r 1 | + |W a 1 | ≤ min(t, |W
Since G add has an amplification order equal to min(t + 1, n -t) for TRPE1 and TRPE2, then G add is a (t, f )-TRPE addition gadget for some function f of amplification order min(t + 1, n -t), which concludes the proof.

Hence, we provided generic constructions of addition and copy gadgets from a single building block, a refresh gadget. The amplification orders achieved can be maximal depending on the properties verified by the refresh gadget. These constructions allow us to look for efficient refresh gadgets with good security properties and plug them directly into our copy and addition gadgets. In the next section, we show that the well-known ISW refresh can be used to instantiate our constructions and both the ISW-based addition and copy gadgets achieve maximal amplification orders.

ISW-based Instantiation of the RPE Compiler

This section describes a complete instantiation of the expanding compiler solely based on the ISW scheme. Namely, we present instantiations of addition and copy gadgets from the ISW refresh gadget, and we directly use the ISW multiplication gadget for our compiler.

ISW addition and copy gadgets. The widely-used ISW refresh gadget can be seen as an ISW multiplication between the input sharing and the n-tuple (1, 0, . . . , 0). We formally depict it in the preliminaries in Algorithm 2. We demonstrate through Lemma 10 that the ISW refresh gadget satisfies TRPE with an optimal close to the optimal one. Lemma 10. Let n ∈ N. For every t ≤ n -1, the n-share ISW refresh gadget is (t, f 1 )-TRPE1 for some function f 1 : R → R of amplification orders d 1 = min(t + 1, n -t). The gadget is also (n -1)-STRPE2.

Proof. We start by proving the first property of the lemma, i.e the amplification order d 1 for TRPE1. The n-share ISW refresh gadget was proven to be (n -1)-SNI [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF], hence it follows from Lemma 6 that d 1 ≥ min(t + 1, n -t). In addition, we know from the proof of Lemma 1 that d 1 ≤ t+1. It remains to show that d 1 ≤ n-t. We thus have to exhibit a simulation failure by carefully choosing n -t leaking variables (the leaking set W ) together with t leaking output variables (indexed by the set J). Consider the set of output shares indexed by J = {1, . . . , t}, which corresponds to the first t shares c 1 , . . . , c t of the output. Next, we construct the set of leaking wires W of size n -t. First, observe that the partial sums of the output shares are of the form

c i,j = a i + r 1,i + • • • + r j,i if j < i a i + r 1,i + • • • + r i-1,i + r i,i+1 + • • • + r i,j otherwise.
Then, let W = {c t+1,t , . . . , c n,t }. We can prove that the constructed set W along with the set of indexes of output shares J = {1, . . . , t} cannot be perfectly simulated with at most min(t, |W |) input shares. For this, we consider a variable s = c 1 + • • • + c t + c t+1,t + . . . + c n,t , the sum of the t output shares indexed in J, and the leaking variables from W . Each of the output shares {c i } 1≤i≤t is the sum of exactly one input share a i and n -1 random values. Each of the leaking variables {c i,t } t+1≤i≤n is the sum of exactly one input share a i and t random values. In addition, it can be observed that each random value appears exactly twice in the set of expressions of the variables {c i } 1≤i≤t ∪ {c i,t } t+1≤i≤n , so all of the random values are eliminated in the expression of the variable s, which is the sum of all of these variables. Since each of the variables has one input share a i appearing in its expression, then we have s = a 1 + . . . + a n = a. Thus, simulating the variable s requires the knowledge of the full input, and hence the leaking variables indexed by W and J cannot be perfectly simulated without the knowledge of the full input. Hence, the set W of size n -t represents a failure set with respect to TRPE1, and so the function f 1 cannot be of amplification order higher than n -t, that is d 1 ≤ n -t. From the three inequalities d 1 ≥ min(t + 1, n -t), d 1 ≤ t + 1 and d 1 ≤ n -t, we obtain d 1 = min(t + 1, n -t).

Next, we demonstrate that the gadget is (n -1)-STRPE2. Let W be a set of leaking wires and J a set of output shares indices such that |W | + |J | ≤ n -1. We aim to prove that there exists a set J indexing n -1 output shares such that J ⊆ J and the leaking variables indexed by both W and J can be perfectly simulated with the input shares indexed by a set I such that |I| ≤ |W | + |J |. First, we observe that the leaking wires in W are of the following forms:

1. input share a i 2. random variable r ij (i < j) 3. partial sum c ij = a i + r 1,i + • • • + r j,i if j < i a i + r 1,i + • • • + r i-1,i + r i,i+1 + • • • + r i,j otherwise.
We then build I from an empty set as follows. For every wire in W of the first or third form, we add index i to I. For every wire in W of the second form (r ij ), if i ∈ I, we add j to I, otherwise we add i to I. Finally, for each i ∈ J , we add i to I. By construction we have

|I| ≤ |W | + |J | ≤ n -1.
Moreover, the wires indexed in W and J only depends of the input shares a i with i ∈ I which implies that we can perfectly simulate them from the input shares indexed by I (an output wire i in J can be simulated with a i and n -1 uniformly random variables).

We then build the set J as the union of two subsets J 1 and J 2 such that J 1 = I and J 2 is any set satisfying |J 2 | = n -1 -|I| and J 1 ∩ J 2 = ∅. We also denote o as the single index in the set [n] \ J. Now, we aim to show that the output shares determined by the indexes in J = J 1 ∪ J 2 can be further perfectly simulated from the input shares indexed by I (namely given the previous simulation of the variables from W ). The simulation works as follows:

• each output share c i such that i ∈ J 1 can be perfectly simulated with a i (since i ∈ I)

and n -1 uniformly random variables (the same generated r ij can be reused for several c i );

• for each output share c i such that i ∈ J 2 , we have i / ∈ I and hence a i is not available. Let us suppose without loss of generality that i < o and consider the random variable r i,o . Since i / ∈ I and o / ∈ I, then r i,o does not appear in any probed expression by construction of the set I from W and J . Hence, we can use r i,o to mask the expression of c i , which can then be simulated as a fresh random value without the need for the input share a i . This produces a perfect simulation of all output wires indexed in J 2 .

We thus obtain a perfect simulation of the output shares indexed by The copy gadget G copy that uses the n-share ISW refresh gadget as a building block in Algorithm 4 achieves the same amplification order as the ISW refresh for the TRPE setting, i.e. d = min(t+1, n-t). This is a direct implication from Lemma 7. Then, from Lemma 4, we have that ISW-based G copy also achieves (t, f )-RPE with amplification order d ≥ d. We can actually prove that ISW-based G copy achieves (t, f )-RPE with amplification order d exactly equal to the amplification order in the TRPE setting, i.e. d = d = min(t + 1, n -t). This is stated in the following lemma.

J = J 1 ∪ J 2 , such that |J| = n -1,
Lemma 11 (ISW copy gadget). Let G copy be the n-share copy gadget displayed in Algorithm 4 and instantiated with the ISW refresh gadget. Then for every t ≤ n -1, G copy achieves (t, f )-RPE with amplification order d = min(t + 1, n -t).

Proof. In order to prove that the amplification order d of G copy instantiated with the ISW refresh gadget is equal to min(t + 1, n -t), we first demonstrate that d ≥ min(t + 1, n -t) and then we show the existence of failure tuples to argue that d ≤ min(t + 1, n -t).

In fact, we already know that the ISW refresh gadget is (t, f 1 )-TRPE of amplification order d 1 = min(t+1, n-t). Then from Lemma 7, we know that G copy instantiated with ISW refresh is also (t, f 2 )-TRPE of amplification order d 2 = d 1 = min(t + 1, n -t). Then, from Lemma 4 we have that G copy is (t, f )-RPE of amplification order d ≥ d 2 = min(t + 1, n -t). Next, we need to prove that d ≤ min(t + 1, n -t). In addition, we know from Lemma 1 that d ≤ t + 1. Hence, it remains to show that it is also upper bounded by n -t.

We know from the proof of Lemma 10 that, for the ISW refresh gadget, we can construct a set of leaking wires W of size n -t along with a set of t indexes of output shares J such that a perfect simulation of both sets W and J requires the knowledge of the full input sharing i.e. I = [n]. Then, in the case of the copy gadget G copy , let W be the set of leaking wires and J 1 , J 2 ⊆ [n] be the sets of output shares on the outputs e and f respectively. Then, we can split W into two distinct subsets W 1 and W 2 such that W = W 1 ∪ W 2 , where W 1 (resp. W 2 ) is the set of leaking wires of ISW G refresh for the output e (resp. f ). Then, in the case where |J 1 | ≤ t, we can construct the set W = W 1 of size n -t (W 2 = ∅) in the exact same way as in the proof of Lemma 10, such that we have simulation failure of W 1 along with the output shares indexed in J 1 on the input of the gadget. Otherwise, in the case where |J 2 | ≤ t, we can construct the set W = W 2 of size n -t (W 1 = ∅) in the exact same way, such that we have simulation failure of W 2 along with the output shares indexed in J 2 on the input of the gadget. Hence, the amplification order d of G copy is upper bounded by n -t.

From the three inequalities d ≥ min(t + 1, n -t), d ≤ t + 1 and d ≤ n -t, we conclude that the copy gadget instantiated with ISW refresh is (t, f )-RPE of amplification order d = min(t + 1, n -t).

The addition gadget G add that uses the n-share ISW refresh gadget as a building block in Algorithm 5 achieves the same amplification order as the ISW refresh gadget, which is tighter than the bound from Lemma 8. This directly follows from Lemma 10 and Lemma 9.

Corollary 6 (ISW addition gadget). Let n ∈ N. For every t ≤ n -1, the n-share gadget G add displayed in Algorithm 5 and instantiated with the ISW refresh gadget is (t, f )-RPE of amplification order d = min(t + 1, n -t).

ISW Multiplication Gadget

In contrast to the copy and addition gadgets that are built from generic schemes with a refresh gadget as a building block, the multiplication gadget can be directly defined as the standard ISW multiplication, recalled in Algorithm 1. We have the following lemma.

Lemma 12. Let n ∈ N. For every t ≤ n -2, the n-share ISW multiplication gadget displayed in Algorithm 1 is (t, f 1 )-RPE1 and (t, f 2 )-RPE2 for some functions f 1 , f 2 : R → R of amplification orders d 1 , d 2 which satisfy:

• d 1 = min(t + 1, n -t) 2 , • d 2 = t + 1 2 .
Proof. We start by proving the first property of the lemma. Since the n-share ISW multiplication gadget is (n -1)-SNI [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF], then we know from Lemma 6 that

d 1 ≥ min(t + 1, n -t) 2 .
In addition, we know from the proof of Lemma 2 that

d 1 ≤ t + 1 2 .
It remains to show that d 1 ≤ (n -t)/2. In this purpose, we exhibit a simulation failure on both inputs by carefully choosing n -t leaking variables, with t output variables. Consider the set of indexes of output shares J = {1, . . . , t}, which corresponds to the first t output shares c 1 , . . . , c t . Next, we construct the set of leaking wires W of size n -t. First, observe that the partial sums of the output shares are of the form

c i,j = a i • b i + r i,1 + • • • + r i,j if j < i a i • b i + r i,1 + • • • + r i,i-1 + r i,i+1 + • • • + r i,j
otherwise.

Then, let W = {c t+1,t , . . . , c n,t }. We can prove that the constructed set W along with the set of output shares J = {1, . . . , t} cannot be perfectly simulated with at most t input shares. For this, we consider a variable s = c 1 + • • • + c t + c t+1,t + . . . + c n,t , the sum of the t output shares indexed in J, and the leaking variables from W . Each of the output shares {c i } 1≤i≤t is the sum of

• one product of input shares a i • b i • n -1 random values,
• at most n -1 pairs of input shares products:

(a i • b j , a j • b i ) with i = j.
Each of the leaking variables {c i,t } t+1≤i≤n is the sum of

• one product of input shares a i • b i ,
• t random values,

• at most t pairs of input shares products:

(a i • b j , a j • b i ) with i = j.
In addition, each random value appears exactly twice in the set of expressions of the variables {c i } 1≤i≤t ∪ {c i,t } t+1≤i≤n , so all the random values are eliminated from the expression of the variable s, which is the sum of all of these variables. Hence,

s = a 1 • b 1 + . . . + a n • b n + C
where C is a variable containing other products of input shares of the form a i • b j and a j • b i with i = j. Thus, simulating the variable s requires the knowledge of the full inputs a and b. Since s is constructed from the set of leaking wires W and the output shares indexed in J, then W and J cannot be perfectly simulated without the knowledge of the full inputs a and b. Hence, the set W of size n -t represents a failure tuple on both inputs, and so the function f 1 for RPE1 cannot be of amplification order higher than (n -t)/2. Thus,

d 1 ≤ (n -t)/2.
From the three inequalities d 1 ≥ min(t + 1, n -t) 2 , d 1 ≤ (t + 1)/2 and d 1 ≤ (n -t)/2, we conclude that

d 1 = min(t + 1, n -t) 2 .
Next, we demonstrate the second part of the lemma. Let W be a set of leaking wires such that |W | ≤ t. We aim to prove that there exists a set J of n -1 output wires such that W and J can be perfectly simulated with sets of input shares I 1 on a and I 2 on b such that |I 1 | ≤ t, |I 2 | ≤ t. First, observe that the leaking wires in W are of the following forms :

1. input shares a i , b i , product of shares a i • b i . 2. partial sum c i,j = a i • b i + r i,1 + • • • + r i,j if j < i a i • b i + r i,1 + • • • + r i,i-1 + r i,i+1 + • • • + r i,j
otherwise.

random variable

r ij for i < j, variable r ji = a i • b j + r ij + a j • b i for j > i.
4. product of shares a i • b j , or variable a i • b j + r ij with i = j.

We build sets I 1 and I 2 from empty sets as follows. For every wire in W of the first or second form, we add index i to I 1 and I 2 . For every wire in W of the third or fourth form, if i ∈ I 1 , we add j to I 1 , otherwise we add i to I 1 , and if i ∈ I 2 , we add j to I 2 , otherwise we add i to I 2 . Since W is of size at most t, then |I 1 | ≤ t and |I 2 | ≤ t. Following the t-SNI property proof from [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF], we can show that W is perfectly simulated using shares of indexes in I 1 and I 2 . We now build the set J of n -1 indexes of output shares from two subsets J 1 and J 2 . We define

J 1 = {i | c i,j is observed in W }. Next, we define J 2 as any set such that |J 2 | = n -1 -|J 1 | and J 1 ∩ J 2 = ∅. Now,
we show that the output shares determined by the indexes in J = J 1 ∪ J 2 can be perfectly simulated from I 1 and I 2 :

• First consider the output wires indexed in J 1 , which have a partial sum observed. For each such variable c i , the biggest partial sum which is observed is already simulated. For the remaining r ij in c i , if i < j, then r ij is assigned to a fresh random value. Otherwise, if r ji enters in the computation of any other internal observation, then i, j ∈ I 1 and i, j ∈ I 2 , and so r ji can be perfectly simulated from the input shares. If not, then r ji is replaced by the random value r ij . So all output wires indexed in J 1 are perfectly simulated from I 1 and I 2 .

• Now consider the output wires indexed in J 2 . None of the c i indexed in J 2 has a partial sum observed. Meanwhile, each c i indexed in J 2 is composed of n-1 random values, and at most one of them can enter in the expression of each other output wire c j . Since by construction of J 1 , all the variables observed through the set W are included in the set of variables observed through J 1 , and since

|J 1 | ≤ |W | ≤ t ≤ n -2 and |J 2 | = n -1 -|J 1 |,
then each output wire c i indexed in J 2 has at least one random value that does not appear in any other observation from W or J 1 , so c i can be assigned to a fresh random value. This produces a perfect simulation of all output wires indexed in J 2 .

We conclude that the set J of n -1 wires is perfectly simulated along with W from the constructed sets I 1 and

I 2 of sizes |I 1 | ≤ |W | ≤ t and |I 2 | ≤ |W | ≤ t.
So there is no failure set of observations of size at most t for RPE2 on any of the inputs. Hence d 2 ≥ (t + 1)/2. In addition, we know from the proof of Lemma 2 and as explained in Section 5.1 that d 2 ≤ (t + 1)/2. Hence, d 2 = (t + 1)/2, which concludes the proof for RPE2.

Corollary 7 then directly follows from Lemma 12 by applying Lemma 3 (RPE1 ∩ RPE2 ⇒ RPE).

Corollary 7. Let n ∈ N. For every t ≤ n -2, the n-share ISW multiplication gadget displayed in Algorithm 1 is (t, f )-RPE of amplification order

d = min(t + 1, n -t) 2 .
According to Lemma 2, the upper bound on the amplification order of a standard multiplication gadget (i.e. which starts with the cross-products of the input shares) is d ≤ min((t + 1)/2, (n -t)) which gives d ≤ (n + 1)/3 for t = (2n -1)/3. In contrast, the ISW multiplication gadget reaches d = n+1 4 by taking t = n-1 2 .

Application to the RPE compiler As described in Section 4.4, instantiating the RPE compiler with three RPE base gadgets gives a (p, 2 -κ )-random probing secure compiler (i.e. achieving κ bits of security against a leakage probability p) with a complexity blowup of O(κ e ) for an exponent e satisfying e = log N max log d

with N max as defined in (4.17) and where d is the minimum amplification order of the three base gadgets as in Definition 14.

We can instantiate the RPE compiler using the ISW-based gadgets. Specifically, we use the ISW multiplication for the multiplication gadget G mult , and the generic constructions of addition and copy gadgets based on the ISW refresh. The maximum amplification order achievable by the compiler is the minimum of the three gadgets, which is the order of the ISW multiplication gadget:

d = min(t + 1, n -t) 2 .
Hence, for a given number of shares n, the maximum amplification order achievable is

d max = n + 1 4
which is obtained for t = n-1 2 . On the other hand, the value of N max can be characterized in terms of the number of shares n. Recall from Section 4.4 that

N max = max N G mult ,m , eigenvalues N G add ,a N Gcopy,a N G add ,c N Gcopy,c .
For the ISW multiplication gadget, we have N G mult ,m = n 2 . Then, for the ISW-based addition and copy gadgets, we have

N G add ,a N Gcopy,a N G add ,c N Gcopy,c = n(2n -1) 2n(n -1) n(n -1) n 2 .
The eigenvalues of the above matrix are λ 1 = n and λ 2 = 3n 2 -2n, implying

N max = 3n 2 -2n . (5.11)
Thus, the RPE compiler purely based on ISW constructions has a complexity blowup O(κ e ) with exponent e = log(3n 2 -2n) log( (n + 1)/4 ) .

Figure 5.2 shows the evolution of the value of this exponent with respect to the number of shares n (where we assume an odd n). The blue curve corresponds to the construction based on ISW for multiplication, addition and copy. The value of e clearly decreases as the number of shares grows, and this decrease is faster for a small number of shares (5 ≤ n ≤ 10). The exponent value reaches e ≈ 4 for a number of shares around 25 and then slowly converges towards e = 2 as n grows. This is to be compared with the O(κ 7.5 ) complexity achieved in Section 4.5. the orange curve assumes the optimal amplification order (i.e. an improvement of the multiplication gadget); the pink curve assumes a better complexity for addition and copy gadgets (so that N max matches N m,m = n 2 ).

The red and orange curves provide a comparison in the cases where we can achieve better values for N max and d. The red curve assumes a lower value for N max . For instance, constructing addition and copy gadgets with better complexity so that N max matches the value of N m,m = n 2 . The orange curve, on the other hand, assumes that we achieve the maximal amplification. While the three curves converge towards e = 2, improving the values of N max and d increases the convergence speed. Decreasing the value of N max allows for a faster convergence (e.g. e ≈ 3.6 for n = 20 shares compared to e ≈ 4.25 on the blue curve) while achieving the maximal amplification order allows achieving much lower complexity blowups for constructions with small numbers of shares (e.g. e < 5 for n = 3 shares).

Towards a Better Complexity. As we saw in Figure 5.2, there are two directions for improvement. The first one is choosing gadgets which attain the upper bound min(t + 1, nt) on the amplification order from Lemma 1, allowing the compiler to have the maximum amplification order d = (n + 1)/2 and thus have the lowest complexity blowup. Our ISWbased copy and addition gadgets achieve this bound while the ISW multiplication gadget is limited to (n + 1)/4 ( Lemma 12). To reach the optimal amplification order, one would need a different multiplication gadget and, in particular, a multiplication gadget which does not perform a direct product of shares (because of the bound from Lemma 2). We tackle this problem in Section 5.4, where we introduce a new multiplication gadget achieving the upper bound on the amplification order min(t + 1, n -t) by avoiding a direct product of shares using a refresh on the input sharings. The orange curve in Figure 5.2 shows the evolution of the value of the exponent when instantiating the expanding compiler with our previous addition and copy gadgets and this new multiplication gadget. For such an instantiation, the complexity exponent still slowly converges towards e = 2, but, as we can see from Figure 5.2, the exponent value is much better for small values of n.

Another possible direction for improvement would be to lower the complexity of the addition and copy gadgets, which is mainly dominated by the complexity of the refresh gadget. Assume that we can design a (T)RPE refresh gadget in sub-quadratic complexity, e.g. as the refresh gadgets proposed in [START_REF] Rivain | Provably secure higher-order masking of AES[END_REF][START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF][START_REF] Dziembowski | Simple refreshing in the noisy leakage model[END_REF], then the eigenvalues of the matrix M ac as defined in Section 4.4 would also be sub-quadratic and the value of N max from equation (4.17) would drop to N m,m = n 2 (if the multiplication gadget still requires n 2 multiplication gates). The pink curve in Figure 5.2 depicts the evolution of the exponent value under this assumption. We still have a slow convergence towards e = 2, but the exponent value is yet better for small values of n. Such asymptotic complexities are interesting for bigger numbers of shares. For this reason, we tackle this direction for improvement in the next chapter ( Chapter 6), where we introduce the idea of dynamic random probing expansion. In a nutshell, the dynamic random probing expansion allows benefiting from the best tolerated leakage rates of constructions for a small number of shares and the optimal asymptotic complexity of constructions for a bigger number of shares. We show that we can use the O(n log n) refresh gadget from [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF] to instantiate the addition and copy gadgets and construct a new multiplication gadget, which performs a linear number of multiplications (i.e. N m,m = O(n)) under some constraints on the base field. Indeed, this construction is asymptotic and works better for more shares. Eventually, this approach allows us to have

N max = O(n log n).
The above analysis shows that the RPE compiler can theoretically approach a quadratic complexity at the cost of increasing the number of shares in the base gadgets. The downside is that the tolerated leakage probability will likely decrease as the number of shares grows. For instance, the ISW construction is known only to tolerate a leakage probability p = O(1/n) [START_REF] Duc | Unifying leakage models: From probing attacks to noisy leakage[END_REF]. The number of shares hence offers multiple trade-offs between the tolerated probability and the asymptotic complexity of the compiler. Starting from a target leakage probability p, one could determine the highest number of shares admissible from a generic construction and thus deduce the best complexity exponent achievable. In Section 5.5, we exhibit concrete trade-offs that can be reached for small values of n.

Multiplication Gadget with Maximal Amplification Order

Constructing a multiplication gadget which achieves the upper bound on the amplification order from Lemma 1 is tricky. First, as a standard multiplication gadget (i.e. which computes the cross products of the input shares), the ISW multiplication cannot achieve the maximal amplification order (see Lemma 2). In order to reach the upper bound for two-input gadgets (see Corollary 3), we need a non-standard multiplication gadget, i.e. which does not perform a direct product between the input shares. As an additional observation, the addition, copy, and random gates are virtually free in a multiplication gadget since they do not impact the final complexity of the RPE compiler (see Section 4.4). This suggests that we can be greedy in terms of randomness to reach the maximal amplification order.

In the following, we will describe the construction of a new multiplication gadget which achieves the maximum amplification order min(t + 1, n -t). We first describe our standard nshare multiplication gadget and then explain how we avoid the initial cross products of shares.

First, the gadget constructs the matrix of the cross product of input shares:

M =      a 1 • b 1 a 1 • b 2 • • • a 1 • b n a 2 • b 1 a 2 • b 2 • • • a 2 • b n . . . . . . . . . . . . a n • b 1 a n • b 2 • • • a n • b n     
Then, it picks n 2 random values which define the following matrix:

R =      r 1,1 r 1,2 • • • r 1,n r 2,1 r 2,2 • • • r 2,n . . . . . . . . . . . . r n,1 r n,2 • • • r n,n     
It then performs an element-wise addition between the matrices M and R:

P = M + R =      p 1,1 p 1,2 • • • p 1,n p 2,1 p 2,2 • • • p 2,n . . . . . . . . . . . . p n,1 p n,2 • • • p n,n     
At this point, the gadget randomizes each product of input shares from the matrix M with a single random value from R. In order to generate the correct output, the gadget adds all the columns of P into a single column V of n elements, and adds all the columns of the transpose matrix R T into a single column X of n elements:

V =      p 1,1 + • • • + p 1,n p 2,1 + • • • + p 2,n . . . p n,1 + • • • + p n,n      , X =      r 1,1 + • • • + r n,1 r 1,2 + • • • + r n,2 . . . r 1,n + • • • + r n,n     
The n-share output is finally defined as (c 1 , . . . , c n ) = V + X.

In order to further increase the maximum amplification order attainable by the gadget, we need to avoid performing a direct product of shares (because of the bound proved in Lemma 2). For this, we add a pre-processing phase to the gadget using a refresh gadget G refresh . Specifically, we refresh the input (b 1 , . . . , b n ) each time it is used. In other terms, each row of the matrix M uses a fresh copy of (b 1 , . . . , b n ) produced using the considered refresh gadget. This amounts to performing n independent refreshes of the input (b 1 , . . . , b n ). The matrix M is thus defined as

M =       a 1 • b (1) 1 a 1 • b (1) 2 • • • a 1 • b (1) n a 2 • b (2) 1 a 2 • b (2) 2 • • • a 2 • b (2) n . . . . . . . . . . . . a n • b (n) 1 a n • b (n) 2 • • • a n • b (n) n      
where (b

(j) 1 , . . . , b (j)
n ), j ∈ [n], are the n independent refreshings of the input (b 1 , . . . , b n ). With this refreshing scheme, we avoid using the same share more than once for one of the two input sharings. As a consequence, the double failure set of size t + 1 which is the reason behind the bound (t + 1)/2 in Lemma 2, becomes a simple failure set (i.e. provoking a failure on a single input sharing). In addition, the computational overhead of these additional n refreshes is negligible compared to the joint contribution of the copy and addition gadgets to the complexity of the RPE compiler.

For the sake of completeness, we present the full algorithm for this multiplication gadget in Algorithm 6.

(i) 1 , . . . , b (i) n ) ← G refresh (b 1 , . . . , b n ); 3 end 4 for i ← 1 to n do 5 for j ← 1 to n do 6 p i,j ← a i × b (i) j + r i,j ; 7 end 8 end 9 (v 1 , . . . , v n ) ← (0, . . . , 0); 10 (x 1 , . . . , x n ) ← (0, . . . , 0); 11 for i ← 1 to n do 12 for j ← 1 to n do 13 v i ← v i + p i,j ; 14 x i ← x i + r i,j ; 15 end 16 end 17 for i ← 1 to n do 18 c i ← v i + x i ; 19 end 20 return (c 1 , . . . , c n );
In the following lemma, we show that if the refresh gadget G refresh achieves the TRPE1 property with the amplification order at least d = min(t + 1, n -t) for any t, then the multiplication gadget depicted in Algorithm 6 achieves TRPE with the maximum amplification orders. The proof of the Lemma is given in Section A.1.

Lemma 13. Let t ≤ n -1. Let G refresh be a (t, f )-TRPE1 refresh gadget for some function f : R → R, and G mult the n-share multiplication gadget from Algorithm 6. If f is of amplification order d ≥ d = min(t + 1, n -t), then G mult achieves (t, f )-TRPE for some function f : R → R of amplification order d = min(t + 1, n -t).

Corollary 8 then directly follows from Lemma 13 by applying Lemma 4 (TRPE ⇒ RPE).

Corollary 8. Let t ≤ n -1. Let G refresh be a (t, f )-TRPE1 refresh gadget for some function f : R → R, and G mult the n-share multiplication gadget from Algorithm 6. If f is of amplification order d ≥ d = min(t + 1, n -t), then G mult achieves (t, f )-RPE for some function f : R → R of the same amplification order d = min(t + 1, n -t).

Efficient Small Gadgets

This section displays our new constructions of small gadgets for copy, addition, and multiplication operations with a low number of shares. As explained earlier, the maximal amplification order achievable for 2-input n-share gadgets is n + 1/2, hence it is equal to 1 for n = 2 gadets. We hence focus on n ≥ 3. Then, as explained in Section 4.4.1, the highest amplification orders can only be achieved for gadgets with an odd number of shares. We therefore omit 4-share gadgets and display our best trade-offs in terms of RPE security and complexity for 3-share and 5-share gadgets. Each one of these gadgets is experimentally verified using the IronMask verification tool.

Addition and Copy Gadgets. For the construction of small 3-share and 5-share addition and copy gadgets, we use the generic constructions depicted in Algorithm 4 and Algorithm 5 (in Section 5.2) which naturally use a refresh gadget as a building block. We hence start by looking for refresh gadgets that have a good complexity in terms of gates count, and achieve the upper bound on the amplification order for the specific case of 3-share and 5-share constructions (but not necessarily for a higher number of shares).

Multiplication gadget. For the construction of small 3-share and 5-share multiplication gadgets, we use the generic construction depicted in Algorithm 6 from Section 5.4 which, to the best of our knowledge, is the only multiplication gadget which achieves the maximum amplification order for any number of shares, and specifically for 3-share and 5-share constructions. As for the refresh gadget G refresh which is used to perform n refreshes on the second input, we use the same scheme as for the construction of small addition and copy gadgets (and which shall satisfy the necessary condition on G refresh from Corollary 8).

While the multiplication gadget from Section 5.4 achieves the desired amplification order, we add another pre-processing phase to the gadget in order to further improve the tolerated leakage probability. In addition to the n refreshes performed on the second input b (see Algorithm 6), we add another single refresh of the input (a 1 , . . . , a n ) before computing the cross-products, using the same refresh gadget G refresh . Refreshing the input (a 1 , . . . , a n ) before usage experimentally shows a further increase in the maximum tolerated leakage probability, by adding more randomness to the input shares before computing the cross-product matrix M in Algorithm 6. And since the refresh gadget G refresh achieves the maximum amplification order, the amplification order achieved by G mult is not affected by adding another refresh to the first input a.

The above construction achieves the maximum amplification order for 3-share (d = 2) and 5-share (d = 3) gadgets based on natural refresh gadgets detailed hereafter.

3-share Gadgets

We start with the construction of 3-share gadgets for our three base operations.

Copy and Addition Gadgets. We build our copy and addition gadgets from the instantiation of the generic constructions of Section 5.2 ( Algorithm 4 and Algorithm 5) with 3 shares. However, instead of using the ISW refresh gadget, we use the following more efficient construction with only two random values:

G refresh : c 1 ← r 1 + a 1 c 2 ← r 2 + a 2 c 3 ← (r 1 + r 2 ) + a 3 .
This refresh is sufficient to reach the upper bounds on the amplification orders (from Lemma 1). From this basis, we obtain the following 3-share addition gadget with four random values:

G add : c 1 ← (r 1 + a 1 ) + (r 3 + b 1 ) c 2 ← (r 2 + a 2 ) + (r 4 + b 2 ) c 3 ← (r 1 + r 2 ) + a 3 + (r 3 + r 4 ) + b 3
and the following 3-share copy gadget with also four random values:

G copy : c 1 ← r 1 + a 1 ; d 1 ← r 3 + a 1 c 2 ← r 2 + a 2 ; d 2 ← r 4 + a 2 c 3 ← (r 1 + r 2 ) + a 3 ; d 3 ← (r 3 + r 4 ) + a 3 .
Multiplication Gadget. The following construction is a 3-share instantiation of the multiplication gadget described in Section 5.4. For the input refreshing, we use the 3-share refresh gadget described above with two uniformly random values. The construction achieves the bound on the amplification order from Lemma 1 with 17 random values:

G mult : i 1,1 ← r 1 + b 1 ; i 1,2 ← r 2 + b 2 ; i 1,3 ← (r 1 + r 2 ) + b 3 i 2,1 ← r 3 + b 1 ; i 2,2 ← r 4 + b 2 ; i 2,3 ← (r 3 + r 4 ) + b 3 i 3,1 ← r 5 + b 1 ; i 3,2 ← r 6 + b 2 ; i 3,3 ← (r 5 + r 6 ) + b 3 a 1 ← r 7 + a 1 ; a 2 ← r 8 + a 2 ; a 3 ← (r 7 + r 8 ) + a 3 c 1 ← (a 1 • i 1,1 + r 1,1 ) + (a 1 • i 1,2 + r 1,2 ) + (a 1 • i 1,3 + r 1,3 ) + (r 1,1 + r 2,1 + r 3,1 ) c 2 ← (a 2 • i 2,1 + r 2,1 ) + (a 2 • i 2,2 + r 2,2 ) + (a 2 • i 2,3 + r 2,3 ) + (r 1,2 + r 2,2 + r 3,2 ) c 3 ← (a 3 • i 3,1 + r 3,1 ) + (a 3 • i 3,2 + r 3,2 ) + (a 3 • i 3,3 + r 3,3 ) + (r 1,3 + r 2,3 + r 3,3 ).
Results. Table 5.1 displays the results for the above gadgets obtained through the Iron-Mask tool. The second column gives the complexity, where N a , N c , N m , N r stand for the number of addition gates, copy gates, multiplication gates and random gates respectively. The third column provides the amplification order of the gadget. And the last column gives the maximum tolerated leakage probability. The last row gives the global complexity, amplification order, and maximum tolerated leakage probability for the RPE compiler using these three gadgets. Remark 3. The copy gadget G copy instantiated in Section 4.5 which uses a refresh scheme with 3 randoms for each output, also reaches the amplification order 2. It tolerates a better leakage probability (i.e. 2 -5.9 ) than the one provided here, but with a higher complexity of (12, 9, 0, 6). If it is used to replace the 3-share copy gadget, the maximum tolerated leakage probability by the compiler from Table 5.1 would be of 2 -7.4 slightly better than the current value of 2 -7.5 but with a higher complexity of O(|C|•κ 4.08 ) instead of O(|C|•κ 3.9 ). Another copy gadget can be constructed by using the refresh scheme with 3 random values from Section 4.5 for one of the outputs, and the refresh scheme presented in this section with 2 random values for the second output. This gadget tolerates a maximum leakage probability of around 2 -7.1 with a complexity of (10, 8, 0, 5). Using it would bring the complexity of the compiler from Table 5.1 to O(|C| • κ 4 ), while tolerating a leakage probability of 2 -7.4 , the same as that of the used multiplication gadget.

5-share Gadgets

We now present our 5-share gadgets for our three base operations, which reach the optimal amplification order from Lemma 1.

Copy and Addition Gadgets. As for the 3-share case, we use the generic constructions from Section 5.2. Instead of using the ISW refresh gadget, we use the circular refresh gadget described in [START_REF] Barthe | Improved parallel mask refreshing algorithms: generic solutions with parametrized non-interference and automated optimizations[END_REF][START_REF] Barthe | Parallel implementations of masking schemes and the bounded moment leakage model[END_REF] which requires less randomness (a.k.a. block refresh gadget):

G refresh : c 1 ← (r 1 + r 2 ) + a 1 c 2 ← (r 2 + r 3 ) + a 2 c 3 ← (r 3 + r 4 ) + a 3 c 4 ← (r 4 + r 5 ) + a 4 c 5 ← (r 5 + r 1 ) + a 5 .
This gadget only uses n randoms for an n-share construction, and while it does not achieve enough security in the generic case (unless the refresh block is iterated on the input a certain number of times [START_REF] Barthe | Improved parallel mask refreshing algorithms: generic solutions with parametrized non-interference and automated optimizations[END_REF][START_REF] Barthe | Parallel implementations of masking schemes and the bounded moment leakage model[END_REF]), it proves to be more than enough to achieve the necessary amplification order for our 5-share constructions. We use a variant of the original version (also suggested in [START_REF] Barthe | Improved parallel mask refreshing algorithms: generic solutions with parametrized non-interference and automated optimizations[END_REF]): we choose to sum the random values first (thus obtaining a sharing of 0) before adding them to the input shares. The idea is to avoid using the input shares in any of the intermediate variables, so that input shares only appear in the input variables {a i } 1≤i≤n and the final output variables {c i } 1≤i≤n . Intuitively, this trick allows to have less failure tuples in the gadget because there are less variables that could leak information about the input. This is validated experimentally where we obtain better results in terms of amplification order and tolerated leakage probability for small gadgets.

From this circular refresh, we obtain an addition gadget with ten random values which reaches the upper bound on the amplification order: and a copy gadget with also ten random values and which also reaches the upper bound on the amplification order: Multiplication Gadget. The following construction is a 5-share instantiation of the multiplication gadget described in Section 5.4. For the input refreshing, we use the 5-share circular refresh gadget described above. The gadget advantageously achieves the optimal amplification order (given by Lemma 1) with 55 random values: a 1 ← (r 26 + r 27 ) + a 1 ; a 2 ← (r 27 + r 28 ) + a 2 ; a 3 ← (r 28 + r 29 ) + a 3 ; Results. Table 5.2 gives the results for the above gadgets obtained through the Iron-Mask tool. From Table 5.1 and Table 5.2, we observe that the asymptotic complexity is better for the instantiation based on 5-share gadgets as they provide a better amplification order with limited overhead. While this result can seem to be counterintuitive, it actually comes from the fact that each gadget will be expended less in the second scenario. We stress that we could only obtain an interval [2 -9.67 , 2 -7.66 ] for the tolerated leakage probability because it was computationally too expensive to obtain a tighter interval. Meanwhile, we can consider that our best complexity O(|C|•κ 3.2 ) comes at the price of a lower tolerated leakage probability of 2 -9.67 (5-share gadget) compared to the O(|C| • κ 3.9 ) complexity and 2 -7.5 tolerated leakage probability obtained for our 3-share instantiation.

G add : c 1 ← (r 1 + r 2 ) + a 1 + (r 6 + r 7 ) + b 1 c 2 ← (r 2 + r 3 ) + a 2 + (r 7 + r 8 ) + b 2
G copy : c 1 ← (r 1 + r 2 ) + a 1 ; d 1 ← (r 6 + r 7 ) + a 1 c 2 ← (r 2 + r 3 ) + a 2 ; d 2 ← (r 7 + r 8 ) + a 2
G mult : i 1,1 ← (r 1 + r 2 ) + b 1 ; i 1,2 ← (r 2 + r 3 ) + b 2 ; i 1,3 ← (r 3 + r 4 ) + b 3 ; i 1,4 ← (r 4 + r 5 ) + b 4 ; i 1,5 ← (r 5 + r 1 ) + b 5 i 2,1 ← (r 6 + r 7 ) + b 1 ; i 2,2 ← (r 7 + r 8 ) + b 2 ; i 2,3 ← (r 8 + r 9 ) + b 3 ; i 2,
a 4 ← (r 29 + r 30 ) + a 4 ; a 5 ← (r 30 + r 26 ) + a 5 c 1 ← (a 1 • i 1,1 + r 1,1 ) + (a 1 • i 1,2 + r 1,2 ) + (a 1 • i 1,3 + r 1,3 ) + (a 1 • i 1,4 + r 1,4 ) +(a 1 • i 1,5 + r 1,5 ) + (r 1,1 + r 2,1 + r 3,1 + r 4,1 + r 5,1 ) c 2 ← (a 2 • i 2,1 + r 2,1 ) + (a 2 • i 2,2 + r 2,2 ) + (a 2 • i 2,3 + r 2,3 ) + (a 2 • i 2,4 + r 2,4 ) +(a 2 • i 2,5 + r 2,5 ) + (r 1,2 + r 2,2 + r 3,2 + r 4,2 + r 5,2 ) c 3 ← (a 3 • i 3,1 + r 3,1 ) + (a 3 • i 3,2 + r 3,2 ) + (a 3 • i 3,3 + r 3,3 ) + (a 3 • i 3,4 + r 3,4 ) +(a 3 • i 3,5 + r 3,5 ) + (r 1,3 + r 2,3 + r 3,3 + r 4,3 + r 5,3 ) c 4 ← (a 4 • i 4,1 + r 4,1 ) + (a 4 • i 4,2 +
In comparison, the previous instantiation of the RPE compiler in Section 4.5 could only achieve a complexity of O(|C| • κ 7.5 ) for maximum tolerated probabilities of 2 -7.09 , and the instantiation of the expanding approach with a multi-party computation protocol [START_REF] Ananth | Private circuits: A modular approach[END_REF], could only achieve a complexity of O(|C| • κ 8.2 ) for maximum tolerated probabilities of 2 -26 .

Conclusion

This chapter provided an in-depth analysis of the RPE security notion and showed that it could be made tighter, with a connection to the strong non-interference (SNI) composition notion. We also introduced generic RPE constructions achieving the maximal amplification order for any number of shares and instantiated small constructions with better asymptotic complexities.

As previously discussed, we want to target high tolerated leakage rates and good asymptotic complexities. While constructions with small numbers of shares tend to tolerate better leakage rates, some constructions have better asymptotic complexities for higher numbers of shares. In the next chapter, we try to get the best of both worlds with dynamic random probing expansion. The goal is to start the expansion with a few iterations of a compiler with a small number of shares to benefit from its tolerated leakage probability. Then, we can continue the expansion with other compilers with optimal asymptotic complexities, bringing us a step closer to optimal expansion strategies.

Chapter 6

Dynamic RPE and Optimal Asymptotic Complexities

In this chapter, we further push the random probing expansion strategy by analyzing the base gadgets' dynamic choice. While the expanding compiler considered in previous chapters consists in applying a compiler CC composed of base RPE gadgets a given number of times, say k, to the input circuit: C = CC (k) (C), we consider a dynamic approach in which a new compiler is selected at each step of the expansion from a family of base compilers {CC i } i . This approach is motivated by the generic gadget constructions introduced in Chapter 5, which achieve the RPE property for any number of shares n. While the asymptotic complexity of the expanding compiler decreases with n, the tolerated leakage probability p also gets smaller with n, which makes those constructions only practical for small values of n. We show that using our dynamic approach, we can get the best of both worlds: our dynamic expanding compiler enjoys the best tolerated probability and the best asymptotic complexity from the underlying family of RPE compilers {CC i } i . We further illustrate how this approach can reduce the complexity of a random probing secure AES implementation by a factor of 10 using a dynamic choice of the gadgets from Section 5.5 in Chapter 5.

The dynamic random probing expansion motivates us to design asymptotic RPE gadgets achieving better complexity. While the earlier asymptotic constructions achieve a quadratic complexity, we introduce new constructions achieving quasi-linear complexity, using the quasilinear refresh gadget from Battistello, Coron, Prouff, and Zeitoun [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF]. With such linear gadgets, the complexity bottleneck of the expanding compiler becomes the number of multiplications in the multiplication gadget, which is quadratic in known RPE constructions. We then provide a new generic construction of an RPE multiplication gadget featuring a linear number of multiplications. We obtain this construction by tweaking the probing-secure multiplication gadget from Belaïd, Benhamouda, Passelègue, Prouff, Thillard, and Vergnaud [START_REF] Belaïd | Private multiplication over finite fields[END_REF]. As in the original construction, our RPE gadget imposes some constraints on the underlying finite field. We demonstrate that for any number of shares, there exists a (possibly large) finite field on which our construction can be instantiated, and we provide some concrete instantiations for small numbers of shares.

Using our new asymptotic gadget constructions with the dynamic expansion approach, we obtain random probing security for a leakage probability of 2 -7.5 with asymptotic complexity of O(κ 2 ). Moreover, assuming that the constraint on the finite field from our multiplication gadget is satisfied, we can make this asymptotic complexity arbitrarily close to O(κ), which is optimal. Hence, securing circuits defined on a large field against random probing leakage can be achieved at a sub-quadratic nearly-linear complexity. The contributions in this chapter are published in [START_REF] Belaïd | Dynamic random probing expansion with quasi linear asymptotic complexity[END_REF].

Dynamic Random Probing Expansion

Recall that the principle of the expanding compiler is to apply a base circuit compiler CC which is composed of base gadgets -one per gate type in the circuit-several times, say k, to the input circuit: C = CC (k) (C). The level of expansion k is chosen in order to achieve a certain desired security level κ such that f (k) (p) ≤ 2 -κ .

In this section, we generalize this approach to choose the circuit compiler dynamically at the different steps of the expansion. Let {CC i } i be a family of circuit compilers, the dynamic expanding compiler for this family with respect to the expansion sequence k 1 , . . . k µ , is defined as

C = CC kµ µ • CC k µ-1 µ-1 • . . . • • • • CC k 1 1 (C) . (6.1)
The idea behind this generalization is to make the most from a family of RPE compilers {CC i } i which is defined with respect to the number of shares n i in the base gadgets. If we assume that each compiler CC i with n i shares achieves the maximum amplification order

d i = n i +1
2 , then the benefit of using a compiler with higher number of shares is to increase the amplification order and thus reduce the number of steps necessary to achieve the desired security level κ. On the other hand, the tolerated leakage rate of existing constructions decreases with n i . As we show hereafter, a dynamic increase of n i can ensure both, the tolerated leakage rate of a small n i and the better complexity of a high n i .

Dynamic Expanding Compiler

In the following, we state the security and asymptotic complexity of the dynamic expanding compiler. We will consider a family of different RPE compilers where each compiler is indexed by an index i, i.e. a family of different RPE compilers is denoted as {CC i } i for different number of shares {n i } i . We start with a formal definition of the dynamic compiler: Definition 21 (Dynamic Expanding Compiler). Let {CC i } i be a family of RPE compilers with numbers of shares {n i } i . The dynamic expanding compiler for {CC i } i with expansion levels k 1 , . . . , k µ , is the circuit compiler (CC, Enc, Dec) where 1. The input encoding Enc is a µ i=1 n k i i -linear encoding.

2. The output decoding Dec is the µ i=1 n k i i -linear decoding mapping.

3. The circuit compilation is defined as

CC(•) = CC kµ µ • CC k µ-1 µ-1 • . . . • • • • CC k 1 1 (•) .
The following theorem states the random probing security of the dynamic expanding compiler. The proof of the theorem is very similar to the proof of RPE security ( Theorem 2) from Section 4.2 The main difference is that at each level of the expansion, we can use a different expanding compiler with different sharing orders. Besides that, the proof follows the same baselines as in the original proof of Theorem 2. For the sake of completeness, we give the full proof in Section A.2.

Theorem 3 (Security). Let {CC i } i be a family of RPE compilers with expanding functions {f i } i . The dynamic expanding compiler for {CC i } i with expansion levels k 1 , . . . , k µ is (p, ε)random probing secure with

ε = f kµ µ • • • • • f k 1 1 (p)
. We now state the asymptotic complexity of the dynamic expanding compiler in the next theorem.

Theorem 4 (Asymptotic Complexity). Let {CC i } i be a family of circuit compilers with complexity matrices {M CC i } i . For any input circuit C, the output circuit

C = CC kµ µ • • • • • • • • CC k 1 1 (C) is of size | C| = |C| • O µ i=1 |λ i | k i with λ i such that |λ i | := max |eigenvalues(M CC i )| . (6.2)
Proof. Let {CC i } i be a family of circuit compilers with complexity matrices {M CC i } i . Given a circuit C with its complexity vector N C as described in Section 4.4, it can be verified that the complexity of the compiled circuit

C = CC kµ µ • • • • • • • • CC k 1 1 (C) satisfies N C = M kµ CCµ • . . . • M k 1 CC 1 • N C If we denote M CC i = Q i • Λ i • Q -1
i to be the eigen decomposition of the matrix M CC i , then we get

N C = Q µ • Λ kµ µ • Q -1 µ • . . . • Q 1 • Λ k 1 1 • Q -1 1 • N C (6.3)
We consider in the theorem that the expansion levels {k i } i are the main parameters. We can also see from (6.3) that the complexity of the compiled circuit is expressed in terms of the eigen matrices to the powers k i as Λ k i i . The parameters {k i } i do not affect the matrices {Q i , Q -1 i } i . Then, if we denote λ i := max eigenvalues(M CC i ) i.e. the maximum of the eigenvalues in Λ i , then we get that in terms of the parameters {k i } i , the complexity of the compiled circuit C can be expressed as

N C = O |λ µ | kµ • . . . • |λ 1 | k 1 • N C which gives | C| = |C| • O µ i=1 |λ i | k i
which concludes the proof of Theorem 4.

In the following, we shall call λ i as defined above, the eigen-complexity of the compiler CC i . We shall further call the product µ i=1 |λ i | k i the complexity blowup of the dynamic expanding compiler. We note that minimizing the complexity blowup is equivalent to minimizing the log complexity blowup, which is

µ i=1 k i • log 2 (|λ i |) .
(6.4)

General Bounds for Asymptotic Constructions

The following theorem introduces general bounds on the tolerated leakage rate and the expanding function of an RPE compiler with respect to its amplification order and gadget complexity.

Theorem 5. Let CC i be an RPE circuit compiler of amplification order d i and gadget complexity s i . The tolerated leakage rate q i of CC i is lower bounded by

q i ≥ qi := 1 e 1 2 e 1 d i -1 d i s i 1+ 1 d i -1 (6.5)
For any p < qi , the expanding function f i of CC i is upper bounded by

f i (p) ≤ 2 s i d i p d i ≤ 2 e • s i d i d i p d i . ( 6
f i (p) ≤ s i j=d i s i j p j , (6.9)
for any p ∈ [0, 1). From (6.7), for any j ∈ [s i ], we get:

s i j + 1 p j+1 ≤ 1 2 s i j p j
which gives

f i (p) ≤ s i j=d i s i d i 1 2 j-d i p d i = s i d i p d i s i -d i j=0 1 2 j ≤ 2 s i d i p d i .
We are now ready to prove Theorem 5. We show that for every p satisfying p < 1 e 1 2 e

1 d i -1 d i s i 1+ 1 d i -1 (6.10) we have f i (p) < p. Let us define fi : p → 2 s i d i p d i .
(the upper bound on f i from Lemma 14). The equation fi (γ) = γ has the following solution

γ = 1 2 s i d i 1 d i -1 which, from s i d i ≤ s i • exp(1) d i d i , further satisfies γ ≥ 1 e 1 2 e 1 d i -1 d i s i 1+ 1 d i -1
We deduce that (6.10) implies p < γ which further implies fi (p) < p. Moreover (6.10) implies p < 1 2

d i s i 1+ 1 d i -1 < 1 2 • d i s i < 1 2 • d i + 1 s i -d i ,
which, by Lemma 14, further implies f i (p) ≤ fi (p). We hence deduce that (6.10) implies f i (p) < p which concludes the proof.

The lower bound qi on the tolerated leakage rate quickly converges to the ratio e -1 • d i /s i as d i grows. In other words, an RPE compiler family {CC i } i indexed by the number of shares n i of its base gadgets tolerates a leakage probability which is linear in the ratio between its amplification order d i and its complexity s i . For known families of RPE compilers from Section 5.5, this ratio is in O(1/n i ).

From Theorem 5, we obtain the following bound for the composition f (k) i . Corollary 9. Let CC i be an RPE compiler of expanding function f i , amplification order d i and gadget complexity s i . For any p < qi as defined in (6.5), we have

f (k) i (p) ≤ 2 s i d i 1+ 1 d i -1 d k-1 i p d k i ≤    2 1 d i es i d i 1+ 1 d i -1 p    d k i .
Proof. For any function f (p) = c • p d , we have

f (k) (p) = c (d k-1 +d k-2 +•••+1) • p d k ≤ c 1+ 1 d-1 d k-1 p d k .
When c i = 2 s i d i , Equation (6.6) from Theorem 5 gives the first and the second inequalities.

The following lemma gives an explicit lower bound on the expansion level {k i } i to reach some arbitrary target probability p out = 2 -κout from a given input probability p in = 2 -κ in by applying CC

(k i ) i . Lemma 15. Let p in = 2 -κ in < q i and p out = 2 -κout ∈ (0, 1]. For any integer k i satisfying k i ≥ log d i (κ out ) -log d i (κ in -∆ i )
with

∆ i := 1 + 1 d i -1 1 d i + log 2 es i d i we have f (k i ) i (p in ) ≤ p out = 2 -κout .
In the above lemma, ∆ i represents a lower bound for κ in which matches the upper bound qi of p in = 2 -κ in . Assuming that s i and d i are both monotonically increasing with i, we get that the threshold ∆ i tends towards log 2 es i d i . From Lemma 15, we further get that the cost induced by the choice of the compiler CC i to go from an input probability p in to a target output probability p out is

k i • log 2 (|λ i |) ≥ log 2 (|λ i |) log 2 (d i ) log 2 (κ out ) -log 2 (κ in -∆ i ) (6.11)
(in terms of the log complexity blowup (6.4)). Note that this lower bound is tight: it could be replaced by an equality at the cost of ceiling the term between parentheses (i.e. the term corresponding to k i ). We further note that the above equation is consistent with the complexity analysis of the expanding compiler provided in Section 4.4. Indeed going from a constant leakage probability p in = p to a target security level p out = 2 -κ by applying k i times a single RPE compiler CC i , we retrieve a complexity of O(κ e ) with e = log 2 (|λ i |) log 2 (d i ) . Equation (6.11) shows that using CC i to go from input probability p in to output probability p out induces a log complexity cost close to

log 2 (|λ i |) log 2 (d i ) log 2 (κ out ) -log 2 (κ in )
provided that κ in is sufficiently greater than ∆ i . So given the latter informal condition, it appears that the parameter i minimizing the ratio log 2 (|λ i |) log 2 (d i ) gives the best complexity.

Application. For the asymptotic construction introduced in Section 5.2 and Section 5.3, the RPE compiler CC i features • an amplification order d i = O(n i ),

• a gadget complexity

s i = O(n 2 i ), • an eigen-complexity |λ i | = O(n 2 i ).
For such a construction, the ratio log 2 (|λ i |) log 2 (d i ) is decreasing and converging towards 2 as n i grows. On the other hand, ∆ i tends to log 2 (n i ) which implies that CC i should only be applied to an input probability lower than 1 n i .

Selection of the Expansion Levels

In this section, we investigate the impact of the choice of the expansion levels k i on the complexity of the dynamic expanding compiler. We first assess the asymptotic complexity obtained from a simple approach and then provide some application results for some given gadgets.

In the following CC 0 shall denote an RPE compiler with constant parameters while {CC i } i≥1 shall denote a family of RPE compilers indexed by a parameter i. We do this distinction since the goal of the CC 0 compiler shall be to tolerate the highest leakage rate and to transit from a (possibly high) leakage probability p to some lower failure probability p i which is in turn tolerated by at least one compiler from {CC i } i .

A Simple Approach. We consider a simple approach in which the compiler CC 0 is iterated k 0 times and then a single compiler CC i is iterated k i times. The complexity blowup of this compiler is |λ 0 | k 0 |λ i | k i . The first expansion level k 0 is chosen to ensure that the intermediate probability p i := f (k 0 ) 0 (p) is lower than qi (the lower bound on the tolerated leakage rate of CC i from Theorem 5). Then k i is chosen so that f

(k i ) i ≤ 2 -κ .
Concretely, we set κ i := ∆ i + 1 which, by Lemma 15, gives

k 0 = log d 0 (∆ i + 1) -log d 0 (log 2 (p) -∆ 0 ) , (6.12)
and

k i = log d i (κ) = O log d i (κ) . (6.13)
For some constant leakage probability p and some start compiler CC 0 with constant parameters, we get k 0 = O log d 0 (∆ i ) giving an asymptotic complexity blowup of

O |λ 0 | k 0 |λ i | k i = O ∆ e 0 i κ e i with e 0 = log 2 (|λ 0 |) log 2 (d 0 ) and e i = log 2 (|λ i |) log 2 (d i ) . (6.14)
Then for any choice of i we get an asymptotic complexity blowup of O κ e i which is the same asymptotic complexity as the standard expanding compiler with base compiler CC i . On the other hand, our simple dynamic compiler CC

(k i ) i • CC (k 0 ) 0
tolerates the same leakage rate as CC 0 .

Using this simple approach we hence get the best of both worlds:

• a possibly inefficient RPE compiler CC 0 tolerating a high leakage rate q 0 , • a family of RPE compilers {CC i } i with complexity exponent e i = log 2 (|λ i |) log 2 (d i ) decreasing with i.

We stress that for monotonously increasing |λ i | and d i , the asymptotic complexity of our simple approach is O(κ e ) where e can be made arbitrary close to lim i→∞

log 2 (|λ i |) log 2 (d i ) .
Application. To illustrate the benefits of our dynamic approach, we simply get back to the experimentations on the AES implementation from Section 4.7. We can apply either a 3-share or 5-share compiler (from the constructions in Section 5.5) repeatedly until they reach their targeted security level. While using the 5-share compiler reduces the tolerated probability, we demonstrate that we can use both compilers to get the best tolerated probability as well as a better complexity. Figure 6.1 illustrates the trade-offs in terms of achieved security level and complexity of the expansion strategy when using different compilers at each iteration of the expansion. Starting from a tolerated leakage probability p (2 -7.6 on the left and 2 -9.5 on the right), the empty bullets (•) give this trade-off when only the 3-share compiler is iterated. In this case, the final security function ε from Theorem 3 is equal to f (k 3 ) 3

(p) if we consider f 3 to be the failure function of the 3-share compiler, for a certain number of iterations k 3 which is written next to each empty bullet on the figure. On the other hand, the black bullets (•) represent the trade-offs achieved in terms of complexity and security levels while combining both compilers with different numbers of iterations. In this case, we start the expansion with a certain number of iterations k 3 of the 3-share compiler, and then we continue with k 5 iterations of the 5-share compiler of failure function f 5 , the final compiled circuit is then random probing secure with ε = f

(k 5 ) 5 (f (k 3 ) 3
(p)) for p ∈ {2 -7.6 , 2 -9.5 }. The number of iterations of the compilers is written next to each black bullet in the format k 3 -k 5 .

For instance, starting from the best tolerated probability 2 -7.6 , the static compiler requires 11 applications of the 3-share compiler to achieve a security level of at least 80 bits. This effort comes with an overall complexity of 10 17.52 . Using our dynamic approach, we can combine the 3-share and the 5-share to achieve this 80 bits security level for the same tolerated probability but with a complexity of 10 16.04 . That would require 7 iterations of the 3-share compiler and 2 iterations of the 5-share compiler. Starting from the same leakage probability, a security level of at least 128 bits is achieved also with 11 applications of the 3-share compiler with a complexity of 10 17. 52 . In order to achieve at least the same security, we would need more iterations of both compilers in the dynamic approach. With 7 iterations of the 3-share compiler and 3 iterations of the 5-share compiler, we get a complexity of 10 17.62 which is very close to the complexity of the 3-share application alone, while achieving a security level of 231 bits. That is, we almost double the security level achieved using 11 iterations of the 3-share compiler with an almost equal complexity. For a tolerated probability of 2 -7.6 and at least 128 bits of security, note that 11 applications of the 3-share compiler yield a security order of 2 -135 while both other trade-offs directly yield security orders of 2 -242 (6 iterations of 3-share and 4 iterations of 5-share) and 2 -231 (7 iterations of 3-share and 3 iterations of 5-share), with one less iteration they would be below 128 bits, which explains their more important complexity. The same behavior can be observed with a starting tolerated leakage probability of 2 -9.5 on the right.

We showed this far that the tolerated leakage probability decreases with an increasing number of shares n. So if we want to tolerate the best leakage probability, we would start with a few iterations of a compiler with a small number of shares and which tolerates a good leakage probability (which can be computed, for instance, with the verification tool VRAPS [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF]), typically a 3-share construction. Meanwhile, after a few constant number of iterations, we can change to a different compiler which benefits from a better asymptotic complexity (as explained above with our simple approach).

The above results motivate finding RPE compilers which achieve the maximal amplification orders and which benefit from good asymptotic complexity (i.e. gadgets defined for any number of shares n with amplification order increasing with n) in order to optimize the securityefficiency trade-off and to tolerate the best possible leakage probability. We showed this far that the tolerated leakage probability decreases with an increasing number of shares n. So if we want to tolerate the best leakage probability, we would start with a few iterations of a compiler with a small number of shares which tolerates a good leakage probability (which can be computed, for instance, with verification tools like IronMask), typically a 3-share construction. Meanwhile, after a few constant number of iterations, we can change to a different compiler which benefits from a better asymptotic complexity (as explained above with our simple approach).

In Section 5.3 and Section 5.4, we instantiate the expanding compiler with ISW-based addition and copy gadgets, and a new multiplication gadget, which all achieve the maximal amplification order. The bottleneck of these constructions in terms of asymptotic complexity was from the linear gadgets (addition and copy) with N max = 3n 2 -2n. In the next section, we show that the O(n log n) refresh gadget from [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF] can be used to instantiate addition and copy gadgets with maximal amplification order, hence achieving quasi-linear complexity in O(n log n). The bottleneck then becomes the multiplication gadget (with n 2 multiplications), which we also improve in the following sections under some conditions on the base field.

Linear Gadgets with Quasi-Linear Complexity

In a first attempt, we aim to reduce the complexity of the linear gadgets that are to be used in our dynamic compiler.

A refresh gadget with O(n log n) complexity was introduced in [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF]. In a nutshell, the idea is to add a linear number of random values on the shares at each step, to split the shares in two sets to apply the recursion, and then to add a linear number of random values again. We recall the algorithmic description of the gadget in Algorithm 3.

The O(n log n) refresh gadget was proven to be (n -1)-SNI in [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF]. In Lemma 16, we show that this gadget is also (t, f )-TRPE of amplification order min(t + 1, n -t) and that it satisfies (n -1)-STRPE2. Hence, we can instantiate the generic copy and addition gadgets described in Algorithm 4 and Algorithm 5 from Section 5.2 using the above refresh gadget as G refresh . We thus obtain RPE gadgets G add and G copy enjoying optimal amplification order in quasi-linear complexity O(n log n).

Lemma 16. Let G refresh be the n-share refresh gadget described above from [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF]. Then G refresh is (t, f )-TRPE for some function f : R → R of amplification order d ≥ min(t + 1, n -t). G refresh is additionally (n -1)-STRPE2.

L I R 1 R 2 L O I J V 0 V 1 V 2 V 3    b 1 . . . b n/2    I 1    b n/2+1 . . . bn    I 2    c 1 . . . c n/2       c n/2+1 . . . cn    Figure 6.2: O(n log n) refresh gadget from [13]
Proof. We will prove that the gadget from Algorithm 3 is (t, f )-TRPE for any t ≤ n -1 of amplification order d ≥ min(t + 1, n -t). For this, we will prove both properties TRPE1 and TRPE2.

Proof for TRPE1.

The gadget is proven to be (n -1)-SNI in [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF], thus it is (t, f )-TRPE1 of amplification order d ≥ min(t + 1, n -t) thanks to Lemma 6. Note that we can find failure sets of wires of size t + 1 which require the knowledge of t + 1 input shares (simply consider the leaking wires {a 1 , . . . , a t+1 } on input a for instance), so d ≤ t + 1.

Proof for (n -1)-STRPE2 (which implies TRPE2 of amplification order t + 1, c.f. Corollary 4).

We will first start by recalling the result of Lemma 5 in [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF] which will be useful for our proof.

Lemma 5 from [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF]. Let a 1 , a 2 ∈ K be inputs, and let r We are now ready to prove our main result. For TRPE2, we will prove the slightly stronger property (n -1)-STRPE2. We can clearly see that (n -1)-STRPE2 implies TRPE2 of amplification order d = t + 1 as shown in Corollary 4. We will prove (n -1)-STRPE2 by recurrence on the number of shares n ≥ 2.

The gadget in the base case (n = 2) gives the following output sharing:

d 1 ← a 1 + r d 2 ← a 2 + r
The proof in this case is easy. Mainly, if J = ∅, it is easy to see that we can choose J of size 1 such that we can perfectly simulate W and J from a set of input shares I on a such that |I| ≤ |W | ≤ 1. Otherwise, if |J | = 1, then |W | = 0, and we choose J = J and in this case we have |I| = 0, since we can perfectly simulate any of the output shares alone by simply generating a freshly random value. This concludes the proof for the base case.

Next we suppose that the gadget is (n -1)-STRPE2 for any number of shares n < n, and we prove the property for n shares.

To prove this, we split the gadget into four subgadgets as in Figure 6.2, where gadget L I corresponds to the first loop in Algorithm 3 which adds n/2 random values to the sharing, R 1 and R 2 gadgets correspond to the two recursive calls respectively, and L O gadget corresponds to the second loop which also add n/2 random values to the output sharing. We split any set of probes W on

G refresh into W = V 0 ∪ V 1 ∪ V 2 ∪ V 3 on each of the subgadgets L I , R 1 , R 2 and L O respectively. The gadget R 1 is a n 2 -share gadget while R 2 is n 2
-share gadget. We consider that there are no probes on the output shares of R 1 and R 2 as they can be probed through V 3 . Similarly, we consider no output probes on L I , since they can be probed through V 1 and V 2 .

Let W bet the set of probes on G refresh and J be the set of output shares indices such that |W | + |J | ≤ n -1. We will construct the sets J 1 and J 2 for output shares of the gadgets R 1 and R 2 as follows:

• for each i ∈ J ∩ n 2 , add i to J 1 • for each i ∈ J ∩ n 2 + 1 : n , add i to J 2 • for each i ∈ n 2 such that the input probe c i to L O is probed in V 3 , add i to J 1 • for each i ∈ n 2 + 1 : n such that the input probe c i to L O is probed in V 3 , add i to J 2
It can be seen that if we can perfectly simulate J 1 and J 2 , then we can perfectly simulate J and all probes in V 3 (V 3 is composed of input probes c i and random variables r i , since probes of the form c i + r j are probed in J ). Observe that we also have

|J 1 | + |J 2 | ≤ |V 3 | + |J |.
In order for the recurrence hypothesis to hold, we need the following condition to hold for the gadget R 1 :

|V 1 | + |J 1 | ≤ n 2 -1 (6.15)
and the following for the gadget R 2 :

|V 2 | + |J 2 | ≤ n 2 -1 (6.16)
We consider three cases based on the sizes of the sets of probes:

• |V 2 | + |J 2 | ≥ n 2
. Then we must have

|V 1 | + |J 1 | ≤ n 2 -1, because we have that |W | + |J | ≤ n -1 and |J 1 | + |J 2 | ≤ |V 3 | + |J |.
Since (6.15) holds, by the recurrence hypothesis on R 1 , we can choose a set J 1 of size n 2 -1 such that J 1 ⊆ J 1 and we can perfectly simulate J 1 and V

| + 2|I 1 | + (n mod 2) ≤ |V 0 | + 2(|V 1 | + |J 1 |) + (n mod 2)
where (n mod 2) comes from the fact that we need to perfectly simulate all shares of (b n/2 , . . . , b n ) and if n mod 2 = 1, then b n = a n by construction of the gadget L I . From (6.15) which holds in this case, observe that we have

|V 1 | + |J 1 | + (n mod 2) ≤ n 2 ≤ n 2 ≤ |V 2 | + |J 2 |,
then we have

|I| ≤ |V 0 | + 2(|V 1 | + |J 1 |) + (n mod 2) ≤ |V 0 | + |V 1 | + |J 1 | + |V 2 | + |J 2 | which gives |I| ≤ |W | + |J |
and using the input shares in I, we can perfectly simulate probes in V 0 , I 1 and I 2 , and using I 1 and I 2 we proved that we can perfectly simulate probes in V 1 , V 2 , J 1 and J 2 , and so we can also perfectly simulate the chosen set of n -1 output shares J and probes in V 3 . So we can perfectly simulate all internal probes plus the chosen set J of n -1 output shares from I. This proves the recurrence step in this case.

•

|V 1 | + |J 1 | ≥ n 2 . Then we must have |V 2 | + |J 2 | ≤ n 2 -1,
J = J 1 ∪ J 2 of n -1 output
shares on G refresh . We can see that J 1 ⊆ J 1 and J 1 and V 1 can be perfectly simulated from I 1 trivially (full input).

Next, we show how to perfectly simulate the sets I 1 , I 2 on intermediate variable b, and V 0 . In fact, thanks to the properties of the L I gadget, we can apply Lemma 5 from [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF] for all 1 ≤ i ≤ n/2 on each set of intermediate variables {a i , a n/2 +i , r i } and output variable b n/2 +i = a n/2 +i -r i , where all output variables b i = a i +r i must be simulated (since we fixed

I 1 = n 2
), and by summing the inequalities, we construct I ⊂ [n] on n-share input a to perfectly simulate I 1 , I 2 on intermediate variable b, and V 0 such that

|I| ≤ |V 0 | + 2|I 2 | ≤ |V 0 | + 2(|V 2 | + |J 2 |)
(in this case, we don't have the term (n mod 2) anymore because we do not need the full input sharing (b n/2 , . . . , b n ) for the simulation as before). Since (6.16) holds and (6.15) does not hold, we observe that

|V 2 | + |J 2 | ≤ n 2 -1 ≤ n 2 ≤ |V 1 | + |J 1 | so we get |I| ≤ |V 0 | + 2(|V 2 | + |J 2 |) ≤ |V 0 | + |V 2 | + |J 2 | + |V 1 | + |J 1 | which gives |I| ≤ |W | + |J |
and using the input shares in I, we can perfectly simulate probes in V 0 , I 1 and I 2 , and using I 1 and I 2 we proved that we can perfectly simulate probes in V 1 , V 2 , J 1 and J 2 , and so we can also perfectly simulate the chosen set of n -1 output shares J and probes in V 3 . So we can perfectly simulate all internal probes plus the chosen set J of n -1 output shares from I. This proves the recurrence step in this case.

• By treating all possible cases on the probed wires, we conclude the recursive proof. This proves that for any n shares such that |W | + |J | ≤ n -1, we can choose a set J of n -1 output shares such that J ⊆ J and we can perfectly simulate J and W from a set of input shares I such that |I| ≤ |W | + |J |. Thus, we conclude that the gadget G refresh is (n -1)-STRPE2. Thus, it is also (t, f )-TRPE2 of amplification order d = t + 1. This concludes the proof.

|V 1 | + |J 1 | ≤ n 2 -1 and |V 2 | + |J 2 | ≤ n 2 -1.
Hence, we can instantiate the generic copy and addition gadgets described in Section 5.2 using the above refresh gadget as G refresh . We thus obtain RPE gadgets G add and G copy in quasi-linear complexity O(n log n). In addition, G add and G copy achieve the maximal amplification order according to the following corollary, which directly follows from Lemma 16, Lemma 9 and Lemma 7.

Corollary 10. Let n ∈ N. Let G add and G copy be the gadgets described in Algorithm 4 and Algorithm 5, and instantiated with the O(n log n) refresh gadget described in Algorithm 3. Then for every t ≤ n -1, G add if (t, f )-RPE and G copy is (t, f )-RPE, both of amplification orders d = min(t + 1, n -t).

Regarding the asymptotic complexity of the expanding compiler, the eigenvalues λ 1 , λ 2 of M ac (4.16) from Section 4.4 are hence now both in O(n log n). Namely, we have

M ac = N G add ,a N Gcopy,a N G add ,c N Gcopy,c = 2n(2 log(n) -1) + n n(2 log(n) -1) 2n(2 log(n) -1) n(2 log(n) -1) + n .
The eigenvalues of the above matrix are λ 1 = n and λ 2 = 6n log(n) -2n, implying

N max = max(6n log(n) -2n, N G mult ,m ) (6.17)
At this point, only the quadratic number of multiplications in the multiplication gadget still separates us from a compiler of quasi-linear complexity. We tackle this issue in the next section by constructing a generic multiplication gadget. We finally end up with a full expanding compiler with quasi-linear asymptotic complexity. In what follows we should distinguish two types of multiplication gates: regular two-operand multiplications on K, that we shall call bilinear multiplications, and multiplications by constant (or scalar multiplications) which have a single input operand and the constant scalar is considered as part of the gate description.

Towards Asymptotically Optimal Multiplication Gadgets

In the previous constructions, the number of bilinear multiplications is the prominent term of the expanding compiler's complexity. While the most deployed multiplication gadgets (e.g., [START_REF] Ishai | Private circuits: Securing hardware against probing attacks[END_REF]) require a quadratic number of bilinear multiplications in the masking order, the authors of [START_REF] Belaïd | Private multiplication over finite fields[END_REF] exhibited a probing secure higher-order masking multiplication with only a linear number of bilinear multiplications. Their construction, which applies on larger fields, is built from the composition of two subgadgets G submult and G compress , as described in Figure 6. The authors of [START_REF] Belaïd | Private multiplication over finite fields[END_REF] instantiate this construction with a sub-multiplication gadget which performs only O(n) bilinear multiplications and with the compression gadget from [START_REF] Carlet | Algebraic decomposition for probing security[END_REF]. In addition to bilinear multiplications, their sub-multiplication gadget additionally requires a quadratic number of linear operations (i.e., addition, copy, multiplications by a constant) and random generation gates.

In the following, we rely on the construction [START_REF] Belaïd | Private multiplication over finite fields[END_REF] with its gadget G submult which offers a linear number of bilinear multiplications to build a more efficient RPE multiplication gadget. In order to use it in our expanding compiler, we integrate an additional gate for the multiplication by a constant and discuss the resulting asymptotic complexity. We additionally demonstrate that the compression gadget of [START_REF] Belaïd | Private multiplication over finite fields[END_REF] is not (n -1)-SNI as claimed in the paper, and show that we can rely on other simple and more efficient compression gadgets which satisfy the expected properties.

Global Multiplication Gadget

We first define two new properties that G submult and G compress will be expected to satisfy to form a (t, f )-RPE multiplication gadget with the maximum amplification order (c.f. Lemma 1).

Contrary to the usual simulation notions, the first partial -NI property distinguishes the number of probes on the gadget, and the number of input shares that must be used to simulate them. It additionally tolerates a simulation failure on at most one of the inputs (i.e., no limitation on the number of shares for the simulation).

Definition 22 ((s, t)-partial NI). Let G be a gadget with two input sharings a and b. Then G is (s, t)-partial NI if and only if any the assignment of any t wires of G can be perfectly simulated from shares (a i ) i∈I 1 of a and

(b i ) i∈I 2 of b such that |I 1 | ≤ s or |I 2 | ≤ s.
The second property is a variant of the classical TRPE property that we refer to as comp-TRPE.

Definition 23 ((t, f )-comp-TRPE). Let G be a 1-to-1 gadget with m input shares and n output shares such that m > n. Let t ≤ n -1 and d = min(t + 1, n -t). Then G is (t, f )-comp-TRPE if and only if for all sets of internal wires W of G with |W | ≤ 2d -1, we have: Similarly to what was done in [START_REF] Belaïd | Private multiplication over finite fields[END_REF] for the SNI property, we can prove that the composition of a gadget G submult and G compress which satisfy well chosen properties results in an overall multiplication gadget which is (t, f )-RPE specifically for any t ≤ n-1 achieving the maximum amplification order d = min(t + 1, n -t). This is formally stated in the following Lemma.

= min(t + 1, n -t). If • G submult is (d -1)-NI and (d -1, 2d -1)-partial NI, • G compress is (t, f )-comp-TRPE,
then the multiplication gadget G mult is (t, f )-RPE of amplification order d.

Proof. First let us fix t ≤ n -1. We will be splitting a set of probe W on the multiplication gadget into two sets of probes W = W m ∪ W c where W m are probes on G submult (internal and output wires) and W c are probes G compress (on internal wires only).

We start by proving RPE1. Let J bet a set of output shares such that |J| ≤ t.

• Let W be a set of probes on the multiplication gadget such that

|W | = |W m ∪W c | ≤ d-1.
We know in particular from the comp-TRPE property on G compress that all wires in J and W c can be simulated from a set of input shares

I c on the intermediate result c such that |I c | ≤ |W c | (since |W c | ≤ d -1 < 2d). Then, we have a set of probes W m = W m ∪ I c on G submult which is of size |W m | ≤ |W m | + |I c | ≤ |W m | + |W c | ≤ d -1, then from (d -1)
-NI property of G submult we know that all the probes in W m can be simulated from sets of input shares I a and

I b such that |I a | ≤ d -1 ≤ t and |I b | ≤ d -1 ≤ t.
This proves that we can simulate all probes in the overall set of probes W and in J from at most t shares of a and t shares of b. this proves the first property for RPE1.

• Next let W be a set of probes on the multiplication gadget such that

d ≤ |W | = |W m ∪ W c | ≤ 2d -1.
We need to show that we can simulate W and J with at most a failure on one of the inputs a or b. We know in particular from the comp-TRPE property on G compress that all wires in J and W c can be simulated from a set of input shares

I c on the intermediate result c such that |I c | ≤ |W c | (since |W c | ≤ 2d -1 < 2d). Then, we have a set of probes W m = W m ∪ I c on G submult which is of size |W m | ≤ |W m | + |I c | ≤ |W m | + |W c | ≤ 2d -1.
Hence from (d -1, 2d -1)-partial NI property of G submult , all the probes in W m can be simulated from sets of input shares I a and

I b such that |I a | ≤ d -1 or |I b | ≤ d -1 ≤ t. Since d = min(t + 1, n -t)
, then this implies that we have a failure on at most one of the inputs.

This proves that we can simulate all probes in the overall set of probes W and in J from at most t shares of at least one of the inputs a or b (in other words, if we need more than t shares of a, then we need at most t shares of b). This proves the second property for RPE1.

From the above two cases, we conclude that the multiplication gadget is (t, f 1 )-RPE1 with amplification order d = min(t + 1, n -t).

Next we prove the property RPE2.

• Let W be a set of probes on the multiplication gadget such that

|W | = |W m ∪ W c | ≤ d -1.
We know in particular from the comp-TRPE property on G compress that there exists a set J of n -1 output shares such that all wires in W c and J can be simulated from a set of input shares

I c on the intermediate result c such that |I c | ≤ |W c | (since |W c | ≤ d -1 < 2d). Then, we have a set of probes W m = W m ∪ I c on G submult which is of size |W m | ≤ |W m | + |I c | ≤ |W m | + |W c | ≤ d -1, then from (d -1)-NI property of G submult
we know that all the probes in W m can be simulated from sets of input shares I a and

I b such that |I a | ≤ d -1 ≤ t and |I b | ≤ d -1 ≤ t.
This proves that there exists a set J of n -1 output shares such that we can simulate all probes in the overall set of probes W and in J from at most t shares of a and t shares of b. This proves the first property for RPE2.

• Next let W be a set of probes on the multiplication gadget such that

d ≤ |W | = |W m ∪ W c | ≤ 2d -1.
We know in particular from the comp-TRPE property on G compress that there exists a set J of n -1 output shares such that all wires in W c and J can be simulated from a set of input shares I c on the intermediate result c such that

|I c | ≤ |W c | (since |W c | ≤ 2d -1 < 2d). Then, we have a set of probes W m = W m ∪ I c on G submult which is of size |W m | ≤ |W m | + |I c | ≤ |W m | + |W c | ≤ 2d -1.
Hence as for RPE1, from (d -1, 2d -1)-partial NI property of G submult , we have that all the probes in W m can be simulated from sets of input shares I a and

I b such that |I a | ≤ d -1 or |I b | ≤ d -1 ≤ t.
Since d = min(t + 1, n -t), then this implies that we have a failure on at most one of the inputs.

This proves that there exists a set J of n -1 output shares such that we can simulate all probes in the overall set of probes W and in J from at most t shares of at least one of the inputs a or b (in other words, if we need more than t shares of a, then we need at most t shares of b). This proves the second property for RPE2.

From the above two cases, we conclude that the multiplication gadget is (t, f 2 )-RPE2 with amplification order d = min(t + 1, n -t).

Combining both properties RPE1 and RPE2 with the same amplification order d, we conclude that the multiplication gadget is (t, f )-RPE with f = max(f 1 , f 2 ) and of amplification order d = min(t + 1, n -t). This concludes the proof of Lemma 17.

Construction of G compress

In a first attempt, we analyze the compression function that was introduced in [START_REF] Carlet | Algebraic decomposition for probing security[END_REF] and used to build a multiplication gadget in [START_REF] Belaïd | Private multiplication over finite fields[END_REF]. As it turns out not to be SNI or meet our requirements we have d i = c i + . . . + c i+K.n , and for + 1 ≤ i ≤ n, we have d i = c i + . . . + c i+(K-1).n . We will prove that G compress is (t, f )-comp-TRPE. This amounts to proving that ∀ W, |W | ≤ 2d -1 a set of probes on the internal wires of G compress where d = min(t + 1, n -t):

1. ∀ J, |J| ≤ t a set of output shares of G compress , J and W can be simulated from a set of input shares I of the input c of G compress , such that |I| ≤ |W |.

2. ∃ J , |J | = n-1 a set of output shares of G compress , such that J and W can be simulated from a set of input shares I of the input c of G compress , such that |I| ≤ |W |.

We will prove both points separately 1. Let J be a set of output shares indices on G compress such that |J| ≤ t for a t ≤ n -1 and let d = min(t + 1, n -t). Let W be a set of probes on G compress such that |W | ≤ 2d -1.

We need to prove that we can perfectly simulate W and J from input shares indices in I such that |I| ≤ |W |. For this, We will simulate W and J using probes on G refresh . First let us consider J the set of probes such that

J = {i | c i ∈ W ∩ {c 1 , . . . , c m }}.
We construct the set W of probes on G refresh as follows:

W = {p | p ∈ W \ {c 1 , . . . , c m }} (6.18)
In addition, we construct the set J of output shares on G refresh as follows:

J = J ∪ i∈J i≤ {i, . . . , i + K.n} ∪ i∈J i> {i, . . . , i + (K -1).n} (6.19)
It is easy to see that if we can perfectly simulate W and J , then we can perfectly simulate W and J since W = W ∪ {c i | i ∈ J } and by perfectly simulating (c i , . . . , c i+K.n ) for i ∈ J such that i ≤ , then we can perfectly simulate d i = c i + . . . + c i+K.n and by perfectly simulating (c i , . . . , c i+(K-1).n ) for i ∈ J such that i > , then we can perfectly simulate d i = c i + . . . + c i+(K-1).n ; thus all output shares in J are perfectly simulate using shares in J . Hence, we need to prove that we can perfectly simulate W and J using the G refresh m-share gadget.

Observe that since

|J | ≤ |W \ W |, then |J | ≤ |W \ W | + K.|J| + min(t, ) ≤ K.t + min(t, ) (6.20)
where the term min(t, ) comes from the worst case where all output shares i ∈ J are such that i ≤ , because in this case we add to J all the indices (i, . . . , i+K.n) instead of (i, . . . , i + (K -1).n) according to (6.19). Also, according to (6. , so

|W | + |J | ≤ 2 min(t + 1, n -t) -1 + K.t + min(t, ) , then |W | + |J | ≤ 2(n -t) + K.t + -1 ≤ 2n + (K -2).t + -1
, and from t ≤ n -1 we get

|W | + |J | ≤ K.n + -1 -(K -2) .
Since by hypothesis we have m ≥ 2n, so K ≥ 2 and (K -2) ≥ 0, hence

|W | + |J | ≤ K.n + -1 ≤ m -1
Then by the (m -1)-SNI property of m-share G refresh , we can perfectly simulate the set of probes W and output shares in J from a set of input shares I such that |I| ≤ |W |, hence we have

|I| ≤ |W | ≤ |W |
which completes the proof for the first point of comp-TRPE on gadget G compress .

2. Let t ≤ n -1 and let d = min(t + 1, n -t). Let W be a set of probes on G compress such that |W | ≤ 2d -1. We need to prove that we can perfectly simulate W and a chosen set J of n -1 output shares from input shares indices in I such that |I| ≤ |W |. For this, we will simulate W and choose the set J using probes on G refresh . First let us consider J the set of probes such that

J = {i | c i ∈ W ∩ {c 1 , . . . , c m }}.
We construct the set W of probes on G refresh as follows:

W = {p | p ∈ W \ {c 1 , . . . , c m }} (6.21)
In addition, we construct the set J of output shares on G refresh as follows:

J = J (6.22) Observe that |W | + |J | ≤ |W | ≤ 2d -1 ≤ 2 min(t + 1, n -t) -1 , so |W | + |J | ≤ 2n -1 ≤ m -1
Then by the (m -1)-STRPE2 property of m-share G refresh , there exists a set J such that J ⊆ J and |J | = m -1 and W and J can be perfectly simulated from input shares indexed in

I such that |I| ≤ |W | + |J |. Since W = W ∪ {c i | i ∈ J } then |I| ≤ |W |.
By perfectly simulating W and J , we can perfectly simulate W since W = W ∪{c i | i ∈ J }. In addition, we choose the set J of n -1 output shares on G compress as follows:

J = {i | i ≤ and {i, . . . , i + K.n} ⊆ J } ∪ {i | i > and {i, . . . , i + (K -1).n} ⊆ J } Since |J | = m -1,
then we are sure that |J| = n -1 since there is only 1 share of (c 1 , . . . , c m ) missing from J . And since we can perfectly simulate J then we can also perfectly simulate J like before. This proves that we can choose a set J of n -1 output shares on G compress using probes on the internal gadget G refresh such that W and J can be perfectly simulated from input shares in

I such that |I| ≤ |W | + |J | ≤ |W | for any |W | ≤ 2d -1.
This concludes the proof for the second point of comp-TRPE on gadget G compress .

Thus, we proved that G compress from Algorithm 7 is (t, f )-STRPE2. This concludes the proof for Lemma 18.

As shown in Section 6.2 ( Lemma 16), the O(n log n) refresh gadget from [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF] is actually (m -1)-SNI and (m -1)-STRPE2 for any sharing order m. This gadget can then be used as a building block for the [m : n]-compression gadget, giving it a complexity of O(m log m) and satisfying the necessary properties. In addition, this further provides an improvement over the complexity of the proposed gadget in [START_REF] Belaïd | Private multiplication over finite fields[END_REF] which has a complexity of O( m n n 2 ) (because it performs a n-share ISW-refreshing m n times, see [START_REF] Belaïd | Private multiplication over finite fields[END_REF] for more details on the algorithm).

We can consider as before that bilinear multiplication gates are solely used in G mult (N G add ,m = N Gcopy,m = N G cmult ,m = 0) and that constant multiplication gates are eventually solely used in G cmult and G mult (N G add ,cm = N Gcopy,cm = 0) which is the case in the constructions we consider in this paper. It can be checked that (up to some permutation) the eigenvalues satisfy

(λ 1 , λ 2 ) = eigenvalues(M ac ) , λ 3 = N G cmult ,cm , λ 4 = N G mult ,m and λ 5 = n where M ac is the top left 2 × 2 block matrix of M CC M ac = N G add ,a N Gcopy,a N G add ,c N Gcopy,c .
We get two complexity expressions for the expansion strategy

| C| = O |C| • N k max (6.23)
with Note that the exhibited construction for the linear multiplication gadget requires N G cmult ,cm = n linear multiplications. Hence λ 3 = N G cmult ,cm = λ 5 = N G random ,r = n and the global complexity (6.23) can be rewritten as

N max = max(|eigenvalues(M ac )|, N G cmult ,cm , N G mult ,m ,
| C| = O |C| • N k max with N max = max(|eigenvalues(M ac )|, N G mult ,m )
if the number of multiplications is greater than n. The asymptotic complexity of the RPE compiler is thus not affected by our new base gadget G cmult . We now describe our constructions of G submult .

G submult from [START_REF] Belaïd | Private multiplication over finite fields[END_REF]. The authors of [START_REF] Belaïd | Private multiplication over finite fields[END_REF] provide a (n -1)-NI construction for G submult which outputs 2n -1 shares while consuming only a linear number of bilinear multiplications in the masking order. We first recall their construction which relies on two square matrices of (n -1) 2 coefficients in the working field. As shown in [START_REF] Belaïd | Private multiplication over finite fields[END_REF], these matrices are expected to satisfy some condition for the compression gadget to be (n -1)-NI. Since we additionally want the compression gadget to be (d -1, 2d -1)-partial NI, we introduce a stronger condition and demonstrate the security of the gadget in our setting.

Let F q be the finite field with q elements. Let γ = (γ i,j ) 1≤i,j<n ∈ F (n-1)×(n-1) q be a constant matrix, and let δ = (δ i,j ) 1≤i,j<n ∈ F (n-1)×(n-1) q be the matrix defined by δ i,j = 1 -γ j,i for all 1 ≤ i, j < n -1. G submult takes as input two n-sharings a and b and outputs a (2n -1)-sharing c such that:

• c 1 = a 1 + n i=2 (r i + a i ) • b 1 + n i=2 (s i + b i ) • c i = -r i • b 1 + n j=2 (δ i-1,j-1 s j + b j ) for i = 2, . . . , n • c i+n-1 = -s i • a 1 + n j=2
(γ i-1,j-1 r j + a j ) for i = 2, . . . , n where r i and s i are randomly generated values for all 2 ≤ i ≤ n. It can be easily checked that G submult performs 2n -1 bilinear multiplications, and that it is correct, i.e. 2n-1 i=1 c i = n i=1 a i • n i=1 b i . In [START_REF] Belaïd | Private multiplication over finite fields[END_REF], the authors prove that a gadget is (n -1)-NI if one cannot compute a linear combination of any set of n -1 probes which can reveal all of the n secret shares of the inputs and which does not include any random value in its algebraic expression. We refer to [START_REF] Belaïd | Private multiplication over finite fields[END_REF] for more details on this result. Based on this result, the authors demonstrate in [START_REF] Belaïd | Private multiplication over finite fields[END_REF], that G submult is (n -1)-NI if the matrices γ and δ satisfy Condition 1 that we recall below.

Condition 1. (from [START_REF] Belaïd | Private multiplication over finite fields[END_REF]) ×(n-1) q be the identity matrix, 0 x×y ∈ F x×y q be a matrix of zeros (when y = 1, 0 x×y is also written 0 x ), 1 x×y ∈ F x×y q be a matrix of ones, D γ,j ∈ F (n-1)×(n-1) q be the diagonal matrix such that D γ,j,i,i = γ j,i , T n-1 ∈ F (n-1)×(n-1) q be the upper-triangular matrix with just ones, and T γ,j ∈ F (n-1)×(n-1) q be the upper-triangular matrix for which T γ,j,i,k = γ j,i for i ≤ k:

Let = 2 • (n + 1) • (n -1) + 1. Let I n-1 ∈ F (n-1)
I n-1 =      1 0 . . . 0 0 1 0 . . . . . . . . . 0 . . . 0 1      D γ,j =      γ j,1 0 . . . 0 0 γ j,2 0 . . . . . . . . . 0 . . . 0 γ j,n-1      T n-1 =      1 1 . . . 1 0 1 1 . . . . . . . . . 0 . . . 0 1      T γ,j =      γ j,1 γ j,1 . . . γ j,1 0 γ j,2 γ j,2 . . . . . . . . . 0 . . . 0 γ j,n-1     
We define the following matrices (with n = n -1):

L = 1 0 1×n 0 1×n 0 1×n 0 1×n . . . 0 1×n 1 1×n 1 1×n . . . 1 1×n 0 n I n 0 n ×n I n I n . . . I n T n T n . . . T n M = 0 n 0 n ×n I n I n D γ,1 . . . D γ,n T n T γ,1 . . . T γ,n
Condition 1 is satisfied for a matrix γ if for any vector v ∈ F q of Hamming weight

hw(v) ≤ n -1 such that L • v contains no coefficient equal to 0 then M • v = 0 n-1 .
In the above condition, the matrices L and M represent the vectors of dependencies for each possible probe. All the probes involving shares of a for matrix γ (and symmetrically shares of b for matrix δ) are covered in the columns of L and M. Namely, the first column represents the probe a 1 . As it does not involve any random, it results in a zero column in M. The next columns represents the probes a i , then the probes r i . They are followed by columns for the probes

(a i + r i ), then (a i + γ j-1,i-1 r i ) (for 2 ≤ j ≤ n), then a 1 + k i=2 (r i + a i ) (for 2 ≤ k ≤ n), and finally then a 1 + k j=2 (γ i-1,j-1 r j + a j ) (for 2 ≤ i ≤ n and 2 ≤ k ≤ n).
The above condition means that there is no linear combination of (n -1) probes which can include the expression of all of the input shares, and no random variable.

From this result and by the equivalence between non-interference and tight non-interference developed in [START_REF] Belaïd | Private multiplication over finite fields[END_REF], we conclude that G submult is (d -1)-NI for d = min(t + 1, n -t) for any t ≤ n -1. Lemma 17 also requires G submult to be (d -1, 2d -1)-partial NI to get an overall RPE multiplication gadget. For G submult to satisfy this second property, we need to rely on a stronger condition for matrices γ and δ that we present in Condition 2.

Set 9: (a 1 + n i=2 (r i + a i )) × (b 1 + n i=2 (s i + b i ))
The matrix γ would be related to probes of the form 1,2 and 3, while the matrix δ is directly related to probes of the form 4,5 and 6. So we split the set W into W = W 1 ∪ W 2 ∪ W 3 with respect to the form of each probe as follows:

• W 1 contains probes of the forms in the sets 1, 2 and 3.

• W 2 contains probes of the forms in the sets 4, 5 and 6.

• W 3 contains probes of the forms in the sets 7, 8 and 9.

This split means that the set W 1 only contains probes involving the input shares of a and the randoms r i , while W 2 only contains probes involving the input shares of b and the randoms s i . W 3 contains products of both of the probes of W 1 and W 2 .

Next, we will construct two subsets of probes W a and W b from the set W and prove that we can simulate all probes in W from W a and W b . In other terms, we start with W a = W 1 and

W b = W 2 .
Suppose first that W 3 = ∅. Then we consider the sets W a = W 1 and W b = W 2 as before. Suppose that to simulate W a , we need sets of input shares I a such that |I a | ≥ d, and let M be the number of probes of the form in sets 2 and 3 in the set of probes W a . Then from Condition 2 on matrix γ we know that Next, we suppose that W 3 = ∅ so there is at least one probe of one of the sets 7, 8 or 9 in W 3 . We construct sets W a and W b as before starting with W a = W 1 and W b = W 2 , and for each probe in W 3 :

|I a | ≤ |W a | -M ≤ |W a | (because |W a | ≤ 2d -1 ≤ n -1 since t ≤ n -1 such that (n = 2k) ∨ (t = n -1 2 ) ),
• If the probe is of the form -r i ×(b 1 + n j=2 (δ i-1,j-1 s j +b j )), then we do W a = W a ∪{-r i }, W b = W b ∪ {(b 1 + n j=2 (δ i-1,j-1 s j + b j ))}.
We denote the set of these probes in W 3 as W 7 3 .

• If the probe is of the form

-s i × (a 1 + n j=2 (γ i-1,j-1 r j + a j )), then we do W a = W a ∪ {(a 1 + n j=2 (γ i-1,j-1 r j + a j ))}, W b = W b ∪ {-s i }.
We denote the set of these probes in W 3 as W 8 3 .

• if the probe is of the form (a

1 + n i=2 (r i + a i )) × (b 1 + n i=2 (s i + b i )), then we do W a = W a ∪ {(a 1 + n i=2 (r i + a i ))}, W b = W b ∪ {(b 1 + n i=2 (s i + b i ))}.
We denote the set of these probes in W 3 as W 9 3 .

Suppose that in order to simulate W a , we need the set

I a such that |I a | ≥ d. In addition, since |W a | ≤ |W | ≤ 2d -1 ≤ n -1 (because t ≤ n -1 such that (n = 2k) ∨ (t = n -1 2
) ), then we know from Condition 2 on γ that W a can be perfectly simulated from I a such that |I a | ≤ |W a |-M where M is the number of probes in W a of the form (a 1 + n j=2 (γ i-1,j-1 r j +a j ))

or (a 1 + n i=2 (r i + a i )). Then, since probes in the sets W We conclude that G submult satisfies both (d -1)-NI and (d -1, 2d -1)-partial NI, which conludes the proof for Lemma 20.

The condition on t and n on Lemma 20 implies that the maximum amplification order for the multiplication gadget cannot be achieved for an odd number of shares (since the maximum order is reached when t

= n -1 2
). This is not a proof artifact but a limitation of the gadget G submult with respect to the new (d -1, 2d -1)-partial NI property. We can easily show that under this extreme conditions on t and n, we have 2d -1 = n. If we consider the instantiation of G submult for n = 3 input shares, we obtain the following 2n -1 = 5 output shares:

c 1 = (a 1 + (r 2 + a 2 ) + (r 3 + a 3 )) • (b 1 + (s 2 + b 2 ) + (s 3 + b 3 )) c 2 = -r 2 • (b 1 + (δ 1,1 • s 2 + b 2 ) + (δ 1,2 • s 3 + b 3 )) c 3 = -r 3 • (b 1 + (δ 2,1 • s 2 + b 2 ) + (δ 2,2 • s 3 + b 3 )) c 4 = -s 2 • (a 1 + (γ 1,1 • r 2 + a 2 ) + (γ 1,2 • r 3 + a 3 )) c 5 = -s 3 • (a 1 + (γ 2,1 • r 2 + a 2 ) + (γ 2,2 • r 3 + a 3 ))
To prove the (d -1, 2d -1)-partial NI property, we need to ensure that any set of at most 2d -1 = 3 probes can be perfectly simulated from at most d -1 = 1 shares of one of the inputs and any number of shares from the other one. However, the three probes on c 1 , c 3 , c 4 reveal information on each of their sub-product. In particular, (a 1 + (r 2 + a 1 ) + (r 3 + a 3 )) (from c 1 ), r 3 (from c 3 ) and

(a 1 + (γ 1,1 • r 2 + a 2 ) + (γ 1,2 • r 3 + a 3 )) (from c 4 ) would reveal a. Similarly, (b 1 + (s 2 + b 2 ) + (s 3 + b 3 )) (from c 1 ), (b 1 + (δ 2,1 • s 2 + b 2 ) + (δ 2,2 • s 3 + b 3 )) (from c 3
) and s 2 (from c 4 ) would reveal b. Hence, the gadget is not (d -1, 2d -1)-partial NI. This counterexample with 3 shares can be directly extended to any odd number of shares.

This counterexample motivates a new construction for G submult which would cover all values for n and t. In the following, we slightly modify the construction from [START_REF] Belaïd | Private multiplication over finite fields[END_REF] to achieve the maximum amplification order in any setting.

Remark 4. The current construction of G submult outputs m = 2n -1 shares, which does not satisfy the requirement m ≥ 2n shares for the compression gadget. Nevertheless, it is enough to add an artificial extra share c 2n-1 equal to zero between both building blocks. In particular, the compression gadget (and subsequently the refresh gadget) does not expect the input sharing to be uniform to achieve the stated security properties.

New Construction for G submult . As stated earlier, Lemma 20 does not hold for G submult in the case where n is odd and t = (n -1)/2. In order to cover this case, we propose a slightly modified version of G submult with two extra random values r 1 and s 1 . In this version, we let γ = (γ i,j ) 1≤i,j≤n ∈ F n×n q be a constant matrix, and let δ ∈ F n×n q be the matrix defined by δ i,j = 1 -γ i,j . The sub-gadget G submult outputs 2n + 1 shares:

• c 1 = n i=1 (r i + a i ) • n i=1 (s i + b i ) • c i+1 = -r i • n j=1 (δ i,j s j + b j ) for i = 1, . . . , n • c i+n+1 = -s i • n j=1
(γ i,j r j + a j ) for i = 1, . . . , n where r i and s i are randomly generated values. It can be easily checked that G submult now performs 2n+1 bilinear multiplications, and that it is correct, i.e.

2n+1 i=1 c i = n i=1 a i • n i=1 b i .
We now need the following slightly modified version of Condition 2 on γ and on δ, which instead of considering a linear combination of at most n-1 probes as in Condition 2, considers up to n probes. Condition 3. Let z = (2n + 4) • n. Let I n ∈ F n×n q be the identity matrix, 0 ×n ∈ F ×n q be the matrix of zeros, 1 ×n ∈ F ×n q be the matrix of ones, D γ,j ∈ F n×n q be the diagonal matrix such that D γ,j,i,i = γ j,i , T n ∈ F n×n q be the upper triangular matrix with just ones, T γ,j ∈ F n×n q be the upper triangular matrix such that T γ,j,i,k = γ j,i for i ≤ k. We define the following matrices:

L = I n 0 n×n I n I n . . . I n T n T n . . . T n M = 0 n×n I n I n D γ,1 . . . D γ,n T n T γ,1 . . . T γ,n
Then we say that γ satisfies Condition 3 if and only if

• for any vector v ∈ F z q of Hamming weight hw(v) ≤ n,

• for any i 1 , . . . , i K ∈ [z] such that v i 1 = 0, . . . , v i K = 0 and the corresponding columns i 1 , . . . , i K in L and in M have no zero coefficient (i.e there are K probes of the form n i=1 (r i + a i ) or n j=1 (γ i,j r j + a j ) for any i = 1, . . . , n),

if M • v = 0, then we have hw(L • v) ≤ hw(v) -K.
Under this new condition, we obtain the following result. Proof. The proof of the Lemma is in fact the same as the proof of Lemma 20. The only difference is that in this lemma, we also cover the special case of an odd value for the number of shares n and t = n -1 2 = n -1 2 . In the latter case, we consider in the proof up to n probes on the gadget G submult , while in Lemma 20, we could only have up to n -1 probes on the gadget. Since Condition 3 covers the case of having up to n probes on G submult , then we can follow the exact same procedure of the proof of Lemma 20 to prove the Lemma by considering the new condition.

Remark 5. The number of output shares m = 2n+1 of G submult satisfies the constraint required by G compress in Algorithm 7 (m ≥ 2n). We can thus use the compression gadget G compress exactly as described in the algorithm on the input sharing (c 1 , . . . , c 2n+1 ), instantiated with the O(n log n) refresh gadget. Since the multiplication sub-gadget G submult requires O(n) random values and G compress requires O(n log n) random values from the refresh gadget, the overall multiplication gadget G mult also requires a quasi-linear number of random values O(n log n).

Instantiations

We first state the existence of a matrix γ which satisfies Condition 3 over any finite field F q for q large enough (with log(q) = Ω(n log n)) 2 . The proof technique follows closely the proof of [START_REF] Belaïd | Private multiplication over finite fields[END_REF]Theorem 4.5] and makes use of the non-constructive "probabilistic method". Specifically, it states that if one chooses γ uniformly at random in F n log n q , the probability that the matrix γ satisfies Condition 3 is strictly positive, when q is large enough. It is important to note that the proof relies on probability but the existence of a matrix γ which satisfies Condition 3 (for q large enough) is guaranteed without any possible error. Theorem 6. For any n ≥ 1, for any prime power q, if γ is chosen uniformly in F n×n q , then

Pr[γ satisfies Condition 3 ] ≥ 1 -2 • (12n) n • n • q -1 .
In particular, for any n ≥ 1, there exists an integer Q = O(n) n+1 , such that for any prime power q ≥ Q, there exists a matrix γ ∈ F q n×n satisfying Condition 3.

As when γ is uniformly random, so is δ, Theorem 6 immediately follows from the following proposition and the union bound. Proposition 4. For any n ≥ 1, for any prime power q, if γ is chosen uniformly in

F n×n q , then Pr[γ satisfies Condition 3 ] ≥ 1 -(12n) n • n • q -1 .
In particular, for any n ≥ 1, there exists an integer Q = O(n) n+1 , such that for any prime power q ≥ Q, there exists a matrix γ ∈ F n×n q satisfying Condition 3.

The proof of this proposition is very technical but follows essentially the proof of the analogous [START_REF] Belaïd | Private multiplication over finite fields[END_REF]Proposition 4.6]. It is provided in Section A.3.

In [START_REF] Belaïd | Private multiplication over finite fields[END_REF], Belaïd et al.. presented examples of matrices which satisfy their condition for 2 shares and 3 shares. Karpman and Roche [START_REF] Karpman | New instantiations of the CRYPTO 2017 masking schemes[END_REF] proposed afterwards new explicit instantiations up to order n = 6 over large finite fields and up to n = 4 over practically relevant fields such as F 256 . It is worth mentioning that the matrices proposed in [START_REF] Karpman | New instantiations of the CRYPTO 2017 masking schemes[END_REF] are actually incorrect (due to a sign error) but this can be easily fixed and we check that matrices obtained following [START_REF] Karpman | New instantiations of the CRYPTO 2017 masking schemes[END_REF] also achieve our Condition 3.

A first matrix for 3 shares can be used over the finite field F 2 5 represented as

F 2 [X]/(X 5 + X 2 + 1): γ =   X + 1 X X 2 + 1 X X 2 + 1 X + 1 X 2 + 1 X + 1 X  
Another matrix for 3 shares (denoted in hexadecimal by evaluating each polynomial at X = 2 and writing the result in base 16) can be used over the finite field F 2 6 represented as Another example for 4 shares can be instantiated using the following matrix (also denoted in hexadecimal) over the (AES) finite field F 2 8 represented as F 2 [X]/(X 8 + X 4 + X 3 + X + 1):

F 2 [X]/(X 6 + X + 1): γ =   36
γ =     2d f5 2e 23 e1 c3 ac 30 bd f6 fa 8a e6 4a 4d ab    
Eventually, we present a matrix for 5 shares over the finite field F 2 10 represented as

F 2 [X]/(X 10 + X 3 + 1): γ =       225 2a9 0d0

Improved Asymptotic Complexity

In the previous sections, we exhibit the construction of a multiplication gadget G mult which performs a linear number of multiplications between variables, and a quadratic number of multiplications by a constant operations. Using the results of Lemma 18, Lemma 21 and Lemma 17, the constructed multiplication gadget is RPE and achieves the maximum amplification order n+1 2

for any number of shares n.

Using the linear gadgets (G add , G copy , G cmult ) instantiated with the O(n log n) refresh gadget (which all achieve the maximal amplification order for any number of shares n), and the proposed construction of the multiplication gadget G mult , we get an expanding compiler with a complexity matrix M CC of eigenvalues: Figure 6.4 illustrates the evolution of the complexity exponent with respect to the number of shares n, for the best asymptotic construction provided in Chapter 5 with quadratic complexity (as in (5.11)) for an expanding compiler (orange curve), and our new construction with quasi-linear complexity (red curve). While the best construction from Section 5.3 yields a complexity in O(|C| • κ e ) for e close to 3 for reasonable numbers of shares, the new expanding compiler quickly achieves a sub-quadratic complexity in the same settings.

(λ 1 , λ 2 ) = (n, 6n log(n) -2n) , λ 3 = n , λ 4 = 2n + 1 and λ 5 = n. Hence we have N max = 6n log(n) -2n = O(n log n).

Conclusion

In this chapter, we have proposed a dynamic expansion strategy for random probing security, which can make the most of different RPE gadgets regarding tolerated leakage probability and asymptotic complexity. We also introduced generic constructions of gadgets achieving RPE for any number of shares n. When the finite base field of the circuit meets the requirement of our multiplication gadget, the asymptotic complexity of the obtained expanding compiler becomes arbitrarily close to linear, which is optimal.

As for concrete instantiations, our small example on the AES demonstrates the benefits of our dynamic approach. Namely, it provides the best tolerated probability (from the bestsuited compiler) while optimizing the complexity using higher numbers of shares. Using two compilers with 3 and 5 shares instead of a single one already reduces the complexity by a factor of 10.

Future works could exhibit explicit constructions of matrices with (quasi)constant field size for our multiplication gadget. One could also investigate different RPE multiplication gadget designs with linear number of multiplications for arbitrary fields. Another interesting direction is to optimize the tolerated leakage probability for a set of (possibly inefficient) small gadgets to be used as the starting point of the expansion in our dynamic approach before switching to more (asymptotically) efficient RPE gadgets. This chapter concludes the theoretical analysis done during the PhD on the random probing expandability and achieving arbitrary levels of security in the random probing model. However, the random probing expansion has proven to be an exciting and promising strategy, and many future works can be done to push it even further to be of actual practical use in real-life implementations.

Chapter 7

Automatic Verification Tools

As discussed in Chapter 1 (Section 1.7), the manual verification of security properties in the (random) probing models is very error-prone [START_REF] Coron | Higherorder side channel security and mask refreshing[END_REF]. Hence, automatic tools are regularly built to apply formal verification on software and hardware masked implementations.

Many tools already exist to verify properties in the probing model. For instance, maskVerif [START_REF] Barthe | Verified proofs of higher-order masking[END_REF][START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF][START_REF] Barthe | maskVerif: Automated verification of higher-order masking in presence of physical defaults[END_REF] includes the verification of most probing-like security notions, including properties in the robust probing model in the presence of glitches. maskVerif allows for efficient verification and good accuracy for circuits of reasonable sizes. Bordes and Karpman [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF] also try to improve accuracy with their tool matverif. SILVER [START_REF] Knichel | SILVER -statistical independence and leakage verification[END_REF] also verifies the classical probing-like security properties for hardware implementations with a method based on the analysis of probability distributions. For a more detailed list of existing tools, we refer to Chapter 1, Section 1.7.

It is worth noting that many of the tools discussed above that verify probing-like security properties do not provide completeness (i.e., they can falsely deem a set of leaking variables as insecure with respect to the secret). As for tools that achieve completeness, we only count SILVER [START_REF] Knichel | SILVER -statistical independence and leakage verification[END_REF], which suffers from low performance, and matverif [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF], which is restricted to specific gadgets only.

On the other hand, before this thesis, no verification tools existed for the random probing model. Since the few past years, the community has made a significant effort to provide designs in this model, see e.g. [START_REF] Ajtai | Secure computation with information leaking to an adversary[END_REF][START_REF] Duc | Unifying leakage models: From probing attacks to noisy leakage[END_REF][START_REF] Ananth | Private circuits: A modular approach[END_REF][START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF][START_REF] Belaïd | On the power of expansion: More efficient constructions in the random probing model[END_REF][START_REF] Cassiers | Towards tight random probing security[END_REF]. The random probing expandability (RPE) approach introduced in the previous chapters currently gives the best complexity to achieve arbitrary random probing security with a constant (and quantifiable) leakage probability.

During our work in [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF] where we introduced the RPE notion, we also introduced VRAPS, the first tool to verify random probing properties. It was followed by STRAPS [START_REF] Cassiers | Towards tight random probing security[END_REF], which additionally provides a probabilistic mode to boost the performance and checks another random probing security property based on what the authors call a Probe Distribution Table (see Remark 2), but still does not provide a complete verification method since it uses a set of verification rules from maskVerif which is not complete.

In terms of efficiency, VRAPS makes it challenging to verify even small gadgets at reasonable orders, and STRAPS only manages to do it using verification rules from the underlying tool maskVerif [START_REF] Barthe | Verified proofs of higher-order masking[END_REF][START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF][START_REF] Barthe | maskVerif: Automated verification of higher-order masking in presence of physical defaults[END_REF] (which only verifies probing security properties), and is not complete. This chapter introduces IronMask (published in [START_REF] Belaïd | Ironmask: Versatile verification of masking security[END_REF]), a new versatile verification tool for masking security. IronMask is the first to verify standard simulation-based security notions in the probing model and recent composition and expandability notions in the random probing model. It supports any masking gadgets with linear randomness (e.g. addition, copy, and refresh gadgets) as well as quadratic gadgets (e.g. multiplication gadgets) that might include non-linear randomness (e.g. by refreshing their inputs) while providing complete verification results for both types of gadgets. We achieve this complete verifiability by introducing a new algebraic characterization for such quadratic gadgets and exhibiting a complete method to determine the sets of input shares necessary and sufficient to perform a perfect simulation of any set of probes. We report various benchmarks which show that IronMask is competitive with state-of-the-art verification tools in the probing model (maskVerif, scVerif, SILVER, matverif). IronMask is also several orders of magnitude faster than VRAPS -the only previous tool verifying random probing composability and expandability-as well as SILVER -the only previous tool providing complete verification for quadratic gadgets with non-linear randomness. Remark 6. We do not discuss VRAPS in this manuscript since IronMask is intended to be a more advanced and efficient version of VRAPS. For more details on the original implementation, we refer the readers to the corresponding work [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF] and the associated open-source project.

The organization of this chapter is as follows.

In Section 7.1, we formalize all of the probing and random probing properties from the state of the art from a single building block, a function we call SIS, and show that all of the security properties can be verified using a unique instantiation of that function. In a nutshell, SIS receives as input a set of probes on a gadget (and the description of the corresponding gadget) and performs some operations on the algebraic expressions of the probes in order to determine the exact sets of input shares which are necessary and sufficient to perform a perfect simulation of these probes. While SIS partially uses some properties from the state of the art, it was not exhibited before, and the unification of all the (random) probing-like security notions for this function was not explicitly well-defined.

Then, in Section 7.2, we extend the algebraic characterization introduced in [START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF][START_REF] Belaïd | Private multiplication over finite fields[END_REF] of gadgets with linear randomness (i.e. all random values are additive on the wires of the gadget) to more general gadgets with non-linear randomness which perform quadratic operations on input shares mixed with randomness. Our extended characterization notably captures recent gadget designs such as the one from [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF] or the multiplication gadget achieving maximal amplification order from Section 5.4. This characterization provides a complete verification method that applies to most (if not all) masking gadgets for standard operations (addition, multiplication, refreshing, etc.). In comparison, the only previously existing complete verification method for such general gadgets would rely on exhausting the truth table of tuples of intermediate variables for the inputs and the randomness, which is highly inefficient.

Finally, in Section 7.3, we present IronMask, a new versatile verification tool for all probing and random probing-like properties in the state of the art. IronMask supports the verification of traditional gadgets with linear randomness and newly formalized gadgets with non-linear randomness, along with a complete verification method for both types of gadgets based on our extended algebraic characterization. IronMask implements several optimizations to make the verification faster. We benchmark the performance of our new tool in Section 7.4 and show that it is competitive with state-of-the-art verification tools in the probing model (maskVerif, scVerif, SILVER, matverif) and is also several orders of magnitude faster than VRAPS, the only previous tool verifying random probing composability and expandability, and SILVER, the only previous tool providing complete verification for gadgets with non-linear randomness. IronMask uses complete methods for the verification, unlike VRAPS and STRAPS which are the only verification tools in the random probing model. IronMask is open-source and publicly available at:

|I i | ≤ t, ∀i ∈ [ ] t-SNI [10] |I i | ≤ t 1 , ∀i ∈ [ ] t-TNI [16] |I i | ≤ t 1 + t 2 , ∀i ∈ [ ] (t, f )-NI [8] |I i | ≤ f (t 1 , t 2 ), ∀i ∈ [ ] t-PINI [33] |(∪ i I i ) \ O| ≤ t 1 PS |I i | ≤ n -1, ∀i ∈ [ ] 7
.1.2 Random Probing Security Notions.

We rely on the LeakingWires procedure formalized in Section 3.1, Chapter 3 to formalize security notions in the random probing model. We recall that LeakingWires outputs a tuple of probes P on the gadget G such that each wire of G is added to P independently with probability p. Definition 26 reformulates Definition 8 of the random probing composability (RPC) notion from Section 3.2, based on the SIS primitive.

Definition 26. Let p, ε ∈ [0, 1] and n, t ∈ [0, n].
Let G be a n-share -to-1 gadget and let P be the random vector defined as

P = LeakingWires(G, p). Then G is (t, p, ε)-RPC if for every O ⊆ [n] with |O| = t, the sets (I 1 , . . . , I ) = SIS G (P , O) satisfy Pr[(|I 1 | > t) ∨ . . . ∨ (|I | > t)] ≤ ε,
where the probability is taken over all tuples of probes P obtained through LeakingWires(G, p).

Recall that the event

(|I 1 | > t) ∨ . . . ∨ (|I | > t)
is called a failure event (failure of a perfect simulation) and ε is the failure probability or the probability of a failure event to occur.

The random probing expandability (RPE) notion introduced and analyzed in Chapter 4, Chapter 5 and Chapter 6 can also be defined similarly. Like in the previous chapters, we restrict its definition to 2-input circuits for clarity but recall that the extension is straightforward. We have that G is (t, p, ε)-RPE1 (resp. RPE2) if for every O ⊆

[n] with |O| = t (resp. if there exists O ⊆ [n] with |O| = n -1), the sets (I 1 , I 2 ) = SIS G (P , O) satisfy Pr[|I 1 | > t] ≤ ε ∧ Pr[|I 2 | > t] ≤ ε ∧ Pr[(|I 1 | > t) ∧ (|I 2 | > t)] ≤ ε 2 .
Table 7.2 summarizes the three random probing notions. As in the probing security case earlier, it can be helpful to verify the random probing security of a complete implementation directly. To represent this case, we denote (p, ε)-RPS the SIS-based definition of random probing security. This notion is similar to the RPC definition, except that we do not consider probes on the outputs, i.e. O = ∅, and a failure occurs when all the shares (of one input) are necessary to simulate the probes perfectly, i.e. the failure event is

Pr[(|I 1 | = n) ∨ . . . ∨ (|I | = n)] ≤ ε .
In the previous chapters, we introduced a method to verify random probing properties by computing the failure probability ε as a function f (p) of the leakage probability p. We briefly recall the principle hereafter using SIS. For more details, we refer to Section 3.3 and Section 4.3. For (p, ε)-RPS of an n-share gadget of s wires for example, ε = f (p) is computed as

f (p) = P s.t. (I 1 ,...,I )=SIS(P ,∅) |I 1 |=n ∨...∨ |I |=n p |P | (1 -p) s-|P | . (7.1)
Table 7.2: Random probing-like security notions from the basic primitive SIS G .

Notion

Output O Condition(s) (t, p, ε)-RPC [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF] ∀ O,

|O| = t Pr[(|I 1 | > t) ∨ . . . ∨ (|I | > t)] ≤ ε (t, p, ε)-RPE1 [18] ∀ O, |O| = t ∀i, Pr[(|I i | > t)] ≤ ε ∧ Pr[(|I 1 | > t) ∧ (|I 2 | > t)] ≤ ε 2 (t, p, ε)-RPE2 [18] ∃O, |O| = n -1 ∀i, Pr[(|I i | > t)] ≤ ε ∧ Pr[(|I 1 | > t) ∧ (|I 2 | > t)] ≤ ε 2 (p, ε)-RPS O = ∅ Pr[(|I 1 | = n) ∨ . . . ∨ (|I | = n)] ≤ ε
In the above equation, we consider that each tuple of probes P on a gadget can exactly leak with probability p |P | (1 -p) s-|P | since each of the wires in P is added independently with probability p, and each of the remaining wires does not leak with probability 1 -p. Then, out of all such possible tuples of wires, f (p) represents the sum over the probabilities of obtaining tuples of probes only for which we get a failure event using SIS (the failure event being

(|I 1 | = n ∨ . . . ∨ |I | = n) in this context).
For a gadget with a total of s wires, computing f (p) then amounts to computing

f (p) = s i=1 c i p i (1 -p) s-i , (7.2)
where we group the probabilities with respect to the size of the tuples of probes. In other words, c i is the number of tuples of i wires, for which we obtain a failure event using SIS. For instance, if there are exactly 2 tuples of probes P 1 , P 2 for which we get a failure event and such that

|P 1 | = |P 2 | = 3, then we get c 3 = 2 in equation (7.
2). For other random probing properties, the computation is similar, considering the correct failure event with the correct t and the condition on the output set of shares O, which is not empty anymore (e.g. RPC, RPE).

The recent Probe Distribution Table (PDT) of Cassiers et al. [START_REF] Cassiers | Towards tight random probing security[END_REF] for tighter random probing composition (see Remark 2) can also be expressed in terms of our basic function SIS G . The PDT is a two-dimensional table indexed by all possible sets of input indices I = (I 1 , . . . , I ) where I i ⊆ [n] and by all possible sets of output indices O ⊆ [n], defined as

PDT[I ][O] := P s.t. I=SIS(P ,O) p |P | (1 -p) s-|P | (7.3)
where s is the number of wires in G. In other words, each entry in the PDT is a different function f (p) as in equations (7.1), ( We showed how standard probing and random probing security notions can be expressed using the SIS G function. In the next section, we focus on the algebraic characterization of masking gadgets and the concrete evaluation of the SIS G function.

Algebraic Characterization of Masking Gadgets

In this section, we recall and extend the algebraic characterization of masking gadgets and the subsequent security results. Previous works [START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF][START_REF] Belaïd | Private multiplication over finite fields[END_REF] considered gadgets with linear randomness, i.e. all random values are additive on the wires of the gadget. We refer to these gadgets as LR-gadgets (see, for instance, ISW multiplication or refresh gadget recalled in Chapter 2). In this work, we extend the characterization to gadgets with non-linear randomness, i.e. gadgets performing non-linear operations on input shares mixed with randomness. We denote these gadgets as NLR-gadgets. Our extended characterization notably captures recent gadget designs; see e.g. [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF] or the multiplication gadget from Section 5.4. We also show how to verify the security of masking gadgets using this algebraic characterization by a concrete evaluation of the SIS primitive, which will be the core primitive of IronMask.

Characterization of Gadgets with Linear Randomness

We call an LR-gadget any -to-m gadget G : x = ( x 1 , . . . , x ) → y = ( y 1 , . . . , y m ) with the output of the form (recall that for the description of SIS, we consider m = 1 but we can generalize it to any number of outputs):

y := R F ( x), r ,
where F is any arithmetic circuit, R is a linear arithmetic circuit (i.e. computing a linear function) and r is a vector of internal randomness uniformly drawn from K ρ . Formally, each coordinate of r is the output of a randomness gate of G, and F and R are composed solely of operation gates. Note that this characterization is more general than the one from [START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF][START_REF] Belaïd | Private multiplication over finite fields[END_REF], which only considers quadratic circuits for F . We show hereafter that we can still obtain an efficient and complete evaluation of SIS for those gadgets, yielding an efficient verification of the considered security notions.

By definition, any probe on an LR-gadget can be written as

p = f p ( x) + r T • s p (7.4)
for some arithmetic function f p : (K n ) → K and some constant vector

s p ∈ K ρ .
Given a tuple of probes P = (p 1 , . . . , p d ) on the gadget G, we are interested in determining the sets of input shares necessary for a perfect simulation of all probes in P . In particular, if P can be simulated with at most n -1 shares of each input sharing, then we know that P is independent of the secret inputs. Belaïd et al. [START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF] showed how to use a Gaussian elimination technique in order to determine the simulatability of a tuple of probes for gadgets with linear randomness over the binary field. This technique was later extended to any finite field in [START_REF] Belaïd | Private multiplication over finite fields[END_REF]. We base our tool's verification procedure for LR-gadgets on this technique.

We start by stating the result with Gaussian elimination from [START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF][START_REF] Belaïd | Private multiplication over finite fields[END_REF] in a different, more convenient formulation for our purposes. For this, we first define a simple function shares(.), which takes as input a tuple of symbolic expressions (e 1 , . . . , e d ) of the input shares, i.e. e i = f e i ( x) for some algebraic function f e i , and which outputs the (smallest) sets of indices I = (I 1 , . . . , I ) such that (e 1 , . . . , e d ) functionally depend on x| I . Notice that evaluating shares(.) consists in extracting the indices of the input shares that are contained in the symbolic expressions (e 1 , . . . , e d ). We stress that the input shares x| I where I = (I 1 , . . . , I ) := shares(e 1 , . . . , e d ) are necessary and sufficient for a perfect simulation of (e 1 , . . . , e d ). Note that shares(.) is executed on the tuple of expressions, the output tuple of the Gaussian elimination technique. In fact, after executing the Gaussian elimination, we are guaranteed that the remaining expressions cannot be simplified any further in the given field K, and they are solely formed of operations between input shares (they do not include any random variables). In this case, to perfectly simulate the resulting tuple (which is equivalent to perfectly simulating the tuple given before Gaussian elimination), there is no choice but to have access to all of the input shares that are involved in the remaining expressions, which is why shares(.) extracts the indices of these input shares.

Lemma 22. Let G be an n-share gadget. Let P = (p 1 , . . . , p d ) be a tuple of probes on G. Let S ∈ K d×ρ be the matrix such that

S T = (s p 1 | s p 2 | • • • | s p d )
(i.e. each s p i is a row vector of S) and let S be the row reduced form of the matrix S such that S is of the form

S = 0 m,d-m 0 m,R-d+m I d-m S
up to some permutations on the rows with S = N • S where N is an invertible matrix in K d×d . Let P be defined as

P = N • P = (p 1 , . . . , p m , p m+1 , . . . , p d ) .
Then, the sets of input shares necessary to simulate the probes in P are shares(p 1 , . . . , p m ).

Proof. The proof of the result follows the proof of Theorem 3.1 from [START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF] and Theorem 3.2 of [START_REF] Belaïd | Private multiplication over finite fields[END_REF]. It is shown in the latter that we can perfectly simulate the probes in P by perfectly simulating all probes in P since the matrix N is invertible and we can obtain P from N -1 •P . Then, to perfectly simulate probes in the tuple P , we observe from S that each algebraic expression in the tuple (p m+1 , . . . , p d ) contains a random value that does not appear in any other algebraic expression in P . We can thus perfectly simulate (p m+1 , . . . , p d ) by generating d -m uniform random values without the need for any input share. The remaining algebraic expressions (p 1 , . . . , p m ) contain no random values and are all of the form p i = f p i ( x). Hence, to perfectly simulate each of them, we need (and only need) the input shares which are involved in each f p i ( x), namely the input shares indexed by I := shares(p 1 , . . . , p m ). Using the input shares x| I , we can perfectly simulate (p 1 , . . . , p m ) and thus perfectly simulate all algebraic expressions in P , from which we get a perfect simulation of the probes in P .

Lemma 22 provides a way to evaluate the function SIS in the case of LR-gadgets. Note that the set of probes P in the lemma must be defined as the union of P and y| O in an evaluation of SIS G (P , O) (while used to define security notions, SIS is based on two arguments to differentiate probes on internal wires and probes on output shares whereas this distinction is not used in the evaluation process of Lemma 22). According to the above lemma, an evaluation of SIS consists of a row reduction on the matrix of the random dependencies S, after which the function shares(.) is used on the obtained expressions without random values (i.e. (p 1 , . . . , p m ) in the lemma). The output of SIS is then the output of shares(.), which is the set of input shares necessary for a perfect simulation of all the probes. Section 7.3 shows how this technique is efficiently implemented in our verification tool.

Characterization of Gadgets with Non-Linear Randomness

In this section, we extend the algebraic characterization for LR-gadgets of Section 7.2.1 to NLR-gadgets, i.e. gadgets performing non-linear operations on input shares mixed with randomness. An NLR-gadgets is an -to-m gadget G : x → y with the output of the form:

y := R +1 F (R 1 ( x 1 , r 1 ), . . . , R ( x , r )), r +1
where F is any arithmetic circuit, the R i are linear arithmetic circuits and the r i are vectors of random values uniformly drawn from K ρ i . We further assume that F computes a homogeneous multi-linear form, namely F (z 1 , . . . , z ) is a sum of degree-monomials, each of which being a product containing exactly one coordinate from each z i . p i of the form (7.5) w.r.t. ( x 2 , r 2 ) (i.e. the probes on R 2 ). This precisely means solving the linear system obtained from the expressions in P 2 which can be done by Gaussian elimination w.r.t. the r 2 variables (just as what is actually performed by step 4 of the verification method). The resulting equations without r 2 variables imply some linear constraints on some of the shares from x 2 . These shares must then be known by the simulator in order to decide if the system has a solution (and to evaluate the probability to get h p 1 = • • • = h p m = 0). Moreover, these shares are by construction the shares of indices in I 2 .

The exact same proof apply to I 1 by taking the uniform distribution for D x 2 and considering the expressions of the form (7.8) (together with the the probes on R 1 ).

Direction 2: The sets (I 1 , I 2 ) are sufficient to simulate P . Suppose that we can perfectly simulate the tuples of algebraic expressions P 1 , P 2 using sets of input shares I 1 on input sharing x 1 and I 2 on x 2 respectively as described in step 4 above. Let two new sets of input shares

Ĩ1 = [n] on x 1 and Ĩ2 = [n] on x 2 .
Observe first that we can perfectly simulate P using the sets of input shares Ĩ1 and I 2 . In fact, in the algebraic expression of each probe p i in P of the form (7.7), the coordinates of the h (p i ) 's can all be perfectly simulated using I 2 since by hypothesis we can perfectly simulate P 2 . Also, the randoms in r 1 are perfectly simulated by generating uniform random values, and all shares of input x 1 are simulated using the full input sharing in Ĩ1 = [n]. Since we can perfectly simulate each term in the expression of p i , then we can perfectly simulate the expression p i and hence we can perfectly simulate P using Ĩ1 and I 2 . Similarly, we can perfectly simulate P using the sets of input shares I 1 and Ĩ2 = [n] by observing the expressions of p i of the form (7.8).

Thanks to [START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF]Lemma 7.5] (which demonstrates that if a set of probes can be simulated from different sets of inputs shares, then it can also be simulated by the intersection of these sets), we get that P can be perfectly simulated using the sets of input shares Ĩ1 ∩ I 1 = I 1 and Ĩ2 ∩ I 2 = I 2 , which proves that by perfectly simulating the tuples P 1 , P 2 using I 1 , I 2 , we can perfectly simulate P using I 1 , I 2 . This concludes the proof for this direction. We hence conclude the proof of the lemma.

The verification method introduced above describes the procedure of the function SIS in the case of NLR-gadgets to determine the simulatability of a set of probes on such gadgets. Section 7.3 shows how this technique is implemented in IronMask. We now present a concrete example of SIS execution on a set of probes on an NLR-gadget.

Example. Let us consider the following 2-share multiplication gadget (with inputs a and b, and output e) while taking K = F 2 :

c 1 = a 1 + r a , c 2 = a 2 + r a d 1 = b 1 + r b , d 2 = b 2 + r b e 1 = (c 1 * d 1 + r) + c 1 * d 2 e 2 = (c 2 * d 1 + r) + c 2 * d 2
The above gadget is an example of NLR-gadgets, and uses 3 random values: r a is used to refresh the input sharing a, r b is used to refresh the input sharing b, and r is used during the compression of the products into the output sharing e. The non-linear random values are r a and r b with respect to e.

Suppose that we would like to verify one of the security properties defined in Section 7.1 using SIS. To do this, we need to determine for each set of probes (formed of intermediate values or output shares) on the gadget the exact sets of input shares necessary and sufficient for a perfect simulation of all the probes in the set. Let us consider, for instance, the following set of 2 probes on the gadget:

P = (p 1 = c 1 * d 1 + r, p 2 = c 2 * d 1 + r)
We need to determine the sets of input shares of a and b necessary to simulate probes in P perfectly. SIS will be executed in four steps, as described earlier.

1. Get rid of the random values that are additive in the compression step (which are not additive to the shares of a and b). In this case, it is the unique random value r. Using the Gaussian elimination technique, we construct a new tuple :

P = (p 1 + p 2 = c 1 * d 1 + c 2 * d 1 , p 2 = c 2 * d 1 + r)
Since r only appears in p 2 , a uniform random value can perfectly simulate this probe.

Next we need to consider the simulation of the new tuple

P = (c 1 * d 1 + c 2 * d 1 ) = ((a 1 + r a ) * (b 1 + r b ) + (a 2 + r a ) * (b 1 + r b )) .
2. Factor the expressions in P with respect to the elementary variables of shares of a and random values which are additive to the shares of a and the constant term 1, in this case the variables (a 1 , a 2 , r a , 1). Since there is a single expression in P , we can rewrite it as:

P = (a 1 * (b 1 + r b ) + a 2 * (b 1 + r b ) + r a * (b 1 + r b + b 1 + r b ) + 1 * (0))
from which we construct the new set of the expressions multiplying (a 1 , a 2 , r a , 1)

P 2 = (b 1 + r b , b 1 + r b , 0, 0) .
3. Do the same thing with respect to (b 1 , b 2 , r b , 1):

P = (b 1 * (a 1 + r a + a 2 + r a ) + b 2 * (0) + r b * (a 1 + r a + a 2 + r a ) + 1 * (0))
from which we construct

P 1 = (a 1 + a 2 , 0, a 1 + a 2 , 0) .
4. Determine the input shares of a necessary to simulate the expressions in P 1 and the shares of b necessary to simulate the expressions in P 2 .

• for input sharing a, we trivially need both input shares (a 1 , a 2 ) to perfectly simulate expressions in P 1 .

• for input sharing b, we apply one step of Gaussian elimination with respect to r b , to obtain the new set P 2 = (b 1 + r b , 0, 0, 0). We can see that we can perfectly simulate the single non-zero expression with a uniform random value. Thus, in this case, no shares of b are necessary to perfectly simulate P 2 and hence also P 2 .

Hence, to perfectly simulate P 1 and P 2 , we need both input shares of a and no shares of b. Thanks to Lemma 23, we can conclude that P can be perfectly simulated using both shares of a and no shares of b.

Efficient Verification: IronMask

In this section, we present IronMask, a new tool that we developed to check probing and random probing security properties using the algorithms presented in Section 7.2. The implementation of IronMask currently considers a finite field K of characteristic 2. It can be extended to any finite field since the verification methods introduced in the previous sections work in any finite field K. IronMask is written in C, and the only external libraries it depends on are the GNU Multiple Precision Arithmetic Library (GMP) and the POSIX Threads (pthreads) library. IronMask takes as input gadgets written in a simple syntax to describe circuits, borrowed from VRAPS [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF]: a gadget is a list of assignments of additions and multiplications into variables, alongside directives to specify the number of shares, the inputs, the outputs, and the randoms. Figure 7.1 illustrates our input syntax on a 2-share ISW multiplication ( Figure 7.1a) and a 3-share refresh gadget ( Figure 7.1b). In Figure 7.1a, the variables a0/b0 (resp. c0) and a1/b1 (resp. c1) are the 1 st and 2 nd shares of the input a/b (resp. output d). Similarly to maskVerif [START_REF] Barthe | Verified proofs of higher-order masking[END_REF][START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF][START_REF] Barthe | maskVerif: Automated verification of higher-order masking in presence of physical defaults[END_REF], the syntax ![ expr ] can be used to stop the propagation of glitches in the robust probing model. For instance, tmp = a0*b0 could be replaced by tmp = ![ a0*b0 ], in which case tmp would leak a0*b0 instead of leaking a0 and b0 separately.

Internally, IronMask represents each wire of the gadget as an array of integers composed of three parts. The first parts correspond to linear dependencies on the inputs of the gadget: if the k th bit of the i th element is set to 1, then the wire depends linearly on the k th share of the i th input. The second part is a bit vector, where the k th bit set to 1 indicates a linear dependency on the k th random of the gadget. Finally, the third part is a bit vector as well, where the k th bit set to 1 indicates a linear dependency on the k th quadratic monomial appearing in the symbolic expressions of the gadget wires. For instance, the internal representation of the wires a0, a1, r0, m3, t1 and c1 of Figure 7.1a are as follows: inputs randoms mults a0: [ 1, 0, 0, 0,0,0,0 ] a1: [ 2, 0, 0, 0,0,0,0 ] r0: [ 0, 0, 1, 0,0,0,0 ] m3: [ 0, 0, 0, 0,0,0,1 ] t1: [ 0, 0, 1, 1,1,0,0 ] c0: [ 0, 0, 1, 0,0,1,0 ],

with an additional data structure storing the operands of each multiplication: 0: a0 * b1 1: a1 * b0 2: a0 * b0 3: a1 * b1

Using this internal representation enables efficient operations: the linear dependencies of a wire on the input shares are accessible with a single operation, and the number of such input shares is efficiently obtained by counting the number of bits to one in the first element (or first two elements for 2-input gadgets), and xoring two wires, which is one of the basic operations of our Gaussian elimination can be done by xoring pointwise the arrays representing them.

We use the same glitch model as in [START_REF] Barthe | maskVerif: Automated verification of higher-order masking in presence of physical defaults[END_REF] to model glitches in the robust probing model. Namely, we consider that an expression a + b (resp a * b) leaks a and b separately, instead of leaking a + b (resp a * b). Registers (usually called flip-flops) can be used to stop the propagation of these glitches.

In IronMask, when taking glitches and transitions into consideration, each wire is represented by an array of arrays instead of a single array since the leakage of an assignment is the union of the leakages of its right-hand side operands. For instance, the wire c0 in Figure 7.1a in the presence of glitches is represented as: inputs randoms mults c0: [ [ 0, 0, 1, 0,0,0,0 ], [ 1, 0, 0, 0,0,0,0 ], [ 0, 1, 0, 0,0,0,0 ] ] If a flip-flop was added to m2 to stop the propagation of glitches by doing m2 = ![a0*b0], then the robust leakage of c0 would become: inputs randoms mults c0: [ [ 0, 0, 1, 0,0,0,0 ], [ 0, 0, 0, 0,0,1,0 ] ]

Basic Verification

This section presents the procedures implemented in IronMask for verifying probing and random probing properties. Recall that in Section 7.1, we give definitions of all the security properties based on a single building block SIS: a primitive that, given a set of probes (internal probes and output probes), determines the input shares necessary for a perfect simulation of these probes. Thus, to verify any security property, IronMask uses a concrete implementation of the function SIS based on the algebraic characterization techniques discussed in Section 7.2.

Gadgets with linear randomness. For the verification of LR-gadgets introduced in Section 7.2.1 (i.e. gadgets in which all random values are additive), IronMask relies on the SIS_LR procedure ( Algorithm 9). This procedure directly applies the result presented in Lemma 22.

We recall that Algorithm 9 in IronMask currently considers a finite field of characteristic 2.

As in Lemma 22, Gaussian elimination is first performed on the tuple by the procedure GaussElimination, after which each probe of the input tuple is either "replaced" by a random Algorithm 9: SIS_LR returns the input shares that are leaked by the tuple P with expressions of the form (7.4), assuming input sharings r (as shown on line 10 of the procedure GaussElimination), or contains one or more input shares and no random values. What we mean by replacing the probe p i by a random value r on line 10 is that after eliminating r from the expressions of all other expressions p j in the same tuple (loop from line 5 to 7 where the instruction p j ← p i + p j aims to remove r from p j in a finite field of characteristic 2), we end up with r only appearing in the expression of p i and so as explained in the proof of Lemma 22, simulating p i amounts to generating r uniformly at random without the need for any other variables. We represent this by replacing the expression of p i with the single random value r. Then, the shares leaked by the input tuple can be found on the probes that do not contain any randoms using the procedure shares. The latter corresponds to an implementation of the function shares(.) used in Lemma 22.

Gadgets with non-linear randomness. For NLR-gadgets (i.e. gadgets performing nonlinear operations on input shares mixed with randomness), IronMask uses the SIS_NLR procedure ( Algorithm 10), which implements the four steps described in Section 7.2.2. As mentioned in Section 7.2.2, SIS_NLR currently only supports gadgets with two input sharings but can be extended to input sharings.

First, SIS_NLR performs Gaussian elimination with respect to the vector of output randoms (i.e. r 3 ), using a modified version of GaussElimination that takes as inputs the randoms to use for the elimination. This corresponds to step 1 of Section 7.2.2. Next, two new tuples of probes P 1 , P 2 are constructed from the probes in P that do not contain any randoms from r 3 , using the FactAndExtract procedure, which corresponds to the factoring technique discussed in steps 2 -3 of Section 7.2.2. We thus get two tuples P 1 and P 2 containing input shares, randoms, and refreshed input shares from each input. Since those variables are linear, we can use the initial SIS_LR procedure to extract the input shares that they leak.

Algorithm 10: SIS_NLR returns the input shares that are leaked by the tuple P in an NLR-gadget refreshing its output with the randoms r 3 (c.f. sec. 7.2.2), assuming 2 input sharings 1 procedure SIS_NLR(P , r 3 ) 2 P ← GaussElimination(P , r 3 ); Verification of security properties. Checking any probing or random probing property (e.g. NI, SNI, RPC, RPE, ...) consists of enumerating tuples of probes, using SIS_LR or SIS_NLR to get the input shares that they leak (we abbreviate with SIS and suppose that we make a call to the correct algorithm for LR-gadgets and NLR-gadgets), and take some action in consequence (see Section 7.1). In the following, we shall call a t-failure tuple (or simply a failure tuple when t is not made explicit) any tuple of probes that leaks more than t input shares of one or more input sharings (i.e. for which SIS outputs a set or more of cardinality strictly greater than t).

For instance, to verify if an n-share gadget is t-NI, we enumerate all tuples of size t and make sure that none of them is a t-failure tuple ( Algorithm 11). This corresponds to the first row of Table 7.1. Verifying random probing-like properties amounts to computing the failure probability ε as a function f (p) of the leakage probability p as described in Section 3.3 and Section 4.3. For instance, to verify the (p, ε)-RPS of an n-share gadget G in the random probing model (first row of Table 7.2), we need to compute the coefficients c i from equation (7.2) of the failure probability function f (p) = ε as explained in Section 7.1. This corresponds to enumerating all the tuples of probes (excluding the output wires) of size 1 to s (where s is the total number of wires in the circuit) and counting how many leak more than n -1 shares. When it is computationally infeasible to enumerate all tuples, we only enumerate tuples of size 1 to a certain threshold β. From these β computed coefficients, we can derive upper and lower bounds on f (p). For example, an upper bound is obtained by replacing each coefficient c i for i > β by the binomial coefficient s i (c.f. Section 3.3). We will see in the experimental results that in most of the cases, the upper and lower bounds on f (p) are tight and give a precise estimation of the actual function f (p) 1 .

Enumerating all tuples becomes impractical as soon as gadgets start growing larger than a few hundred variables since the number of tuples of size k in a gadget containing s variables is s k . For instance, checking that a 9-share masked ISW multiplication containing 279 variables is 8-NI requires enumerating 279 8 ≈ 8 × 10 14 tuples, which is not far from being out of reach for modern computers.

The rest of the Section is organized as follows. In Section 7.3.3, we address dimension reduction techniques proposed in [START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF][START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF] to reduce the search space of the enumerated tuples. In Section 7.3.4, we present some optimizations of our implementation that make verification faster by reducing the cost of SIS_LR (since the latter is also a building block for SIS_NLR) and parallelizing our procedures. Finally, in Section 7.3.5, we introduce a constructive algorithm to generate failures without enumerating all tuples in linear gadgets.

Dimension Reduction

Checking any probing or random probing property requires enumerating many tuples. For instance, for a gadget G made of s variables, s t tuples must be checked to assess whether G is t-NI. We remove some variables from the search to reduce the number of tuples that have to be considered. First, as proposed in [START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF] and further explained in [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF], elementary deterministic probes can be removed when checking any probing or random probing property. Then, when checking for probing properties only, we use the "reduced sets" optimization proposed in [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF], eliminating some "less powerful" variables from the search. We recall hereafter the principle of those two optimizations and show how to make the first one work in the random probing model and why the second one cannot be used in this model. Note that the dimension reduction technique is proved to be sound in [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF], which means that our verification technique implementing the optimization remains sound.

Removing elementary probes. Elementary deterministic probes refer to input shares and products of input shares. The idea behind the removal of those probes is that if a tuple P functionally depends on k input shares, we can always make it depend on k + k input shares (with k + k less or equal to the number of shares of the gadget) by adding elementary deterministic probes. For instance, if a tuple t does not depend on the input share a 0 , then the tuple (t, a 0 ) does, and so do any of the tuples of the form (t, a 0 b i ).

The goal of our search procedure, instead of finding tuples of size k 1 that depend on t input shares, now becomes to find tuples of size k 2 ≤ k 1 that depend on t -(k 1 -k 2 ) input shares. In the probing model, such a tuple is enough to know that the property being checked does not hold. However, we want to generate and count all failures in the random probing model. When we find such a tuple P , we thus generate all expansions of P combined with elementary deterministic probes that leak t input shares, thus making sure that all failures of the gadget are generated.

Similarly, we can remove elementary random probes: if, after the Gaussian elimination on a tuple P , some input shares are masked by random variables, we can make them appear by adding the corresponding randoms. For instance, consider the 1-element tuple a0+r1+a1. It is easy to see that adding r1 to this tuple would make it leak a0 and a1. For simplicity, we keep elementary random probes when checking random probing properties and only perform this optimization for probing properties.

Using reduced sets. This optimization is formally introduced and proven correct in [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF]. For completeness, we informally recall its principle here.

Let P and P be two sets of probes. P is said to be a reduced set for P iff |P | ≤ |P | and for every linear combination of probes of P , there exists a linear combination of P using an equal or lower number of probes, which contains the same random dependencies, and at least as many input share dependencies. [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF] proved that if P is a set of all wires of a gadget G and P is a reduced set for P , then, to prove that G is NI or SNI, the set of probes P can be used instead of P to enumerate all tuples. If no failure is found in P , then none can be found in P either, and, conversely, if a failure is found in P , the same failure exists in P .

For instance, if we consider a set P = (r 0 , a 0 , a 1 , a 0 + r 0 , a 0 + r 0 + a 1 ) (where r 0 is a random value and a 0 , a 1 are input shares), then the set P = (r 0 , a 0 , a 1 , a 0 + r 0 + a 1 ) is a reduced set for P . Evaluating the probing security of a gadget using the latter would yield the same conclusion as with the former while being faster since the latter contains one less probe.

This optimization is especially potent on ISW-like multiplications, which contain many wires of the form X + a i • b j : the wire X can often be omitted since (informally) X + a i • b j contains the same random dependencies as X. However, it contains some additional input shares. This optimization cannot be used in the random probing model because a set P and a reduced set P would yield different failures. For instance, consider the sets proposed earlier as an example: P = (r 0 , a 0 , a 1 , a 0 + r 0 , a 0 + r 0 + a 1 ), and P = (r 0 , a 0 , a 1 , a 0 + r 0 + a 1 ). The tuple (a 0 + r 0 , a 0 + r 0 + a 1 , a 1 ), made of wires of P , reveals two input shares and cannot be built from wires of P since a 0 + r 0 is not in P .

Implementation Optimizations

On-the-fly Gaussian Elimination. In order to find all failures of a given size, we enumerate all the tuples of that size and apply the SIS procedure on each. This means a complete Gaussian elimination must be performed on each tuple. However, we generate the tuples in lexicographic order, meaning that two consecutive tuples only differ by their last elements and, in most cases, only by their last element. For two consecutive tuples, it is thus very likely that most of the Gaussian elimination will be identical. We take advantage of this by implementing our Gaussian elimination on the fly: we only recompute the elimination on the elements that differ from the previous tuple for each tuple.

The cost of the Gaussian elimination for a single tuple of k elements of a gadget containing d inputs and randoms is O(dk 2 ). Performing the elimination on-the-fly brings the amortized complexity down to O(dk).

The authors of [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF] used a similar, slightly more efficient technique to speed up their implementation. They used a revolving-door algorithm to generate the tuples so that each consecutive tuple differs by exactly one element, which allows for amortizing the analysis's cost. However, we cannot use this revolving-door algorithm because when changing the i th element of a tuple, the Gaussian elimination needs to be recomputed from this i th element up to the end of the tuple.

Parallelization. Recall that we generate the tuples in lexicographic order, which admits an efficient unranking algorithm. This means that we can efficiently compute the j th tuple of size k for any j and any k. Multi-threading the verification of n tuples is thus trivial: run l threads in parallel, the j th thread starts with the j × n/l th tuple, and verifies the next n/l tuples.

Our implementation is multi-threaded in this fashion using POSIX threads provided by the pthread library. In order to be transparent from the properties' point of view (e.g., from Algorithms 11 and Algorithm 12), the multi-threading is done inside SIS. To this end, we use a few mutexes, which incur an overhead in the random probing model: the more failures a gadget contains, the less of a speedup multi-threading offers. Although it would not be hard to implement multi-threading on the properties' side rather than in SIS, we opted for readability and maintainability of the code at the slight expense of performance.

Constructive Approach

The enumerative approach of Section 7.3.2 generates many tuples that are trivial non-failures because they do not contain enough shares to be failures or their shares are masked by random variables. We designed a constructive algorithm only to generate potential failures to overcome this issue. Our constructive algorithm aims at generating incompressible failure tuples, which we define as follows:

Definition 27 (Incompressible failure tuple). A tuple P is an incompressible failure tuple if it is a failure, and if no tuple P ⊂ P is a failure itself. (⊂ between two tuples means that all wires of P are included in the tuple P ).

We will describe our constructive algorithm for the well-adapted case of LR-gadgets and then explain how to extend it to NLR-gadgets. The idea is that given wires which are all of the form (7.4), a failure tuple of probes on these wires has a specific form: it contains some wires with input shares, and if those input shares are masked by randoms, it contains some additional wires to cancel out those randoms. The expression masked by randoms means that the perfect simulation of the considered probe amounts to generating a uniform random value. This is typically the case in a tuple of probes where a random value appears only once in one of the expressions, which then can be used to mask the expression of that probe. To cause a failure event and avoid masking the expressions, we add wires using the same randoms to cancel them out.

We start by giving the intuition of the algorithm on the 3-share refresh gadget presented in Figure 7.1b. We first build a map ( Table 7.3), called Columns, whose keys are the input shares and randoms of the gadget considered and whose values are all the wires that depend on those inputs and randoms (a wire will be displayed in several columns if it depends on several shares or randoms). To build a failure tuple that leaks three shares, we can pick one wire from each of the a0, a1 and a2 buckets, say (a0, a1+r0,a2+r1) for instance. This tuple is not a tuple P Gauss contains no random, then there is nothing to unmask, and we can move on to the next index (which was already done by line 11). Otherwise, we select any random r of P Gauss and try to add to P each wire that contains r (i.e., each wire of the r column of the Columns map, and move to the next unmask_index (lines 16 to 19).

Unmasking each element of P one by one misses some failures. For this reason, line 11 skips the unmasking of the element of P at index unmask_index to move directly to index unmask_index +1. Consider, for instance, a 2-share gadget and the tuple P = (a 0 + r 0 , a 1 + r 1 + r 0 ). After the Gaussian elimination, the 1 st element of P is r 0 , and lines 16 to 19 of UnmaskTuple will thus try to add a wire containing r 1 to the tuple. However, this would be missing the fact that the 2 nd element of P , a 1 + r 1 + r 0 , already contains r 1 and thus somewhat unmasks a 0 + r 1 . By skipping the first element of P , we will try to unmask its second element by adding the wire r 1 to the tuple. This will produce the tuple (a 0 + r 0 , a 1 + r 1 + r 0 , r 1 ), which is a failure, and would have been missed without the recursive call of line 11. This constructive method is exhaustive since any incompressible failure tuple P can be built by taking one element in each column (and possibly removing duplicates) and adding necessary elements to remove the masks. Consider a minimal sub-tuple P of P , which contains one element of each column. This sub-tuple P will be listed in line 11. The other coordinates of P are necessary to remove the masks remaining after an application of the Gaussian elimination to P (otherwise P would not be incompressible). Since Algorithm 13 is exhaustive in removing those masks, it will necessarily build P at some point.

Implementation. Implementing UnmaskTuple in Algorithm 13 does not perform a full Gaussian elimination at every recursive call. Instead, the elimination is performed on the fly, similar to what we do for the enumerative algorithm (see Section 7.3.4). Likewise, we keep a variable input_shares containing the input shares already revealed by the current tuple P , which enables to check if P is a failure in constant time, without having to call SIS_LR: we can check if input_shares contains n input shares.

Extension to gadgets with non-linear randomness. The procedure UnmaskTuple of Algorithm 13 only considers gadgets with linear randomness. To adapt it for gadgets with non-linear randomness, we proceed similarly as in SIS_NLR ( Algorithm 10): a first step unmasks randoms that are used to refresh outputs, while a second step unmasks randoms that are used to refresh inputs. We call ConstructiveFailuresGenNLR this version of our constructive algorithm and define ConstructiveFailuresGen as the function that chooses between ConstructiveFailuresGenLR and ConstructiveFailuresGenNLR depending on whether its input gadget contains linear or non-linear randomness.

Application. Algorithm 14 shows how to use ConstructiveFailuresGen to compute all gadget failures. While the latter returns all incompressible failures to evaluate the failure function coefficients for random probing notions (RPC, RPE1, RPE2, RPS ), we need to count the number of all failures, regardless of their incompressibility. To do so, we expand all incompressible failures into regular failures by adding wires one by one (using the procedure ExpandTuple, whose pseudo-code is trivial and hence omitted). However, doing so will lead to the same tuple being generated multiple times: for instance, if the tuples (x 1 , x 2 ) and (x 1 , x 3 ) are both incompressible failures, expanding them will generate (x 1 , x 2 , x 3 ) and (x 1 , x 3 , x 2 ), which are the same tuple. We thus use a hash table (called S failure in Algorithm 14, and abstracted as a set for simplicity) to store the tuples that we generate and prevent counting multiple times the same tuple. In practice, our hash function returns the sum of the hashes of the indices of wires in the tuple, which results in a fairly low number of collisions. Remark 7. We initially tried to count the failures from the incompressible failures without generating all of them. This problem can be formulated as follows: Let W be a set of integers (the wires). Let S be a set of subsets of W of arbitrary sizes (the set of incompressible failures). How many subsets of W of size k are super-sets of elements of S (those subsets are non-incompressible failures)? This is a problem of inclusion-exclusion, and solving it requires computing the intersections of all pairs of sets in the powerset of S. Since there are 2 |S| such sets, this approach would be prohibitively expensive for any gadget with more than a few incompressible failures.

Performance & limitations. This constructive algorithm is faster than the traditional enumerative algorithm of Section 7.3.2 when checking (n -1)-NI and RPS* properties for linear gadgets. Table 7.4 shows the exact performance improvements when checking the RPS* property on some common linear gadgets (ISW refresh [START_REF] Ishai | Private circuits: Securing hardware against probing attacks[END_REF], O(n log n) refresh [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF], and an "ISW addition" made of a share-wise addition preceded by an ISW refresh of each input), and on an ISW multiplication with a circular refresh on one of the inputs. On linear gadgets, the constructive algorithm can go about two coefficients further than the enumerative one simultaneously, thus producing much more precise results. Furthermore, the constructive algorithm verifies larger, previously out-of-reach gadgets. For instance, a 9-share ISW addition contains 243 variables and thus contains 243 9 ≈ 7 * 10 15 tuples of size 9 (for 8-RPS*), which is clearly beyond the capabilities of the enumerative algorithm. Nevertheless, our constructive algorithm can generate all of its failures of size 9 in 7 minutes. However, the constructive algorithm is slower on multiplication gadgets than the enumerative one. Table 7.4 illustrates this on an ISW multiplication with an ISW refresh on one of the inputs. This can be explained by the fact that many tuples are generated multiple times by this constructive algorithms, each time through a different path in the recursion. For instance, on the refresh gadget of Figure 7.1b, the tuple (a 0 , a 1 +r 0 , a 2 +r 1 , a 1 +r 0 +r 1 ) can be generated by selecting (a 0 , a 1 + r 0 , a 2 + r 1 ) as the initial tuple (line 23 of Algorithm 13), and then adding a 1 + r 0 + r 1 at line 18. However, the same tuple can also be generated by selecting (a 0 , a 1 + r 0 + r 1 , a 2 + r 1 ) at line 23 and then adding a 1 + r 0 at line 18. This phenomenon is even more impactful when dealing with multiplication gadgets because multiple shares of the same input will appear on the same wire, resulting in larger columns (particularly in the "inputs" part of the Columns map), which can lead to a worst complexity than simply enumerating all tuples.

Additionally, the constructive algorithm does not perform well when checking t-NI or t-RPS* with t < n -1, SNI, RPC, and RPE. The reason is that the traditional enumerative algorithm enumerates all tuples regardless of the property being checked and the failure condition. However, with the constructive algorithm, for an n-share gadget, to generate tuples of that leak k shares, all n k possible combinations of shares must be tested. For instance, in our example of Figure 7.1b, to generate all failures leaking two shares, we would generate all failures leaking the 1 st and the 2 nd shares, then the ones leaking the 1 st and the 2 nd share, and, finally, the ones leaking the 2 nd and the 3 rd share. Testing these combinations quickly becomes less efficient than just enumerating all tuples, as in the basic enumerative approach.

Evaluation and Performance

To showcase IronMask, we start in Section 7.4.1 by providing new bounds for the maximum RPE leakage probability tolerated by some common gadgets (in the random probing model). Then, we compare the scope and performance (Section 7.4.2) of IronMask and existing verification tools: VRAPS and STRAPS in the random probing model, and maskVerif, matverif and SILVER in the probing model. The description files of the gadgets tested in the following sections are publicly available on IronMask's GitHub repository.

New Random Probing Expandability Results

So far, VRAPS [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF] was the only tool verifying the (t, p, ε)-RPE property. IronMask is several orders of magnitude faster than VRAPS, in addition to being complete (IronMask avoids failure false positives i.e. detected failure tuples which are not failures, unlike VRAPS), allowing us to compute more precise bounds for the coefficient of the failure function f (p) = ε and hence more precise bounds on the tolerated leakage probability. In particular, we consider the ISW multiplication and refresh [START_REF] Ishai | Private circuits: Securing hardware against probing attacks[END_REF], the O(n log n) refresh [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF], the circular refresh [START_REF] Barthe | Parallel implementations of masking schemes and the bounded moment leakage model[END_REF], as well as the addition, copy, and multiplication from Section 5.5. Additionally, we consider addition (resp. copy) gadgets obtained by doing an ISW or O(n log n) refresh on one of the inputs followed by a simple addition (resp. copy). Finally, we also evaluate a double-SNI multiplication [START_REF] Goudarzi | How fast can higher-order masking be in software?[END_REF] made of an ISW multiplication where one of the inputs is refreshed using circular refresh [START_REF] De Cnudde | Masking AES with d+1 shares in hardware[END_REF] (with n shares).

The results are shown in Table 7.5. For the t parameters, we used t = (n -1)/2 (with n shares) to maximize the amplification order (c.f. Section 4.4.1). We cannot precisely compute the maximum leakage probability tolerated in a reasonable time for large gadgets. Instead, we compute all failures up to a given c β , which allows us to obtain upper and lower bounds for the leakage probability.

For ISW multiplication, our results improve previous results obtained with VRAPS in two ways: by increasing the value β of the verification, we obtain tighter bounds on the failure event function f (p) and thus tighter intervals (and even exact values in some cases) for the tolerated leakage probability. Plus, thanks to the completeness of the verification of IronMask by avoiding failure false positives (unlike VRAPS), we obtain better values for the estimated tolerated leakage probability (by better, we mean higher probability values). For example, our results show that the (exact) tolerated leakage probability of the 6-share ISW multiplication is 2 -12 instead of the 2 -13 lower bound of Table 4.1 (Section 4.6, Chapter 4). For all the other gadgets in the table, we report the first verification results of the RPE property.

Comparison with State-Of-The-Art Tools

We compare IronMask to six carefully chosen state-of-the-art tools: maskVerif [START_REF] Barthe | Verified proofs of higher-order masking[END_REF][START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF][START_REF] Barthe | maskVerif: Automated verification of higher-order masking in presence of physical defaults[END_REF] (and its extension scVerif [START_REF] Barthe | Masking in fine-grained leakage models: Construction, implementation and verification[END_REF]), matverif [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF], SILVER [START_REF] Knichel | SILVER -statistical independence and leakage verification[END_REF], VRAPS [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF], and STRAPS [START_REF] Cassiers | Towards tight random probing security[END_REF], with which our new tool IronMask share the following features:

• do not rely on any gadget's structure (unlike e.g., maskComp [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF], tightPROVE [START_REF] Belaïd | Tight private circuits: Achieving probing security with the least refreshing[END_REF],

Tornado [START_REF] Belaïd | Tornado: Automatic generation of probing-secure masked bitsliced implementations[END_REF]),

• verify probing or random probing-like security notions.

We discuss the concretely verified properties and provide benchmarks highlighting the main differences with IronMask.

Scope. Introduced in 2015 [START_REF] Barthe | Verified proofs of higher-order masking[END_REF] and then extended multiple times ( [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF][START_REF] Barthe | maskVerif: Automated verification of higher-order masking in presence of physical defaults[END_REF]), maskVerif is the very first tool able to verify reasonable higher-order masking schemes. Based on a symbolic representation of leakage, it integrates the language-based verification of (robust) probing security and (S)NI notions with or without leakage on register transitions. One step further, the latest extension of maskVerif, referred to as scVerif [START_REF] Cassiers | Towards tight random probing security[END_REF], captures even more hardware side effects, potentially configurable by the user [START_REF] Barthe | Masking in fine-grained leakage models: Construction, implementation and verification[END_REF]. Compared to our proposal, maskVerif includes tricks to verify bigger circuits (e.g., s-boxes, block encryption scheme) but fails to provide a complete verification as soon as the randomness is not linear (i.e., failure false positives may be produced).

Similarly, matverif [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF] targets the same properties as maskVerif. It features a new method to obtain a complete verification (i.e., without any failure false positive) for specific circuits (e.g., ISW multiplications) and significantly improve its performance thanks to dimensionreduction strategies. Regarding supported gadgets, matverif is more limited than maskVerif and IronMask, as it does not support gadgets with non-linear randomness. Unlike our proposal and similarly to maskVerif, matverif focuses only on verifying probing-like properties.

Following a different strategy, SILVER [START_REF] Knichel | SILVER -statistical independence and leakage verification[END_REF] was built by Knichel, Sasdrich, and Moradi to verify the physical security of hardware designs. It takes as input either a Verilog implementation or an instruction list and checks the probing (S/PI)NI notions in the standard and robust models and the uniformity of some output sharing. On the one hand, it outperforms the capacities of maskVerif by offering a complete verification based on a symbolic and exhaustive analysis of probability distributions and statistical independence of joint distributions. On the other hand, its verification is significantly slower than that of maskVerif.

Introduced in 2020, VRAPS is the first tool to verify random-probing-like properties [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF]. Written in Python and SageMath, it was built to evaluate the RPE security of some base gadgets to assess the global security of the expanding compiler of [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF]. Specifically, VRAPS detects all the leaking tuples within an implementation with respect to the RPS , RPE1, RPE2, and RPC security properties as described in Section 7.1. Nevertheless, it suffers from low performance and, unlike IronMask, can generate failure false positives for both gadgets with linear and non-linear randomness. VRAPS supports more gadgets than IronMask which is limited to LR-gadgets and NLR-gadgets. Nevertheless, to our knowledge, all the masking gadgets in the literature fit the latter representations. While VRAPS can additionally (directly) verify bigger gadgets (i.e., composition of atomic gadgets), the performance and completeness would be deficient in practice. In addition, the verification of atomic gadgets using IronMask already makes it possible to obtain secure global circuits since once individually verified (for probing or random probing properties), they can be safely composed (c.f. [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF] or Section 3.2).

Finally, STRAPS is a recent tool designed to verify random probing-like properties [START_REF] Cassiers | Towards tight random probing security[END_REF]. In particular, it was built to compute the distribution of a gadget's input sets of shares with respect to the output observations and the leakage probability of each internal wire. In its deterministic mode, it relies on maskVerif as a basic primitive. It integrates a probabilistic mode based on Monte-Carlo methods, significantly improving performance by avoiding a complete exploration and limiting the analysis to selected tuples. While the probabilistic mode can allow increased performance and thus more accurate results for random probing properties, it uses a set of rules from maskVerif as a building block. These rules by construction do not provide complete verification, which implies that the verification method of STRAPS is incomplete too. 7.6 recalls the categories of properties (as in Section 7.1) that are verified by the tools mentioned above on higher-order masked implementations. It additionally specifies the consideration of hardware effects, i.e. glitches (captured in the robust probing model). A green check () means the row tool verifies the column property. On the contrary, a red cross () means that the row tool does not handle the column property. We can see that IronMask is the first tool to verify probing-like properties and random probing-like properties in the standard model and in the presence of glitches (robust model).

Additionally, IronMask offers a complete verification method for gadgets with linear randomness and for most deployed gadgets with non-linear randomness (mainly all known multiplication gadgets). The only other tool providing complete verification for such gadgets is SILVER but this is achieved by an exhaustive approach making its running time quickly prohibitive (see comparison hereafter).

Performance. We evaluate the performance of IronMask compared to other state-of-the-art verification tools in both the probing and random probing models.

Probing Model. We compared the time required by IronMask, maskVerif and matverif to check that some commonly-used gadgets are (n -1)-NI and (n -1)-SNI (abstracted NI and SNI hereafter for conciseness). In particular, the gadgets we considered are the ISW multiplication [START_REF] Ishai | Private circuits: Securing hardware against probing attacks[END_REF], the double-SNI multiplication [START_REF] Goudarzi | How fast can higher-order masking be in software?[END_REF][START_REF] Cassiers | Trivially and efficiently composing masked gadgets with probe isolating non-interference[END_REF] using an ISW multiplication and a circular refresh [START_REF] De Cnudde | Masking AES with d+1 shares in hardware[END_REF] on one of the inputs, the new NI and SNI multiplications from [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF], and the O(n log n) refresh [START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF]. The results are presented in Table 7.7. We used the multi-threaded version of each tool, setting the maximal number of cores to use to 4, to give a fair chance to maskVerif: while IronMask and matverif can use an arbitrary number of cores, maskVerif is limited to 4 cores. We evaluated several masking orders for each gadget to highlight each tool's scaling. To save time, we did not run the verification of gadgets when it would have taken more than a few hours. Finally, to analyze a gadget, matverif needs probes description files to be generated using a SageMath script and the main program to be recompiled. While the incurred additional time was ignored in [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF], we take it into account so that the time we report reflects the actual time that a user would need to check those gadgets.

Before discussing the results, we recall that the three tools are not functionally equivalent. maskVerif can handle any circuit, while IronMask is limited to LR-gadgets and NLR-gadgets as characterized in Section 7.2, and matverif only handles LR-gadgets. On the other hand, the verification of IronMask is complete for both types of gadgets, while maskVerif's is not. In addition, while IronMask is limited to LR-gadgets and NLR-gadgets, to the best of our knowledge, all the masking gadgets in the literature fit the latter representations, and the verification of atomic gadgets already makes it possible to obtain secure global circuits through composition.

Overall, the three tools have similar performance and allow the analysis of gadgets up to similar masking orders, although each tool has strengths and weaknesses. For instance, maskVerif performs better on LR-gadgets, while matverif shines on LR multiplications. In the following, we investigate the relative speed of each tool in more detail.

Five main factors need to be considered to analyze the performance of IronMask compared to matverif. First, matverif's method to verify a tuple of probes on an LR-gadget has linear complexity in the tuple's length, while our SIS_LR method has the complexity of a Gaussian elimination which in our implementation is quadratic in the tuple's length. Second, the dimension reduction performed by IronMask is faster than that of matverif in most cases, probably because ours is written in C and matverif's in SageMath. Third, our dimension reduction often removes more wires, resulting in fewer tuples. Fourth, matverif needs to be recompiled for each gadget. Fifth and last, on linear gadgets (add and copy) and when checking (n -1)-NI, IronMask uses the constructive algorithm (see Section 7.3.5), which is much faster than any enumerative algorithm. It can be observed through Table 7.7 that the scale of the speedups offered by IronMask compared to matverif and maskVerif depends mainly on the structure and nature of the gadgets. We will explain the reason for this scaling depending on the tested gadgets. matverif tends to be slower than IronMask at smaller masking orders and at any order when checking (n -1)-NI on linear gadgets. However, at the highest masking orders, the cost of the dimension reduction and the recompilation of matverif becomes negligible compared to the main enumerative algorithm. matverif thus becomes faster than IronMask, thanks to its linear complexity in the tuples' length (compared to the quadratic complexity of IronMask's SIS_LR primitive).

On the standard ISW multiplication and the multiplication from [START_REF] Bordes | Fast verification of masking schemes in characteristic two[END_REF], both matverif and IronMask outperform maskVerif thanks to the dimension reduction they use (see Section 7.3.3), which is not implemented in maskVerif. For instance, the 7-order ISW multiplication initially contains 220 variables, but only 77 remain after the dimension reduction.

The dimension reduction is much less potent on the double-SNI ISW multiplication with a circular refresh on the inputs. For the 6 th -order double-SNI multiplication, 175 probes must thus be considered against 57 for the standard 6 th -order ISW multiplication. As a result, maskVerif and IronMask have similar performance on this gadget.

The O(n log n) refresh is NI at any order since at no point multiple secret shares are part of the same probe. maskVerif has a special rule to detect that, resulting in the verification of NI that is almost instantaneous. We did not add this special rule in IronMask, but our constructive algorithm (presented in Section 7.3.5) can detect that the gadget is indeed NI very quickly. However, to check that this gadget is SNI, both matverif and IronMask enumerate all tuples, which becomes very expensive as the masking order grows. As a result, checking that the 11 th -order gadget is SNI with IronMask would require at least a few days. On the other hand, maskVerif does not need to enumerate all tuples and can quickly determine that this gadget is SNI, taking just 5 minutes to do so at order 11. As mentioned earlier, SILVER, while being the only tool mentioned here that is complete on any gadget suffers from severe performance limitations. This is illustrated in Table 7.8, which shows that SILVER is several orders of magnitude slower than IronMask on the ISW multiplication and the O(n log n) refresh.

Random Probing Model. Table 7.9 shows the time needed by VRAPS and IronMask to compute the maximum tolerated leakage probability of the ISW multiplications when setting β to 4 (which is the maximum that is computable by VRAPS in reasonable time). IronMask was not multi-threaded in this benchmark, and we recall that VRAPS does not support multithreading. IronMask is several orders of magnitude faster than VRAPS in addition to being more precise (since VRAPS can incorrectly classify tuples as failures). Several factors explain the performance gains. First, IronMask is written in C, whereas VRAPS is written in SageMath. Second, IronMask uses a complete technique based on Gaussian elimination to determine if tuples are failures, whereas VRAPS uses SageMath's symbolic calculus to apply simplification rules inspired by maskVerif iteratively. Third, IronMask allocates less memory and performs its Gaussian elimination on the fly (see Section 7.3.4), whereas VRAPS allocates chunks of memory to store batches of tuples and restarts the simplifications from scratch for each tuple. The performance gains of IronMask over VRAPS have two main benefits. First, IronMask can be more beneficial for prototyping since it can provide approximate results for small β within a few seconds. Second, IronMask can compute exact and more precise results by increasing β, as shown in Table 7.5.

Conclusion

In this chapter, we introduced our verification tool IronMask, which offers an exact verification for most gadgets in the state of the art, using an algebraic characterization of the probes inspired from [START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF][START_REF] Belaïd | Private multiplication over finite fields[END_REF]. We discussed how to extend this algebraic characterization to gadgets with linear and non-linear randomness and how to use it to implement SIS, our building block used to verify any (random) probing-like property. We showed that IronMask is competitive with other tools in the literature for probing-like properties and is more efficient than existing tools for checking properties in the random probing model. Namely, IronMask can verify the RPC and RPE properties discussed in the previous chapters. It gives tighter results than the original tool VRAPS and can verify gadgets for bigger numbers of shares.

Future works include generalizing the algebraic characterization of probes to gadgets with more than quadratic randomness. In other words, non-linear randomness is restricted to quadratic, where we refresh some inputs and then perform multiplication between those inputs. This characterization could be generalized to any level of non-linearity on the randoms in the gadget. A possible approach would be to extend this characterization to a leveled approach where we partition randoms into different layers and process them iteratively from bottom to top. One challenge is when the same random is used in different layers, in which case, special processing is needed. Nevertheless, the benefit of this generalization would be to verify broader types of circuits not restricted to atomic gadgets anymore.

Another direction for future works is to combine the fast verification of IronMask with recent automatic verification tools combining fault and probing attacks on circuits, such as VERICA [START_REF] Richter-Brockmann | VER-ICA -verification of combined attacks automated formal verification of security against simultaneous information leakage and tampering[END_REF]. The latter tool verifies combined security properties in the fault probing model but relies on the slow verification technique of SILVER. The goal would be to extend the algebraic characterization and verification techniques of IronMask to take faults into account (i.e. in the fault probing and fault random probing models), to achieve faster verification in these combined models, inspired by the verification techniques against fault attacks in VERICA.

Chapter 8

Conclusion

During this thesis, we studied the security of masked constructions in the random probing model. We introduced the first composition notion in this model in [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF], analogous to the ones in the probing model. Our random probing composability notion allows safely composing gadgets while preserving global security in the resulting circuit.

In [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF], we also studied a powerful approach, the expansion strategy, which allows for achieving arbitrary levels of security in the random probing model. Inspired by [START_REF] Ananth | Private circuits: A modular approach[END_REF], we provided a practical instantiation of the approach using expanding compilers equipped with gadgets instead of MPC techniques as in [START_REF] Ananth | Private circuits: A modular approach[END_REF]. We presented the random probing expandability notion and showed that any gadget satisfying this notion could be used with an expanding compiler. Indeed, the gadgets' choice affects the expansion's complexity to achieve the desired security level. Namely, we showed that achieving κ bits of security using expansion on a circuit C induces a complexity of O(|C| • κ e ), where |C| is the number of gates in the circuit and e is a parameter which depends on the size of the gadgets in the expanding compiler and the parameter that we referred to as the amplification order. The latter is the size of the smallest set of probes that reveal information about the secret inputs and relates to the simulation failure function of the random probing security of the gadgets. The bigger this amplification order and the smaller the size of the gadgets, the lower the complexity exponent e becomes. We provided bounds on the best amplification order achievable. Then, we constructed a 3-share expanding compiler, which outperforms the MPC construction from [START_REF] Ananth | Private circuits: A modular approach[END_REF] without achieving the optimal amplification order. Our construction tolerates a leakage rate of 2 -7.09 with a complexity of O(|C| • κ 7.5 ), while we showed that the one from [START_REF] Ananth | Private circuits: A modular approach[END_REF] tolerates a rate of 2 -26 with a complexity of ≈ O(|C| • κ 8 ). We finally provided an open-source implementation of our expanding compiler and a proof-of-concept masked AES1 .

After that, we pushed the limits of the expansion strategy and showed that optimal complexities could be achieved in [START_REF] Belaïd | On the power of expansion: More efficient constructions in the random probing model[END_REF]. We tightened the random probing expandability notion, showed its relation to the SNI notion in the probing model, and used this analysis to exhibit generic constructions of addition and copy gadgets achieving the maximal amplification order, using a refresh gadget as a building block. Using this generic construction instantiated with the well-known ISW scheme and a new multiplication gadget we introduced, we could construct 3-share and 5-share expanding compilers, achieving the maximal amplification orders and thus giving much better complexities. Our 3-share compiler tolerates a leakage rate of 2 -7.5 with a complexity of O(|C| • κ 3.9 ), while our 5-share compiler tolerates a slightly lower leakage rate 2 -7.66 ≤ p ≤ 2 -9.67 with a better complexity of O(|C| • κ 3.23 ).

Next, we discussed that the complexity of the expanding compiler decreases as the number of shares n grows, but also the tolerated leakage rate decreases. This motivated us to introduce the dynamic random probing expansion strategy in [START_REF] Belaïd | Dynamic random probing expansion with quasi linear asymptotic complexity[END_REF] , which benefits from the best of both worlds: the best asymptotic complexities of constructions for large numbers of shares and the best tolerated leakage rates of constructions for a small and fixed number of shares. We tackled the problem of optimal asymptotic complexity, providing new constructions of linear gadgets with quasi-linear global complexity using the O(n log n) refresh gadget, as well as a multiplication gadget that performs a linear number of multiplications. These new constructions gave a new expanding compiler with sub-quadratic values for the complexity exponent e.

We saw that many future works are possible in the random probing model. For instance, we can look for constructions of small gadgets that tolerate the best leakage probability for a fixed number of shares (e.g. n = 3). Proving bounds on the tolerated leakage rate depending on the structure of the gadgets can also help perform an exhaustive search for such optimal constructions. Also, as stated in Remark 2, we can integrate the tight composition technique from [START_REF] Cassiers | Towards tight random probing security[END_REF] based on probe distribution tables into our expansion strategy to benefit from tighter results but also from the security levels that can be achieved using the expanding compilers. Another example for future works is to look for efficient constructions of the expanding compilers while considering the underlying parameters, such as the used field or the physical defaults of the underlying device.

In a parallel work [START_REF] Belaïd | Ironmask: Versatile verification of masking security[END_REF], we introduced a powerful verification tool, IronMask, offering a complete verification technique for most gadgets in the state-of-the-art and covering all security properties in the probing and random probing models. Our technique relies on an algebraic characterization of probes on gadgets with a Gaussian elimination-based approach. We showed that our tool is the fastest verification tool for the random probing model and is competitive with verification tools in the probing model. Future works include extending the algebraic characterization used in IronMask to cover more gadgets and circuits than the current ones. Another direction would be to integrate the combined probing and fault verification techniques from VERICA [START_REF] Richter-Brockmann | VER-ICA -verification of combined attacks automated formal verification of security against simultaneous information leakage and tampering[END_REF] into IronMask to extend the verification to more extended models. Indeed, VERICA only considers the probing model and relies on techniques from SILVER, which are relatively slow, while a possible approach is to also consider faults in the random probing model and extend the verification technique with the efficient method of IronMask.

The end of this thesis is only the beginning of research in this field. Having proven security levels against side-channel attacks is essential. While current theoretical constructions are still far from being practical to achieve high security levels (such as 128 bits of security), as shown in Section 4.7 on the AES implementation, it still offers a proof-of-concept achieving such levels. However, further research is necessary to ultimately bridge the gap between theory and practice. Verification tools help us achieve this goal by offering a reliable method to validate our constructions. One can even look for constructions directly in the noisy leakage model based on the obtained results on the random probing model.

On the Practical Usability of Leakage Models

The noisy leakage, random probing, and t-probing models have proven helpful for the community to model side-channel attacks theoretically and provide formal security proofs on masked implementation. Meanwhile, applying these security proofs to real-world implementations is still challenging.

First, the theoretical literature lacks a proper methodology to implement proven secure constructions in the leakage models on a physical device while preserving the proven security levels. Second, these leakage models rely on two assumptions about the physical device for which a systematic investigation is lacking: the leakage of an elementary operation only depends on its inputs (i.e. the data isolation assumption), and the leakage's noise of an operation is independent of the previous and following noises (i.e. the noise independence assumption).

The first assumption (data isolation) can be easily broken, for instance, due to physical effects on a device. In particular, transitions occurring on memory buses or CPU registers between a previously processed value x i-1 and the current one x i usually leak some information correlated to x i-1 ⊕ x i , which violates the data isolation principle [START_REF] Coron | Conversion of security proofs from one leakage model to another: A new issue[END_REF][START_REF] Balasch | On the cost of lazy engineering for masked software implementations[END_REF]. On the hardware level, glitches further make the successive gates' leakages mutually dependent on their respective inputs [START_REF] Mangard | Side-channel leakage of masked CMOS gates[END_REF][START_REF] Mangard | Side-channel leakage of masked CMOS gates[END_REF][START_REF] Mangard | Successfully attacking masked AES hardware implementations[END_REF]. On the software level, CPU synchronization limits, but does not eliminate, the issue of glitches. These issues can be avoided by adding registers and controlling transitions [START_REF] Faust | Composable masking schemes in the presence of physical defaults & the robust probing model[END_REF][START_REF] Cassiers | Provably secure hardware masking in the transition-and glitch-robust probing model: Better safe than sorry[END_REF] in hardware, and by trying to avoid transitions using assembly programming tricks in software [START_REF] Gao | Share-slicing: Friend or foe? IACR Transactions on Cryptographic Hardware and Embedded Systems[END_REF][START_REF] Bronchain | Bitslicing arithmetic/boolean masking conversions for fun and profit with application to lattice-based KEMs[END_REF][START_REF] Bloem | Power contracts: Provably complete power leakage models for processors[END_REF]. However, these techniques still rely on abstract models for the leakage, and current techniques in the literature test the data isolation assumption only indirectly, by estimating the statistical security order of an implementation [START_REF] Barthe | Parallel implementations of masking schemes and the bounded moment leakage model[END_REF][START_REF] Schneider | Leakage assessment methodology -A clear roadmap for side-channel evaluations[END_REF].

As for the second assumption (noise independence), the noise in the side channel leakage of a device is multivariate, and the noises occurring during successive operations likely include some dependency. This assumption is only currently studied at a high level in a few works [START_REF] Grosso | Masking proofs are tight and how to exploit it in security evaluations[END_REF][START_REF] Marios | Efficient multivariate statistical techniques for extracting secrets from electronic devices[END_REF].

In [START_REF] Belaïd | A methodology to achieve provable side-channel security in real-world implementations[END_REF], we tackle the above issues by proposing a complete methodology to transform abstract circuits into physical implementations secure against side-channel attacks. For this purpose, we rely on a random probing compiler and discuss the concrete steps to use the reduction from the noisy leakage model to the random probing model on physical implementations. While this reduction is well-studied in theory, our methodology summarizes all hypotheses that must be met in practice and identifies technical challenges that must be overcome to achieve formally secure circuits on physical devices.

Then, we propose new tools to solve these technical challenges. Namely,

• we explain how to enforce the data isolation assumption and introduce a novel practical test for its validation on a physical implementation. Our test offers a direct approach, contrasting with existing methods in the literature. We conduct experiments on a real target, an STM32F3 MCU, using NewAE's ChipWhisperer-Lite CW1173 board. While our test does not provide a formal proof for the assumption, it stands as the first literature instance of directly addressing and validating this hypothesis with a practical, dedicated procedure,

• we also offer a method to integrate the noise independence assumption into the analysis, making it possible to quantify the loss of security implied by a lack of independence. We specifically discuss a relaxation of the assumption aiming to split the noise occurring during the execution of the algorithm into independent noises on each of the operations. We first show a trivial way of doing the split and then express it as a constrained optimization problem that better scales with the size of the circuit. We propose a direct non-optimal solution to the problem and leave the question of optimally and efficiently solving it as an open problem.

Finally, we highlight the design goals that this security reduction involves. We also exhibit the remaining limitations and open problems of the practical usability of the leakage models. Our goal is to show that it is possible to bridge theory and practice and to motivate further research on remaining issues to fully close the gap, that is to get practical implementations proven secure against side-channel attacks on a physical device without any ideal assumption about the leakage.

• • • a 2 • b (2) n . . . . . . . . . . . . a n • b (n) 1 a n • b (n) 2 • • • a n • b (n) n       .
Then, it picks n 2 random values which define the following matrix:

R =      r 1,1 r 1,2 • • • r 1,n r 2,1 r 2,2 • • • r 2,n . . . . . . . . . . . . r n,1 r n,2 • • • r n,n      .
It then performs an element-wise addition between the matrices M and R:

P = M + R =      p 1,1 p 1,2 • • • p 1,n p 2,1 p 2,2 • • • p 2,n . . . . . . . . . . . . p n,1 p n,2 • • • p n,n      .
At this point, the gadget randomized each product of input shares from the matrix M with a single random value from R. In order to generate the correct output, the gadget adds all the columns of P into a single column V of n elements, and adds all the columns of the transpose matrix R T into a single column X of n elements:

V =      p 1,1 + • • • + p 1,n p 2,1 + • • • + p 2,n . . . p n,1 + • • • + p n,n      , X =      r 1,1 + • • • + r n,1 r 1,2 + • • • + r n,2 . . . r 1,n + • • • + r n,n     
The n-share output is finally defined as (c 1 , . . . , c n ) T = V + X such that

c 1 = V 1 + X 1 . . . c n = V n + X n .
(a 1 , . . . , a n )

I a I b (b 1 , . . . , b n ) I (1) b W (1) G refresh J (1) b (b (1) 1 , . . . , b (1) n
) . . . . . . I (n) b W (n) G refresh J (n) b (b (n) 1 , . . . , b (n) n ) W G submult J (c 1 , . . . , c n ) Figure A.1: G mult gadget from Section 5.4. Figure A.
1 represents the G mult gadget from a high-level, composed of several blocks. First, a refresh gadget G refresh is executed n independent times on the input sharing of b to produce n fresh copies b (1) , . . . , b (n) . Then, the gadget G submult takes as input (a 1 , . . . , a n ) and the outputs of the refreshing gadgets b (1) , . . . , b (n) to produce the output of G mult .

In the following proofs, we will denote W to be any set of probes on the global gadget G mult , then W can be split as W = W ∪ W (1) ∪ . . . ∪ W (n) where W (i) is the set of probes on the internal wires of the execution of G refresh for the fresh sharing b (i) of b, and W is the set of probes on the internal wires of G submult . We will also denote J to be any set of output wires of G mult (which are the output wires of G submult ), and J ) any set of output wires (resp. input wires) of the execution of G refresh for the fresh sharing b (i) of b. Observe that any probe on the output wires of G refresh for any sharing b (i) can be obtained through internal probes in W on G submult , so in the beginning we always consider that J

(i) b = ∅ for all i ∈ [n].
Observe that any probe in the set W on the internal wires of G submult is of one of the following forms:

(a) a i , b (i) j , a i • b (i) j , r i,j , p i,j = a i • b (i) j + r i,j , (b) V i,j partial sum of the first j terms of V i . Observe that V i,n = V i , (c) X i,j partial sum of the first j terms of X i . Observe that X i,n = X i .
Also observe that each random value r i,j only appears in the expression of the wires r i,j , p i,j , V i,j , or X j,i (so also c i = V i + X i and c j = V j + X j ), and does not appear anywhere else in the wires.

We will first start by proving some simple claim.

Claim 1. Let J be a set of output shares of G mult and W = W ∪ W (1) ∪ . . . ∪ W (n) be a set of leaking wires as described above such that |J| + |W | ≤ n -1 (we only consider the set W of probes on the internal wires to G submult ). Then, for any i ∈ J such that V i,j / ∈ W for any j ∈ [n], the output wire c i can be perfectly simulated by generating a uniform random value without knowing any of the input shares. b , and by generating uniformly random values r i,j when necessary. Probes of the form (c) are also perfectly simulated by simply generating uniformly random values, since X i,j = r 1,i + . . . + r j,i . As for probes of the form (b), we know that i ∈ I a and i ∈ J (i) b , then we look at each of the terms p i,j for j ∈ [j] in V i,j = p i,1 + . . . p i,j . In particular, if j ≥ i, the term p i,i is in the partial sum V i,j and is perfectly simulated using the input shares a i and b (i) i and by generating the random value r i,i . Next, for each p i,j such that j = i, if j ∈ J (i) b , then p i,j can be perfectly simulated from the corresponding input shares and by generating uniformly at random r i,j . Otherwise, if j / ∈ J (i) b , then that means that the wires p i,j , r i,j and X j are not probed in W because otherwise j would have been added to all J (k) b for k ∈ [n]. Since the random value r i,j only appears in the expression of the wires p i,j , r i,j and X j (besides V i,j which is already probed), and of the output wire c j = V j + X j' , we need to consider two cases:

• j / ∈ J: in this case, the random value r i,j can be used to mask the expression of p i,j in the partial sum V i,j , perfectly simulating it without the need to the share b (i) j .

• j ∈ J: c j = V j + X j , and r i,j is the one of the summed terms in the expression of X j .

We know that V j ,k / ∈ W for any k ∈ [n] since otherwise j would have been added to J

(i) b . Since in addition we have |J| + |W | ≤ t + d -1 ≤ t + n -t -1 ≤ n -1,
by claim 1, the output share c j can be masked by some random value r j , . Thus, X j is masked and r i,j does not appear anymore in c j . So r i,j can be used to mask the expression of p i,j in the partial sum V i,j . This brings us to a perfect simulation of p i,j simply by generating at random r i,j .

By perfectly simulating each of the terms p i,j for j ∈ [j] in the probed wire V i,j independently, we can perfectly simulate their sum and thus perfectly simulate V i,j . This brings us to a perfect simulation of the set W .

Simulation of J:

Let i ∈ J. • if V i,j / ∈ W for any j ∈ [n],
then by claim 1, c i is perfectly simulated by simply generating a uniform random value r i, for some ∈ [n].

• if V i,j ∈ W for at least one j ∈ [n], then let V i,j be the largest of the probed partial sums. All of the partial sums including V i,j are perfectly simulated as described earlier.

Then, let us consider c i + V i,j = p i,j +1 + . . . + p i,n + X i . The wire X i can be perfectly simulated by generating uniform random values. As for each of the terms p i,j +1 , . . . , p i,n , they can each be perfectly simulated in the exact same way each of the terms in V i,j are simulated independently.

In the particular case where j ≤ i then the term p i,i = a i • b (i) i + r i,i appears in the expression of c i + V i,j , and in this case, the random value r i,i is cancelled out in the expression of c i + V i,j since it appears in both p i,i and X i , and c i + V i,j = p i,j +1 + . . . + p i,i + . . . + p i,n + X i . So to simulate the term p i,i in c i + V i,j we need both input shares a i and b (i) i . This is already the case by construction because we assume that V i,j ∈ W . Thus, by perfectly simulating V i,j and c i + V i,j , the output share c i is also perfectly simulated. We have shown that we can perfectly simulate any set of t output shares J and any set of probes W of size at most d -1, with at most min(|W |, t) shares of each of the inputs a and b. This concludes the proof of Lemma 25.

Also, since |J

Remark 8. We can observe that for this lemma to apply on G mult , we do not need the preprocessing phase of the refresh on input b. In fact, we can see that during the construction of the sets J To get back to the proof of Lemma 24, we also need the following result. Proof. Recall that the set W can be split into subsets W = W ∪ W (1) ∪ . . . ∪ W (n) as described above. We can consider two cases.

Case 1: |W | ≤ d -1. This case is similar to the case of Lemma 25, so we can construct the set I a in the same way as in the proof of Lemma 25, and we can eventually consider

I b = [n]. We know that |I a | ≤ |W | ≤ d -1 ≤ t,
so there is no failure on the input a. And all probes in W can be simulated like in the proof of Lemma 25 with I a and trivially with I b = [n]. Also, all probes in W (1) ∪ . . . ∪ W (n) can be trivially simulated since we have access to the full input b. As for output shares in J, whenever i ∈ J ∩ I a , then from empty sets, in a way that we will have a simulation failure on at most one of the inputs a or b, and we will be able to perfectly simulate W and output shares in J using I a and J (k) b . We will also show how to perfectly simulate all J (k) b and W (k) using a set of input shares I b .

c i = V i + X i is easily simulated using I b = [n]. If i ∈ J but i / ∈ I a , then V i,j / ∈ W for any j ∈ [n] and since |J| + |W | ≤ t + d -1 ≤ t + n -t -1 ≤ n -1, c i is
First, we construct the sets I a and J (c) For probes of form (c), we add index i to J

(k) b for all k ∈ [n].
In the rest of the proof, we will show that if we have a failure on one of the inputs, we can still perfectly simulate W and J without a failure on the other input. In this purpose, we will consider two cases: in the first case (2.1), we will have a failure on input a (i.e., more than min(t, |W |) shares of a are added to I a ) and in the second case (2.2), we won't have a failure on input a, and so we will eventually have a failure on input b. can be perfectly simulated using the simulator of G refresh without a failure on the input b. Next, we will show that W and output shares in J can be perfectly simulated using I a and J (k) b . Since we only add shares indices to I a when we have probes of the form (a) or (b), this means that we have at least t + 1 probes of these two forms with t + 1 different values for the index i. In addition, since we have at least t + 1 probes (a) or (b) with distinct values for the index i, then this also means that each of the sets J In other words, for each i ∈ [n] there is exactly one probe in W of the form (a) or (b) and no probe of the form (c) i.e X i,j nor probes in W (1) ∪ . . . ∪ W (n) . We will prove that all the probes in W and in J can be perfectly simulated from these constructed sets I a and J If we also have i ∈ J, then we know that we only have one probe of the form (a) for the considered index i in W and no probe of the form (b) or any probe of the form (c). And since there are t output shares probed in J, then there are at least n -t -1 > 1

(since t = n -1 2
) remaining random values which only appear in the expression of c i , and any of them can be used to perfectly simulate c i without the knowledge of the input shares (i.e., to mask c i ).

• V i,n ∈ W then V i,n contains in its expression n random values r i,1 , . . . , r i,n . Since there are no probes of the form (a) for the index i, and no probes of the form (c), then each of these random values appears at most once in each of the expressions of the probed outputs c j in J. With t probed output shares, there are n -t > 1 (since t = n -1 2 ) remaining random values which only appear in the expression of V i,n and any of them can be used to perfectly simulate V i,n , i.e., mask V i,n .

If in addition we have i ∈ J, then the output share c i is perfectly simulated by simulating V i,n and simulating c i + V i,n = X i which is perfectly simulated by generating uniform random values.

• V i,j ∈ W for some j ∈ [n] such that 1 < j < n (j > 1 because otherwise it would be the wire p i,1 which is probed). Thus, V i,j is the sum of at least two wires p i,j 1 and p i,j 2 .

-If i / ∈ J, then c i is not probed and V i,j is the sum of at most n -1 terms of the form p i,1 = a i • b (i) 1 + r i,1 , . . . p i,j = a i • b (i) j + r i,j . We have that i ∈ I a by construction and j ∈ J In addition, we can perfectly simulate this way all of the summed terms in V i,j by using the corresponding input shares and thus we can perfectly simulate V i,j . Since we have no probes of the form (a) for this same index i, then reconstructing J does not affect the simulation of the probes.

-If i ∈ J, then we consider V i,j and c i + V i,j . Since we have no probes of the form (a) for the index i, then as proven before, with t probed output shares, there are at least n -t > 1 remaining random values which only appear in the expression of V i,j or c i + V i,j . Any of these random values can be used to mask the expression of V i,j or c i + V i,j . In the case where the expression of V i,j is masked, then we can reconstruct as before the set J (i) b with at most n -1 output shares of b (i) in order to perfectly simulate all the terms p i,k in c i + V i,j including the shares of b (i) and thus perfectly simulate c i + V i,j (the rest of the terms are just random values to be generated uniformly at random). In the other case where the expression of c i + V i,j is masked, we can also reconstruct the set J (i) b with at most n -1 output shares of b (i) in order to perfectly simulate all the summed terms in V i,j . In either case, by perfectly simulating one term (V i,j or c i + V i,j ) masked by a random value, and perfectly simulating the remaining one with i ∈ I a and the reconstructed set J (i) b , we can perfectly simulate both V i,j and c i + V i,j and hence also perfectly simulate the output share c i .

So we proved that we can perfectly simulate the sets W and J from the constructed set I a and from sets J or p k,j is probed, and no random value r k,j is probed since otherwise we would have k ∈ I a by construction.

On another hand, since |I a | ≥ t + 1, there are at most d -1 ≤ n -t -1 remaining probes of the form (c) in W , and since we have t output shares in the set J, there exists at least one wire X such that / ∈ J and for which there is no partial sum X ,j probed in W . These two wires X and V k for , k ∈ [n] will be very important for the simulation of the sets W and J. In particular, we need the two following claims.

Claim 2. Let i ∈ J. Suppose that i / ∈ I a . Then the expression of c i = V i + X i can be masked by the random value r i, , in other terms c i ← r i, .

Proof. This claim can be proved easily, since we suppose that i / ∈ I a so the random value r i, and p i, are not probed in W . In addition, since / ∈ J and X ,j / ∈ W for all j ∈ [n], then the random value r i, does not appear in any other probed wire expression except in c i , then c i can be masked by the random value r i, .

Claim 3. Let i ∈ J. Suppose that X i,j / ∈ W for any j ∈ [n]. Suppose that i ∈ I a . Then the expression of c i = V i + X i can be masked by the random value r k,i , in other terms c i ← r k,i .

Proof. Since we suppose that k / ∈ I a , then the random value r k,i or p k,i or V k,j for all j ∈ [n] are not probed in W . Then, if k / ∈ J, then the random value r k,i does not appear in the expression of any other probed wire in W or J and c i can be masked by the random value r k,i . Otherwise, if k ∈ J, then by Claim 2, c k = V k + X k can be masked by r k, and so c i can also be masked by r k,i since i = (because i ∈ J and / ∈ J).

From these two claims, we are now ready to show that W and J can be perfectly simulated with the sets I a and J Let us now check the probes of the form (b). Let V i,j = p i,1 + . . . + p i,j be such a probe. Let us consider each of the terms p i,j for j ∈ [j]. if j = i, then by construction p i,i is perfectly simulated using a i and b (i) i and by generating the random value r i,i if needed. Otherwise, let j = i. If j ∈ J (i) b then the simulation of p i,j is straightforward. Otherwise if j / ∈ J (i) b , then we know that none of the wires r i,j or p i,j or X j ,s for all s ∈ [n] are probed in W . Thus, r i,j can be eventually used to mask the expression of p i,j without the need of the share b (i) j for the simulation. Meanwhile, we still need to check if j ∈ J, since X j appears in the expression of c j = V j + X j . Then we consider two cases:

• If j / ∈ I a , then by claim 2, c j can be masked by the random value r j , and so r i,j does not appear in the expression of X j in c j anymore, and r i,j can be used to mask p i,j .

• Otherwise, if j ∈ I a , then by claim 3, c j can be masked by the random value r k,j and so r i,j does not appear in the expression of X j in c j anymore, and r i,j can be used to mask p i,j (since i / ∈ k).

Thus, each term p i,j in V i,j can be perfectly simulated and thus V i,j = p i,1 + . . . + p i,j can be perfectly simulated. This concludes the simulation of the set W . Simulation of J. Let i ∈ J. If i / ∈ I a , then by claim 2, c i is perfectly simulated by generating the random value r i, . Otherwise, let i ∈ I a . If X i,j / ∈ W for any j ∈ [n], then by claim 3, c i is perfectly simulated by generating the random value r k,i . Otherwise, we can show that we can perfectly simulate each term in c i = V i + X i . In particular, each term in X i can be simulated by generating the underlying random value uniformly. For each term in the sum V i , we know in particular that a i • b (i) i is perfectly simulated since X i,j ∈ W for at least one j ∈ [n] so i ∈ J (i) b by construction. For the other terms in V i , they can be perfectly simulated in the exact same way as we simulated the probes V i,j of the form (b) in the set W . So c i is perfectly simulated by summing all the perfectly simulated terms. This concludes the simulation proof for the set J.

Up until now, we have concluded that if we have a constructed set I a of size at least t + 1, then we can perfectly simulate the sets W and J without having a simulation failure on the input b. In the rest of the proof, we will consider that |I a | ≤ t (along with |I a | ≤ |W | by construction meaning that we have no failure on input a), and we will prove that we can perfectly simulate W and J with at most a simulation failure on b. Recall that we are also considering that |W | ≥ d and |W (1) ∪ . . . ∪ W (n) | ≤ d -1.

Case 2.2: |I a | ≤ t. This means that the number of probes of the form (a) or (b) in W with distinct values for the index i is at most t.

First, let us consider that |I a | ≥ d (this is the case where d = n -t ≤ t + 1). Then, as proved earlier, and with t additional output shares in J of the form c i = V i + X i , there are at least one X remaining such that / ∈ J and X ,j / ∈ W for all j ∈ [n]. In this case, we can set I b = [n] and I a as constructed with respect to the probes in W . It is clear that all probes in W (1) ∪ . . . ∪ W (n) and J and generating the necessary random values. This means that we can perfectly simulate all of the set of probes W = W ∪ W (1) ∪ . . . ∪ W (n) . As for the set of output shares indexed in J. Let i ∈ J. If i ∈ I a , then c i is perfectly simulated using the share a i and I b = [n], and by generating the necessary random values. Otherwise, if i / ∈ I a , then in the same way as in claim 2, c i can be masked by the random value r i, (because / ∈ J and X ,j / ∈ W for all j ∈ [n]), so a i is not needed for the simulation of c i . This proves that we can perfectly simulate the output shares in J with I a and I b = [n].

In the rest, we suppose that |I a | ≤ d -1 ≤ n -t -1, i.e., the number of probes of the form (a) or (b) in W with distinct values for the index i is at most d -1 ≤ n -t -1. In this case, and with t additional output shares, we have at least one index k such that k / ∈ J and for which there are no probes in W of the form (a) or (b). In other terms, no partial sum of V k Lemma 28. Let W be a set of leaking wires as described above such that |W | < min(t+1, n-t). Then there exists a set J of n -1 output shares, such that W and J can be perfectly simulated from at most min(|W |, t) = |W | shares of each of the inputs a and b.

Proof. We will construct the set of input shares indices I a and the sets of output shares J b . The value of X will be useful to use the following claim. Claim 4. Let i ∈ J. Suppose that V i,j / ∈ W for all j ∈ [n]. Then the expression of c i = V i + X i can be masked by the random value r i, , in other terms c i ← r i, .

Proof. The proof of this claim is quite straightforward since we suppose that V i,j / ∈ W for all j ∈ [n], so none of the partial sums V i,j has been probed. Then V i in c i contains n -1 random values. In particular, we know that r i, and p i, only appear in the expression of the probed output c i , because if they were probed in W then we would have ∈ J which does not hold), then r i, does not appear in any other expression of the probed wires in W , so we can simply use it to perfectly simulate c i .

We can now show that the sets W and J can be perfectly simulated from the constructed sets I a and J Simulation of W . Probes of the form (a) can be perfectly simulated from the corresponding input shares in I a and J (k) b , and by generating uniformly random values r i,j when necessary. Probes of the form (c) are also perfectly simulated by simply generating uniformly random values, since X i,j = r 1,i + . . . + r j,i . As for probes of the form (b), we know that i ∈ I a , then we look at each of the terms p i,j for j ∈ [j] in V i,j = p i,1 + . . . p i,j . For each p i,j , if j ∈ J (i) b , Case 1: |W | < min(t + 1, n -t). This case is similar to the case of Lemma 28, so we can construct the set I a in the same way as in the proof of Lemma 28, and we can eventually consider I b = [n]. We know that |I a | ≤ |W | ≤ min(t + 1, n -t) -1 ≤ t, so there is no failure on the input a. And all probes in W can be simulated like in the proof of Lemma 28 with I a and trivially with I b = [n]. Also, all probes in W (1) ∪ . . . ∪ W (n) can be trivially simulated since we have access to the full input b. In addition, we choose the set J of size n -1 in the same way as in Lemma 28. Whenever i ∈ J and V i,j ∈ W for some j ∈ [n], then c i = V i + X i is easily simulated using I b = [n] and the share a i . If i ∈ J but V i,j / ∈ W for all j ∈ [n], then as in the proof of Lemma 28, c i in this case can be masked by the random value r i, (because |W | < min(t + 1, n -t)) and so simulating c i amounts to generating uniformly at random the corresponding random value. Thus, W and J are perfectly simulated with at most min(|W |, t) shares of a and eventually the full input b.

Case 2: |W | ≥ min(t + 1, n -t) (and thus |W (1) ∪ . . . ∪ W (n) | < min(t + 1, n -t)). In this case, we will construct the sets I a and J (k) b from empty sets, in a way that we will have a simulation failure on at most one of the inputs a or b. We construct the mentioned sets depending on the probes in W as follows:

(a) For probes of form (a), we add index i to I a , and index j only to J In the rest of the lemma, we will prove that if we have a failure on one of the inputs, we can still perfectly simulate W and a chosen set J of n -1 output shares without a failure on the other input. For this, we will consider two cases, the first where we have a failure on input a, the second where we don't have a failure on input a, and so we can eventually have a failure on input b. can be perfectly simulated using the simulator of G refresh without a failure on the input b. Next, we will show that W and a well chosen set of n -1 output shares in J can be perfectly simulated using I a and J (k) b . Since we only add shares indices to I a , when we have probes of the form (a) or (b), this means that we have at least t + 1 probes of these two forms with t + 1 different values for the index i. In addition, since we have at least t + 1 probes (a) or (b) with distinct values for the index i, then this also means that each of the sets J Now let us consider the remaining probes in W which are either in W of the form (c) or in W (1) ∪. . .∪W (n) or of the forms (a) or (b) with i ∈ I a . Since |I a | ≥ t+1 ≥ min(t+1, n-t), then there are at most min(t + 1, n -t) -1 of these remaining probes. Without loss of generality, we consider that there are exactly min(t + 1, n -t) -1 instead of at most min(t + 1, n -t) -1 probes. Let m be the number of probes in W (1) ∪. . .∪W (n) if for the considered i, the probe in W is of the form (a) i.e a i , b (i) j , a i • b (i) j , p i,j = a i • b (i) j + r i,j , then the simulation of this probe is trivial by construction of the sets I a and J (i) b . In addition, we know that r i, and p i, are not probed in W by assumption, and since X ,j / ∈ W for all j ∈ [n], then the random value r i, only appears in the expression of c i = V i + X i (specifically in V i ), and so can be used to mask c i . So simulating c i amounts to generating a fresh random value.

if for the considered i, the probe in W is of the form (b), i.e V i,j ∈ W for a certain j ∈ [n] (there is a unique probe of this form), then: * either j < , and so the random value r i, can be used as before to mask the expression of c i + V i,j , and since in this case V i,j contains less than n -1 terms p i,j , then we can add all the necessary shares of b (i) to J (i)

b without having a failure on b (recall that W (i) = ∅). So we can perfectly simulate V i,j and c i + V i,j , and hence also simulate c i . * or j ≥ , and so the random value r i, can be used in this case to mask the expression of V i,j so simulating V i,j amounts to generating a fresh random value, and since V i,j is the sum of at least two terms of the form p i,j , then c i + V i,j can be simulated with at most n -1 shares of b (i) , so there is no simulation failure on input b (i) . So we can perfectly simulate V i,j and c i + V i,j , and hence also simulate c i .

Next we consider the case of the probe V ,j :

either j < , and so in this case V ,j contains less than n -1 terms p ,j , then we can add all the necessary shares of b ( ) to J ( ) b without having a failure on b (recall that W ( ) = ∅). So we can perfectly simulate V ,j using the input share a , the input shares of b ( ) and by generating necessary random values.

or j ≥ , and so the random value r , can be used in this case to mask the expression of V ,j so simulating V ,j amounts to generating a fresh random value.

Thus, also in this case, we can perfectly simulate W and a chosen set of n -1 output shares without a failure on input b, using

I a = [n].
This concludes the simulation for the special case where I a = [n].

Case 2.1.2: I a ⊂ [n] such that |I a | ≤ n -1. Let k such that k / ∈ I a . Recall that |I a | ≥ t + 1 ≥ min(t + 1, n -t) and |W | < 2 • min(t + 1, n -t), then there are at most min(t + 1, n -t) -1 ≤ t ≤ n -1 probes remaining either in W (1) ∪ . . . ∪ W (n) , of the form (c) in W , or of the form (a)/(b) with i ∈ I a . Thus, there exists at least one index ∈ [n] such that X ,j / ∈ W for all j ∈ [n]. In this case, we choose J = [n] \ { }. Next, we will prove that we can perfectly simulate the sets W and J from the constructed sets I a and J (k) b , using the following claims. Claim 5. Let i ∈ J. Suppose that i / ∈ I a . Then the expression of c i = V i + X i can be masked by the random value r i, , in other terms c i ← r i, .

Proof. This claim can be proved easily, since we suppose that i / ∈ I a so the random value r i, and p i, are not probed in W . In addition, since / ∈ J and X ,j / ∈ W for all j ∈ [n], then the random value r i, does not appear in any other probed wire expression except in c i , then c i can be masked by the random value r i, . Claim 6. Let i ∈ J. Suppose that X i,j / ∈ W for any j ∈ [n]. Suppose that i ∈ I a . Then the expression of c i = V i + X i can be masked by the random value r k,i , in other terms c i ← r k,i .

Proof. Since we suppose that k / ∈ I a , then the random value r k,i or p k,i or V k,j for all j ∈ [n] are not probed in W . Then, if k / ∈ J, then the random value r k,i does not appear in the expression of any other probed wire in W or J and c i can be masked by the random value r k,i (Recall that c i = V i + X i and X i = r 1,i + . . . + r n,i ). Otherwise, if k ∈ J, then by Claim 5, c k = V k + X k can be masked by r k, and so c i can also be masked by r k,i since i = (because i ∈ J and / ∈ J) and i = k (because i ∈ I a and k / ∈ I a ).

Probes of the forms (a) or (c) in W are trivially simulated using the constructed sets of input shares, and generating the necessary random values. Let us now check the probes of the form (b). Let V i,j = p i,1 + . . . + p i,j be such a probe. Let us consider each of the terms p i,j for j ∈ [j]. if j = i, then by construction p i,i is perfectly simulated using a i and b (i) i and by generating the random value r i,i if needed. Otherwise, let j = i. If j ∈ J (i) b then the simulation of p i,j is straightforward. Otherwise if j / ∈ J (i) b , then we know that none of the wires r i,j or p i,j or X j ,s for all s ∈ [n] are probed in W . Thus, r i,j can be eventually used to mask the expression of p i,j without the need of the share b (i) j for the simulation. Meanwhile, we still need to check if j ∈ J, since r i,j appears in X j in the expression of c j = V j + X j .

• If j ∈ J and j / ∈ I a , then by claim 5, c j can be masked by the random value r j , and so r i,j does not appear in the expression of X j in c j anymore, and r i,j can be used to mask p i,j .

• Otherwise, if j ∈ J ∩ I a , then by claim 6 c j can be masked by the random value r k,j and so r i,j does not appear in the expression of X j in c j anymore, and r i,j can be used to mask p i,j (since i / ∈ k).

Thus, each term p i,j in V i,j can be perfectly simulated and thus V i,j = p i,1 + . . . + p i,j can be perfectly simulated. This concludes the simulation of the set W .

We now focus on the simulation of J. Let i ∈ J. If i / ∈ I a , then by claim 5, c i is perfectly simulated by generating the random value r i, . Otherwise, let i ∈ I a . If X i,j / ∈ W for any j ∈ [n], then by claim 6, c i is perfectly simulated by generating the random value r k,i . Otherwise, we can show that we can perfectly simulate each term in c i = V i +X i . In particular, each term in X i can be simulated by generating the underlying random value uniformly. For V i , we know in particular that a i • b (i) i is perfectly simulated since X i,j ∈ W for at least one j ∈ [n] so i ∈ J (i) b by construction. For the other terms in V i , they can be perfectly simulated in the exact same way as we simulated the probes V i,j of the form (b) in the set W . So c i is perfectly simulated by summing all the perfectly simulated terms. This concludes the simulation proof for the set J.

Up until now, we have concluded that if we have a constructed set I a of size at least t + 1, then we can perfectly simulate the sets W and a chosen set J of n -1 output shares, without having a simulation failure on the input b. In the rest of the proof, we will consider that |I a | ≤ t, and we will prove that we can perfectly simulate W and J with at most a simulation failure on b. Recall that we are also considering that |W | ≥ d and |W (1) • If for at least one ∈ J, we have X ,n ∈ W , we can mask the expression of X ,n by the random value r n, (because there are no probes of the form (a) or (b) in W and n / ∈ J, so r n, only appears in the expression of X ,n ). Recall that X ,n = r 1, + . . . + r n, , so r n, masks all random values r j, for j ∈ [n -1]. Each of the random values r j, for j ∈ [n -1] \ { } can be used to mask the corresponding output share c j for j ∈ J because there are no probes of the form (a) or (b) in W and X ,n is already masked by r n, , so r j, only appears in the expression of c j = V j + X j , so c j ← r j, . As for the output c , we can let I a = { } and we can perfectly simulate c using a and I b = [n]. Since |W | = n, so min(t + 1, n -t) > n 2 ≥ 1, so we have no failure on the input a, and we can perfectly simulate the chosen set J and the set of probes W .

∪ . . . ∪ W (n) | ≤ d -1.
• Now we consider that for all W = {X 1,j 1 , . . . , X n,jn }, we have j 1 < n, . . . , j n < n. In this case, the set W is also trivially simulated by generating random values, and we let J = [n -1]. Since, n / ∈ J and there are no probes of the form (a) or (b) in W , then the random values r n,i for i ∈ [n -1] only appear in the expression of the output share c i = V i + X i each. And since all probes of the form X i,j are such that j < n, then we can let r n,i be used to mask the expression of c i + X i,j because r n,i does not appear in X i,j for j < n, i.e c i + X i,j ← r n,i . By perfectly simulating the masked expression of c i + X i,j and the sum of random values X i,j , we can perfectly simulate c i . Thus, simulating all output shares in J amounts to generating random values uniformly. So we can perfectly simulate sets W and J from I a = ∅ and

I b = [n].
Next, we suppose that the number of probes of the form (c) in W with different values for the index i is strictly smaller than n. So, there is at least one index such that X ,j / ∈ W for all j ∈ [n]. We let J = [n] \ { }. We also let I b = [n] and we keep the set I a as constructed according to the probes in the set W . Observe that all probes in W are perfectly simulated by easily using the set I a and I b = [n]. As for the output shares in J, observe that for each i ∈ J such that i / ∈ I a , we can use claim 5 to mask the expression of c i by r i, , and so the share a i is not needed for the simulation of c i . Otherwise, if i ∈ J ∩ I a , then c i is perfectly simulated using a i and

I b = [n].
This proves that whenever i / ∈ I a , the output share c i can be simulated without the need of the share a i . Since we suppose that |I a | ≤ t, then we conclude that we can perfectly simulate W and a chosen set of n -1 output shares J with at most a simulation failure on input b.

By considering both cases |I a | ≥ t + 1 and |I a | ≤ t, we covered all the cases for the simulation, and we proved that we can always perfectly simulate the set of probes W along with a chosen set of n -1 output shares J while having a failure on at most one of the inputs. This concludes the proof of Lemma 29.

From Lemmas 28 and 29, we conclude that G mult is (t, f 2 )-TRPE2 of amplification order d ≥ min(t + 1, n -t). This concludes the proof of Lemma 27. such that v i 1 = 0, . . . , v i K = 0 and the corresponding columns i 1 , . . . , i K in L and in M have no zero coefficient). Going back to the original matrices L I and M I we have shown for any set I ⊆ {1, . . . , n} ∪ {(n + 3) • n + 1, . . . , z} of cardinal n, with probability at least 1 -2 n • n • q -1 over the choice of γ, we have hw(L I • v) < n -K or M I • v = 0 n for any vector v ∈ F n q (indeed a vector v satisfies M I • v = 0 n if an only if M I • v = 0 n where v denotes the restriction of v to the support I ∩ {1, . . . , n} and the Hamming weight of hw(L I • v) is at smaller than hw(L I • v ) + ρ since at most ρ positions can be set arbitrarily..

Case 4.

We now consider all sets I ⊆ {1, . . . , z} (with no restrictions). Without loss of generality, we can assume that all not identically zero column vectors in M I are pairwise distinct. Indeed, if two columns are equal, they come either from the two submatrices I n of M, or from the first column vectors of a submatrix I n and the submatrix T n , or from the first column vectors of a submatrix D γ,i for some i ∈ {1, . . . , n} and the corresponding submatrix T γ,i . In all these cases, one can replace the index of the second vector in I by an index in {1, . . . , n -1} (and modify the vector accordingly ) in such a way that M I for the new set I has a new null column vector for each duplicate in the original matrix M I .

We can now delete the columns corresponding to the null vectors as in Case 3 (i.e., for each i ∈ I ∩{1, . . . , n+1} = ∅, the i-th column and the i-th row in M I and L I ). The only difference occurs if a column in M I is equal to the i-th vector in the canonical basis (for i ≥ 2) or to the scalar multiplication of this vector by some element of the matrix γ ∈ F q (corresponding to the cases I ∩ {n + 1, . . . , 2n} = ∅ and I ∩ {2n + 1, . . . , (n + 3) • n + 1} = ∅ respectively). As in Case 3, we can delete the corresponding column and row in M I and L I (i.e., it corresponds to a probe of a value r i , a value a i + r i or a value a i + γ j,i r i ).

As above, if we denote M I and L I the corresponding matrices (with m columns and n < n and n + 1 rows, respectively), the previous argument shows that with probability at least 1 -2 n • n • q -1 , we have hw(L I • v) < n -K or M I • v = 0 n for any vector v ∈ F m q (where K denotes the number of coordinates i 1 , . . . , i K ∈ [z] such that v i 1 = 0, . . . , v i K = 0 and the corresponding columns i 1 , . . . , i K in L and in M have no zero coefficient).

Going back to the original matrices L I and M I we have shown for any set I ⊆ {1, . . . , z} of cardinal n, with probability at least 1-2 n •n•q -1 over the choice of γ, we have hw(L I •v) < n-K or M I • v = 0 n for any vector v ∈ F n q A.3.1 Conclusion

. By the union on all such sets, we obtain that the probability that, for γ picked uniformly at random in F n×n q , the matrix M satisfies Condition 3, i.e., for any vector v ∈ F z q of Hamming weight hw(v) ≤ n we have hw(L

• v) < n -K or M • v = 0 n is at least 1 - z n 2 n • n • q -1 = 1 - (2n + 4) • n + 1 n 2 n • n • q -1 .
The binomial coefficient in this lower-bound is always less than (6n) n (this can be checked by hand for small values of n and it follows for large values using the classical upper-bound r s ≤ ((r • exp(1))/s) s ). We thus obtain the claimed bounds and this concludes the proof.

. 1 )

 1 A circuit compiler (CC, Enc, Dec) is (p, ε)-random probing secure if for every (randomized) arithmetic circuit C the compiled circuit C = CC(C) is (p, |C| • ε)-random probing secure where |C| is the size of the original circuit.

Figure 3 . 1 :

 31 Figure 3.1: Illustration of compilation using a standard circuit compiler with 2-share gadgets. The inputs are x 1 , x 2 , x 3 and the output is y. Each arrow represents a wire carrying the value output by the gate represented as a circle. A gadget is represented as a rectangle since it consists of multiple gates.

Figure 3 . 2 :

 32 Figure 3.2: Evolution of the failure probability function f (p) for the 2-share ISW multiplication gadget, for an increasing leakage rate p.

Figure 4 . 1 :

 41 Figure 4.1: Illustration of all elements of S 1 and some elements of S 2 , for n = 3 and t = 1.

3. the output distribution satisfies out id =

 id AssignWires(G, W, ( x, y)) , z| J * (4.7)

  base , y b | I 2,base ) , (4.11) Note that the input values x b | I 1,base and y b | I 2,base can be obtained from the corresponding shares in I * 1 and I * 2 . Thanks to the (t, f )-RPE property of G and by construction of I 1,base and I 2,base , this outputs a distribution satisfying out base id = AssignWires(G, W base , ( x b , y b )), z b | J base (4.12)

j

  , I 1 and I 2 are the corresponding sets produced by the Sim 1 simulator for G (k) j , and x and y are the inputs of G (k) j

1 .

 1 there exists a failure set W w.r.t. the first input or the second input such that |W | = d up , 2. there exists a failure set W w.r.t. the first input and the second input such that |W | = 2d up . In the former case, the existence of the failure set implies that the function f (p) has a non-zero coefficient in p dup and hence d ≤ d up . In the latter case, the existence of the double failure set implies that the function f 2 (p) has a non-zero coefficient in p 2dup and hence d ≤ d up . The case of a single-input gadget is simpler: it has amplification order d ≤ d up if there exists a failure set W (w.r.t. its single input) such that |W | = d up .

Lemma 1 .

 1 Let f : R → R, n ∈ N and , m ∈ {1, 2}. Let G : (K n ) → (K n ) m be an -to-m n-share complete gadget achieving (t, f )-RPE. Then its amplification order d is upper bounded by min((t + 1), (

N G mult ,m = 9 .

 9 Following the asymptotic analysis of Section 4.4, our construction yields the following instantiation of the matrix MThe eigenvalues of M ac are 3 and 21, which gives N max = 21. We also have a random probing expandability with function f of amplification order d =3 2 (by taking the worst case between G add ,G copy and G mult ). Hence we get complexity of | C| = O |C| • κ7.5 . Finally, our construction tolerates a leakage probability up to p max ≈ 2 -7.09 .

Figure 4 . 2 :

 42 Figure 4.2: Number of gates for G (k) add , G (k) copy , G (k) mult circuits with respect to the level k.

Figure 4 . 3 :

 43 Figure 4.3: Values taken by f (k) (p) for different starting leakage rates p with respect to the level k.

Figure 4 . 4 :

 44 Figure 4.4: Circuit for the exponentiation x → x 254 .

Figure 4 . 5 :

 45 Figure 4.5: Number of gates after compilation of AES-128 encryption/decryption circuits with respect to the level k.

5 )

 5 with ε = f (p) (in particular F 1 and F 2 are mutually independent), 2. J is such that J = J if |J| ≤ t and J ⊆ [n] with |J | = n -1 otherwise, 3. the output distribution satisfies out id = AssignWires(G, W, ( x, y)) , z| J(5.6)

9 )

 9 with ε = f (p) (in particular F 1 and F 2 are mutually independent), 2. J is such that J ⊆ [n] with |J| = n -13. the output distribution satisfiesout id = AssignWires(G, W, ( x, y)) , z| J (5.10)

Figure 5 . 1 :

 51 Figure 5.1: Summary of relations between the different notions.

  |) and with a failure on input b with I 2 = [n]. That concludes the proof for the second property.

  together with the variables indexed by W , from the input shares indexed by a set I of size |I| ≤ |W | + |J | ≤ n -1. Hence the ISW refresh gadget is (n -1)-STRPE2, which concludes the proof. Corollary 5 then directly follows from Lemma 3 applied to TRPE, Lemma 10, and Corollary 4.

Corollary 5 .

 5 Let n ∈ N. For every t ≤ n -1, the n-share ISW refresh gadget is (t, f )-TRPE of amplification order d = min(t + 1, n -t).

4 Nmax = 3n 2 - 2 Figure 5 . 2 :

 42252 Figure 5.2: Evolution of the complexity exponent e = log(N max )/ log(d) with respect to the number of shares n. The blue curve matches the instantiation with the ISW-based gadgets;the orange curve assumes the optimal amplification order (i.e. an improvement of the multiplication gadget); the pink curve assumes a better complexity for addition and copy gadgets (so that N max matches N m,m = n 2 ).

Algorithm 6 :

 6 Our multiplication gadget Input : (a 1 , . . . , a n ),(b 1 , . . . , b n ) input sharings, {r ij } 1≤i≤n,1≤j≤n random values, refresh gadget G refresh Output: (c 1 , . . . , c n ) sharing of a • b 1 for i ← 1 to n do 2 (b

c 3 ← 3 c 4 ←

 334 (r 3 + r 4 ) + a 3 + (r 8 + r 9 ) + b (r 4 + r 5 ) + a 4 + (r 9 + r 10 ) + b 4 c 5 ← (r 5 + r 1 ) + a 5 + (r 10 + r 6 ) + b 5

c 3 ← (r 3 + r 4 ) + a 3 ; d 3 ← (r 8 + r 9 ) + a 3 c 4 ← (r 4 + r 5 ) + a 4 ; d 4 ← (r 9 + r 10 ) + a 4 c 5 ← (r 5 + r 1 ) + a 5 ; d 5 ←

 3343389344544910455155 (r 10 + r 6 ) + a 5 .

4 ← 5 i 3 , 1 ← 5 i 4 , 1 ← 5 i 5 , 1 ←

 4531541551 (r 9 + r 10 ) + b 4 ; i 2,5 ← (r 10 + r 6 ) + b (r 11 + r 12 ) + b 1 ; i 3,2 ← (r 12 + r 13 ) + b 2 ; i 3,3 ← (r 13 + r 14 ) + b 3 ; i 3,4 ← (r 14 + r 15 ) + b 4 ; i 3,5 ← (r 15 + r 11 ) + b (r 16 + r 17 ) + b 1 ; i 4,2 ← (r 17 + r 18 ) + b 2 ; i 4,3 ← (r 18 + r 19 ) + b 3 ; i 4,4 ← (r 19 + r 20 ) + b 4 ; i 4,5 ← (r 20 + r 16 ) + b (r 21 + r 22 ) + b 1 ; i 5,2 ← (r 22 + r 23 ) + b 2 ; i 5,3 ← (r 23 + r 24 ) + b 3 ; i 5,4 ← (r 24 + r 25 ) + b 4 ; i 5,5 ← (r 25 + r 21 ) + b 5

r 4 , 2 ) + (a 4 • i 4 , 3 + r 4 , 3 ) + (a 4 • i 4 , 4 + r 4, 4 )+(a 4 • i 4 , 5 + r 4 , 5 ) + (r 1 , 4 + r 2 , 4 + r 3 , 4 + r 4 , 4 + r 5, 4 )c 5 ←

 42443434444445451424344445 (a 5 • i 5,1 + r 5,1 ) + (a 5 • i 5,2 + r 5,2 ) + (a 5 • i 5,3 + r 5,3 ) + (a 5 • i 5,4 + r 5,4 ) +(a 5 • i 5,5 + r 5,5 ) + (r 1,5 + r 2,5 + r 3,5 + r 4,5 + r 5,5 ).

Figure 6 . 1 :

 61 Figure 6.1: Complexity of random probing AES for different security levels for a tolerated probability of 2 -7.6 (left) or 2 -9.5 (right).

$

  ← -K . Let V be a subset of the variables {a 1 , a 2 , r} and O ∈ {∅, {a 1 + r}}. Then the variables in V ∪ O ∪ {a2 -r} can be perfectly simulated from I ⊂ {a 1 , a 2 }, with |I| ≤ |V | + 2 • |O|. Proof of Lemma 5 from [13]. If |O| = 1 or |V | ≥ 2, we can take I = {a 1 , a 2 }. If |O| = 0 and |V | = 0, we can simulate a 2 -r with a random value. If |O| = 0 and |V | = 1, if V = {a 1 } we let I = {a 1 } and we can again simulate a 2 -r with a random value; if V = {r} or V = {a 2 } then we let I = {a 2 }.

Figure 6 . 3 :

 63 Figure 6.3: n-share multiplication gadget G mult from two subgadgets G submult and G compress

  [START_REF] Ananth | Private circuits: A modular approach[END_REF]. In a nutshell, on input sharings a and b, the subgadget G submult performs multiplications between the input shares of a and b as well as linear combinations of these products and it outputs a m-sharing c of the product a • b where m ≥ n 1 . Next, the compression gadget G compress compresses the m-sharing c back into an n-sharing d of the product a • b.

1 .

 1 ∀ J, |J| ≤ t a set of output share indices of G, the assignment of the wires indexed by W and the output shares indexed by J can be jointly perfectly simulated from the input shares of G indexed by a set I, such that |I| ≤ |W |. 2. ∃ J , |J | = n -1 a set of output share indices of G, such that the assignment of the wires indexed by W and the output shares indexed by J can be jointly perfectly simulated from the input shares of G indexed by a set I, such that |I| ≤ |W |.

Lemma 17 .

 17 Consider the n-share multiplication gadget of Figure 6.3 formed by a 2-to-1 multiplication subgadget G submult of m output shares and a 1-to-1 compression gadget G compress of m input shares such that m > n. Let t ≤ n -1 and d

  n) and with the security parameter κ | C| = O |C| • κ e with e = log N max log d .

  then in order to have |I a | ≥ d, we must have: d ≤ |I a | ≤ |W a | Hence, since |W | ≤ 2d -1, then we must have |W b | ≤ d -1 (because |W a | + |W b | ≤ 2d -1), then from Condition 2 on matrix δ, we can perfectly simulate W b from I b such that |I b | ≤ |W b | -M ≤ |W b | ≤ d -1 where M is the number of probes of the form in sets 5 and 6 in the set of probes W b . Thus we showed that we can perfectly simulate W with |W | ≤ 2d-1 ≤ n-1 from W a and W b using I a and I b such that if |I a | ≥ d, then |I b | ≤ d -1, so we have |I a | ≤ d -1 or |I b | ≤ d -1. This concludes the proof in the case where W 3 = ∅.

8 3 and W 9 3 3 | 3 |

 933 add to W a probes of these forms, then we have |I a | ≤ |W a | -|W 8 3 | -|W 9 3 |. Hence, in order to have |I a | ≥ d, we must have d ≤ |I a | ≤ |W a | -|W 8 3 | -|W 9 3 | ≤ |W 1 | + |W 7 Similarly, suppose that to simulate W b we need |I b | ≥ d, then we also must have d ≤ |I b | ≤ |W b | -|W 7 3 | -|W 9 3 | ≤ |W 2 | + |W 8 Hence, in order to have |I a | ≥ d and |I b | ≥ d at the same time, we must have 2d ≤ |I a | + |I b | ≤ |W 1 | + |W 7 3 | + |W 2 | + |W 8 3 | ≤ |W | which holds a contradiction with the fact that |W | ≤ 2d -1. Hence, we cannot have at the same time |I a | ≥ d and |I b | ≥ d. So G submult is (d -1, 2d -1)-partial NI in the case where W 3 = ∅. Hence, we conclude that G submult is (d -1, 2d -1)-partial NI after proving the property in both cases W 3 = ∅ and W 3 = ∅.

Lemma 21 .

 21 Let t ≤ n -1 and d = min(t + 1, n -t). Let G submult as defined above with n-share inputs. If both matrices γ and δ satisfy Condition 3, then G submult is (d -1)-NI and (d -1, 2d -1)-partial NI.

2 Figure 6 . 4 :

 264 Figure 6.4: Evolution of the complexity exponent e = log(N max )/ log(d) with respect to the number of shares n. The orange curve matches the instantiation from Section 5.3 using the ISW refresh gadget with quadratic asymptotic complexity and the multiplication gadget from Section 5.4; the red curve matches the new construction (including the new multiplication gadget) with quasi-linear asymptotic complexity (N max = O(n log n)).

  . Computing the PDT amounts to considering each possible tuple of probes P on the gadget and computing SIS G (P , O) = I = (I 1 , . . . , I ) for each possible set of output shares indices O ⊆ [n]. Then, update the corresponding function in the PDT indexed by I and O as PDT[I ][O] = PDT[I ][O] + p |P | (1 -p) s-|P | . When exploring all the possible sets of internal probes, P , and all the sets of output indices O, the output of SIS G shall serve as a basis to compute the expected distributions.

Figure 7 . 1 :

 71 Figure 7.1: Masking gadgets written in IronMask's syntax

20 P

 20 ← GaussElimination(P ); 21 return shares(P );

3 P 1 ← 4 for each probe p i in P do 5 if p i contains no randoms of r 3 then 6 (P 1 , 7 (P 1 , 8 end 9 end 10 I 1 ←

 3145617189101 ( ), P 2 ← ( ); P 2 ) ← FactAndExtract(p i ); P 2 ) ← (P 1 ||P 1 , P 2 ||P 2 ); SIS_LR(P 1 ), I 2 ← SIS_LR(P 2 ); 11 return I 1 , I 2 ;

Algorithm 11 : 3 I 1 4 if |I 1 |Algorithm 12 :

 11314112 Is_t_NI returns true if G is t-NI and false otherwise, assuming G has input sharings 1 procedure Is_t_NI(G, t) 2 for each tuple P of size t in G do , . . . , I ← SIS(P ); > t or . . . or |I | > t then 5 GetCoeffsRPS returns an array of β cells where the k th index contains the number of failure tuples of k probes on n-share gadget G with input sharings 1 procedure GetCoeffsRPS (G, β) 2 coeffs ← [0, . . . , 0] of size β;

3 for k = 1 to β do 4 for 6 if |I 1 | 7 coeffs

 34617 each tuple P of k probes on G do 5 I 1 , . . . , I ← SIS(P ); > n -1 or . . . or |I | > n -1 then

Algorithm 14 : 2 coeffs ← empty array; 3 t 4 S 5 S 7 S 9 S 11 S

 1423457911 GetCoeffsRPconstr returns an array of c max cells where the k th index contains the number of failure tuples of size k in G 1 procedure GetCoeffsRPconstr(G, c max ) ← number of shares in G; incompr ← ConstructiveFailuresGen(G, t); failure ← ∅; 6 for k = 1 to c max do failure ← all tuples of S incompr of size k; 8 for each tuple P of S failure do failure ← S failure ∪ ExpandTuple(P ); 10 end failure ← S failure ; 12 coeffs[k] ← number of tuples in S failure ;

  (b) For probes of form (b), we add index i to I a and to J (k) b for k ∈ [n]. (c) For probes of form (c), we add index i to J (k) b for k ∈ [n]. Observe that since |W | ≤ d -1, then in particular |W | ≤ d -1 ≤ t, then |I a | ≤ |W | ≤ |W | ≤ min(t, |W |) so we have no failure on the input a. We also have |J (k) b | ≤ |W | ≤ t. Simulation of W : probes of the form (a) can be perfectly simulated from the corresponding input shares in I a and J (k)

  |W | ≤ t and |W (k) | ≤ d-1, and since G refresh is (t, f )-TRPE achieving the amplification order d, then we can perfectly simulate sets J (k) b and W (k) from the set of input shares I (k) b such that |I (k) b | ≤ |W (k) | ≤ t for k ∈ [n]. Thus, we can let I b = I (1) b ∪ . . . ∪ I (n) b and we have |I b | ≤ |W (1) | + . . . + |W (n) | ≤ |W | ≤ min(|W |, t), so we have no failure on the input b either. Until now, we have shown that we can simulate all sets W (k) and J (k) b from I b of size at most min(|W |, t). It remains to show that we can also perfectly simulate the sets W and J from I a and J (k) b for k ∈ [n].

  (k) b , we add each index to all of the sets for all k ∈ [n]. However, executing n refreshings on the input b is necessary to prove the next result, specifically when we consider W such that d ≤ |W | ≤ 2d -1.

Lemma 26 .

 26 Let J be a set of at most t output shares of G mult . Let W be a set of leaking wires as described above such that d ≤ |W | ≤ 2d -1. Then W and J can be perfectly simulated from the sets of input shares I a and I b such that |I a | ≤ min(|W |, t) or |I b | ≤ min(|W |, t). In other terms, we have a simulation failure on at most one of the inputs a or b.

  perfectly simulated by a single random value thanks to claim 1. Thus, W and J are perfectly simulated with at most |W | ≤ min(|W |, t) shares of a and eventually n shares of b.

Case 2 :

 2 |W | ≥ d (and thus |W (1) ∪ . . . ∪ W (n) | ≤ d -1). In this case, we will construct the sets I a and J (k) b

  depending on the probes in W as follows:(a) For probes of form (a), we add index i to I a , and index j only to J (i) b . (b) For probes of form (b), we add index i to I a and only to J(i) b .

Case 2 . 1 :

 21 Simulation failure on input a. Notice that by construction we always have |I a | ≤ |W | ≤ |W |. Thus, a simulation failure on input a for TRPE1 means that the set I a is of size |I a | ≥ t + 1 ≥ d. We will first start by showing that the sets W (k) and J (k) b

b 2 ≤n - 1 ,

 21 built from these probes has at most one share of b(i) added to it by construction. In other terms, when we only consider probes of the form (a) and (b) with distinct i, we have |J (k) b | ≤ 1 for each k ∈ [n]. Now let us consider the remaining probes in W which are either in W of the form (c), in W of the form (a)/(b) for which i ∈ I a or in W (1) ∪ . . . ∪ W (n) . Since |I a | ≥ t + 1 ≥ d, then there are at most d -1 of these remaining probes. Without loss of generality, we consider that there are exactly d -1 instead of at most d -1 probes. Let m be the number of probes in W (1) ∪ . . . ∪ W (n) and d -1 -m the remaining in W of the form (c) or of the form (a)/(b) for which i ∈ I a . Since each wire in W of the form (c) or of the form (a)/(b) for which i ∈ I a results in adding at most one more share index to each J (k) b for k ∈ [n], then we have |J (k) b | ≤ 1 + (d -1 -m) = d -m. And |W (1) ∪ . . . ∪ W (n) | ≤ m, in particular |W (k) | ≤ m for any k ∈ [n]. • if m = 0, then W (k) = ∅ for any k ∈ [n], and |J (k) b | ≤ d ≤ min(t + 1, n -t) ≤ n + 1 so by the TRPE property of G refresh for any t ≤ n -1, all of the J (k) b sets can be perfectly simulated with no knowledge of the input shares of b since W (k) = ∅, so I (k) b = ∅. Hence, I b = I (1) b ∪ . . . ∪ I (n) b = ∅ and we have no simulation failure on the input b.• if m > 0, then |J (k) b | ≤ d -1 ≤ t and |W (1) ∪ . . . ∪ W (n) | ≤ d -1, in particular |W (k) | ≤ d -1 for each k ∈ [n]. Thus, by the (t, f )-TRPE property of the refresh gadget G refresh achieving the amplification order d for any t ≤ n -1, we can perfectly simulate both sets for each k ∈[n] with I (k) b such that |I (k) b | ≤ |W (k) |. Thus, we can let I b = I (1) b ∪ . . . ∪ I (n) b so we can have |I b | ≤ |W (1) ∪ . . . ∪ W (n) | ≤ d -1 ≤ t,and we can perfectly simulate W (1) ∪ . . . ∪ W (n) along with J (1) b ∪ . . . ∪ J (n) b from the set I b without a simulation failure on input b. So far we proved that if we have |I a | ≥ t + 1, then we must have |I b | ≤ |W (1) ∪ . . . ∪ W (n) | ≤ d -1 ≤ t, and W (1) ∪ . . . ∪ W (n) can be perfectly simulated along with J (1) b ∪ . . . ∪ J (n) b from the set I b . Next we need to prove that we can perfectly simulate W and J from these sets I a and J (1) b ∪ . . . ∪ J (n) b . Case 2.1.1: I a = [n]. This only occurs by construction in the case where |W | = 2d -1 = n so when d = d max = n + 1 2 for t = n -1 2 . In this case, since |W | ≤ 2d-1 ≤ (n+1)-1 ≤ n, then all probes in W are all in W of the form (a) or (b) with n distinct values for the index i and so |J (i) b | ≤ 1 for all i ∈ [n].

b

  for i ∈ [n]. For this, for each i ∈ [n] we consider three cases: • V i,j / ∈ W for any j ∈ [n], then we know that there exists a probe of the form (a) in W with index i, in other terms,a i ∈ W , or ∃! j ∈ [n] such that b (i) j or a i • b (i) j or r i,j or p i,j = a i • b (i) j + r i,j is probed in W .The corresponding probe is perfectly simulated by construction of the sets I a and J (i) b .

  fact we can reconstructJ (i) b into J (i) b = {1, . . . , j} such that |J (i) b | ≤ n-1and since W (i) = ∅, then by the (t, f )-TRPE1 property of G refresh for any t ≤ n -1, we still have no failure on the input b and we still have|I (i) b | ≤ |W (i) | = 0.

  b | ≤ n -1 for all i ∈ [n]. Furthermore, from the TRPE property of G refresh for any t ≤ n -1 and the fact that W (i) = ∅ for all i ∈ [n], we have no simulation failure on the input b. This concludes the simulation of W and output shares in J for the case whereI a = [n]. Case 2.1.2: I a ⊂ [n] with |I a | ≤ n -1.In this case, we have at least one index k ∈ [n] \ I a for which there are no probes in W of the form (a) or (b). In other terms, no partial sum of V k is probed, no product of shares a k • b (k) j

( 1 )

 1 b ∪ . . . ∪ J (n) bas constructed earlier with respect to the probes in the set W . Recall that all probes in W (1) ∪ . . . ∪ W (n) and J (1) b ∪ . . . ∪ J b (n) are perfectly simulated using I b and the simulator of G refresh . Simulation of W . Probes of the form (a) and (c) are trivially simulated by construction of the sets of input shares and by generating uniformly at random the necessary random values.

( 1 )

 1 b ∪ . . . ∪ J (n) b are trivially simulated using I b = [n]. In addition, all probes in W are also perfectly simulated by construction of the set I a and using I b = [n]

  for k ∈ [n] depending on the probes in the set W (recall that W = W ∪ W(1) ∪ . . . ∪ W(n) ) as follows (we consider that all J (k) b are empty at first since all the output shares of G refresh can be probed directly in W ):(a) For probes of form (a), we add index i to I a , and index j to J (k) b for k ∈ [n]. (b) For probes of form (b), we add index i to I a and to J (k) b for k ∈ [n].(c) For probes of form (c), we add index i toJ (k) b for k ∈ [n]. Observe that since |W | < min(t + 1, n -t), then in particular |W | ≤ min(t + 1, n -t) -1 ≤ t, then |I a | ≤ |W | ≤ |W | ≤ t so we have no failure on the input a. Also, since |J (k) b | ≤ |W | ≤ t and |W (k) | < min(t + 1, n -t),then by the (t, f )-TRPE1 property of G refresh , we will be able to simulate sets J (k) b and W (k) from the set of input shares I (k) b such that |I (k) b | ≤ |W (k) | ≤ t for k ∈ [n]. Thus, we can let I b = I (1) b ∪. . .∪I (n) b and we have |I b | ≤ |W (1) ∪. . .∪|W (n) | ≤ |W | ≤ t, so we have no failure on the input b either. Until now, we have shown that we can simulate all sets W (k) and J (k) b from I b of size at most min(|W |, t) = |W |. It remains to show that we can also perfectly simulate the set W and a well chosen set J of n -1 output shares, from I a and J (k) bfor k ∈ [n]. We will choose the set J from two subsets J = J 1 ∪ J 2 , whereJ 1 = {i | i ∈ J (k) b for any k ∈ [n]}, and J 2 ⊂ [n] is any set such that J 1 ∩ J 2 = ∅ and |J 1 ∪ J 2 | = n -1. Let ∈ [n] be the index such that / ∈ J. Since |W | ≤ min(t + 1, n -t) -1 ≤ n -1,then by construction of the sets J (k) b , we have that |J (1) b ∪ . . . ∪ J (n) b | ≤ n -1, then for the index , we have that / ∈ J (k) b for all k ∈ [n], then X ,j / ∈ W for any j ∈ [n] by construction of the sets J (k)

  all k ∈ [n]. In addition, since X ,j / ∈ W for all j ∈ [n] (because otherwise then by construction ∈ J (k) b

  For probes of form (b), we add index i to I a and only to J (i) b . (c) For probes of form (c), we add index i to J (k) b for all k ∈ [n].

Case 2 . 1 :

 21 simulation failure on input a, i.e. I a > t. This means that the set I a is of size |I a | ≥ t + 1 ≥ min(t + 1, n -t) (this is because by construction |I a | ≤ |W |, so to have |I a | > min(|W |, t), we must have |I a | > t). We will first start by showing that the sets W (k) and J (k) b

b

  has at most one share of b (i) added to it. In other terms, |J (k) b | ≤ 1 for each k ∈ [n] (from the probes (a) and (b) with distinct indices i).

  and d-1-m the remaining probes in W of the form (c) or (a)/(b) with i ∈ I a . Since each wire in W of the form (c) or (a)/(b) with i ∈ I a results in adding at most one more share index to each J (k) b for k ∈ [n], then we have |J (k) b | ≤ 1+(min(t+1, n-t)-1-m) = d-min(t+1, n-t). And |W (1) ∪. . .∪W (n) | ≤ m, in particular |W (k) | ≤ m for any k ∈ [n].

Case 2 . 2 :

 22 |I a | ≤ t. This means that the number of probes of the form (a) or (b) in W with distinct values for the index i is at most t.First, let us check the special case where the number of probes of the form (c) in W with different values for the index i is equal to n (notice that this cannot occur when we have|I a | ≥ t + 1). Since |W | ≤ 2 • min(t + 1, n -t) -1 ≤ n,then we have W = {X 1,j 1 , . . . , X n,jn } for certain j 1 , . . . , j n ∈ [n]. So we can let J (k) b = [n] for all k ∈ [n] and I b = [n], and by construction I a = ∅. In this case, we choose J = [n -1]. The simulation of the set W is straightforward since all wires of the form (c) are just sums of random values. Then, let us consider the output shares in J.

  In a nutshell, their composition strategy relies on using what they call a probe distribution table or PDT. Each entry in the table corresponds to a failure function f I,O (p) where O is the set of output shares leaking in addition to the intermediate variables, and I is the set of input shares necessary for a perfect simulation of the intermediate probes and the output share in O. The PDT for an n-share gadget with inputs and m outputs has n × rows and n × m columns.

Table 4 .

 4 2: Complexity and execution time (in ms, on an Intel i7-8550U CPU) for compiled gadgets

Table 4 .

 4 4: Standard and n-share AES-128 execution time (in ms, on an Intel i7-8550U CPU) using compiled gadgets G

	2(k) add , G	1(k) copy , G	1(k) mult .
	AES Version		Execution Time (in ms) Encryption Decryption
	Standard (no sharing)		0.06	0.05
	3-share (k = 1)		1.08	1.07
	9-share (k = 2)		11.71	10.26
	27-share (k = 3)		200.29	197.70

  Proof. The proof for the first two points is easy. In particular, for the first point, if G achieves TRPE with an amplification order of d, then G achieves RPE with amplification order at least d, since a failure in the TRPE setting i.e. |I j | > min(t, |W |) does not necessarily imply a failure in the RPE setting i.e. |I j | > t, meanwhile if there is no failure for TRPE for a leaking set of wires W , then this implies that |I j | ≤ min(t, |W |) ≤ t so there is no failure in the RPE setting either.

3. If

d = t + 1, then G achieves (t, f )-TRPE if and only if G achieves (t, f )-RPE.

  so we have |I j | ≤ t (i.e. no failure for RPE) and |I j | > min(t, |W |) = |W | (i.e. failure on TRPE).This concludes the proof for the second point.We will now prove the third point. Let d = t + 1. We will show that for every set J ⊆ [n] of output shares and every leaking set of wires W , a failure occurs in the TRPE setting if and only if a failure also occurs in the RPE setting. If |W | ≥ t, then the two settings are equivalent since min(t, |W |) = t. We will thus only focus on the case |W | < t. Clearly, a failure in the RPE setting, i.e. |I j | > t, implies a failure in the TRPE setting, i.e. |I j | > min(t, |W |). Let us now show that the converse is also true.

  . . , I which can perfectly simulate any leaking wires set W such that |W | ≤ t and any set of output shares J such that |J| ≤ t, satisfying |I 1 |, . . . , |I | ≤ |W |. Consequently, there exist input sets I 1 , . . . , I which can perfectly simulate any leaking wires set W such that |W | = t i ≤ t and any set of output shares J such that |W | + |J| ≤ t with |I 1 |, . . . , |I | ≤ t i . G is thus t-SNI.

  then for any set of leaking wires W and output shares J such that |W | + |J| ≤ τ , the wires indexed by W and the output shares indexed by J can be perfectly simulated from input shares indexed by I 1 , . . . , I such that |I j | ≤ |W | for every 1 ≤ j ≤ . In the TRPE1 property, the set J of output shares can be any set of size |J| ≤ t so we can assume |J| = t without loss of generality. -t+1 implies |W |+|J| ≤ τ and hence the existence of the sets I 1 , . . . , I allowing the simulation with |I j | ≤ |W |. And |W | < t + 1 implies |I j | ≤ min(t, |W |) for every j which implies the absence of failure. Then for a leaking set W of size |W | ≥ min(t + 1, τ -t + 1),

For a leaking set W of size |W | < min(t + 1, τ -t + 1) no failure event occurs. Indeed τ -SNI and |W | < τ

  Since G refresh achieves an amplification order d, then by definition of TRPE, the sets W 1 and J 1 can be simulated with a set of input shares I 1 such that |I 1 | ≤ min(|W 1 |, t). Similarly, the sets W 2 and J 2 can be simulated with a set of input shares I 2 such that |I 2 | ≤ min(|W 2 |, t). As a consequence, set I defined as I = I 1 ∪ I 2 is enough to simulate W = W 1 ∪ W 2 and both output shares J 1 and J 2 . Furthermore, we have|I| ≤ |I 1 | + |I 2 | ≤ min(|W 1 |, t) + min(|W 2 |, t) ≤ |W | = min(|W |, t) • |J 1 | > t,|J 2 | > t: in this case, we need to prove the existence of a set of input shares I such that |I| ≤ min(t, |W |) = |W | (since |W | ≤ d -1 ≤ t) for which we can perfectly simulate W together with two chosen output sets J 1 and J 2 such that |J 1

  then by definition of TRPE, there exists J 1 , |J 1 | = n-1 such that W 1 and J 1 can be perfectly simulated from a set of inputs sharesI 1 such that |I 1 | ≤ min(|W 1 |, t).Similarly, there exists J 2 , |J 2 | = n-1 such that W 2 and J 2 can be perfectly simulated from a set of inputs shares I 2 such that |I 2 | ≤ min(|W 2 |, t). By choosing such sets J 1 , J 2 , the overall simulation of G copy can be done with the set of input shares I = I 1 ∪ I 2 , and we have

  1. Any set of leaking wires W such that |W | < d 2 can be simulated together with any set of outputs wires J ⊆ [n] from sets of input wires I 1 on a and I 2 on b such that |I 1 | ≤ t and |I 2 | ≤ t (for TRPE we would have |I 1 | ≤ min(t, |W |) and |I 2 | ≤ min(t, |W |)). 2. Any set of leaking wires such that d 2 ≤ |W | < d can be simulated together with any set of outputs wires J ⊆ [n] from sets of input wires I 1 , I 2 such that |I 1 | ≤ t or |I 2 | ≤ t (because of the double failure, i.e failure on both inputs) (for TRPE we would have |I 1 | ≤ min(t, |W |) or |I 2 | ≤ min(t, |W |)).

  1 such that |I 1 | ≤ t (for TRPE we would have |I 1 | ≤ min(t, |W |)) and I 1 perfectly simulates W 1 and any set J 1 of up to t variables e i . Similarly, there exists an input set of shares of b I 2 such that |I 2 | ≤ t (for TRPE we would have |I 2 | ≤ min(t, |W |)) and I 2 perfectly simulates W 2 and any set J 2 of up to t variables f i . J 1 and J 2 are chosen as the inputs e i and f i respectively of wires e . we now assume that d 2 ≤ |W | < d. Then we consider the set W = W 1 ∪ W 2 such that |W | ≤ 2|W | < 2d and hence, |W 1 | < d or |W 2 | < d. Without loss of generality, let us consider that |W 1 | < d (the proof is similar in the opposite scenario). From the (t, f )-RPE property of G refresh and its amplification order, there exists an input set of shares of a I 1 such that |I 1 | ≤ t (for TRPE we would have |I 1 | ≤ min(t, |W |)) and I 1 perfectly simulates W 1 and any set J 1 of up to t variables e i . There also exists an input set of shares of b I 2 which perfectly simulates W 2 and any set J 2 of up to t variables f i but not necessarily of size less than t (less than min(t, |W |) for TRPE). If J 1 and J 2 are chosen as the inputs e i and f i respectively of wires e i + f i in set J, then sets I 1 and I 2 together perfectly simulate W and J. In this case, we only have a failure on at most one of the inputs (b in this case), which concludes the proof for the second property.

i + f i in set J. Namely |J 1 | = |J 2 | = |J|.

From these definitions, I 1 and I 2 together perfectly simulate W and J and are both of size less than t (less than min(t, |W |) for TRPE), which proves the first property in this scenario. 2At this point, we proved that G add achieves an amplification order greater than or equal to d 2 for RPE1 (for TRPE1 in the TRPE setting). • if |J| > t ((T)RPE2): we prove both properties 1 and 2: 1. we assume that |W | < d 2 . Then we consider the set W = W 1 ∪ W 2 (as previously defined) such that |W | ≤ 2|W | < d. W 1 and W 2 both point to leaking wires in instances of G refresh . We denote by W 1 the set of leaking wires on the first instance of G refresh (on input a) such that W 1 contains W 1 and all the wires that are leaking within the second instance of G refresh (designated by W 2 in this second instance). Hence, we have that |W 1 | ≤ |W 1 ∪ W 2 | < d. From the (t, f )-RPE ((t, f )-TRPE in the TRPE setting) property of G refresh and its amplification order, there exists an input set of shares of a I 1 such that |I 1 | ≤ t (for TRPE we would have |I 1 | ≤ min(t, |W |)

  . Any set of leaking wires such that min(t + 1, n -t) ≤ |W | < 2 min(t + 1, n -t) can be simulated together with any set of outputs wires J ⊆ [n] from sets of input wires I 1 , I 2 such that |I 1 | ≤ min(t, |W |) or |I 2 | ≤ min(t, |W |) (because of the double failure, i.e failure on both inputs).

	2

1. Any set of leaking wires W such that |W | < min(t + 1, n -t) can be simulated together with any set of outputs wires J ⊆ [n] from sets of input wires I 1 on a and I 2 on b such that |I 1 | ≤ min(t, |W |) and |I 2 | ≤ min(t, |W |).

Table 5 .

 5

	Gadget	Complexity	Amplification	log 2 of maximum
		(Na, Nc, Nm, Nr)	order	tolerated proba
	G refresh	(4, 2, 0, 2)	2	-5.14
	G add	(11, 4, 0, 4)	2	-4.75
	Gcopy	(8, 7, 0, 4)	2	-7.50
	G mult	(40, 29, 9, 17)	2	-7.41
	Compiler	O(|C| • κ 3.9 )	2	-7.50

1: Results for the 3-share gadgets for (t = 1, f )-RPE, achieving the bound on the amplification order.

Table 5 . 2 :

 52 Results for the 5-share gadgets for (t = 2, f )-RPE, achieving the bound on the amplification order.

	Gadget	Complexity	Amplification	log 2 of maximum
			order	tolerated proba
	G refresh	(10, 5, 0, 5)	3	-4.83
	G add	(25, 10, 0, 10)	3	[-4.67, -4.42]
	Gcopy	(20, 15, 0, 10)	3	-6.17
	G mult	(130, 95, 25, 55)	3	[-9.67, -7.66]
	Compiler	O(|C| • κ 3.23 )	3	[-9.67, -7.66]

  To prove Theorem 5, we introduce the following lemma. Lemma 14. Let CC i be an RPE circuit compiler of amplification order d i and complexity s i .

	For any probability
	p ≤	1 2	•	d i + 1 s i -d i	(6.7)
	the expanding function f i of CC i is upper bounded by
	f i (p) ≤ 2	s i d i	p d i .	(6.8)
	Proof. ( Lemma 14) Let us first recall the following general bound on f i :

.6)

Proof.

  1 from a set of input shares I 1 on (b 1 , . . . , b n/2 ) such that |I 1 | ≤ |V 1 | + |J 1 |. Since (6.16) does not hold for ≤ i ≤ n/2 on each set of intermediate variables {a i , a n/2 +i , r i } and output variable b i = a i +r i , where all output variables b n/2 +i = a n/2 +i -r i must be simulated (since we fixed I 2 = n 2 : n ), and by summing the inequalities, we construct I ⊂ [n] on n-share input a to perfectly simulate I 1 , I 2 on intermediate variable b, and V 0 such that |I| ≤ |V 0

	R 2 , we can set J 2 =	n 2	: n and I 2 =	n 2	: n , and finally set J = J 1 ∪ J 2 of

n -1 output shares on G refresh . We can see that J 2 ⊆ J 2 and J 2 and V 2 can be perfectly simulated from I 2 trivially (full input). Next, we show how to perfectly simulate the sets I 1 , I 2 on intermediate variable b, and V 0 . In fact, thanks to the properties of the L I gadget, we can apply Lemma 5 from

[START_REF] Battistello | Horizontal side-channel attacks and countermeasures on the ISW masking scheme[END_REF]

for all 1

  This case can be treated in the exact same way as the above cases. Namely, if we have|V 1 | + |J 1 | + (n mod 2) ≤ |V 2 | + |J 2 |,then we can consider the first case and treat it in the same way (by appyling the recursion hypothesis on gadget R 1 and settingJ 2 = Otherwise, if we have |V 2 | + |J 2 | ≤ |V 1 | + |J 1 | + (n mod 2), then we can consider the second case and treat it in the same way (by appyling the recursion hypothesis on gadget

		n 2	: n and I 2 =	n 2	: n .
	R 2 and setting J 1 = This also concludes the proof in this case. n 2 and I 1 = n 2	.

Table 7 .

 7 1: Probing-like security notions from the basic primitive SIS G . t 1 indicates the number of probes on input and intermediate variables, while t 2 indicates the number of probes on output shares, with t = t 1 + t 2 .

	Notion	Condition
	t-NI [9]

  Add all input shares in p i of each input j to I j ;

	1 procedure GaussElimination(P )
	2	for each probe p i of P do
	3	if p i contains at least one random variable then
	4	r ← choose (any) one random variable in p i ;
	5	for each probe p j of P with i = j do
	6	if p j contains r then
	7	p j ← p i + p j ;
	8	end
	9	end
	10	p i ← r;
	11	end
	12	end
	13 procedure shares(P )
	14	I 1 ← ∅, . . . , I ← ∅;
	15	for each probe p i of P do
	16
	17	end
	18	return I 1 , . . . , I ;
	19 procedure SIS_LR(P )

Table 7 . 3 :

 73 Columns map for the constructive generation of incompressible tuples of Figure 7.1b

		input shares			randoms
	a0	a1	a2	r0	r1	r2
	a0	a1	a2	r0	r1	r2
	a0 + r0	a1 + r0	a2 + r1	a0 + r0	a2 + r1	a1 + r0 + r2
	a1 + r0 + r1 a1 + r0 + r2 a2 + r1 + r2	a1 + r0	a2 + r1 + r2 a2 + r1 + r2
				a0 + r0 + r1 a0 + r0 + r1

Table 7 .

 7 4: RPS* performance of our new constructive algorithm against our traditional enumerative one

				Enumerative Constructive
	Gadget	Shares #wires	β	Verif time	β	Verif time
	ISW refresh	8	140	8	5min	8 10	3sec 6min
	ISW add	7	224	7	18min	8 9	2sec 2min
	O(n log n) refresh	8	100	9	1min	9 11	2sec 2min
	ISW mult refreshed	6	297	6 7	2min 38min	6	12min

Table 7 .

 7 5: Maximum t-RPE leakage probabilities tolerated by some common masking gadgets

	Gadget	Shares	t	Ampl. order	β	#wires	log 2 maximum tolerated proba.	Verif. time
					Linear Randomness
			5	2	3/2	6	180	-10.54	24min
		mult	6	2	3/2	5	267	-12.00	13min
			7	3	2	5	371	[-10.45, -8.73]	28min
			5	2	3	10	50	-4.28	2min
		refresh	6	2	3	8	75	[-4.81, -4.61]	5min
	ISW		7	3	4	7	105	[-5.50,-4.01]	21min
	[59]		5	2	3	7	110	[-6.48,-4.70]	11min
		add	6	2	3	6	162	[-7.81,-5.03]	17min
			7	3	4	6	224	[-8.47,-4.15]	3h
			5	2	3	6	105	[-5.92,-5.54]	12min
		copy	6	2	3	5	156	[-6.92,-5.93]	24min
			7	3	4	4	217	[-8.02,-3.87]	33min
		refresh	4 8	1 3	2 4	30 7	30 100	-5.27 [-5.42,-4.36]	1sec 18min
	n log n [13]	add	4 8	1 3	2 4	8 6	68 216	-5.40 [-8.40,-4.40]	4min 4h
		copy	4 8	1 3	2 4	6 4	64 208	-6.96 [-7.94,-4.25]	27sec 55min
	circular	5	2	3	25	25	-4.84	1sec
	refresh [11]	10	4	3	8	50	-5.21	1min
	Sec. 5.5	add copy	5 5	2 2	3 3	9 6	55 60	[4.67,-4.42] -6.17	10min 41sec
					Non-linear Randomness
	Double-SNI	4	1	2	5	190	-9.85	5min
	ISW	5	2	5/2	5	305	[-10.01,-8.09]	31min
	mult Sec. 5.5	5	2	3	6	405	[-9.67,-7.66]	31h

Table 7 .

 7 6: Verified security properties on higher-order masked implementations for carefully chosen state-of-art automatic tools.

	Tools	probing-like soft robust soft robust RP-like
	maskVerif
	scVerif
	matverif
	SILVER
	VRAPS
	STRAPS
	IronMask

Table

Table 7 . 7 :

 77 Comparison of the performance of IronMask, maskVerif and matverif on higherorder masked gadgets. The multithreaded versions of each tool were used, with the maximum number of threads set to 4. N/A means that a tool cannot check a gadget, whereasmeans that a tool was not evaluated on a gadget because we deemed it too slow.

	Gadget	Type	Shares	Property	Verification time
					IronMask	maskVerif	matverif
			7	NI SNI	7sec 8sec	1min30sec 3min56sec	24sec 25sec
	ISW mult	LR	8	NI SNI	4min 6sec 5min 15sec 6h 30min 5min 15sec 2h 10min 5min 19sec
			9	NI SNI	2h 22min 3h 7min	--	2h 3min 1h 58min
			6	NI SNI	2sec 3sec	3sec 10sec	N/A N/A
	ISW mult refreshed	NLR	7	NI SNI	3min 41sec 1min 50sec 6min 8min 16sec	N/A N/A
			8	NI SNI	8h 52min 14h 46min	2h 2min 10h 4min	N/A N/A
			7		1sec	1min50sec	5sec
	NI mult [28]	LR	8 9	NI	5sec 2min50sec	2h 10min -	9sec 40sec
			10		6h 28min	-	1h 40min
			7		1sec	6min	8sec
	SNI mult [28]	LR	8 9	SNI	46sec 24min	6h 26min -	17sec 4min 37sec
			10		24h	-	1h 54min
			9	NI SNI	1sec 24sec	< 1sec 2sec	1sec 1sec
	refresh O(n log n)	LR	10 11	NI SNI NI SNI	1sec 16min 1sec 7h 50min	<1sec 9sec <1sec 1min	10sec 10sec 3min 3min
			12	NI SNI	1sec -	<1sec 5min	3h 35min 1h 52min

Table 7 .

 7 8: Verification time of NI and SNI verification of the ISW multiplication and O(n log n) refresh by IronMask and SILVER

	Gadget	Shares	Property	Verification time IronMask SILVER
		4	NI SNI	<1sec <1sec	1sec 2sec
	ISW mult	5	NI SNI	<1sec <1sec	9min 14min
		6	NI SNI	<1sec <1sec	>10h >10h
		6	NI SNI	<1sec <1sec	8sec 20sec
	refresh n log n	7	NI SNI	<1sec <1sec	7min 14min
		8	NI SNI	<1sec 2sec	>10h >10h

Table 7 .

 7 9: Performance of (t, p, ε)-RPE verification of IronMask and VRAPS on ISW multiplication gadgets at orders 4 to 6 (i.e. 5 to 7 shares)

	Shares	t	β	#wires	log 2 maximum tolerated proba	Verification time IronMask VRAPS
	5	2	4	180	[-11.00,-10.67]	3sec	1h 15min
	6	2	4	267	-13	17sec	24h
	7	3	4	371	[-12.00,-7.83]	24sec	24h

See https://github.com/CryptoExperts/VRAPS

In[START_REF] Ananth | Private circuits: A modular approach[END_REF], the authors only consider

2(m -1) for the cost of this step, not counting the number of random gates necessary to compute the additive sharing of the output.

The authors claim in their paper a complexity of m-1 c 2 + 2mk, since they do not take into account the copy gates needed to compute the product of input shares.

In case of a sharewise multiplication for instance, we would have m = n

.

Such large finite fields may actually be useful to build efficient symmetric primitives (see for instance MiMC[START_REF] Albrecht | MiMC: Efficient encryption and cryptographic hashing with minimal multiplicative complexity[END_REF]).

https://github.com/CryptoExperts/IronMask

This technique has already been used in VRAPS[START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF]

https://github.com/CryptoExperts/poc-expanding-compiler

m1 m2 mj mt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Acknowledgements

projects. I also thank Victor Lomné for our discussions during projects and conferences. Indeed, I thank Camille again for our collaboration.

In addition, I thank Karine Heydemann and Quentin Meunier for helping me with my research projects. I thank Quentin Meunier for allowing me to work with him and for his expertise in the field.

for the expanding compiler, we exhibit a new and also more efficient construction in a second attempt.

G compress from [START_REF] Belaïd | Private multiplication over finite fields[END_REF][START_REF] Carlet | Algebraic decomposition for probing security[END_REF]. The authors of [START_REF] Belaïd | Private multiplication over finite fields[END_REF] use the [m : n]-compression gadget introduced in [START_REF] Carlet | Algebraic decomposition for probing security[END_REF] for any input sharing m, using a [2n : n]-compression subgadget as a building block.

In a nutshell, it first generates an ISW -refresh of the zero n-sharing (w 1 , . . . , w n ). Then, these shares are added to the input ones (c 1 , . . . , c n ) to produce the sequence of output shares (c 1 + w 1 , . . . , c n + w n ).

The compression gadget is claimed to be (n -1)-SNI in [START_REF] Belaïd | Private multiplication over finite fields[END_REF]. However, we demonstrate that it is not with the following counterexample. Let n > 2 and i ∈ [n]. We consider the set composed of a single output share of the compression procedure J = {(c i + w i ) + c n+i } and the set of probes on the internal wires W = {w i }. For the compression to be 2-SNI, we must be able to perfectly simulate both the wires in W and J with at most |W | = 1 share of the input c. However, we can easily observe that (c i + w i ) + c n+i -w i = c i + c i+n requires the two input shares c i and c i+n to be simulated, which does not satisfy the 2-SNI property. In conclusion, the above gadget is actually not SNI, and interestingly it is not sufficient either for our construction, i.e. it does not satisfy Definition 23. This observation motivates our need for a new compression gadget which satisfies the necessary property for our construction.

New Construction for G compress . In Algorithm 7, we exhibit a new [m : n]-compression technique using an m-share refresh gadget G refresh as a building block. We demonstrate in Lemma 18 that this new compression gadget satisfies the necessary properties for our construction as long as m ≥ 2n. Proof. Let G compress be the [m : n]-compression gadget from Algorithm 7 such that m ≥ 2n and let G refresh be the m-share refresh gadget such that G refresh is (m -1)-SNI and (m -1)-STRPE2. We will prove that G compress [m : n]-compression gadget constructed with such G refresh is (t, f )-comp-TRPE. Let us denote (c 1 , . . . , c m ) the input shares of G compress , (d 1 , . . . , d n ) its output shares, and (c 1 , . . . , c m ) the refreshed shares of (c 1 , . . . , c m ) using G refresh . We write m as m = K.n + for K, ∈ N such that K = m/n . For each 1 ≤ i ≤ ,

Construction of G submult

To complete the construction of the overall multiplication gadget, we now exhibit relevant constructions for G submult . We first rely on the construction from [START_REF] Belaïd | Private multiplication over finite fields[END_REF] which happens to achieve the desired goal in some settings. While all the cases are not covered by the stateof-the-art proposal, we then slightly modify the construction to meet all our requirements. Both constructions rely on linear multiplications that are not included yet in the expanding compiler. We thus start with a construction for this additional linear gadget that we further denote G cmult .

Construction for G cmult . We give a natural construction for G cmult in Algorithm 8 which simply multiplies each input share by the underlying constant value and then applies a (t, f )-RPE refresh gadget G refresh . Basically, with a (T)RPE refresh gadget G refresh , we obtain a (T)RPE linear multiplication gadget G cmult as stated in Lemma 19. Proof. G cmult has the exact same wires as the underlying G refresh except for the extra input wires {a 1 , . . . , a n } (the wires multiplied by the constant i.e {c•a 1 , . . . , c•a n } are the input wires to G refresh ). So to simulate probes on G cmult , we use the simulator of G refresh . Each probe which is in the set {a 1 , . . . , a n } will be replaced by the corresponding input share multiplied by the constant c, in the set of probes on G refresh , which would lead to a probe on an input share of G refresh of the form c • a i . It is clear that if we can perfectly simulate c • a i in G refresh , then we can perfectly simulate the input share a i in G cmult . Thus any set of probes on G cmult is simulated using the simulator of G refresh with the exact same number of probes. Hence, if G refresh is (t, f )-(T)RPE n-share refresh gadget of amplification order d, then the gadget G cmult is also (t, f )-(T)RPE of amplification order d. This concludes the proof.

Relying on an additional gate for the linear multiplication does not impact the security analysis and the application of the compilation, but it modifies the complexity analysis of the expanding compiler. From the analysis given in Section 4.4, a complexity vector is associated to each base gadget N G = (N a , N c , N cm , N m , N r ) T where N a , N c , N cm , N m , N r stand for the number of addition gates, copy gates, constant multiplication gates, (bilinear) multiplication gates and random gates respectively in the corresponding gadget. The matrix M CC is now a 5 × 5 square matrix defined as

including, for each vector, the number of linear multiplications. Five eigenvalues λ 1 , λ 2 , λ 3 , λ 4 , λ 5 are to be computed, i.e., one more compared to the expanding compiler in the original setting.

and L and M the same matrices as defined in Condition 1.

Condition 2 is satisfied for a matrix γ if and only if for any vector v ∈ F z q of Hamming weight hw(v) ≤ n -1, and for any i 1 , . . . , i K ∈ [z] such that v i 1 = 0, . . . , v i K = 0 and the corresponding columns i 1 , . . . , i K in L and in M have no zero coefficient (i.e there are K probes of the form

Based on this new condition, we can prove our second property G submult , as stated in Lemma 20.

Lemma 20. Let t ≤ n-1 such that either n is even or t = n -1 2 and let d = min(t+1, n-t).

Let G submult the multiplication subgadget introduced in [START_REF] Belaïd | Private multiplication over finite fields[END_REF] Proof for (d -1)-NI:

If the matrices γ and δ satisfy Condition 2, then they also sastisfy Condition 1, since Condition 2 is stronger. Then, in [START_REF] Belaïd | Private multiplication over finite fields[END_REF], the authors prove that we have that if γ and δ satisfy Condition 1, then the gadget G submult is (n -1)-NI. In addition, if G submult is (n -1)-NI, then in particular it is also (d -1)-NI for any t ≤ n -1 and d = min(t + 1, n -t). This implies that if the matrices satisfy Condition 2, then the gadget G submult is (d -1)-NI thanks to the proof from [START_REF] Belaïd | Private multiplication over finite fields[END_REF]. This concludes the proof for the first point of Lemma 20.

Proof for (d -1, 2d -1)-partial NI:

We need to prove that G submult is (d -1, 2d -1)-partial NI where d = min(t + 1, n -t). In other words, we need to consider a set of probes W of size |W | ≤ 2d -1 ≤ n -1 and show that W can be simulated from inputs shares I a and

For this, we will split the set W into 3 distinct subsets W = W 1 ∪ W 2 ∪ W 3 with respect to the form of the probes in W . In fact, The authors from [START_REF] Belaïd | Private multiplication over finite fields[END_REF] show that G submult is (n -1)-NI if the matrices γ and δ satisfy certain conditions. In fact, all of the probes on the sub-gadget G submult are of a form in one of the following sets:

Characterization of Security Notions for Masking Gadgets

In the following, we shall consider the symbolic expression of a probed wire of a circuit or gadget. The symbolic expression of a circuit's wire is expressed in terms of the circuit inputs (shares) and the generated randoms (outputs of random gates). We denote as before the input sharings of the circuit as x 1 , . . . , x of n shares each, and we group the random variables used as input to the circuit in a vector r of size ρ.

We also denote in the rest of this chapter a set of probes on a gadget as a vector or a tuple P , slightly different from the previous chapters where we consider sets of probes denoted by W . This is because we consider the vector representation of variables to perform linear algebra operations on tuples of probes, such as Gaussian Elimination.

Although many different security notions have been introduced to build proofs of gadgets in the (random) probing model (e.g. NI, SNI in the probing model, and RPC, RPE in the random probing model), we show that they can almost all be defined on top of a single building block: the set of input shares (SIS) function. The latter takes as input a set of probes on the gadget's internal wires and a set of output shares and returns a set of input shares necessary (and sufficient) to perfectly simulate these internal probes and output shares. We formalize the SIS primitive in Definition 24 before showing how to use it to express state-of-the-art properties. For clarity, we restrain the following definitions to the case of single-output gadgets (the most common case), but the extension to multi-output gadgets is straightforward. We denote SIS G to be SIS with input gadget G.

Definition 24. Let G be an (n-share, -to-1) gadget mapping input sharings ( x 1 , . . . , x ) ∈ (K n ) to an output sharing y ∈ K n . Let P be a tuple of probes on G and O ⊆ [n] a set of output shares indices. The function SIS G maps P and O to the unique smallest sets of input indices I 1 , . . . , I such that (P , y| O ) can be perfectly simulated from x 1 | I 1 , . . . , x | I .

Note that for any gadget G, the smallest set of input shares returned by SIS G is uniquely defined from the result [START_REF] Belaïd | Randomness complexity of private circuits for multiplication[END_REF]Lemma 7.5], which demonstrates that if a set of probes can be simulated from different sets of inputs shares, then it can also be simulated by the intersection of these sets.

Probing Security Notions

We now formalize the probing-like security notions (i.e., to achieve security and secure composition in the probing model) for any n-share, -to-1 gadget G (all these notions can be generalized for the case of multiple outputs). Definition 25 reformulates Definition 4 of the NI notion from [START_REF] Barthe | Strong non-interference and type-directed higher-order masking[END_REF], using the SIS building block.

Definition 25 (t-NI).

A gadget G is t-NI if for any tuple P of t 1 internal probes and any set O of t 2 output share indices such that t 1 + t 2 ≤ t, the sets (I 1 , . . .

Other common probing-like properties can be defined in a similar way by changing the condition on the sets (I 1 , . . . , I ) in the output of the SIS G primitive. We list these conditions in Table 7.1 for some of the most common probing-like properties with respect to t and O. While most of the properties are interesting in the context of composing secure gadgets to achieve global security, directly verifying the probing security of a complete implementation is useful in some cases, such as analyzing a complete 2-share AES implementation. To represent this case, we denote PS the SIS-based probing security definition. PS is actually equivalent to the case of (n -1)-NI with O = ∅ and t = n -1. We list this property in Table 7.1 as well.

For clarity, we describe the verification method for the case of 2-input gadgets; the extension to inputs is straightforward. We thus present NLR-gadgets as 2-to-m gadgets G : ( x 1 , x 2 ) → ( y 1 , . . . , y m ) with the output of the form:

This characterization notably covers most (if not the totality of) multiplication gadgets. It covers, in particular, multiplication gadgets which first start by refreshing one of (resp. each of) their inputs before performing share-wise products that are finally recombined into the output sharing (with additional randomness). Such multiplication gadgets have been recently described in [START_REF] Goudarzi | How fast can higher-order masking be in software?[END_REF][START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF][START_REF] Cassiers | Trivially and efficiently composing masked gadgets with probe isolating non-interference[END_REF] and Section 5.4.

Any probe on such an NLR-gadget is either a probe on the inner circuits R i ( x i , r i ) and is of the form:

for i ∈ {1, 2} (since the R i are linear arithmetic circuits) with w p ∈ K n , s p ∈ K ρ i , or is a probe on the outer circuit and is of the form:

where z i := R i ( x i , r i ) for i ∈ {1, 2} with s p ∈ K ρ 3 , and for some arithmetic function f p :

We show hereafter that we can still obtain an efficient and complete evaluation of SIS for those gadgets, yielding an efficient verification of the considered security notions.

The verification technique for NLR-gadgets essentially consists of several iterations of the verification process for LR-gadgets used in Lemma 22. The steps of the technique are as follows. Suppose that we have a tuple of probes P = (p 1 , . . . , p k , p k+1 , . . . , p d ) where (p 1 , . . . , p k ) are all of the form (7.6) while (p k+1 , . . . , p d ) are all of the form (7.5).

1. First, we apply the Gaussian elimination technique of Section 7.2.1 on the probes (p 1 , . . . , p k ) with respect to the vector of randoms r 3 . This is possible since all of these probes respect the form (7.4) w.r.t. inputs (z 1 , z 2 ) and randomness r 3 . Specifically, let

, with s p i defined from (7.6), and let N 3 be the permutation matrix such that S 3 = N 3 • S 3 is the row reduced form of S 3 (see Lemma 22). From this, we get a new derived tuple P := N 3 • P = (p 1 , . . . , p m , p m+1 , . . . , p k ) and we know from Lemma 22 that each of the expression in (p m+1 , . . . , p k ) can be perfectly simulated by simply generating k -m uniform random values. Thus, we end up with (p 1 , . . . , p m ), which we need to simulate perfectly, and where each of the p i is of the form f p i (z 1 , z 2 ) with no random values from r 3 , along with the remaining probes (p k+1 , . . . , p d ). We then construct the new tuple to simulate P = (p 1 , . . . , p m , p k+1 , . . . , p d ), which we rewrite as P = (p 1 , . . . , p m+d-k ). Thus, to perfectly simulate the tuple of probes P , we need to perfectly simulate the probes in P .

We stress at this stage that each algebraic expression p i in P is either of the form p i = f p i (z 1 , z 2 ) with f p i of a homogeneous bilinear form (this is of the first m coordinates resulting from Gaussian elimination) or of the form (7.5) (i.e. the probes on R 1 or R 2 that are not affected by the previous Gaussian elimination since they do not contain any randoms from r 3 ). 2. For each p i in P of the form p i = f p i (z 1 , z 2 ), we factor its algebraic expression with respect to the vector of values ( x 1 ||r 1 ). In other terms, we rewrite each p i as

where h p i is a tuple of n + ρ 1 algebraic expressions of the form (7.5) w.r.t. ( x 2 , r 2 ).

We then construct a new tuple P 2 := (h p 1 • • • h p m ) to which we append all the expressions p i of the form (7.5) w.r.t. ( x 2 , r 2 ) (i.e. probes from R 2 ).

3. We perform the same procedure as in the last step but this time factoring each p i in P of the form p i = f p i (z 1 , z 2 ) with respect to ( x 2 ||r 2 ), rewriting each p i as

From those expressions we define a new tuple

where the coordinates of the g p i 's are of the form (7.5) w.r.t. ( x 1 , r 1 ), to which we append all the expressions p i of the form (7.5) w.r.t. ( x 1 , r 1 ) (i.e. probes from R 1 ).

4. Recall from the first step that perfectly simulating P amounts to perfectly simulating P . We will prove later in this section that the input shares from x 1 and x 2 that are necessary and sufficient to produce a perfect simulation of P are the same as the ones for a perfect simulation of P 1 , P 2 constructed in the last two steps. Observe that all probes in P 1 , P 2 respect the form (7.5), which is a special case of (7.4). Hence, we separately apply the Gaussian elimination technique of Lemma 22 on P 1 with respect to ( x 1 , r 1 ), and on P 2 with respect to ( x 2 , r 2 ). This provides us with the sets of input shares I 1 on x 1 and I 2 on x 2 that are respectively necessary and sufficient to produce a perfect simulation of the expressions in P 1 and P 2 . These sets are, therefore, output as the necessary and sufficient sets of input shares for a perfect simulation of P .

We state in the following lemma that the above verification method is complete.

Lemma 23. Let G be a 2-input n-share NLR-gadget. Let P = (p 1 , . . . , p d ) be a tuple of probes on G. Let P 1 , P 2 be the tuples of linear expressions w.r.t. ( x 1 , r 1 ) and ( x 2 , r 2 ) obtained by applying the above method. The sets I 1 , I 2 obtained by applying the method of Lemma 22 on P 1 with respect to ( x 1 , r 1 ) and separately on P 2 with respect to ( x 2 , r 2 ) are the sets of input shares necessary and sufficient to simulate P .

Proof. The proof follows the different steps of the method described above. All the statements hold from Lemma 22 except that the sets I 1 , I 2 are necessary and sufficient for a perfect simulation of P . We prove this statement hereafter.

For any random distributions D x 1 and D x 2 over K n , we denote D P the distribution induced on P by picking

Then I 1 and I 2 are the minimal sets such that for any distributions D x 1 and D x 2 , there exists a probabilistic algorithm S (the simulator) which given x 1 | I 1 and x 1 | I 2 outputs a tuple P which is i.i.d. as D P w.r.t. the random draw x 1 ← D x 1 , x 2 ← D x 2 and the random coins of S.

Direction 1: The sets (I 1 , I 2 ) are necessary to simulate P . Here we need to perfectly simulate the distribution of P given the random samplings

for any distributions D x 1 and D x 2 over K n . Let us consider the uniform distribution for D x 1 , then the m first coordinates of P (i.e. the expressions of the form (7.7)) can be written as

, where u is a vector uniformly sampled on K n+ρ 1 . Recall that the h p i 's corrdinates are expressions of the form (7.5) w.r.t. ( x 2 , r 2 ).

Given the values taken by the h p i 's we can have different distributions for P | [m]

. A particular case is the distribution "P | [m] = 0 with probability 1" which appears if and only if

In order to evaluate the probability of outputting P | [m] = 0 (which must be exact for a perfect simulation), the simulator must hence evaluate the probability that h p 1 = • • • = h p m = 0 occurs, which must be further conditioned on the remaining expressions Algorithm 13: Our constructive algorithm to generate failures. G is the gadget we are considering, and n is the number of shares required for a tuple to be a failure.

1 procedure UnmaskTuple(G, S, P , unmask_index) failure because the shares a1 and a2 are masked by the randoms r0 and r1 (the two random values appear only once in the tuple and can be used to mask the corresponding expressions). We thus pick a wire from the r0 bucket and add it to the tuple, say a0 + r0 + r1 (which happens to cancel r1 as well as r0). The resulting tuple is (a0,a1+r0,a2+r1,a0+r0+r1), which is a failure. By doing this for every possible wire of each column, we can generate all failures of the gadget of Figure 7.1b. Algorithm 13 introduces more formally this procedure for LR-gadgets. This algorithm lists all of the tuples composed of one element from each input share column (line 23); we note the resulting list L. Note that those tuples might have some duplicates since some wires appear in several columns: these duplicates are removed while building the tuples (which implies that the tuples in L contain possibly less than n elements).

Then, for each tuple in L, the recursive procedure UnmaskTuple adds wires to the tuple to cancel the randoms that mask its input shares. The procedure takes as argument the circuit G, the set of incompressible tuples already computed S, a tuple P that needs to be turned into a failure and an integer unmask_index that contains the next index of P that we should try to unmask. First, UnmaskTuple checks if P is a failure (line 2). To do so, we can use the procedure SIS_LR ( Algorithm 9). If P is a failure, we then check if it is incompressible (line 3) by checking if any tuple P ⊂ P is already in S. Ignoring line 11 for now, a Gaussian elimination is then performed on P (line 12). If the unmask_index th element of the resulting

Appendices

A.1 Proof of Lemma 13

Recall the procedure of the gadget. We consider that we have an n-share (t, f )-TRPE refresh gadget G refresh achieving the amplification order d ≥ min(t + 1, n -t). First, the gadget G mult performs n executions of the gadget G refresh on the input sharing (b 1 , . . . , b n ) to produce:

(without counting the random r i,i because it is cancelled out in c i as it appears in V i and X i and c i = V i + X i ). Observe that each random value r i,k in V i appears in exactly one other output share c k = V k +X k that comes from the expression of X k = r 1,k +. . .+r i,k +. . .+r n,k . In other terms, each output share c k has exactly one random value in common with V i in c i . Then, by probing |J| output shares in J including c i , there are at least n -|J| remaining random values in V i that do not appear in any other expression of the output shares. In addition, observe that any probed variable in W can have in its expression at most one random value in common with V i (because each random value r i,j appears exactly once in each of the wires p i,j , r i,j or X j ). Then, since

that does not appear in any other expression of the probed values in W or J. So c i = V i + X i can be perfectly simulated by generating the uniform random value r i, , which concludes the proof.

In the following, we will separately prove the TRPE1 then the TRPE2 property on G mult via Lemmas 24 and 27 to demonstrate Lemma 13.

A.1.1 Proof for TRPE1 property

Proof. We proceed in two steps through the following two lemmas 25 and 26, considering the leaking wires in two distinct ranges.

Lemma 25. Let J be a set of at most t output shares of G mult . Let W be a set of leaking wires as described above such that |W | ≤ d -1 ≤ t. Then W and J can be perfectly simulated from at most min(t, |W |) = |W | shares of each of the inputs a and b.

Proof. Let J be the set of t output shares of G mult (i.e of G submult ), and let W = W ∪ W (1) ∪ . . .∪W (n) with |W | ≤ d-1 ≤ t be the set of probes on the global gadget G mult and decomposed as explained earlier. We organize the proof in two steps:

1. We first identify the set of input shares I a and the sets J (i) b for i ∈ [n] which are necessary to perfectly simulate J and W in G submult .

2. Then, we show that we can perfectly simulate the sets J (i) b and W (i) for i ∈ [n] using the simulator of the gadget G refresh . This will determine the sets I

Using I b , we will be able to perfectly simulate

we will be able to perfectly simulate W and J. This will lead to a perfect simulation of all probes W and output shares in J on the global gadget G mult .

We first start by constructing the set of input shares indices I a and the sets J (a) For probes of form (a), we add index i to I a , and index j to 1 We consider that all J (k) b are empty at first since all the output shares of G refresh can be probed directly in W .

is probed, no product of shares a k • b (k) j or p k,j is probed, and no random value r k,j is probed. Now we reason on the number of probes of the form (c) in W :

• We first consider the special case where the number of X i,j probed (of form (c) in W ) for distinct values of i is equal to n. In other terms, we have probes X • Next, we consider that there is at least one index such that X ,j / ∈ W for all j ∈ [n] (in other terms, the number of probes of the form X i,j for distinct values of i is at most n -1). Notice that this case is slightly different than the case of claims 2 and 3, since can be in the set J. In this case, we can let I b = [n] so that we can perfectly simulate all wires in W (1) ∪ . . . ∪ W (n) and J

and we can perfectly simulate all wires in W using I a by construction and I b = [n] and generating the necessary random values. Next, we need to prove that we can perfectly simulate all output shares in J. Let i ∈ J. If i ∈ I a , then c i is perfectly simulated using a i and I b = [n] and generating the necessary random values. Next, if i / ∈ I a , then if / ∈ J, we can use claim 2 to prove that we can replace the expression of c i = V i + X i by the random value r i,l and so the share a i is not needed for the simulation of c i (even if X i,j for a certain j is probed, the expression of V i is still masked by r i,l and a i is not needed to simulate X i which is a sum of random values). Meanwhile, if ∈ J, then we cannot directly use the random value r i, to mask the expression of c i . But since X ,j / ∈ W for all j ∈ [n], and since r k, / ∈ W because k / ∈ I a by assumption, then c can be masked by the random value r k, , i.e c = V + X ← r k, . Since i ∈ J and k / ∈ J, then i = k and the random value r i, does not appear anymore in X in the expression of c . Since i / ∈ I a then r i, can be used to mask the expression of the output share c i indexed in J and so the share a i is not needed for the simulation of c i . This proves that we can perfectly simulate all shares in J with the constructed sets I a and

We managed to show that whenever the construction of the set I a gives |I a | ≤ t, then we can perfectly simulate the sets W and J with at most a failure on input b and while still having

By considering both cases |I a | ≥ t + 1 and |I a | ≤ t, we covered all the cases for the simulation, and we proved that we can always perfectly simulate the set of probes W along with the set of output shares J while having a failure on at most one of the inputs. This concludes the proof of Lemma 26.

A.1.2 Proof for TRPE2 property

Lemma 27. The above multiplication gadget is (t, f 2 )-TRPE2 of amplification order d ≥ min(t + 1, n -t) Proof. To prove the lemma, we proceed in two steps through the following two lemmas 28 and 29. then p i,j can be perfectly simulated from the corresponding input shares and by generating uniformly at random r i,j . Otherwise, if j / ∈ J (i) b , then that means that the wires p i,j , r i,j and X j are not probed in W . That means that we can potentially replace p i,j by a random value r i,j since r i,j does not appear in any other expression of the variables probed in W . Meanwhile, we also need to check the case where j ∈ J, since c j = V j + X j , and r i,j is the one of the summed terms in the expression of X j :

• If j / ∈ J, then we can replace p i,j by a random value r i,j since r i,j does not appear in any other expression of the variables probed in W and is not probed either through c j .

• If j ∈ J, then we also know that V j / ∈ W (because otherwise we would have by construction j ∈ J (k) b for k ∈ [n] which does not hold), then we know from claim 4 that c j can be masked by the random value r j , , which masks V j +X j . Since = j (because / ∈ J while j ∈ J), then r i,j does not appear anymore in any other wire expression of the probed variables in W or J except in the term p i,j of V i,j , so r i,j can be used to mask the expression of p i,j .

By perfectly simulating each term p i,j in V i,j , we can perfectly simulate V i,j . Thus, we can perfectly simulate all wires in W . Simulation of J. Let i ∈ J. Let us first consider the case where V i,j / ∈ W for any j ∈ [n], then by claim 4, the output share c i can be masked by the random variable r i, , so c i is perfectly simulated by generating a fresh random value. Otherwise, if V i,j ∈ W for a certain j ∈ [n], then we know that the value of V i,j is perfectly simulated as proven above. Now, let us check each term p i,j for j ∈ [j + 1, n]. Actually, we can also perfectly simulate each of these terms like the terms p i,j for j ∈ [j]. Plus, the term p i,i is perfectly simulated by construction of the sets I a and J (i) b (because V i,j ∈ W ). In addition, all terms in X i in c i = V i + X i can be perfectly simulated by generating a fresh random value. Thus, c i can be perfectly simulated by summing all of the perfectly simulated terms in it. This brings us to a perfect simulation of all output shares in J. We have shown that we can perfectly simulate any set of probes W of size at most min(t + 1, n -t) -1 with a chosen set J of n -1 output shares, with at most min(|W |, t) = |W | shares of each of the inputs a and b. This concludes the proof of Lemma 28.

Remark 9. We can observe that for this lemma to apply on G mult , we don't need the preprocessing phase of the refresh on input b. In fact, you can see that during the construction of the sets J (k) b , we add each index to all of the sets for all k ∈ [n]. However, executing n refreshings on the input b will be necessary for the proof of the next result, specifically when we consider W such that min

To get back to the proof of Lemma 27, we also need the following result.

Lemma 29. Let W be a set of leaking wires as described above such that min(t + 1, n -t) ≤ |W | < 2 • min(t + 1, n -t). Then there exists a set J of n -1 output shares such that W and J can be perfectly simulated from sets of input shares Proof. Recall that the set W can be split into subsets W = W ∪ W (1) ∪ . . . ∪ W (n) as described above. We consider two cases.

so by the TRPE property of G refresh for any t ≤ n -1, all of the J (k) b

sets can be perfectly simulated with no knowledge of the input shares of b since W (k) = ∅, so I for some k ∈ [n], note this probe q k,i ∈ {r k,i , p k,i }. Since also I a = [n], this means that we have probes q k 1 ,1 , . . . , q kn,n , such that k 1 = . . . = k n . Because |W | = n, then all probes in W are of the form (a) (specifically q k,i ), and we have no probes of the form V i,j for any i, j ∈ [n]. In this case, the simulation of the probes in W is straightforward by construction of the sets I a and J

b . As for the set J, we let J ⊂ [n] such that |J| = n -1 (any set of n -1 shares works), and let ∈ [n] such that / ∈ J. Observe that out of all the random values r i, in X in the expression of c = V + X , only the random value r k , appears in the expression of the probe q k , in the set W , and all other random values r i, for i = k do not appear in any other probed variable in W (since W = {q k 1 ,1 , . . . , q k , , . . . , q kn,n }, such that k 1 = . . . = k n ). Then, for each i ∈ J such that i = k , the expression of c i = V i + X i can be masked by the random value r i, , so simulating c i amounts to generating a fresh random value r i, . Now let's check i = k ∈ J. Since q k , is probed, then we cannot mask the expression of c k using r k , . However, for each i ∈ J with i = k , we have that c i is masked by r i, . Since c i = V i + X i , and the random value r k ,i is one of the terms in X i , then r k ,i does not appear anymore in the expression of c i . And since W = {q k 1 ,1 , . . . , q k , , . . . , q kn,n }, such that k 1 = . . . = k n and q k , ∈ W , then q k ,i / ∈ W and r k ,i only appears in the expression of c k , so c k can be masked by the random value r k ,i . Thus, we proved that we can perfectly simulate the sets W and J using the sets I a and J (k) b .

• Next, we suppose that there exists ∈ [n] such that we have no probes in W of the form q k, ∈ {r k, , p k, }. In this case, we choose J = [n] \ { }. Next, we show that we can perfectly simulate all probes in W and output shares in J for each i ∈ I a = [n]. For this, first let i ∈ [n] \ { } (notice that we automatically have i ∈ J):

A.2 Proof of Theorem 3

We consider that we have compilers CC 1 , . . . , CC , and we want to prove the following result:

Lemma 30. Let CC 1 , . . . , CC RPE compilers with expanding functions f 1 , . . . , f . The dynamic expanding compiler for CC 1 , . . . , CC ,which on input circuit C outputs the compiled circuit

, is an RPE compiler with expanding function f such that

It can be seen that proving Lemma 30 implies proving the result of Theorem 3. Indeed, we can replace in the lemma by k 1 + . . . + k µ from Theorem 3 and consider the corresponding compilers with their expansion levels. Thus, we will prove in this appendix Lemma 30 and the proof of the Theorem will follow directly.

To prove the lemma, we first start by introducing some definitions from [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF] for random probing expandability of level-with different sharing orders n 1 , . . . , n gadgets. First, we introduce a generalized definition of adequate subsets of [n 1 × . . . × n ] as in [START_REF] Belaïd | Random probing security: Verification, composition, expansion and new constructions[END_REF]. For this, we define recursively a family S k ∈ P([n 1 × . . . × n k ]) for k ≤ , where P([n 1 × . . . × n k ]) denotes the set of all subsets of [n 1 × . . . × n k ], as follows:

In other words, a subset I belongs to S k if among the n k subset parts of I, at most t k of them are full, while the other ones recursively belong to S k-1 . For simplicity, we will sometimes denote S k without the parameters ({n i } i∈[k] , {t i } i∈[k] ) which will be implicit in the notation. We will also denote for simplicity

Then we recall the generalized definition of RPE with S k for level-k gadgets.

Definition 28 (Random Probing Expandability with {S k } k∈N ). Let f : R → R and k ∈ N.

An N k -share gadget G :

)-random probing expandable (RPE) if there exists a deterministic algorithm Sim G 1 and a probabilistic algorithm Sim G 2 such that for every input ( x, y) ∈ K N k ×K N k , for every set J ∈ S k ∪[N k ] and for every p ∈ [0, 1], the random experiment

ensures that 1. the failure events

with ε = f (p) (in particular F 1 and F 2 are mutually independent), 2. the set J is such that J = J if J ∈ S k , and where z = G( x, y).

the output distribution satisfies

We are now ready to prove Lemma 30.

Lemma 30. We will prove the Lemma recursively. In other words, we will suppose that we have RPE compilers CC 1 , . . . , CC k with expanding functions f 1 , . . . , f k and (t i , f i )-RPE gadgets for each i ≤ k, and we will prove that the gadgets of the expanding compiler

This will imply that the expanding compiler

The base case is one of the theorem hypotheses, namely for k = 1, the level-1 gadgets are (t 1 , f 1 )-RPE, which is equivalent to (S 1 , f 1 )-RPE. We must then show the induction step: assuming that the level-k gadgets are

For the sake of simplicity, we depict our proof by assuming that all the gadgets are 2-to-1 gadget (which is actually not the case for copy gadgets). The proof mechanism for the general case (with 2-to-1 and 1-to-2 gadgets) is strictly similar but heavier on the form. We also denote in the following

• G CC k to be a gadget of the expanding compiler CC k ,

• G (k) to be the gadget resulting from applying In order to show that a gadget G (k+1) is (S k+1 , ε k+1 )-RPE we must construct two simulators Sim G (k+1) 1 and Sim G (k+1) 2 that satisfy the conditions of Definition 28 for the set of subsets S k+1 . More precisely, we must construct two simulators Sim G (k+1) 1 and Sim G (k+1) 2 such that for every ( x * , y * ) ∈ K N k+1 × K N k+1 , and for every set J * ∈ S k+1 ∪ [N k+1 ], the random experiment where z = G (k+1) ( x, y). We distinguish two cases: either J * ∈ S k+1 (normal case), or J * = [N k+1 ] (saturated case).

Normal case: J * ∈ S k+1 .

By definition of the expanding compiler, we have that a level-(k + 1) gadget G (k+1) is obtained by replacing each gate of the base gadget G CC k+1 of the compiler CC k+1 by the corresponding level-k gadget G (k) and by replacing each wire of the base gadget by N k wires carrying a N k -linear sharing of the original wire. In particular G (k+1) has N k+1 output wires which can be split in n k+1 groups of N k wires, each group being the output of a different G (k) gadget. We split the set J * accordingly so that

, where each set J * i pertains to the ith group of output wires. By definition of S k , since J * ∈ S k+1 , we must have J * i ∈ S k for all 1 ≤ i ≤ n k+1 , except at most t k+1 of them for which

We define J base as the set of indexes i such that J * i / ∈ S k . Therefore we must have |J base | ≤ t k+1 . We first describe the simulator Sim G (k+1) 1 that takes the leaking wires W * and the output wires J * ∈ S k+1 to be simulated and produce the sets

1 starts by defining a set W base which is initialized to ∅; this will correspond to the set of leaking wires for the base gadget G CC k+1 . Then the simulation goes through all the level-k gadgets composing G (k+1) from bottom to top i.e. starting with the level-k gadgets producing the output sharing up to the level-k gadgets processing the input sharings. Let us denote by {G (k) j } j these level-k gadgets. For each G (k) j , one runs the simulator Sim 1 from the (S k , f k • . . . • f 1 )-RPE property on input W j and J j defined as follows. The set of leaking wires W j is defined as the subset of W * corresponding to the wires of G (k) j . For the gadgets G (k) j on the bottom layer, the set J j is set to one of the J * i (with indices scaled to range in [N k ]). For all the other gadgets G (k) j (which are not on the bottom layer), the set J is defined as the set I 1 or I 2 output from Sim 1 for the child gadget G simulation, the set W base contains all the labels of wires in the base gadget G CC k+1 for which a failure event has occurred in the simulation of the corresponding G (k) j gadget. Thanks to the (S k , ε k )-RPE property of these gadgets, the failure events happen (mutually independently) with probability ε k which implies

Recall that |J base | ≤ t k+1 . We can then run Sim G CC k+1

1 to obtain:

so that the corresponding i-th input wire of the base gadget can be computed from the corresponding input wires in I * 1,i . The simulator Sim G (k+1) 1 then returns (I * 1 , I * 2 ) as output.

The (t k+1 , f k+1 )-RPE property of the base gadget G CC k+1 implies that the base failure events |I 1,base | = n k+1 and |I 2,base | = n k+1 are ε k+1 -mutually unlikely, where ε k+1 = f k+1 (ε k ). We argue that for all ). We deduce that the failure events F * 1 and F * 2 are also ε k+1 -mutually unlikely, as required by the (S k+1 , ε k+1 )-RPE property of G (k+1) .

We now describe the simulator Sim G (k+1) 2 that takes as input x * | I * 1 and y * | I * 2 and produces a perfect simulation of AssignWires(G (k+1) , W * , ( x * , y * )), z| J * where z = G (k+1) ( x, y). Let x b and y b denote the n k+1 -linear sharings obtained by applying the linear decoding to each group of N k shares in x * and y * , so that the elements of x b and y b correspond to the input wires in the base gadget G CC k+1 . The assignment expansion property implies that a perfect assignment of the wires of G (k+1) on input x * and y * can be derived from an assignement of the wires of the base gadget G CC k+1 on input x b and y b . The simulator makes use of this property by first running The simulator then goes through all the G (k) j gadgets from input to output and for each of them runs the simulator Sim 2 of the RPE property on inputs W j , J j , x| I 1 and y| I 2 where W j and J j are the sets from the first phase of the simulation for the gadget G in the evaluation of G (k+1) ( x * , y * ). Provided that the partial inputs x| I 1 and y| I 2 are perfectly simulated, this call to Sim 2 produces a perfect simulation of AssignWires(G (k) j , W j , ( x, y), z| J j where z = G (k) j ( x, y). In order to get perfect simulations of the partial inputs x| I 1 and y| I 2 , the simulator proceeds as follows. For the top layer of G (k) gadgets (the ones processing the input shares) the shares x| I 1 and y| I 2 can directly be taken from the inputs x * | I * 1 and y * | I * 2 . For the next gadgets the shares x| I 1 and y| I 2 match the shares z| J output from the call to Sim 2 for a parent gadget. The only exception occurs in case of a failure event.

In that case the simulation needs the full input x = (x 1 , . . . , x N k ) (and/or y = (y 1 , . . . , y N k )), while we have set |I 1 | = N k -1 (and/or |I 2 | = (N k -1) to satisfy the RPE requirements of the parent gadget in the first simulation phase. Nevertheless, for such cases a perfect simulation of the plain value x = LinDec( x) (and/or y = LinDec( y)) is included to out base by construction of W base . We can therefore perfectly simulate the missing share from the N k -1 other shares and the plain value x (or y). We thus get a perfect simulation of AssignWires(G (k) j , W j , ( x, y), z| J j for all the level-k gadgets G (k) j which gives us a perfect simulation of AssignWires(G (k+1) , W * , ( x * , y * )), z| J * .

Saturated case: J

The saturated case proceeds similarly. The difference is that we must simulate all N k+1 output shares of the level-(k + 1) gadget, except for one share index j * that can be chosen by the simulator.

The simulator Sim G (k+1)

1 is defined as previously. Since J * = [N k+1 ], we must define

. This implies that for the gadgets G (k) j on the output layer, the sets J j are all equal to [N k ] as well. The set W base is defined as previously, and the simulator Sim G (k+1) 1 returns (I * 1 , I * 2 ) as previously. The failure events F * 1 and F * 2 are still ε k+1 -mutually unlikely, as required by the (S k+1 , ε k+1 )-RPE property of G (k+1) .

The simulator Sim G (k+1) 2 is defined as previously. In particular, from the running of the base gadget simulator Sim G CC k+1

2

, we obtain a perfect simulation of the output wires z b | J base for some J base with |J base | = n k+1 -1. Combined with the perfect simulation of the output wires corresponding to the output sets J j from the gadgets G (k) j on the output layer, with |J j | = N k -1, we obtain a subset J of output wires for our level-(k + 1) gadget with |J | = N k+1 -1 as required. Eventually this gives us a perfect simulation of AssignWires(G (k+1) , W * , ( x * , y * )), z| J . This terminates the proof of Lemma 30. As stated earlier, proving Lemma 30 implies proving Theorem 3. Thus, this also terminates the proof for the theorem.

A.3 Proof of Proposition 4

Proof. We consider the following matrices

The matrices L and M have z = (2n + 4) • n columns. We want to lower-bound the probability, for γ picked uniformly at random in F n×n q , that for any vector v ∈ F z q of Hamming weight hw(v) ≤ n, and for any i 1 , . . . , i K ∈ [z] such that v i 1 = 0, . . . , v i K = 0 and the corresponding columns i 1 , . . . , i K in L and in M have no zero coefficient (i.e there are K probes of the form n i=1 (r i + a i ) or n j=1 (γ i,j r j + a j )

For any set I ⊆ {1, . . . , z}, we denote by L I the n × |I| submatrix of L obtained by only keeping the columns in L whose indices are in I and M I is the n×|I| submatrix of M obtained by only keeping the columns in M whose indices are in I. We will lower-bound the probability that for any set I ⊆ {1, . . . , z} of cardinal n and any vector v

We consider different cases (in order of increasing generality) which depend on the columns selected with the set I:

1. I ⊆ {(n + 4) • n + 1, . . . , z}, i.e., all columns in M I are taken from the matrices T γ,i for i ∈ {1, . . . , n};

, all columns in M I are taken from the matrix T n or the matrices T γ,i for i ∈ {1, . . . , n};

, all columns in M I are taken from the null vectors, from the matrix T n or the matrices T γ,i for i ∈ {1, . . . , n};

4. I ⊆ {1, . . . , z}, i.e., the columns in M I can be taken arbitrarily.

Case 1.

In order to analyze the probability in the first case, we recall the definition of a probability distribution on structured matrices introduced in [START_REF] Belaïd | Private multiplication over finite fields[END_REF]. In this distribution of structured matrices, a number of elements with known location are identically zero, and remaining elements are chosen uniformly at random independently of each other.

Definition 29. Let n and m be two positive integers. Let α = (α 1 , . . . , α m ) be a non-decreasing finite sequence with

is called a progressive patterned matrix with pattern α if θ i,j = 0 for all j ∈ {1, . . . , m} and all i / ∈ {α j-1 + 1, . . . , α j } (where α 0 = 0).

• The unitary progressive patterned matrix Υ α = (u i,j ) ∈ F n×m q with pattern α is defined by u i,j = 0 for all j ∈ {1, . . . , m} and all i / ∈ {α j-1 + 1, . . . , α j } and u i,j = 1 for all j ∈ {1, . . . , m} and all i ∈ {α j-1 + 1, . . . , α j }.

• The distribution D α is the probability distribution on random progressive patterned matrix S α = (s i,j ) ∈ F n×m q whose elements s i,j for (i, j) ∈ {1, . . . , n} × {1, . . . , m} are sampled uniformly at random and independently according to:

if s = 0 and u i,j = 0 0 if s = 0 and u i,j = 0 q -1 for all s ∈ F q if u i,j = 1 where

is the unitary progressive patterned matrix with pattern α.

A matrix Θ is thus a progressive patterned matrix with pattern α = (α 1 , . . . , α m ) if it is of the form described in Figure A.2 where the symbol denotes an arbitrary value in F q . For the unitary progressive patterned matrix Υ α , this symbol is replaced by a 1 and for a random progressive patterned matrix S α each symbol is replaced by a value picked uniformly and independently at random in F q . Note that such a matrix can contain a null column (when α i = α i+1 for some i ∈ {1, . . . , m -1}).

Belaïd et al. [START_REF] Belaïd | Private multiplication over finite fields[END_REF] also defined more generally block column matrices formed of progressive patterned matrices. Definition 30. Let n, m, t be three positive integers. Let m 1 , . . . , m t be positive integers such that m 1 + • • • + m t = m and let α (i) = (α

m i ≤ n for all i ∈ {1, . . . , t}. We suppose that there exists at least one j ∈ {1, . . . , t} such that α (j) m j = n.

• A matrix Θ ∈ F n×m q is called a block progressive patterned matrix with pattern (α (1) , . . . , α (t) ) if there exist progressive patterned matrices Θ (i) ∈ F n×m i q with pattern α (i) for all i ∈ {1, . . . , t} such that Θ = (Θ (1) | . . . |Θ (t) ).

• The block unitary progressive patterned matrix Υ α (1) ,...,α (t) ∈ F n×m q with pattern (α (1)

• The distribution D α (1) ,...,α (t) is the probability distribution on block random progressive patterned matrix in F n×m q defined by

The main ingredient of the proof of Proposition 4 is the following technical lemma:

Lemma 31. Let n, m, t be three positive integers with m ≥ n and let α (i) for i ∈ {1, . . . , t} be patterns for block progressive patterned matrix as in Definition 30. For a block random progressive patterned matrix S drawn following the distribution D α (1) ,...,α (t) , there exists a linear subspace of F m q of dimension m -n that contains {v ∈ F m q s.t. hw(v) = m and Sv = 0}, with probability at least 1 -mq -1 . Lemma 31. We will prove this lemma by induction on m.

For m = 1, since m ≥ n ≥ 1, Definition 30 implies that the matrix S consists simply in a single entry s 1,1 which is picked uniformly at random in F q and this entry is null with probability q -1 . The set {v ∈ F q s.t. hw(v) = 1 and S • v = 0} is therefore the empty set with probability at least 1 -q -1 and it is thus included in the subspace of dimension 0 with probability at least 1 -q -1 .

We now consider m ≥ 2 and we suppose Lemma 31 proven for all block random progressive patterned matrix with strictly less than m columns.

We first assume that the matrix Υ α (1) ,...,α (t) ∈ F n×m q is the matrix of ones U n×m (i.e., does not contain any zero). Then S is simply a matrix drawn from F n×m q with the uniform distribution.

It is well known that the number of full-rank n × m matrices over F q (with m ≥ n) is:

and the probability that S is of full rank is thus equal to:

which is greater than

The subspace {v ∈ F m q s.t. S • v = 0} is therefore included in a linear subspace of dimension m -n with probability at least 1 -2q n-m-1 and the result follows (since m ≥ 2).

We now assume that the matrix Υ α (1) ,...,α (t) ∈ F n×m q contains some 0. By assumption, there exists some j ∈ {1, . . . , t} such that α (j)

1. We first assume that m j > 1 (i.e. that the column of index m 1 + • • • + m j consists in α (j) m j -1 ≥ 1 zeroes followed by α (j)

It is easy to see that this submatrix is a block unitary progressive patterned matrix with n ≤ n -1 rows and m -1 columns, where some columns may possibly contain only zeroes (see Figure A.3). We can thus apply the induction hypothesis to the submatrix S of S obtained by deleting the same column and the same rows.

By induction hypothesis, we know that with probability at least 1 -(m -1)q -1 , there exists a linear subspace

and this set is thus the empty set. We then have {v ∈ F m q , hw(v) = m and S•v = 0} = ∅ with probability at least 1-(m-1)q -1 ≥ 1-mq -1 , and so there exists a linear subspace V of dimension m -n that contains this set.

If V is of dimension m -1 -n > 0, we can assume without loss of generality that the column of S deleted to obtain S was the last one (by permuting the blocks of the matrix). We have the following block-decomposition of S S = S 0 n ×1 S u . . . . . . . . . . . . . The column and the rows highlighted in red are deleted in order to apply the induction hypothesis.

where S is a (n -n ) × (m -1) matrix and u a column vector of dimension (n -n ). Note that u is a random vector in F n-n q independent from S and S . Let v ∈ F m q such that hw(v) = m and Sv = 0.

We write v = w τ where w ∈ F m-1 q and τ ∈ F q is a scalar. We have hw(w) = m-1 and S w = 0, and therefore w ∈ V . Since τ = 0 by assumption, the vector u thus belongs to the image W of V by S (with probability at least 1 -(m -1)q -1 ). Moreover, W has dimension at most max(m -1 -n , n -n ).

• If W is of dimension at most n-n -1, since u is independent of S and S (and thus of W ), u belongs to W with probability at most q -1 . Therefore, with probability at least (1 -q -1 ) • (1 -(m -1)q -1 ) ≥ 1 -mq -1 , {v ∈ F m q s.t. hw(v) = m and Sv = 0} = ∅.

• If W is of dimension n -n , with probability 1 -q -(n-n ) ≥ 1 -q -1 , we have u = 0 (n-n )×1 and we can construct a basis u 1 = u, . . . , u n-n of W .

All subspaces V ∩ S -1 ( u i ) are of dimension at least one and we have

Therefore the linear subspace V defined as

Moreover, we have {v ∈ F m q s.t. hw(v) = m and Sv = 0} ⊆ V and since this occurs with probability at least (1 -q -1 )(1 -(m -1)q -1 ) ≥ 1 -mq -1 , the result follows. . The column and the rows highlighted in red are deleted in order to apply the induction hypothesis.

2. We now assume that m i = 1 for all i such that α (i) m i = n (i.e. that all the columns with a one in the last row consists only of ones, see Figure A.4). Since the matrix Υ α (1) ,...,α (t) ∈ F n×m q contains some 0, there exists some j ∈ {1, . . . , t} such that m j > 1 and we consider such a j ∈ {1, . . . , t} for which α We know that with probability at least 1 -(m -1)q -1 , there exists a linear subspace

If V is of dimension 0, then {v ∈ F m-1 q s.t. hw(v) = m -1 and S v = 0} ⊆ {0} and this set is thus the empty set. We then have {v ∈ F m q , hw(v) = m and Sv = 0} = ∅ with probability at least 1 -(m -1)q -1 ≥ 1 -mq -1 , and so there exists a linear subspace V of dimension m -n that contains this set.

If V is of dimension m -1 -n > 0, we can assume without loss of generality that the column of S deleted to obtain S was the last one (by permuting the blocks of the matrix). We have the following block-decomposition of S S = S u S 0 n ×1 where S is a (n -n ) × (m -1) matrix and u a column vector of dimension (n -n ). Note that u is a random vector in F n-n q independent from S and S . Let v ∈ F m q such that hw(v) = m and Sv = 0.

We write v = τ w where w ∈ F m-1 q and τ ∈ F q is a scalar. We have hw(w) = m-1 and S w = 0, and therefore w ∈ V . Since τ = 0 by assumption, the vector u thus belongs to the image W of V by S (with probability at least 1 -(m -1)q -1 ). Moreover, W has dimension at most max(m -1 -n , n -n ).

• If W is of dimension at most n-n -1, since u is independent of S and S (and thus of W ), u belongs to W with probability at most q -1 . Therefore, with probability at least (1 -q

and we can construct a basis u 1 = u, . . . , u n-n of W . All subspaces V ∩ S -1 ( u i ) are of dimension at least one and we have

Therefore the linear subspace V defined as

Moreover, we have {v ∈ F m q s.t. hw(v) = m and Sv = 0} ⊆ V and since this occurs with probability at least (1 -q -1 )(1 -(m -1)q -1 ) ≥ 1 -mq -1 , the result follows.

This concludes the proof of Lemma 31.

Recall that we want to lower-bound the probability over the γ ∈ F n×n q , that for a given set

where K denotes the number of coordinates i 1 , . . . , i K ∈ [z] such that v i 1 = 0, . . . , v i K = 0 and the corresponding columns i 1 , . . . , i K in L and in M have no zero coefficient.

Remark that the non-zero coefficients in the lower block of L I and in M I are at the same positions. If K = 0, then the matrices M I and L I have a null row. In this case, we have readily hw(L

If K ≥ 1, then the matrices M I and L I does not have a null row. The matrix M I (up to some permutation of its columns) can be written as a block matrix where each block is of the form described in From this matrix, one can construct another matrix MI such that in each block, one substract each column to the following columns (i.e., one substract iteratively the i-th column to the columns of index in {i + 1, . . . , m} for i ∈ {1, . . . , m}). The blocks appearing in the matrix MI are given in Figure A.5 (on the right). Since we apply only elementary operations on the columns, if there exists a vector v ∈ F n q such that M I v = 0 then, there exists a vector v ∈ F n q such that MI v = 0. Since M I has no null row, we have α m = n in one of this block (with the notation from Figure A.5) and the matrix MI is thus a block random progressive patterned matrix as defined in Definition 30. By Lemma 31, for each non-empty subset J of the n columns of MI , the probability over γ that there exists a vector v ∈ F n q with support J (i.e., set of non-zero coordinates) such that MI v = 0 is upper bounded by n • q -1 . By the union bound over all supports, the probability over γ that there exists a vector v ∈ F n q such that MI v = 0 is thus upper-bounded by 2 n • n • q -1 .

For the sets I ⊆ {(n + 4) • n + 1, . . . , z} of cardinal n, we have proved that with probability at least 1 -2 n • n • q -1 (over the choice of γ ∈ F n×n q ), we have hw( We now consider matrices M I were all columns are taken from the matrix T n or the matrices T γ,i for i ∈ {1, . . . , n} (i.e., I ⊆ {(n + 3) • n + 1, . . . , z}). With the notation from Definition 30, we consider the modified distribution Dα (1) ,...,α (t) defined as the following probability distribution in F n×m q :

(i.e., in which the first block is a fixed unitary progressive patterned matrix instead of being a random progressive patterned matrix). We can easily extend Lemma 31 to this distribution:

Lemma 32. Let n, m, t be three positive integers with m ≥ n and let α (i) for i ∈ {1, . . . , t} be patterns for block progressive patterned matrix as in Definition 30. For a block random progressive patterned matrix matrix S drawn following the distribution Dα (1) ,...,α (t) , there exists a linear subspace of F m q of dimension m -n that contains {v ∈ F m q s.t. hw(v) = m and Sv = 0}, with probability at least 1 -mq -1 . Lemma 32. We will prove Lemma 32 by induction on m.

For m = 1, since m ≥ n ≥ 1, Definition 30 implies that the the matrix S either (1) consists simply in a single entry s 1,1 which is picked uniformly at random in F q or (2) a constant non-null vector. In the first case, this vector is null with probability q -1 and in all cases the set {v ∈ F q s.t. hw(v) = 1 and Sv = 0} is therefore the empty set with probability at least 1 -q -1 . It is thus included in the subspace of dimension 0 with probability at least 1 -q -1 .

We now consider m ≥ 2 and we assume Lemma 32 proven for all block random progressive patterned matrix matrix drawn from a distribution Dα (1) ,...,α (t) with strictly less than m columns.

We first assume that the matrix Υ α (1) ,...,α (t) ∈ F n×m q is the unitary matrix U n×m (i.e., does not contain any zero). Then, by assumption, we have m i = 1 and α (i) = n for i ∈ {1, . . . , t}. The matrix S is thus the concatenation of the vector 1 n×1 and a matrix picked from F n×m-1 q with the uniform distribution. Using elementary operations on the columns of S, one can obtain a matrix of the form

is the all-one vector and S is a matrix drawn from F n-1×m-1 q with the uniform distribution. As in the proof of Lemma 31, the matrix S is of full rank n -1 with probability at least 1 -2q n-m-2 . The matrix S is thus of full rank n with probability at least 1 -2q n-m-2 and thus with probability at least 1 -mq -1 .

We now assume that the matrix Υ α (1) ,...,α (t) ∈ F n×m q contains some 0. By assumption, there exists j ∈ {1, . . . , t} such that α (j) m j = n and in the following, it there exist two indices j ∈ {1, . . . , t} such that α (j) m j = n, we select one such index different from 1. If j = 1, by assumption we have α (i) m i < n for all i ∈ {2, . . . , t} and the last row of the matrix S has one coordinate equal to 1 and all other coordinates equal to 0. If v ∈ F q is of full Hamming weight hw(v) = m, the last coordinate of the vector Sv is always non-null and the set {v ∈ F q s.t. hw(v) = m and Sv = 0} is therefore the empty set. It is thus included in the subspace of dimension 0 with probability at least 1 ≥ 1 -mq -1 . We therefore now assume that j > 1.

1. We first assume that m j > 1 (i.e. that the column of index m 1 + • • • + m j consists in α (j) m j -1 ≥ 1 zeroes followed by α (j)

We consider the submatrix of Υ α (1) ,...,α (t) ∈ F n×m q obtained by deleting the column of index m 1 + • • • + m j and the rows of indices i in {α (j) m j-1 +1 , . . . , α (j) m j }. This submatrix is a block unitary progressive patterned matrix with n ≤ n rows and m -1 columns. We can thus apply the induction hypothesis to the submatrix S of S obtained by deleting the same column and the same rows. We know that with probability 1 -(m -1)q -1 , there exist a linear subspace V of dimension m -1 -n that contains the set {v ∈ F m-1 q s.t. hw(v) = m -1 and S v = 0}.

If V is of dimension 0, then {v ∈ F m-1 q s.t. hw(v) = m -1 and S v = 0} ⊆ {0} and the set is the empty set. We thus have {v ∈ F m q , hw(v) = m and Sv = 0} = ∅ and with probability 1 -(m -1)q -1 ≥ 1 -mq -1 , there exist a linear subspace V of dimension m -n that contains this set.

If V is of dimension m -1 -n > 0, we can assume without loss of generality that the deleted column of S to obtain S was the last one in the last block (i.e., in a block where S is a random progressive patterned matrix since j > 1).

By permuting some rows and columns, we can write

where S is a (n -n ) × m -1 matrix on which we can apply the induction hypothesis (since m j > 1). Let v ∈ F m q such that hw(v) = m and Sv = 0.

We write v = w τ where w ∈ F m-1 q and τ ∈ F q is a scalar. We have hw(w) = m -1

and S w = 0, and therefore w ∈ V . Since τ = 0 by assumption, the vector u thus belongs to the image W of V by S (with probability at least 1 -(m -1)q -1 ). Since j > 1, note that u is a random vector in F n-n q independent from S . We can then conclude as in the proof of Lemma 31.

2. We now assume that m i = 1 for all i such that α (i) m i = n for i ∈ {1, . . . , t} (i.e. that all the columns with a one in the last row consists only of ones).

Since the matrix Υ α (1) ,...,α (t) ∈ F n×m q contains some 0, there exists some j ∈ {2, . . . , t} such that m j > 1 and we consider such a j ∈ {2, . . . , t} for which α (j) 1 is minimal.

We consider the submatrix of Υ α (1) ,...,α (t) ∈ F n×m q obtained by deleting the column of index m 1 + • • • + m j-1 + 1 and the rows of indices in the set {1, . . . , α (j) 1 -1}. It is easy to see that this submatrix is a block unitary progressive patterned matrix with n ≤ n -1 rows and m -1 columns. We can thus apply the induction hypothesis to the submatrix S of S obtained by deleting the same column and the same rows.

We write v = w τ where w ∈ F m-1 q and τ ∈ F q is a scalar. We have hw(w) = m -1

and S w = 0, and therefore w ∈ V . Since τ = 0 by assumption, the vector u thus belongs to the image W of V by S (with probability at least 1 -(m -1)q -1 ). Since j > 1, note that u is a random vector in F n-n q independent from S . We can then conclude as in the proof of Lemma 31.

We know that with probability at least 1 -(m -1)q -1 , there exists a linear subspace V ⊆ F m-1 q of dimension m -1 -n that contains the set {v ∈ F m-1 q s.t. hw(v) = m -1 and S v = 0}.

If V is of dimension 0, then {v ∈ F m-1 q s.t. hw(v) = m -1 and S v = 0} ⊆ {0} and this set is thus the empty set. We then have {v ∈ F m q , hw(v) = m and Sv = 0} = ∅ with probability at least 1 -(m -1)q -1 ≥ 1 -mq -1 , and so there exists a linear subspace V of dimension m -n that contains this set.

If V is of dimension m -1 -n > 0, we can assume without loss of generality that the column of S deleted to obtain S was the last one (by permuting the blocks of the matrix). We have the following block-decomposition of S S = S u S 0 n ×1 where S is a (n -n ) × (m -1) matrix and u a column vector of dimension (n -n ). Note that u is a random vector in F n-n q independent from S and S . Let v ∈ F m q such that hw(v) = m and Sv = 0. Since j > 1, note that u is a random vector in F n-n q independent from S . We can then conclude as in the proof of Lemma 31. This concludes the proof of the lemma.

Using the same arguments as above for Case 1 (but replacing Lemma 31 by Lemma 32), we obtain that for any set I ⊆ {1, . . . , z} of cardinal n such that M I has no identically zero column vectors, with probability at least 1 -2 n • n • q -1 over the choice of γ, we have hw(L I • v) < n -K or M I • v = 0 n for any vector v ∈ F n q (where K denotes the number of coordinates i 1 , . . . , i K ∈ [z] such that v i 1 = 0, . . . , v i K = 0 and the corresponding columns i 1 , . . . , i K in L and in M have no zero coefficient). .

Case 3.

We now consider the sets I ⊆ {1, . . . , n}∪{(n+3)•n+1, . . . , z} of cardinal n for which M I has some identically zero column vectors (i.e., I ∩ {1, . . . , n} = ∅). For each i ∈ I ∩ {1, . . . , n} = ∅, the i-th column in L is the i-th vector in the canonical basis of F n q (i.e., it corresponds to a probe of a value a i ). We can consider the submatrix of M I and L I in which we delete for each i ∈ I ∩ {1, . . . , n} = ∅, the i-th column and the i-th row. We denote ρ = #I ∩ {1, . . . , n} = ∅.

Let us denote M I and L I the corresponding matrices (with m = m -ρ columns). These matrices are of the form handled in the previous Case 2 (with m < m). The previous argument shows therefore that with probability at least 1 -2 n • n • q -1 , we have hw(L I • v) < n -ρ -K or M I •v = 0 n for any vector v ∈ F m q (where K denotes the number of coordinates i 1 , . . . , i K ∈ [z]