Learning With Physical Rounding for Linear and Quadratic Leakage Functions
Abstract
Freshre-keyingisacountermeasureagainstside-channelanal- ysis where an ephemeral key is derived from a long-term key using a pub- lic random value. Its most popular instances rely on key-homomorphic primitives, so that the re-keying process is easy to mask and the rest of the (e.g., block cipher) computations can run with cheaper countermea- sures. The main requirement for these schemes to be secure is that the leakage of the ephemeral key does not allow recovering the long-term key. The Learning with Physical Rounding problem formalizes the security that can be expected from fresh re-keying in a practically-relevant model where the adversary can observe noise-free leakages. It can be viewed as a physical version of the Learning With Rounding problem, where the rounding is performed by a leakage function and therefore does not have to be computed explicitly. It has been shown that fresh re-keying based on such physical problems can be very efficient, leading to the important challenge to define the classes of leakage functions that ensure secure instances. An introductory work showed security for the specific case of Hamming weight leakages. In this paper, we first provide a generalized analysis that clarifies necessary conditions to maintain this security. Pre- cisely, we show how combining an assumption on the degree of the leak- age function with an assumption on the quantization of the adversary’s measurement apparatus is sufficient to prevent important attack vectors. We next describe an improved cryptanalysis for serial implementations of Learning With Physical Rounding instances, which allows better ad- justing security parameters in this important implementation context. We finally confirm the practical relevance of these findings by validating our assumptions experimentally for an exemplary implementation.