Conversion from Arithmetic to Boolean Masking with Logarithmic Complexity

A general technique to protect a cryptographic algorithm against side-channel attacks consists in masking all intermediate variables with a random value. For cryptographic algorithms combining Boolean operations with arithmetic operations, one must then perform conversions between Boolean masking and arithmetic masking. At CHES 2001, Goubin described a very elegant algorithm for converting from Boolean masking to arithmetic masking, with only a constant number of operations. Goubin also described an algorithm for converting from arithmetic to Boolean masking, but with \(\mathcal{O}(k)\) operations where k is the addition bit size. In this paper we describe an improved algorithm with time complexity \(\mathcal{O}(\log k)\) only. Our new algorithm is based on the Kogge-Stone carry look-ahead adder, which computes the carry signal in \(\mathcal{O}(\log k)\) instead of \(\mathcal{O}(k)\) for the classical ripple carry adder. We also describe an algorithm for performing arithmetic addition modulo \(2^k\) directly on Boolean shares, with the same complexity \(\mathcal{O}(\log k)\) instead of \(\mathcal{O}(k)\). We prove the security of our new algorithm against first-order attacks. Our algorithm performs well in practice, as for \(k=64\) we obtain a \(23\,\%\) improvement compared to Goubin’s algorithm.