Abstract
With the advent of the quantum computer threat, the NIST (National Institute of Standards and Technology) initiated a post-quantum standardization process in 2017 to select new algorithms for asymmetric cryptography. Several of these algorithms are based on lattice-based cryptography. One of the major challenges in implementing these algorithms is protecting them against side-channel attacks. A widely used defense technique is masking, which involves splitting sensitive values into a predefined number of random shares, such that an attacker with access to only a subset of these shares learns nothing about the secret. Operations that are adapted to masked inputs are referred to as gadgets. Securing post-quantum algorithms based on lattice cryptography is particularly challenging because they combine arithmetic operations on fields/rings with Boolean functions that operate on bits or bit vectors. This characteristic requires the use of mechanisms that enable conversion between different types of masking, which are known to be costly. In recent years, the literature on masking post-quantum schemes has been very active. With the emergence of new gadgets, it has become evident that comparing different gadgets masking the same operation is difficult. Neither asymptotic cost nor execution time in clock cycles on a given architecture provides a fully satisfactory solution. In this thesis, we introduce InspectorGadget, an Open Source Python-based software tool for evaluating and comparing the complexity of masking gadgets. By providing a limited set of characteristics of a hardware platform, our tool allows estimating the cost of a masking gadget in terms of clock cycles equivalent and memory footprint. InspectorGadget is highly flexible. It allows users to define their own estimation functions, as well as extend the predefined sets of gadgets and microcontrollers. As a case study, we propose a fair comparison of several masked versions of the Kyber compression function from the litera- ture, as well as new alternatives automatically generated by our tool. In the following, we focus exclusively on Kyber and the masking of its 1-bit compression function. We present the first fully arithmetic-masked 1-bit compression gadget, in contrast to the compression gadgets in the literature, which all require the use of a masking conversion. Our gadget simplifies Kyber masking by reducing the number of masking conversions used in this scheme. Although our results show that this conversion is less efficient than those from the literature, it is a first step towards a fully arithmetic-masked Kyber scheme.