Paper 2024/1968 Original: eprint.iacr.org/2024/1968 ↗

SoK: Pseudorandom Generation for Masked Cryptographic Implementation

Abstract

This paper investigates pseudorandom generation in the context of masked cryptographic implementation. Although masking and pseudorandom generators (PRGs) have been distinctly studied for a long time, there has been little study on how randomness should be generated in masked implementation. The lack of analysis on mask-bits generators obscures the practical security of masked cryptographic implementation, potentially confusing practitioners (e.g., designer, implementer, and evaluator) about how to realize them securely. This paper provides a novel viewpoint and comprehensive analyses by developing three new models, each of which corresponds to a practical scenario: leakage assessment, quantitative evaluation of side-channel security (e.g., success rate), and practical deployment. We reveal what PRG properties are required. In particular, we support a long-held belief/folklore through proof and experiment: for the output of PRG for masking, cryptographic security (i.e., unpredictability) is sufficient but not necessary; statistical uniformity alone is necessary. In addition, we thoroughly investigate the SCA security of PRGs in the wild within the masking context. We conclude this paper with some recommendations for practitioners and a proposal of leakage-resilient method offering comparative performance.