Generalized Polynomial Decomposition for S-boxes with Application to Side-Channel Countermeasures
Résumé
Masking is a widespread countermeasure to protect implementations of block-ciphers against side-channel attacks. Several masking schemes have been proposed in the literature that rely on the efficient decomposition of the underlying s-box(es). We propose a generalized decomposition method for s-boxes that encompasses several previously proposed methods while providing new trade-offs. It allows to evaluate nλ-bit to mλ-bit s-boxes for any integers n,m,λ≥1 by seeing it a sequence of mn-variate polynomials over F2λ and by trying to minimize the number of multiplications over F2λ.