Generalized polynomial decomposition for S-boxes with application to side-channel countermeasures

Abstract

Masking is a widespread countermeasure to protect implementations of block-ciphers against side-channel attacks. Several masking schemes have been proposed in the literature that rely on the efficient decomposition of the underlying s-box(es). We propose a generalized decomposition method for s-boxes that encompasses several previously proposed methods while providing new trade-offs. It allows to evaluate nλ-bit to mλ-bit s-boxes for any integers n,m,λ ≥ 1 by seeing it a sequence of m n-variate polynomials over 𝔽2λ and by trying to minimize the number of multiplications over 𝔽2λ.