The propagation game: on simulatability, correlation matrices, and probing security

TL;DR

This paper formalizes the concept of simulatability in side-channel security using categorical and matrix-based approaches, offering new theoretical insights and tools for analyzing probing security.

Contribution

It introduces a categorical formalization of simulatability, revisits existing definitions, and explores probabilistic and spectral methods to enhance security analysis tools.

Findings

Revisits probe isolating non-interference with categorical formalization

Provides a new, less contrived definition of simulatability

Explores probabilistic and spectral approaches to security analysis

Abstract

This work is intended for researchers in the field of side-channel attacks, countermeasure analysis, and probing security. It reports on a formalization of simulatability in terms of categorical properties, which we think will provide a useful tool in the practitioner toolbox. The formalization allowed us to revisit some existing definitions (such as probe isolating non-interference) in a simpler way that corresponds to the propagation of \textit{erase morphisms} in the diagrammatic language of \prop{} categories. From a theoretical perspective, we shed light into probabilistic definitions of simulatability and matrix-based spectral approaches. This could mean, in practice, that potentially better tools can be built. Readers will find a different, and perhaps less contrived, definition of simulatability, which could enable new forms of reasoning. This work does not cover any practical implementation of the proposed tools, which is left for future work.

Equations

$$⟨f⟩g=2^{-n}\sum _{x}f(x)g(x)$$

$$g(x)=2^{-n}\sum _{\gamma }{T}_g(\gamma )(-1{)}^{{\gamma }^{⊺}x}$$

$$T_g(\gamma )=\sum _{x\in {\mathbb{F}}_2^n}g(x)(-1{)}^{{\gamma }^{⊺}x}$$

$$g(x)\propto \sum _{\gamma }{T}_g(\gamma )|\gamma ⟩$$

$$g(x)\propto a|00⟩+b|01⟩+c|10⟩+d|11⟩$$

$$T_g(\gamma )={\left[\begin{array}{cccc}a& b& c& d\end{array}\right]}^{⊺}$$

$${\hat{f}}_{\omega ,\alpha }=\sum _{x\in {\mathbb{F}}_2^n}(-1{)}^{{\omega }^{⊺}f(x)\oplus {\alpha }^{⊺}x}$$

$$W_f=2^{-n}\hat{f}$$

$$W_f=[{\delta }_{i,{(M^{-1})}^{⊺}j}{]}_{i,j}$$

$$\mathcal{D}({\mathbb{F}}_2^m)={\mathbb{R}}^{{\mathbb{F}}_2^m}\simeq {\mathbb{R}}^{2^m}$$

$$p_X(x)={\delta }_{x,0}(1-a)+{\delta }_{x,1}a$$

$$T_{p_X}(\gamma )=\sum _{x\in {\mathbb{F}}_2^n}{p}_X(x)(-1{)}^{{\gamma }^{⊺}x}=\sum _{x\in {\mathbb{F}}_2^n}[{\delta }_{x,0}(1-a)+{\delta }_{x,1}a](-1{)}^{{\gamma }^{⊺}x}=(1-a)+a(-1{)}^{\gamma }$$

$$p_X(x)=|0⟩+(1-2a)|1⟩$$

$$T_{p_X}(\gamma )=\left[\begin{array}{c}1\\ 0\end{array}\right]$$

$$p_X(x)=|0⟩+(-1{)}^s|1⟩$$

$$p_{X,Y}(x,y)=p_X(x)p_Y(y)$$

$$p_{X,Y}(x,y)=\sum _{\gamma }\sum _{\zeta }{T}_{P_X}(\gamma )T_{P_Y}(\zeta )|\gamma \zeta ⟩$$

$$p_Q(x,r_1,r_2)=(|0⟩+(-1{)}^s|1⟩)|0⟩|0⟩=|000⟩+(-1{)}^s|100⟩$$

$$\left[\begin{array}{c}1\\ 0\\ 0\\ 0\\ (-1{)}^s\\ 0\\ 0\\ 0\end{array}\right]$$

$$y=f(x),f:{\mathbb{F}}_2^n\to {\mathbb{F}}_2^m$$

$$W_f{T}_{p_X}=T_{p_Y}$$

$$f_0$$

$$f_1$$

$$f_2$$

$$T_{p_Y}(\gamma )=W_f{T}_{p_X}(\gamma )=\left[\begin{array}{cccccccc}1& 0& 0& 0& 0& 0& 0& 0\\ 0& 1& 0& 0& 0& 0& 0& 0\\ 0& 0& 1& 0& 0& 0& 0& 0\\ 0& 0& 0& 1& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 0& 1\\ 0& 0& 0& 0& 0& 0& 1& 0\\ 0& 0& 0& 0& 0& 1& 0& 0\\ 0& 0& 0& 0& 1& 0& 0& 0\end{array}\right]\left[\begin{array}{c}1\\ 0\\ 0\\ 0\\ (-1{)}^s\\ 0\\ 0\\ 0\end{array}\right]=\left[\begin{array}{c}1\\ 0\\ 0\\ 0\\ 0\\ 0\\ 0\\ (-1{)}^s\end{array}\right]$$

$$p_Y(y)=(|000⟩+(-1{)}^s|111⟩)$$

$$\text{FinProbVect}\subseteq \text{FinVect}$$

$$\mathcal{D}({\mathbb{F}}_2^n)=\underset{n}{⨂}\mathcal{D}({\mathbb{F}}_2^1)$$

$${\Sigma }^{\ast }=\{W_{\oplus },W_{\wedge },W_1\}$$

$$\Delta :(x)\mapsto (x,x),!:(x)\mapsto ()$$

$$\Sigma =\{W_{\oplus },W_{\wedge },W_1,W_0,W_{\Delta },W_{!}\}$$

Full text

1 Introduction

Masking is a common countermeasure to side channel attacks, which can pose a significant threat to hardware and software implementations of cryptographic primitives; however, it can be difficult to implement effectively, especially when considering more advanced adversary models such as probing adversaries or extended probing adversaries [11, 13].

A gadget is considered secure $d$-probing if it is impossible to derive information about secret values encoded in masks or shares, even if an adversary has access to $d-1$ probes. The composability of two such gadgets, or the ability to determine whether their combination is also $d$-probing-secure, depends on the amount of refreshing randoms used to ensure non-interference [1].

To assess the composability of gadgets, a technique called probing security by optimized composition [5] is used, which takes advantage of the internal properties of the gadget to determine if the composition with other gadgets is secure. One such property is strong non-interference (SNI)[2], which states that the number of input shares derivable from a set of probes depends only on the number of internal positions present in that set, as long as the size of the set is less than $d$. Establishing that a gadget is $d$-SNI may require lengthy proofs or the use of automatic tools [3], but once this property has been verified, the composition of the gadget can be studied using simpler rules, though not without difficulty.

This approach to gadget composability is called optimized because it has the potential to lead to gadgets with minimal refresh efforts; however, it can be difficult to implement [15]. An alternative approach, called trivial composability, aims to identify the inner properties of the gadget that make reasoning about composition even more straightforward, such that certain gadgets must ensure at least probe isolation-non-interference (PINI) to compose them [5].

All forms of security proof are typically based on non-interference [1], that is, showing that some outputs of a system are not influenced by sensitive inputs. This is typically done by building probabilistic proofs of simulatability, i.e. showing that the distribution of considered outputs is equal to the one of a system that does not depend on the sensitive values.

In this work, we show that simulatability can afford a simple yet effective explanation through correlation matrices. The formalization, based on category theory, allows for a simpler reexamination of existing definitions, such as PINI, in terms of repeated application of propagation rules to objects called erase morphisms. From a theoretical perspective, this work provides a connection between probabilistic definitions of simulatability and matrix-based spectral approaches, which could potentially lead to the development of better tools and enable new forms of reasoning.

We will introduce background notions on correlation matrices and bit-vector distributions in Section 2 while in Section 3 we will introduce the main theoretical result, i.e., a categorical/diagrammatic treatment of simulatability that stems from correlation matrices. As these are preliminary results, we conclude with a call for action for all the interested researchers, to collaborate on these new tools.

2 Background

The theory of Boolean functions is important for side-channel attack analysis because side-channel attacks exploit physical characteristics of a cryptographic implementation, rather than attempting to directly break the cryptographic algorithm itself. These physical characteristics, known as side channels, can include information such as power consumption, electromagnetic radiation, or the execution time of the implementation.

Correlation immunity [18] is a property of Boolean functions that is related to side-channel analysis in that it can be used to design cryptographic implementations that are resistant to certain types of side-channel attacks [19, 14]. Specifically, correlation immunity refers to the inability of an attacker to infer the value of a secret variable by measuring the correlations between the output of a Boolean function and the values of the secret variable.

In the context of cryptographic implementations, correlation immunity can be used to protect against side-channel attacks that aim to reconstruct secret information, such as a secret key, by analyzing the correlations between the output of the implementation and the values of the secret information. For example, an attacker may attempt to measure the power consumption of a cryptographic implementation while it is executing a Boolean function and observe that the power consumption varies depending on the values of the secret key. If the Boolean function is highly correlated with the secret key, then the attacker may be able to use this information to reconstruct the secret key.

The Fourier expansion of a Boolean function is a way of expressing the function as a linear combination of "base" functions, known as Fourier basis functions or parities. Each Fourier basis function corresponds to a certain subset of the input variables of the Boolean function, and the coefficients of expansion represent the contributions of each basis function to the overall output of the Boolean function.

The Fourier expansion of a Boolean function can be used to measure the correlation immunity of the function. This is because the magnitude of the expansion coefficients is indicative of the correlation between the function and the input variables. If the magnitude of a coefficient is large, then the corresponding input variable is strongly correlated with the output of the function. Conversely, if the magnitude of the coefficient is small, then the input variable is less correlated with the output of the function.

According to [16], one can define the Fourier expansion of $f:\mathbb{F}_{2}^{n}\rightarrow\mathbb{R}$ by introducing an inner product

[TABLE]

and, under this product, one can define an orthonormal basis set composed of functions called parities: $\chi_{\gamma}(x)=(-1)^{{{\gamma}^{\intercal}}x}$; any pseudo-Boolean function $g$ can be represented as a linear combination of these parities:

[TABLE]

where the term

[TABLE]

is called the Fourier expansion of $g(x)$. Borrowing the notation from quantum mechanics (for reasons that will become evident in the following pages), we will use the symbol $\ket{\gamma}=\chi_{\gamma}(x)=(-1)^{{{\gamma}^{\intercal}}x}$ and write

[TABLE]

A remarkable property of the Fourier expansion is that the study of any Boolean function $g(x)$ can be reduced to the study of vectors $T_{g}\in\mathbb{R}^{2^{n}}$. Correlation immunity can, in fact, be observed directly through the Fourier coefficients. For example, assume that $g(x)$ is decomposed into the following combination of parity functions:

[TABLE]

then,

[TABLE]

represents the correlations of $g$ with each of the orthonormal bases, and the inner product between functions $\braket{f}{g}$ can be understood as the dot product of vectors $T_{g}$ and $T_{f}$. In particular, the linear form $\braket{f}{-}=\bra{f}$ is representable in $\mathbb{R}^{2^{n}}$ with a row vector ${{T_{f}(\gamma)}^{\intercal}}$; we’ll call this linear form a co-vector.

2.1 The Walsh transform

The Walsh transform is an extension of the Fourier expansion above to any vectorial Boolean function $f:\mathbb{F}_{2}^{n}\rightarrow\mathbb{F}_{2}^{m}$ in the space $\mathbb{R}^{2^{m}}\times\mathbb{R}^{2^{n}}$. The Walsh transform is defined as a $2^{m}\times 2^{n}$ matrix $\widehat{f}$ whose elements are:

[TABLE]

Sometimes, they appear in the literature scaled by a coefficient $2^{-n}$, and thus called correlation matrices [9]:

[TABLE]

Each row of the correlation matrix is in fact a Fourier expansion of a Boolean function ${{\omega}^{\intercal}}f(x),\omega\in\mathbb{F}_{2}^{m}$. Some notable properties are [17]:

• •

If $W_{f}$ is orthogonal (i.e. $W_{f}{{W_{f}}^{\intercal}}=I$) then it is also balanced [9].

• •

Any orthogonal $W_{f}$ is also invertible and vice-versa.

An important case is when $f(x)=Mx$ (where $M$ is an invertible matrix) [19]. This case can describe a circuit that, for example, decodes a set of shares into the corresponding secret value or vice-versa:

[TABLE]

2.2 Bit-vector probability distributions

Bit-distributions are probability distributions over bit-vectors, or sequences of $m$ bits:

[TABLE]

They are often used in cryptography to model random events or to sample from distributions of secret keys or random numbers. Bit distributions are thus among the most prominent examples of pseudo-Boolean functions.

They are important for another reason; they can be used to reason about non-interference and simulatability. We start by analysing 1-bit distributions and assume that $x$ is a bit with a non-uniform probability $a$ of being $1$

[TABLE]

then

[TABLE]

In terms of bracket notation:

[TABLE]

For uniformly random values we have ($a=1/2$) this becomes $p_{X}(x)=\ket{0}$, i.e.,

[TABLE]

When $a$ is either 0 or 1, we deal with a fixed value $x=s$ where $s\in\{F,T\}$; its probability will be

[TABLE]

This reasoning can be extended to the distribution of multiple bits through the joint probability distribution of two independent Boolean variables $X$ and $Y$:

[TABLE]

By expanding both distributions in terms of parities, we get:

[TABLE]

where we denote $\ket{\gamma\zeta}$ the orthonormal bases of the joint space of functions over $X\otimes Y$.

2.2.1 Example

Assume $n=3$ variables $Q=(X,R_{1},R_{2})$ where $X=s$ while $R_{*}$ are independent uniform randoms; we have that

[TABLE]

which gives a direct representation for $T_{Q}$ i.e.:

[TABLE]

2.3 The Walsh transform as a map

Walsh transforms and probability distributions combine to describe the probabilistic behavior of a circuit [9, 17]; in fact, given a function

[TABLE]

and a probability distribution $p_{X}:\mathcal{D}(\mathbb{F}_{2}^{n})$ (which maps from each combination of bit values to its probability), the following relation holds:

[TABLE]

where $p_{Y}:\mathcal{D}(\mathbb{F}_{2}^{m})$ is the distribution of the output value $y$. For example, assume $f(x)=[f_{0}(x),f_{1}(x),f_{2}(x)]$, where

[TABLE]

and that $x=(s,r_{1},r_{2})$ where $s$ is a constant value, while $r_{1},r_{2}$ are two uniformly random values. Indeed, we have that the distribution of output shares is the following:

[TABLE]

In fact, this encodes $s$ on the three shares111Note that the three shares are not decomposable anymore in three independent variables. Somehow these become entangled to highlight yet again the similarity with quantum computing.:

[TABLE]

3 On the algebra of simulatability

Let us now depart from linear algebra into a small category-theoretic tour, which starts by considering that matrices are linear maps over vector spaces. Indeed, we consider the category of finite-dimensional vector spaces (FinVect) that has vector spaces as objects and matrices as morphisms, the latter respecting obvious composition properties. FinVect is also a symmetric monoidal category, in the sense that one can define, for all objects and morphisms, a tensor product that abides by well-known pentagon rules [12]. For FinVect this is the actual tensor product of vector spaces.

Now, each $\mathcal{D}(\mathbb{F}_{2}^{n})$ (for any $n$) is evidently a vector space and correlation matrices map to vector spaces of the same type. In fact, we can define the category with objects $\mathcal{D}(\mathbb{F}_{2}^{n})$ and correlation matrices as morphisms as a subcategory of FinVect

[TABLE]

More interestingly, recalling the joint probability distributions (Eq. 2), each of these vector spaces can be seen as a tensor product of a single generating vector space.

[TABLE]

It turns out that property in Eq. 7 allows us to reason about FinProbVect in simpler terms. In fact, if we work in the context of objects of the type $\mathcal{D}(\mathbb{F}_{2}^{*})$ we could say that a correlation matrix mapping $\mathcal{D}(\mathbb{F}_{2}^{n})\to\mathcal{D}(\mathbb{F}_{2}^{m})$ is just a morphism $n\to m$, while the tensor product $M_{0}\otimes M_{1}$ of matrices $M_{0}:\mathcal{D}(\mathbb{F}_{2}^{n_{0}})\to\mathcal{D}(\mathbb{F}_{2}^{m_{0}})$ and $M_{1}:\mathcal{D}(\mathbb{F}_{2}^{n_{1}})\to\mathcal{D}(\mathbb{F}_{2}^{m_{1}})$ is a morphism $n_{0}+n_{1}\to m_{0}+m_{1}$. This type of description is associated with a product and permutation (PROP) category [10].

A PROP is a strict symmetric monoidal category with natural numbers as objects, where the monoidal tensor $\otimes$ works on objects as the sum over natural numbers. In a PROP, only connectivity matters [8]; Transformations between functions depend on the morphisms themselves and not on the objects to which they apply.

Any PROPs can be summarized by a "presentation" $(\Sigma,E)$ that corresponds to a set of generator morphisms $\Sigma$ and a set $E$ of equations (or equivalences) between morphisms. PROPs can be amenable to simple syntactic reasoning in the form of diagrams. In particular, PROP FinProbVect is a ’semantic’ category which can be further abstracted into a ’syntactic’ one where morphisms are represented as string (or tensor) diagrams or signal flow graphs [10]. Reasoning with such diagrams is sound, that is, two diagrams represent the same correlation matrix if one can be turned into the other, and complete i.e., if two diagrams represent the same matrix, then one can be turned into the other.

3.1 The FinProbVect PROP category

It is well known that all Boolean functions can be represented through algebraic normal form (ANF, [4]). This means that any Boolean function can be built using two operators ($\oplus$ and $\wedge$) and a constant (1 or true). This suggests a minimum set of generating morphisms/correlation matrices $\Sigma^{*}$ in the FinProbVect category:

[TABLE]

This set is, however, not enough for FinProbVect as one must explicitly introduce copy and erasure of variables

[TABLE]

which is somehow implicit in the expression language (but will be explicit in the diagrammatic one); additionally, it will be useful to introduce also a morphism for the 0 (false) value:

[TABLE]

where, a part from correlation matrices of $\oplus$ and $\wedge$ operators,

[TABLE]

Syntactically, we can represent the above matrices as the following symbols in the signal flow graph category:

[TABLE]

[TABLE]

Example 3.1**.**

For example, let us consider the example function $f$ in Eq. 6; this can be translated into a transformation of probabilities

[TABLE]

as:

[TABLE]

Reading the equation right to left, we can produce a syntactic, signal flow graph view of the above transformation:

[TABLE]

to be interpreted top to bottom.

FinProbVect is equipped with equations as well. These are mostly related to the monoidal nature of the $\oplus$ and $\wedge$ operators and we can use syntactic diagrams to represent them,

[TABLE]

An additional equations are related to the duplication and erase morphisms:

[TABLE]

The latter corresponds to:

[TABLE]

where $W_{\Delta}$ and can be readily demonstrated

[TABLE]

Analogously:

[TABLE]

3.2 The FinProbVect${}_{\textsf{R}}$

Proposition 1**.**

category

The erase morphism ($!$) will play a role in the following for two reasons; on the one hand, it might be used in the situation where, from a vector Boolean function, we take a subset of outputs. The "propagation" of the erase morphism given by Eq. 8 and Eq. 9 can be used to derive the correlation matrix of such a reduced function. On the other hand, the dual morphism of erase is

[TABLE]

which is just the Fourier transform of a uniform random value (Eq. 1); this is in fact the correlation matrix of a $0\to 1$ gate that produces a uniform random.

We can think of a new

Proposition 3**.**

category called FinProbVect${}_{\textsf{R}}$ where the signature is equipped with all the morphisms of FinProbVect plus the random gate $\ket{0}$. This allows us to introduce a new syntactic equation called the "cut" rule:

[TABLE]

Proof:

[TABLE]

readily provable as:

[TABLE]

Note that the above equation is not true for any other gate; let us consider, for example, the $\wedge$ gate:

[TABLE]

As one can verify through the resulting probability distribution:

[TABLE]

3.3 Simulatability as a "propagation" game

Simulatability is all about proving the equivalence of two output distributions up to a certain constraint222Here output is a generalised term which might refer to actual outputs or internal values (probes).; in the context of $d$-probing security, the first one is the one of the original circuit $f$, while the second one is the same circuit as viewed by a $d$-limited adversary $f_{d}$, i.e., an adversary that has access only up to $d$ inputs of the circuit with the remaining $n_{i}-d+1$ inputs are taken as uniformly random:

[TABLE]

If such an equivalence holds then $f_{d}$ is called the simulator. Constructing the simulator means proving the above equivalence and, given the property of secret-sharing, no information can be derived from the actual encoded secret. While having a constructive proof is useful, sometimes we want only to know if it exists, and not how it is built. FinProbVect${}_{\textsf{R}}$ allows us to syntactically and soundly represent the existence of a simulator problem as a pure "rewriting" game according to the equations of the presentation itself.

Consider the correlation matrix of a circuit $C$ with $n$ outputs (See fig. 1, left). We say that $o$ outputs of a circuit $C$ can be simulated with $d$ inputs if and only if one can prove the equivalence with the circuit in fig. 1, right, i.e., if one diagram can be deduced from another by using the equation of the FinProbVect${}_{\textsf{R}}$ presentation.

More precisely, $C$ can be simulated if we can refactor $W_{\sigma_{0}}W_{C}W{\rho_{r}}$ (where $\sigma_{0}$ is $n-o$ erase morphisms and otherwise identities and $\rho_{r}$ is a matrix with $r$ randoms and otherwise identities) into $W_{\sigma_{1}}W_{S_{r}}W_{\kappa_{d}}$ where $\kappa_{d}$ is a matrix of up to $d$ identities and otherwise erase morphisms.

We call $W_{S_{r}}$ the correlation matrix of the simulator of the circuit (which is a probabilistic circuit, as it contains randoms). We have just defined simulatability not as much as identities (or probes) propagating backward (e.g., **[5*]**) but as *erase morphisms propagating back according the

Proposition 4**.**

presentation

.

Example 3.2**.**

The cut rule:

[TABLE]

embodies the smallest form of simulatability; i.e., if

[TABLE]

the output can be simulated with zero identities

[TABLE]

Example 3.3**.**

As another example we show that, contrary to what has been observed in [2], the refreshM2 gadget does not depend on any input share at all for the considered outputs (see Fig. 6).

3.4 Redefined simulatability can explain Probe Isolation Non

Interference

We will prove that PINI (probe isolating non-interference, **[5, 6]**) is a composable property and appreciate how much erase propagation can simplify the reasoning.

We say that an input domain “receives an erase morphism” when, applying FinProbVect${}_{\textsf{R}}$’s equations, one can rewrite the circuit correlation matrix such that matrix $W_{\kappa_{d}}$ presents an erase morphism on that particular input domain.

Define $R_{q}(n)$ the predicate that asserts that $n$ input domains to circuit $q()$ receive an erase morphism, $p_{q}$ and $o_{q}$ respectively the probes in $q$ and the output domains taken from $q$.

The PINI property for $q$ can be defined as a simple predicate:

[TABLE]

This property is composable. Consider in fact the composition of two gadgets $f\circ g$, where for both $f$ and $g$

[TABLE]

When $f$ is composed with $g$ (i.e., $f\circ g$), the outputs domains taken from $g$ are the ones which will not receive an erase, i.e.: $o_{g}=p_{f}+o_{f}$. If we put this definition in Eq. 14 we get

[TABLE]

which is the PINI property for $f\circ g$.

3.4.1 Example

The example in Figure 3 is taken from **[7]**. It shows that DOM multiplication is not PINI because there is one probe $p$ should be allowed to block only one domain from being reached by an erase morphism, instead of two.

3.5 Robust probing security

Concerning the conventional (overly conservative) definition of glitch-robust probing security, we could extend the prop FinProbVect${}_{\textsf{R}}$ with an additional morphism which corresponds to a register and impose additional equations which, for example, allow the cut rule only in presence of the register itself. However, in this timeless description the correlation matrix of a register is the identity; thus the string diagram tool is no longer sound with respect to the probability distributions. Two string diagrams would, in fact, correspond to the same correlation matrix, but they would not be reducible to one another.

Conclusions

In conclusion, this paper has provided a formalization of simulatability in category-theoretic terms, which could potentially lead to better tools in the field of side-channel attacks, countermeasure analysis, and probing security. I believe that these findings are significant and could open up new forms of reasoning in the field. However, practical implementations of the proposed tools are needed to fully understand the implications of this work. Therefore, I call on all willing researchers to collaborate with me and develop these new tools in order to further explore the potential of these ideas.