Software Camouflage

Abstract

Obfuscation is a software technique aimed at protecting high-value programs against reverse-engineering. In embedded devices, it is harder for an attacker to gain access to the program machine code; of course, the program can still be very valuable, as for instance when it consists in a secret algorithm. In this paper, we investigate how obscurity techniques can be used to protect a secret customization of substitution boxes in symmetric ciphers, when the sole information available by the attacker is a side-channel. The approach relies on a combination of a universal evaluation algorithm for vectorial Boolean functions with indistinguishable opcodes that are randomly shuffled. The promoted solution is based on the noting that different logic opcodes, such as AND/OR or AND/XOR, happen to be very close one from each other from a side-channel leakage point of view. Moreover, our solution is very amenable to masking owing to the fact the substitution boxes are computed (combinationally).

Algorithms Source Code

It is shown by Carlet in [22, page 11] that there exists a simple divide-and-conquer butterfly algorithm to compute the ANF from the truth-table (or vice-versa). It is called the “Fast Möbius Transform”. An implementation in python is given in code listing 1.1, for $n\rightarrow 1$ Boolean functions. As already underlined in Sect. 3.2, the very same code also works for $n\rightarrow n$ vectorial Boolean functions.

The application of the code listing 1.1 to $f=\mathtt{{SubBytes}}$ (array noted S_TT) is given as S_AND in the code listing 1.2. The values in the array S_TT are $\{f(y), y\in \mathbb {F}_2^8\}$, in this order, whereas the values in the array S_ANF are $\{a_y, y\in \mathbb {F}_2^8\}$ (recall Eq. (4)). In the same code listing, the function anti_scare_eval applies SubBytes on a byte $x$, with the formula of Eq. (4). Furthermore, in this code, the $y$’s are shuffled (See Sect. 3.3) by a simple XOR with a random byte $r$.