{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,18]],"date-time":"2026-08-18T05:53:53Z","timestamp":1787032433822,"version":"build-2736575974"},"reference-count":30,"publisher":"International Association for Cryptologic Research","license":[{"start":{"date-parts":[[2024,7,9]],"date-time":"2024-07-09T00:00:00Z","timestamp":1720483200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100000781","name":"European Research Council","doi-asserted-by":"publisher","award":["101096871 BRIDGE"],"award-info":[{"award-number":["101096871 BRIDGE"]}],"id":[{"id":"10.13039\/501100000781","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IACR CiC"],"accepted":{"date-parts":[[2024,9,2]]},"abstract":"<jats:p>Raccoon is a lattice-based scheme submitted to the NIST 2022 call         for additional post-quantum signatures. One of its main selling         points is that its design is intrinsically easy to         mask against side-channel attacks. So far, Raccoon's physical security guarantees         were only stated in the abstract probing model.         In this paper, we discuss how these         probing security results translate into guarantees in more realistic leakage models.         We also highlight that this translation differs from what is usually observed         (e.g., in symmetric cryptography), due to the algebraic structure of         Raccoon's operations.         For this purpose, we perform an in-depth information theoretic evaluation         of Raccoon's most innovative part, namely the AddRepNoise         function which allows generating its arithmetic shares on-the-fly.   Our results are twofold. First, we show that         the resulting shares do not enforce a statistical security         order (i.e., the need for the side-channel adversary to estimate higher-order         moments of the leakage distribution), as usually expected when masking.         Second, we observe that the         first-order leakage on the (large) random coefficients manipulated         by Raccoon cannot be efficiently turned into   leakage on the (smaller) coefficients of\u00a0its long-term secret.         Concretely, our information theoretic evaluations for relevant leakage functions         also suggest that         Raccoon's masked implementations can ensure high         security with less shares than suggested by         a conservative analysis in the probing model.<\/jats:p>","DOI":"10.62056\/abkp2c3w9p","type":"journal-article","created":{"date-parts":[[2024,10,7]],"date-time":"2024-10-07T11:13:33Z","timestamp":1728299613000},"update-policy":"https:\/\/doi.org\/10.62056\/adfjwm02dj","source":"Crossref","is-referenced-by-count":1,"title":["Information Theoretic Evaluation of   Raccoon's Side-Channel Leakage"],"prefix":"10.62056","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7238-9567","authenticated-orcid":false,"given":"Dinal","family":"Kamel","sequence":"first","affiliation":[{"id":[{"id":"https:\/\/ror.org\/02495e989","id-type":"ROR","asserted-by":"publisher"}],"name":"UCLouvain, Crypto Group","place":["Louvain-la-Neuve, Belgium"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7444-0285","authenticated-orcid":false,"given":"Fran\u00e7ois-Xavier","family":"Standaert","sequence":"additional","affiliation":[{"id":[{"id":"https:\/\/ror.org\/02495e989","id-type":"ROR","asserted-by":"publisher"}],"name":"UCLouvain, Crypto Group","place":["Louvain-la-Neuve, Belgium"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7595-718X","authenticated-orcid":false,"given":"Olivier","family":"Bronchain","sequence":"additional","affiliation":[{"id":[{"id":"https:\/\/ror.org\/031v4g827","id-type":"ROR","asserted-by":"publisher"}],"name":"NXP Semiconductors","place":["Leuven, Belgium"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"48349","published-online":{"date-parts":[[2024,10,7]]},"reference":[{"key":"ref1:DBLP:journals\/iacr\/RaviJHCB18","first-page":"821","article-title":"Side-channel Assisted Existential Forgery Attack on\n  Dilithium - A NIST PQC candidate","author":"Prasanna Ravi","year":"2018","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"ref2:DBLP:journals\/tifs\/LiuZSWZM21","doi-asserted-by":"publisher","first-page":"1868","DOI":"10.1109\/TIFS.2020.3045904","article-title":"On the Security of Lattice-Based Fiat-Shamir Signatures in\n  the Presence of Randomness Leakage","volume":"16","author":"Yuejun Liu","year":"2021","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref3:DBLP:journals\/iacr\/MarzouguiUTS22","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1007\/978-3-031-58411-4_1","article-title":"Profiling Side-Channel Attacks on Dilithium - A Small\n  Bit-Fiddling Leak Breaks It All","volume":"13742","author":"Vincent Quentin Ulitzsch","year":"2022"},{"key":"ref4:DBLP:journals\/tches\/BerzatiVCMVV23","doi-asserted-by":"publisher","first-page":"188","DOI":"10.46586\/TCHES.V2023.I4.188-210","article-title":"Exploiting Intermediate Value Leakage in Dilithium: A\n  Template-Based Approach","volume":"2023","author":"Alexandre Berzati","year":"2023","journal-title":"IACR Trans. Cryptogr. Hardw. Embed. Syst."},{"key":"ref5:DBLP:conf\/acns\/MiglioreGTF19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"344","DOI":"10.1007\/978-3-030-21568-2_17","article-title":"Masking Dilithium - Efficient Implementation and\n  Side-Channel Evaluation","volume":"11464","author":"Vincent Migliore","year":"2019"},{"key":"ref6:DBLP:journals\/tches\/AzouaouiBCHKRSSSV23","doi-asserted-by":"publisher","first-page":"58","DOI":"10.46586\/TCHES.V2023.I4.58-79","article-title":"Protecting Dilithium against Leakage Revisited Sensitivity\n  Analysis and Improved Implementations","volume":"2023","author":"Melissa Azouaoui","year":"2023","journal-title":"IACR Trans. Cryptogr. Hardw. Embed. Syst."},{"key":"ref7:DBLP:conf\/sp\/PinoPRS23","doi-asserted-by":"publisher","first-page":"1168","DOI":"10.1109\/SP46215.2023.10179342","article-title":"High-Order Masking of Lattice Signatures in Quasilinear\n  Time","author":"Rafa\u00ebl del Pino","year":"2023"},{"key":"ref8:DBLP:conf\/crypto\/IshaiSW03","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"463","DOI":"10.1007\/978-3-540-45146-4_27","article-title":"Private Circuits: Securing Hardware against Probing\n  Attacks","volume":"2729","author":"Yuval Ishai","year":"2003"},{"key":"ref9:DBLP:conf\/eurocrypt\/ProuffR13","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"142","DOI":"10.1007\/978-3-642-38348-9_9","article-title":"Masking against Side-Channel Attacks: A Formal Security\n  Proof","volume":"7881","author":"Emmanuel Prouff","year":"2013"},{"key":"ref10:DBLP:conf\/eurocrypt\/DucDF14","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"423","DOI":"10.1007\/978-3-642-55220-5_24","article-title":"Unifying Leakage Models: From Probing Attacks to Noisy\n  Leakage","volume":"8441","author":"Alexandre Duc","year":"2014"},{"key":"ref11:DBLP:conf\/eurocrypt\/DucFS15","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"401","DOI":"10.1007\/978-3-662-46800-5_16","article-title":"Making Masking Security Proofs Concrete - Or How to Evaluate\n  the Security of Any Leaking Device","volume":"9056","author":"Alexandre Duc","year":"2015"},{"key":"ref12:DBLP:journals\/jce\/SchneiderM16","doi-asserted-by":"publisher","first-page":"85","DOI":"10.1007\/S13389-016-0120-Y","article-title":"Leakage assessment methodology - Extended version","volume":"6","author":"Tobias Schneider","year":"2016","journal-title":"J. Cryptogr. Eng."},{"key":"ref13:DBLP:journals\/tches\/LeviBS19","doi-asserted-by":"publisher","first-page":"293","DOI":"10.13154\/TCHES.V2019.I2.293-317","article-title":"Reducing a Masked Implementation's Effective Security Order\n  with Setup Manipulations And an Explanation Based on Externally-Amplified\n  Couplings","volume":"2019","author":"Itamar Levi","year":"2019","journal-title":"IACR Trans. Cryptogr. Hardw. Embed. Syst."},{"key":"ref14:DBLP:conf\/eurocrypt\/StandaertMY09","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"443","DOI":"10.1007\/978-3-642-01001-9_26","article-title":"A Unified Framework for the Analysis of Side-Channel Key\n  Recovery Attacks","volume":"5479","author":"Fran\u00e7ois-Xavier Standaert","year":"2009"},{"key":"ref15:DBLP:conf\/asiacrypt\/StandaertVOGMKM10","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"112","DOI":"10.1007\/978-3-642-17373-8_7","article-title":"The World Is Not Enough: Another Look on Second-Order\n  DPA","volume":"6477","author":"Fran\u00e7ois-Xavier Standaert","year":"2010"},{"key":"ref16:DBLP:books\/daglib\/0017272","isbn-type":"print","volume-title":"Power analysis attacks - revealing the secrets of smart\n  cards","author":"Stefan Mangard","year":"2007","ISBN":"https:\/\/id.crossref.org\/isbn\/9780387308579"},{"key":"ref17:DBLP:journals\/tches\/CassiersDSU23","doi-asserted-by":"publisher","first-page":"270","DOI":"10.46586\/TCHES.V2023.I3.270-293","article-title":"Efficient Regression-Based Linear Discriminant Analysis for\n  Side-Channel Security Evaluations Towards Analytical Attacks against 32-bit\n  Implementations","volume":"2023","author":"Ga\u00ebtan Cassiers","year":"2023","journal-title":"IACR Trans. Cryptogr. Hardw. Embed. Syst."},{"key":"ref18:DBLP:conf\/uss\/McCannOW17","first-page":"199","article-title":"Towards Practical Tools for Side Channel Aware Software\n  Engineering: 'Grey Box' Modelling for Instruction Leakages","author":"David McCann","year":"2017"},{"key":"ref19:DBLP:journals\/iacr\/BronchainAERS23","doi-asserted-by":"publisher","first-page":"359","DOI":"10.46586\/TCHES.V2024.I2.359-383","article-title":"Exploiting Small-Norm Polynomial Multiplication with\n  Physical Attacks Application to CRYSTALS-Dilithium","volume":"2024","author":"Olivier Bronchain","year":"2024","journal-title":"IACR Trans. Cryptogr. Hardw. Embed. Syst."},{"key":"ref20:DBLP:conf\/crypto\/ChariJRR99","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"398","DOI":"10.1007\/3-540-48405-1_26","article-title":"Towards Sound Approaches to Counteract Power-Analysis\n  Attacks","volume":"1666","author":"Suresh Chari","year":"1999"},{"key":"ref21:DBLP:conf\/ches\/GoubinP99","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"158","DOI":"10.1007\/3-540-48059-5_15","article-title":"DES and Differential Power Analysis (The \"Duplication\"\n  Method)","volume":"1717","author":"Louis Goubin","year":"1999"},{"key":"ref22:DBLP:conf\/ccs\/ItoUH22","doi-asserted-by":"publisher","first-page":"1521","DOI":"10.1145\/3548606.3560579","article-title":"On the Success Rate of Side-Channel Attacks on Masked\n  Implementations: Information-Theoretical Bounds and Their Practical Usage","author":"Akira Ito","year":"2022"},{"key":"ref23:DBLP:conf\/cosade\/BeguinotCGLMRS23","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"86","DOI":"10.1007\/978-3-031-29497-6_5","article-title":"Removing the Field Size Loss from Duc et al.'s Conjectured\n  Bound for Masked Encodings","volume":"13979","author":"Julien B\u00e9guinot","year":"2023"},{"key":"ref24:DBLP:conf\/tcc\/DziembowskiFS16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"291","DOI":"10.1007\/978-3-662-49099-0_11","article-title":"Optimal Amplification of Noisy Leakages","volume":"9563","author":"Stefan Dziembowski","year":"2016"},{"key":"ref25:DBLP:conf\/eurocrypt\/MasureMMS23","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"596","DOI":"10.1007\/978-3-031-30634-1_20","article-title":"Effective and Efficient Masking with Low Noise Using\n  Small-Mersenne-Prime Ciphers","volume":"14007","author":"Lo\u00efc Masure","year":"2023"},{"key":"ref26:DBLP:journals\/iacr\/FaustMMOS24","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"316","DOI":"10.1007\/978-3-031-58737-5_12","article-title":"Connecting Leakage-Resilient Secret Sharing to Practice:\n  Scaling Trends and Physical Dependencies of Prime Field Masking","volume":"14654","author":"Sebastian Faust","year":"2024"},{"key":"ref27:DBLP:conf\/eurocrypt\/BartheBEFGRT18","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"354","DOI":"10.1007\/978-3-319-78375-8_12","article-title":"Masking the GLP Lattice-Based Signature Scheme at Any\n  Order","volume":"10821","author":"Gilles Barthe","year":"2018"},{"key":"ref28:DBLP:conf\/sp\/KrachenfelsGMTS21","doi-asserted-by":"publisher","first-page":"1955","DOI":"10.1109\/SP40001.2021.00029","article-title":"Real-World Snapshots vs. Theory: Questioning the t-Probing\n  Security Model","author":"Thilo Krachenfels","year":"2021"},{"key":"ref29:DBLP:journals\/tches\/BronchainS21","doi-asserted-by":"publisher","first-page":"202","DOI":"10.46586\/TCHES.V2021.I3.202-234","article-title":"Breaking Masked Implementations with Many Shares on 32-bit\n  Software Platforms or When the Security Order Does Not Matter","volume":"2021","author":"Olivier Bronchain","year":"2021","journal-title":"IACR Trans. Cryptogr. Hardw. Embed. Syst."},{"key":"ref30:DBLP:conf\/pkc\/HoffmannLMPS23","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"114","DOI":"10.1007\/978-3-031-31368-4_5","article-title":"POLKA: Towards Leakage-Resistant Post-quantum CCA-Secure\n  Public Key Encryption","volume":"13940","author":"Cl\u00e9ment Hoffmann","year":"2023"}],"container-title":["IACR Communications in Cryptology"],"original-title":[],"language":"en","deposited":{"date-parts":[[2024,12,10]],"date-time":"2024-12-10T16:28:45Z","timestamp":1733848125000},"score":1,"resource":{"primary":{"URL":"https:\/\/cic.iacr.org\/p\/1\/3\/44"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,10,7]]},"references-count":30,"URL":"https:\/\/doi.org\/10.62056\/abkp2c3w9p","archive":["Internet Archive","Internet Archive"],"relation":{},"ISSN":["3006-5496"],"issn-type":[{"value":"3006-5496","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,10,7]]},"assertion":[{"value":"2024-07-09","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-09-02","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"cc1-3-119"}}