# Research on a Random Mask Infection Countermeasure against Double Fault Attacks
## 3 Design of a Random Mask Infection Countermeasure
### Randomized Design of the Diffusion Function  
In the infection countermeasure unit, a randomized diffusion function is designed to close the loopholes in the infection mechanism mentioned in Section 2.2 (that is, it cannot be resistant to fault attacks which are based on the byte fault model). The specific expression of the designed diffusion function \(F\) is shown in (2). \[F:\left\{ \begin{array}{l}\mathrm{M}_{il}^{\prime}=\sum_{n=0}^{3}\mathrm{M}_{ mi}\oplus\sum_{m=0}^{3}\mathrm{M}_{mj}\\ \theta=\mathrm{N}_{3}\cdot\mathrm{M}_{il}^{\prime}\end{array} \right. \tag{2}\]  
where \(\mathrm{N}_{3}\) is the \(4\times 4\) random number matrix generated by the random number generator and is non-zero. \(F\) is the result after diffusion, also a \(4\times 4\) matrix. When \(\mathrm{M}=0\), the value of \(\mathrm{M}_{ij}^{\prime}\) and \(\theta=\mathrm{N}_{3}\cdot\mathrm{M}_{ij}^{\prime}\) equals zero and satisfies the property that the diffusion function \(F(0)=0\). Once \(\mathrm{M}\
eq 0\), then the value of \(\mathrm{M}_{ij}^{\prime}\) and \(F\) will not be equal to zero, and \(\theta\) has randomness due to \(\mathrm{N}_{3}\) being randomly varying. Based on Figure 3 and Equation (2), what is called a random mask infection countermeasure is designed, which can both defend against double-fault attacks and avoid the disadvantage of the simplification of diffusion function mapping. In Algorithm 1, the algorithm description of this strategy is shown. ```
Input: plaintexts P, random masks \(\mathrm{N}_{1}\), \(\mathrm{M}_{2}\), and \(\mathrm{M}_{3}\) (\(\mathrm{M}_{1}\), \(\mathrm{M}_{2}\), and \(\mathrm{M}_{3}\
eq 0\)) Output: ciphertext C. (1) \(\mathrm{P}_{1}\leftarrow\mathrm{P}\oplus\mathrm{N}_{1}\), \(\mathrm{P}_{2}\leftarrow\mathrm{P}\oplus\mathrm{N}_{2}\); (2) \(\mathrm{A}_{0}\leftarrow\mathrm{Cipher}(\mathrm{P}_{1})\), \(\mathrm{A}_{0}\leftarrow\mathrm{Cipher}(\mathrm{P}_{2})\); (3) \(\mathrm{A}\leftarrow\mathrm{(A}_{0}\oplus\mathrm{N}_{1}\)), \(\mathrm{A}^{\prime}\leftarrow\mathrm{(A}_{0}\oplus\mathrm{N}_{2})\); (4) \(\mathrm{M}\leftarrow\mathrm{A}\oplus\mathrm{A}\); (5) \(\theta\leftarrow\mathrm{N}_{3}\cdot\mathrm{F}(\mathrm{M})\); (6) \(\mathrm{A}\leftarrow\mathrm{A}\oplus\theta\), \(\mathrm{A}^{\prime}\leftarrow\mathrm{A}^{\prime}\oplus\theta\); (7) \(\mathrm{C}\leftarrow\mathrm{Cipher}(\mathrm{A})\). ```  
**Algorithm 1**Random Mask Infection Countermeasure  
The flow of the entire algorithm is: the initial plaintexts of the two encryption paths are all P. We perform masking operations on P, i.e., \(\mathrm{P}_{1}\)\(\leftarrow\)P\(\oplus\)N\({}_{1}\), \(\mathrm{P}_{2}\)\(\leftarrow\)P\(\oplus\)N\({}_{2}\). Then, we encrypt the mask-transformed \(\mathrm{P}_{1}\) and \(\mathrm{P}_{2}\), and, after several encryption operations, the intermediate states obtained are \(\mathrm{A}_{0}\) and \(\mathrm{A}_{0}\)'. Subsequently, we calculate \(\mathrm{A}\)\(\leftarrow\)(\(\mathrm{A}_{0}\oplus\)N\({}_{1}\)'), \(\mathrm{A}^{\prime}\)\(\leftarrow\)(\(\mathrm{A}_{0}\)\({}^{\prime}\oplus\)N\({}_{2}\)'), and \(\mathrm{M}\)\(\leftarrow\)\(\mathrm{A}\oplus\)A', where \(\mathrm{N}_{1}\)' and \(\mathrm{N}_{2}\)' are the random numbers used for demasking corresponding to the random numbers \(\mathrm{N}_{1}\) and \(\mathrm{N}_{2}\), respectively. Then, we detect whether \(\mathrm{M}\) is zero and if \(\mathrm{M}\
eq 0\), it means that at least one of the two paths possess a fault in the encryption process, followed by the diffusion function \(\theta\)\(\leftarrow\)\(\mathrm{N}_{3}\):\(F(\mathrm{A})\) which spreads the fault to other bytes.