# Lightweight Conversion from Arithmetic to Boolean Masking for Embedded IoT Processor
## 2 Background
### The A2B Algorithm Based on the Ripple-Carry Adder
#### 2.3.2 [PERSON]'s A2B Algorithm
],\Gamma,r\) generated during pre-computation phase*/
13:\((x^{\prime},R)\)/* \(x=x^{\prime}\oplus R\)*/
14:\(A\gets A-(r||\ldots||r)-\Gamma\)
15:for\(i=0\) to \(n-1\)do
16:\(A\gets A+(R_{i}\cdot 2^{i\cdot k})\)
17:\(t||B_{i}\gets G[A_{i}]||\)LSB\({}_{A_{i}}\)
18:\(B_{i}\gets B_{i}\oplus R_{i}\)
19:\(A\gets A+(C[t]\cdot 2^{i\cdot k})\)
20:\(A\gets A\&(2^{(i+1)\cdot k}-1)\)
21:endfor
22:return\((B_{n-1}||\ldots||B_{0})\oplus(r||\ldots||r)\)
```

**Algorithm 9** Conversion of a \((k\cdot n)\)-bit variable

## 4 Security Analysis and Soundness of Algorithm

When proposing a new countermeasure, two crucial points are the security analysis and soundness. First, to achieve security against first-order DPA attacks, we prove that all intermediate values to process our A2B algorithm are masked by random numbers. Namely, if the intermediate values of the algorithm are uniformly distributed random numbers (i.e., masking values), this algorithm can be considered as having achieved security against first-order DPA attacks. Second, the soundness is that an algorithm achieves its goal with arbitrary inputs in any case. We then use mathematical induction to prove the soundness of our countermeasures. Now, we analyze the security of our A2B algorithm. To achieve this goal, we enumerate all intermediate values of our algorithms (Algorithms 8 and 9), then verify whether these values have any random numbers. Algorithm 8 is the algorithm that computes pre-computation tables. The mainly handled data is the masking value. This phase is a good target for horizontal correlation attacks [29; 30]. However, this attack can effectively cope with shuffling and dummy operations. In terms of sensitive values such as the key, this algorithm is computed without any sensitive values. The only information attackers can gain is the masking value. To recover the key, the pre-computation and conversion phase should be measured twice. These two probings deviate from the assumption of the first-order DPA. That is, the higher-order DPA should be required to restore the secret key in the pre-computation and conversion algorithms. Algorithm 9 is the A2B algorithm. We prove the randomness of each intermediate value as shown in Table 4. Table 4 shows that the sensitive value \(x\); the random values \(r,R,\gamma\), and \(\alpha\) are combined in \(V_{i}\). \(0_{l}\) indicates 0 filled with \(l\)-bits. \(V_{i}\) denotes the intermediate values at \(A\) in Algorithm 9, where \(i\) is the number of the Line, i.e., \(V_{1},V_{3},V_{6}\),and \(V_{7}\) are Lines 1, 3, 6, and 7, respectively. * \(V_{1}\) is constructed with the masking value \(R\), the masking value \(r\) of table \(G\), and the masking value \(\alpha\) of table \(C\). \(\alpha\) does not mask the lower \(k\)-bit. \(V_{1}\) is uniformly distributed by \(R\), so it guarantees the side-channel security. * \(V_{3}\) is concatenated with the upper part like \(V_{1}\); the middle part, which is \((x-r)\), by adding \(R_{i}\cdot 2^{i\cdot k}\); and the lower part, which is always filled with 0s, by Line 7. Since masking values \(R\) and \(r\) are independent, this distribution is uniformly random. * \(V_{4},V_{5}\) are values that have been converted from arithmetic to Boolean masking by table \(G\). The carry bit is masked with \(\gamma\), and the rest are masked with \(r\). These Lines are secure because \(\gamma\) and \(r\) are independent and random numbers. * \(V_{6}\) is constructed with the upper part like \(V_{1}\); the upper-middle part, which is \((x+c-R-r)\); the lower-middle part like \(V_{3}\); and the lower part as 0s. The masking value \(\alpha\) of the upper-middle part is removed by adding table \(C\). The security against side-channel attacks is explained by the same principle as that of \(V_{3}\). * \(V_{7}\) is the clearing process to 0s in the lower part, this step is important to achieve the side-channel safety. If the algorithm omits this clearing process, the pattern of the masking values of the lower part is represented as a concatenated form like \(r||r\).