# On Non-Completeness and G-Equivariance
## 1 Introduction  
With the growing threat of SCA (Side-Channel Attack, [1; 2; 3; 4]), many countermeasures have been proposed accordingly, and the masking method has been one of the most promising power attack countermeasures for securely implementing block ciphers [5; 6]. The basic principle of the masking methods is that if the sensitive variable (which depends on key material and some known information by definition) is split into some random shares and then is manipulated in a secure manner, the relationship between the behavior of internal variables and the corresponding side-channel information may look independent from the outside world. However, after the introduction of the glitch attack, there has been a lot of concern about the security of the masking method itself [7; 8; 9]. The glitch attack primarily utilizes a specific hardware (HW) criterion, say, the glitch. More precisely, most of the HW-based masking schemes prior to the glitch attack were mainly based on the assumption that all gates' input signals arrive at the gate simultaneously. However, that is not true in practice. That is, the gate delay and the variable path lengths are very common in semiconductor technologies, so each input signal arrives at a gate at different times. And, with this phenomenon in hand, the state of the gate's output signal fluctuates within a clock cycle until it isfinally stabilized at a certain value, which is called a glitch. In particular, the glitch phenomenon highly affects the amount of electrical power consumed by the circuit, and, moreover, the consumed power is highly related to the circuit's input. The glitch attack analyzes this relationship to retrieve some secret information in cryptographic devices. Unfortunately, most masking schemes prior to the glitch attack have been shown to possess some inherent vulnerabilities to the attack. To mitigate the devastating effect of the glitch attack, the authors in [10; 11; 12; 13] introduced the concept of TI (Threshold Implementation), which is based on the techniques of secret-sharing and multi-party computation and is believed to be provably secure against a first-order differential power attack (DPA). Basically, TI is a Boolean masking scheme which satisfies three specific properties, say, correctness, non-completeness, and uniformness. The correctness implies that the (Boolean) sum of the output shares is equal to the original output. And, the (\(d\)-th order) non-completeness means that processing any combination of up to \(d\) output masks altogether does not require at least one input share. The uniformness requires that the output distribution is preserved when a function is implemented in a shared form. The exact definition of these three properties is given in the next section. The most important characteristic of TI is that (first-order) TI is provably secure against the 1 st-order differential power attack even in the presence of glitches [11]. As another glitch attack countermeasure, the authors in [14] proposed a new kind of gates, say, G-equivariant gates. Simply speaking, the G-equivariant gate is the gate, the toggling count of whose output is independent with the arrival order of the gate's input signals. After all, the independency is believed to successfully prevent the 1 st-order side-channel DPA regardless of the arrival order of the input signals. However, it was also shown in [14] that there are no G-equivariant gates which have two input shares and the XOR sum in which two output shares is equal to the logical AND evaluation of its original inputs. Contribution of this paper. As noted before, the most notable characteristic of TI is that it is provably secure against the 1 st-order DPA even in the presence of glitches. And, the main concern of this paper lies at the security proof itself. That is, we re-investigate the proof that TI is secure against the 1 st-order DPA even in the presence of glitches, and conclude that the proof has some missing points. To remedy it, we then propose to utilize the concept of G-equivariance.