Exploiting Small Leakages in Masks to Turn a Second-Order Attack into a First-Order Attack and Improved Rotating Substitution Box Masking with Linear Code Cosets

Algorithm 1

Mask recovery.

input: Window when masking is thought to occur

    A single power trace

    Length of masking operation

    Mask matrix

Output: The mask set and the mask offset

(1) ChooseSamples();       // leakage Detection

(2) 0;        // row index for subtrace matrix V

(3) for    do

(4)    for    to 15 do

(5)    ;  // measured leakage at sample i

      for byte j

(6)    ;        // build subtrace matrix

(7)    end

(8)    ;              //  increment row index

(9) end

(10) ;            // mask Hamming weight

(11) return  ;    //  recover the mask offset

(12) return  ;          // guessed mask set