Masking and Countermeasures: Arithmetic-to-Boolean Shares and the Cost of Provable Resistance

Abstract

Physical side channels cannot be closed by constant-time discipline; they require masking, and this piece explains what masking is, why post-quantum schemes make it especially costly, and what provable resistance actually guarantees. Masking splits every secret value into random shares processed separately, so no measured quantity depends on the secret, with order-d masking resisting attacks that combine up to d observations. Post-quantum schemes mix arithmetic operations (the transform, additions) that suit arithmetic masking with Boolean operations (hashing, comparison, sampling) that suit Boolean masking, forcing frequent, expensive conversions between the two share types. The piece covers the quadratic overhead of masking nonlinear operations, the probing-model foundation of provable security and its composable gadgets, and the way real-hardware glitches violate the idealized model. It closes with the practical cost, the complementary role of shuffling, and the agent-hardware angle. The theme: masking is the real defense against power and electromagnetic attacks, but its cost — conversions, quadratic overhead, glitch-resistance — is substantial and must be matched to the threat.

The power and electromagnetic attacks of the previous article cannot be stopped by making the code run in constant time, because a constant-time operation still radiates a signal that depends on the secret data it processes. The defense that actually works is masking: split every secret value into random shares whose combination reconstructs it, and process the shares separately so that no single wire, and no single measurement, ever depends on the secret. Post-quantum schemes make this unusually hard, because they interleave arithmetic and Boolean operations that need different kinds of masking and costly conversions between them. This article explains masking, its post-quantum-specific expense, and exactly what its provable-security guarantees mean and do not mean.

Masking: no wire carries the secret

Masking randomizes the representation of every secret. Instead of holding a secret value directly, the implementation holds several shares whose combination — their sum in one variant, their bitwise exclusive-or in another — equals the secret, with all but one share being fresh randomness. Because each individual share is uniformly random and independent of the secret, any single measured quantity reveals nothing; only combining information about all the shares simultaneously recovers anything, and the whole computation is arranged so that shares are processed separately and never brought together in the clear.

The strength of masking is quantified by its order. An order-d masking uses d plus one shares and is designed to resist an attacker who can combine up to d observations — probing d wires, or exploiting d statistical moments of the leakage. An order-one masking defeats a first-order attack that looks at one point at a time; higher orders resist more sophisticated multi-point analysis, at rapidly rising cost. The order is chosen to exceed the capability of the modeled attacker, so a device facing powerful physical analysis needs a higher order than one facing a weak adversary.

The guarantee masking provides is fundamentally different from constant-time execution. Constant-time removes the timing channel by making duration secret-independent; masking removes the power and electromagnetic channels by making every processed value secret-independent through randomization. The two are complementary and both necessary against a physical attacker: a masked implementation must also be constant-time, and a constant-time implementation on exposed hardware must also be masked.

The secret is split into random shares whose combination reconstructs it; each share is processed alone, so no single measurement depends on the secret.

\[\text{arithmetic: } x = x_0 + x_1 + \dots + x_d \bmod q; \quad \text{Boolean: } x = x_0 \oplus x_1 \oplus \dots \oplus x_d\]

\[\text{order-}d \text{ masking resists any } d \text{ combined observations}\]

Two mask types and the conversion problem

Masking comes in two flavors matched to two kinds of operation. Arithmetic masking, where shares sum to the secret modulo the scheme's modulus, composes naturally with the scheme's arithmetic: additions and the number-theoretic transform operate on arithmetic shares directly, because these operations are linear and distribute over the sum. Boolean masking, where shares combine by exclusive-or, composes naturally with bitwise operations: hashing, comparison, and the bit-manipulation inside samplers work on Boolean shares.

The difficulty is that post-quantum schemes mix both kinds of operation intimately, so a masked implementation must repeatedly convert secrets between arithmetic and Boolean share representations. Masked decapsulation, for example, does arithmetic decryption and then a Boolean comparison and decode; masked sampling turns Boolean randomness into arithmetic error. Each transition requires a masked conversion gadget — arithmetic-to-Boolean or the reverse — and these conversions are the most expensive and error-prone part of the whole effort, because they must transform the representation without ever exposing the secret in either form.

This conversion burden is what makes masking post-quantum schemes so much harder than masking a classical primitive that lives entirely in one arithmetic world. The frequent boundaries between the transform's arithmetic and the sampler's and comparison's Boolean logic force many conversions, each a costly masked gadget that must itself be proved secure. The mix of operation types, which the earlier articles noted as a source of leakage surfaces, is here a source of countermeasure cost.

Arithmetic shares suit the transform and additions; Boolean shares suit hashing and comparison; mixing them forces costly conversions.

Order and overhead

Masking is expensive, and the expense grows with the order and the nonlinearity of the operations. Linear operations — additions, and the transform under arithmetic masking — mask cheaply, because they can be applied to each share independently, so their cost grows only linearly with the number of shares. Nonlinear operations, chiefly multiplications, are the problem: a masked multiplication must combine every share of one operand with every share of the other and re-randomize the results, so its cost grows with the square of the number of shares, quadratically in the order.

Because the schemes contain both linear and nonlinear parts, plus the conversion gadgets, the overall overhead of a masked implementation is substantial — commonly several times the unmasked cost at first order and much more at higher orders. Doubling the security order more than doubles the cost of the nonlinear parts, so there is a steep price for each additional order of protection. This is why the order is chosen to just exceed the modeled attacker rather than set as high as possible: every order costs, and over-provisioning wastes real performance.

The practical upshot is that masking is a significant engineering investment, not a compiler flag. Masking a full key mechanism or signature means masking the transform, the sampler, the comparison, and the hashing, inserting and proving conversion gadgets at every arithmetic-Boolean boundary, and doing so at an order matched to the threat. The cost is the price of provable physical resistance, and it is only worth paying where the threat model includes a physical attacker.

\[\text{linear op cost} \sim O(d); \quad \text{masked multiplication cost} \sim O(d^2)\]

\[\text{total overhead grows steeply with order } d \text{ and number of nonlinear operations}\]

Provable resistance and the glitch caveat

Masking's appeal is that its security can be proved, in a model. The probing model idealizes the attacker as able to read the values on any d wires of the circuit; a masking is secure in this model if any d probed wires are jointly independent of the secret. Crucially, masked operations can be built as composable gadgets with a property — strong non-interference — that guarantees they remain secure when wired together, so a large masked implementation can be assembled from proved pieces without the composition leaking. This composability is what makes masking a rigorous discipline rather than an ad hoc one.

The caveat is that real hardware violates the idealized model. Physical circuits have glitches — transient signals as gates settle — and coupling between wires, so a single physical probe can capture a combination of values that the abstract model treats as separate, effectively lowering the achieved order below the designed one. A masking proved secure in the clean probing model can leak on real silicon because of these effects. Defending against them requires hardware-aware masking, such as threshold implementations designed so that glitches cannot combine shares, which adds further constraints and cost.

The lesson is that provable resistance is provable relative to a model, and the model must match the hardware. A masking order proved sufficient against idealized probing may need to be raised, or the gadgets redesigned for glitch-resistance, to hold on a physical device. This is why masked implementations for real hardware are validated empirically against actual power and electromagnetic measurement, not merely proved on paper — a theme the final article, on verification, develops.

The probing model defines security, composable gadgets let pieces combine safely, but hardware glitches can lower the achieved order and must be countered.

Practical cost, shuffling, and agent hardware

In practice, masking is combined with cheaper complementary countermeasures. Shuffling randomizes the order in which independent operations are performed — the order in which coefficients are processed, for instance — so that an attacker cannot align leakage to a specific secret coefficient without first untangling the random permutation, which raises the number of traces needed. Shuffling is inexpensive relative to masking and raises the bar against both averaging and single-trace attacks, so it is often layered on top of masking as a force multiplier rather than a replacement.

The combined cost of masking and shuffling, at an order sufficient for a real physical threat, is a genuine performance and complexity burden, and it is justified only for devices actually exposed to physical attack. A cloud-hosted service does not need it; a device an adversary can hold does. Matching the countermeasure investment to the threat model — the first article's discipline — is what keeps the cost proportionate, because paying for high-order masking on a data-center server wastes it, and omitting it on an exposed device leaves the real threat undefended.

For autonomous AI systems this lands on the physically deployed edge of the fleet. Edge agents, on-premises inference appliances, and secure elements holding agent identity keys in untrusted locations are the devices that need masked, shuffled, glitch-resistant implementations, and the budget to pay for them. The guidance is to identify which agent hardware is physically exposed, require validated masked implementations there at an order matched to the expected adversary, and accept the performance cost as the price of physical security — while sparing the cloud-hosted majority of the fleet that expense, since their threat is timing, not the probe. The next article shows how to verify that any of these implementations, masked or merely constant-time, actually meets its claim.

📌

Match the order to the adversary. Masking cost grows quadratically with order for nonlinear operations, and glitches can lower the achieved order on real hardware. Choose an order that just exceeds the modeled physical attacker, add cheap shuffling, and pay this cost only on physically exposed devices.

Key takeaways

Masking splits each secret into random shares processed separately, so no single measured quantity depends on the secret; order-d masking uses d+1 shares and resists any d combined observations.
Masking removes the power and electromagnetic channels as constant-time removes the timing channel; both are needed against a physical attacker.
Post-quantum schemes mix arithmetic operations (transform, additions) suiting arithmetic masking with Boolean operations (hashing, comparison, sampling) suiting Boolean masking, forcing frequent, costly arithmetic-Boolean conversion gadgets.
Linear operations mask cheaply (linear in order), but nonlinear multiplications cost quadratically in the order, making high-order masking steeply expensive.
Security is proved in the probing model with composable (strongly non-interfering) gadgets, but real-hardware glitches can lower the achieved order, requiring glitch-resistant designs and empirical validation.
Masking is combined with cheap shuffling and justified only on physically exposed hardware — edge agents, inference appliances, secure elements — matched in order to the adversary, sparing the cloud-hosted majority.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

✅Reviewing a masked implementationchecklist

Check that masking is complete and matched to the threat.

Is the masking order chosen to exceed the modeled physical attacker?
Are the transform, sampler, comparison, and hashing all masked, with no unmasked intermediate?
Are arithmetic-Boolean conversion gadgets present and proved at every boundary?
Are the gadgets glitch-resistant, not merely secure in the clean probing model?
Is shuffling layered on, and was the whole validated empirically on the target hardware?

🚀Specify countermeasures for exposed hardwarequickstart

Choose the right masking level for a physical device.

Set the masking order just above the expected adversary's capability.
Require masked conversion gadgets at every arithmetic-Boolean boundary.
Add shuffling as an inexpensive force multiplier.
Budget for several-times overhead and validate against real measurement.

🔒Masking policy for exposed devicespolicy

A stub scoping masking order and scope.

masking:
  applies_to: physically_exposed_hardware_only
  order: just_above_modeled_attacker
  scope: [transform, sampler, comparison, hashing]
  conversions: masked_a2b_b2a_proved
  gadgets: glitch_resistant
  shuffling: layered_on
validation:
  empirical_on_target: required
cloud_hosted:
  masking: not_required

Illustrative documentation template, not a product config.

Glossary

Masking: Representing each secret as random shares processed separately so no single measured value depends on the secret.
Security order (d): The number of combined observations a masking resists; order-d uses d+1 shares and defeats any d-wire or d-moment attack.
Arithmetic vs Boolean masking: Shares that sum modulo q (suiting the transform and additions) versus shares combined by exclusive-or (suiting hashing and comparison).
A2B / B2A conversion: Masked gadgets converting a secret between arithmetic and Boolean share representations; the most expensive part of masking post-quantum schemes.
Probing model / strong non-interference: A model where the attacker reads d wires; composable gadgets with strong non-interference stay secure when combined.
Glitches: Transient hardware signals that let one physical probe capture combined values, lowering the achieved masking order below the designed one.