From: A secure and highly efficient first-order masking scheme for AES linear operations
l | Il | Steps |
1 | s, GF256MUL2(s) | 1,7,9 |
2 | r0,r1,r2,r3 | 3,4,5,6,7,9 |
3 | ST, OT | 7,9,10 |
4 | t, tmp, GF256MUL2(tmp) | 7,9,10 |
5 | \(ST[i]\oplus s, \bigoplus _{i}{ST[i]}\oplus GF256MUL2(s)\) | 7,9 |
6 | t⊕r3,tmp⊕rj | 7,9 |
7 | GF256MUL2(tmp)⊕ST[i] | 10 |
8 | OT | 10 |
l | EIl | Steps |
1 | <t,ST[4(i+1)]> | 7 |
2 | <tmp,ST[4i+(j+1)]> | 9 |