Automated Generation of Masked Hardware

Knichel, David; Moradi, Amir; Müller, Nicolai; Sasdrich, Pascal

doi:10.46586/tches.v2022.i1.589-629

Cited by 13 publications

(9 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, as our implementations are fully pipelined and successive inputs are assumed to be shared independently, this vulnerability does not apply in this case. The authors of [20,21] previously demonstrated the side-channel resistance of the HPC2 gadgets using TVLA. Therefore, we did not perform side-channel measurements for the HPC2 adder designs.…”

Section: Side-channel Evaluationmentioning

confidence: 99%

Boolean Masking for Arithmetic Additions at Arbitrary Order in Hardware

Güneysu

2022

Applied Sciences

View full text Add to dashboard Cite

Modular addition is an important component of many cryptographic algorithms such as ARX-ciphers and lattice-based post-quantum secure schemes. In order to protect devices that execute these algorithms against side-channel attacks, countermeasures such as masking must be applied. However, if an implementation needs to be secured against multivariate attacks, univariately secure masking schemes do not suffice. In this work, we focus on hardware architectures for higher-order masked addition circuits. We present and discuss three adder designs that are protected with a provably secure masking scheme. Concretely, we discuss Kogge–Stone, Sklansky and Brent–Kung adders regarding their suitability for high-order masking and their performance in this setting. All architectures are fully pipelined and achieve a throughput of one addition per cycle. In order to achieve multivariate security at arbitrary orders, we use HPC2 Gadgets that satisfy the PINI security notion. Additionally, we apply a first-order secure threshold implementation scheme to the adder variants and compare their performance in the univariate case.

show abstract

Section: Side-channel Evaluationmentioning

confidence: 99%

Boolean Masking for Arithmetic Additions at Arbitrary Order in Hardware

Güneysu

2022

Applied Sciences

View full text Add to dashboard Cite

show abstract

“…For the sake of completeness in assessing the security of our optimized construction, we further performed experimental analysis by conducting a leakage assessment on SCA traces measured from an FPGA prototype. To this end, and in order to be consistent with the state-of-the-art, we mainly followed the procedure explained by Knichel et al [KMMS22].…”

Section: Experimental Analysismentioning

confidence: 99%

“…The design requires 1092 fresh random bits and has a latency of 8 clock cycles. Hence, we again followed Knichel et al [KMMS22] for an FPGA-friendly implementation of a 31-bit Linear Feedback Shift Register (LFSR) for each required fresh random bit, updated at every clock cycle. A sample power trace (covering the entire 8 clock cycles) and the result of t-tests are depicted in Figure 9.…”

Section: Experimental Analysismentioning

confidence: 99%

“…While there are already some initial concepts and tools to design and verify composed circuits [BGR18,CGLS21,KMMS22], all of the given tools maintain gadget barriers and boundaries without further optimization and improvement of the final masked circuits. Consequently, this leads to the question, whether dissolving gadget barriers and boundaries can help to share resources and, hence, decrease the overhead introduced through conservative security notions.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Randomness Optimization for Gadget Compositions in Higher-Order Masking

Feldtkeller

Knichel

Sasdrich

et al. 2022

TCHES

Self Cite

View full text Add to dashboard Cite

Physical characteristics of electronic devices, leaking secret and sensitive information to an adversary with physical access, pose a long-known threat to cryptographic hardware implementations. Among a variety of proposed countermeasures against such Side-Channel Analysis attacks, masking has emerged as a promising, but often costly, candidate. Furthermore, the manual realization of masked implementations has proven error-prone and often introduces flaws, possibly resulting in insecure circuits. In the context of automatic masking, a new line of research emerged, aiming to replace each physical gate with a secure gadget that fulfills well-defined properties, guaranteeing security when interconnected to a large circuit. Unfortunately, those gadgets introduce a significant amount of additional overhead into the design, in terms of area, latency, and randomness requirements.In this work, we present a novel approach to reduce the demands for randomness in such gadget-composed circuits by reusing randomness across gadgets while maintaining security in the probing adversary model. To this end, we embedded the corresponding optimization passes into an Electronic Design Automation toolchain, able to construct, optimize, and implement masked circuits, starting from an unprotected design. As such, our security-aware optimization offers an additional building block for existing or new Electronic Design Automation frameworks, where security is considered a first-class design constraint.

show abstract

“…These implementations are potentially beneficial and usually more efficient compared to their gadget-based variants. For example, [KMMS22] provides a comparison of different masked byte-serial implementations of the Advanced Encryption Standard (AES). However, their probing security remains unproven.…”

Section: Introductionmentioning

confidence: 99%

Prolead

Müller

Moradi

2022

TCHES

Self Cite

View full text Add to dashboard Cite

Even today, Side-Channel Analysis attacks pose a serious threat to the security of cryptographic implementations fabricated with low-power and nanoscale feature technologies. Fortunately, the masking countermeasures offer reliable protection against such attacks based on simple security assumptions. However, the practical application of masking to a cryptographic algorithm is not trivial, and the designer may overlook possible security flaws, especially when masking a complex circuit. Moreover, abstract models like probing security allow formal verification tools to evaluate masked implementations. However, this is computationally too expensive when dealing with circuits that are not based on composable gadgets. Unfortunately, using composable gadgets comes at some area overhead. As a result, such tools can only evaluate subcircuits, not their compositions, which can become the Achilles’ heel of such masked implementations.In this work, we apply logic simulations to evaluate the security of masked implementations which are not necessarily based on composable gadgets. We developed PROLEAD, an automated tool analyzing the statistical independence of simulated intermediates probed by a robust probing adversary. Compared to the state of the art, our approach (1) does not require any power model as only the state of a gate-level netlist is simulated, (2) can handle masked full cipher implementations, and (3) can detect flaws related to the combined occurrence of glitches and transitions as well as higher-order multivariate leakages. With PROLEAD, we can evaluate masked mplementations that are too complex for existing formal verification tools while being in line with the robust probing model. Through PROLEAD, we have detected security flaws in several publicly-available masked implementations, which have been claimed to be robust probing secure.

show abstract

Automated Generation of Masked Hardware

Cited by 13 publications

References 16 publications

Boolean Masking for Arithmetic Additions at Arbitrary Order in Hardware

Boolean Masking for Arithmetic Additions at Arbitrary Order in Hardware

Randomness Optimization for Gadget Compositions in Higher-Order Masking

Prolead

Contact Info

Product

Resources

About