Boolean Masking for Arithmetic Additions at Arbitrary Order in Hardware

Abstract

Modular addition is an important component of many cryptographic algorithms such as ARX-ciphers and lattice-based post-quantum secure schemes. In order to protect devices that execute these algorithms against side-channel attacks, countermeasures such as masking must be applied. However, if an implementation needs to be secured against multivariate attacks, univariately secure masking schemes do not suffice. In this work, we focus on hardware architectures for higher-order masked addition circuits. We present and discuss three adder designs that are protected with a provably secure masking scheme. Concretely, we discuss Kogge–Stone, Sklansky and Brent–Kung adders regarding their suitability for high-order masking and their performance in this setting. All architectures are fully pipelined and achieve a throughput of one addition per cycle. In order to achieve multivariate security at arbitrary orders, we use HPC2 Gadgets that satisfy the PINI security notion. Additionally, we apply a first-order secure threshold implementation scheme to the adder variants and compare their performance in the univariate case.

Gadget-based Masking of Streamlined NTRU Prime Decapsulation in Hardware

“…Add13 and Add64. In their work [BG22], Bache and Güneysu compare the Brent-Kung, Kogge-Stone, and Sklansky adder architectures in the context of Boolean masking. For gadget-based masking, the Sklansky adder turns out to be the optimal choice, having the same low latency as Kogge-Stone but less randomness demand while having a lower latency than Brent-Kung at the cost of slightly more randomness.…”

“…These concepts also have been adapted to the Boolean masked domain first in [SMG15]. This was followed by a broader examination of more recent techniques like threshold implementation and gadget-based masking [BG22], which we deploy for our work.…”

“…Note that all modules pass first-and second-order verification, while third-order verification is too complex for Mod3 and Mul3. For the Add13 and Add64 modules, we use the implementation by Bache and Güneysu [BG22], which has been analyzed by practical measurements.…”

A Holistic Approach Towards Side-Channel Secure Fixed-Weight Polynomial Sampling

“…Eventually, we obtain a masked six-bit result for each 32-bit block which is fed into an accumulation stage. The accumulator is implemented by a fully pipelined masked 8-bit Sklansky adder as proposed in [2]. Since the adder consists of eight register stages, we obtain eight masked intermediate results that need to be accumulated to a final result.…”