Handcrafting: Improving Automated Masking in Hardware with Manual Optimizations

Momin, Charles; Cassiers, Gaëtan; Standaert, François‐Xavier

doi:10.1007/978-3-030-99766-3_12

Cited by 4 publications

(4 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For the masked AES in binary fields, we rely on the PINI S-box architecture proposed in [MCS22]. It is based on the binary representation with 34 ANDs and 94 XORs presented in [BP12].…”

Section: Pini Aes S-boxmentioning

confidence: 99%

“…The latter is a glitch-robust masking scheme for which the composability has been proven for an arbitrary number of shares. As explained in [MCS22], the input latency asymmetry of the HPC2 multiplication gadget may result in suboptimal implementation result if a naive instantiation strategy is used. Instead, the authors show that significant performance improvements, both in terms of area and latency, can be obtained by switching the input ports of some specific multiplication gadgets.…”

Section: Pini Aes S-boxmentioning

confidence: 99%

“…This strategy simplifies the integration of the S-boxes, minimizes the required control logic and is overall well-suited for a comparison as it requires no additional assumptions about the timing of input values. However, the additional registers lead to an area overhead compared to more optimized realizations such as [MCS22].…”

Section: Hardware Cost and Performancementioning

confidence: 99%

“…For static attacks, we consider the standard adversary model with control over the clock to make use of intra-trace averaging (see details and reference list in Section 2.2). Besides, we perform the same analysis for the standard (binary) AES, using the state-of-the-art implementation proposed in [MCS22].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Prime-Field Masking in Hardware and its Soundness against Low-Noise SCA Attacks

Cassiers

Masure²,

Momin³

et al. 2023

TCHES

View full text Add to dashboard Cite

A recent study suggests that arithmetic masking in prime fields leads to stronger security guarantees against passive physical adversaries than Boolean masking. Indeed, it is a common observation that the desired security amplification of Boolean masking collapses when the noise level in the measurements is too low. Arithmetic encodings in prime fields can help to maintain an exponential increase of the attack complexity in the number of shares even in such a challenging context. In this work, we contribute to this emerging topic in two main directions. First, we propose novel masked hardware gadgets for secure squaring in prime fields (since squaring is non-linear in non-binary fields) which prove to be significantly more resource-friendly than corresponding masked multiplications. We then formally show their local and compositional security for arbitrary orders. Second, we attempt to >experimentally evaluate the performance vs. security tradeoff of prime-field masking. In order to enable a first comparative case study in this regard, we exemplarily consider masked implementations of the AES as well as the recently proposed AESprime. AES-prime is a block cipher partially resembling the standard AES, but based on arithmetic operations modulo a small Mersenne prime. We present cost and performance figures for masked AES and AES-prime implementations, and experimentally evaluate their susceptibility to low-noise side-channel attacks. We consider both the dynamic and the static power consumption for our low-noise analyses and emulate strong adversaries. Static power attacks are indeed known as a threat for side-channel countermeasures that require a certain noise level to be effective because of the adversary’s ability to reduce the noise through intra-trace averaging. Our results show consistently that for the noise levels in our practical experiments, the masked prime-field implementations provide much higher security for the same number of shares. This compensates for the overheads prime computations lead to and remains true even if / despite leaking each share with a similar Signal-to-Noise Ratio (SNR) as their binary equivalents. We hope our results open the way towards new cipher designs tailored to best exploit the advantages of prime-field masking.

show abstract

“…For the masked AES in binary fields, we rely on the PINI S-box architecture proposed in [MCS22]. It is based on the binary representation with 34 ANDs and 94 XORs presented in [BP12].…”

Section: Pini Aes S-boxmentioning

confidence: 99%

Section: Pini Aes S-boxmentioning

confidence: 99%

Section: Hardware Cost and Performancementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations