Improving First-Order Threshold Implementations of SKINNY

Abstract

Threshold Implementations have become a popular generic technique to construct circuits resilient against power analysis attacks. In this paper, we look to devise efficient threshold circuits for the lightweight block cipher family SKINNY. The only threshold circuits for this family are those proposed by its designers who decomposed the 8-bit S-box into four quadratic S-boxes, and constructed a 3-share byte-serial threshold circuit that executes the substitution layer over four cycles. In particular, we revisit the algebraic structure of the S-box and prove that it is possible to decompose it into (a) three quadratic S-boxes and (b) two cubic S-boxes. Such decompositions allow us to construct threshold circuits that require three shares and executes each round function in three cycles instead of four, and similarly circuits that use four shares requiring two cycles per round. Our constructions significantly reduce latency and energy consumption per encryption operation. Notably, to validate our designs, we synthesize our circuits on standard CMOS cell libraries to evaluate performance, and we conduct leakage detection via statistical tests on power traces on FPGA platforms to assess security. 1

Revisiting the Security of COMET Authenticated Encryption Scheme

“…As can be seen that this output bit of S 2 is constructed by a standalone AND gate, and correction terms have to be added to construct a 3-input/3-output share TI of the SKINNY S-box. In the supplementary material [8], we present explicit algebraic expressions for all 3 shares of the S-boxes F , G and H. While noncompleteness and correctness are easy to argue, we additionally argue uniformity of our construction too.…”

“…Since we also have that S = S Red • S Blue , this also gives us the cubic decomposition required to construct a first order TI using 4 input/output shares that can evaluate the shared S-box in just 2 cycles. In the supplementary material [8], we present explicit algebraic expressions for all 4 shares of the S-boxes S Red , S Blue , where we additionally argue uniformity of our construction too.…”

“…After decomposing the S-box into quadratic and cubic component functions, we use the direct sharing approach to obtain the algebraic expressions for each of the individual shares of the masked S-box. In all cases, except for S 2222 , correction terms were required to ensure uniform sharing (all the algebraic expressions for the individual shares can be found in [8]).…”

“…and the other u i 's are as defined for S Blue . Correspondingly we define S Red : {0, 1} 9 → {0, 1} 8 where…”

“…We compile the netlist for the S 222 and S 33 S-boxes using the NanGate 45nm standard cell library and verified that both netlists satisfied first-order probing security in the standard and robust probing models as well as uniformity. A script together and the corresponding netlist files are given in the auxiliary repository [8].…”