LLTI: Low-Latency Threshold Implementations

Arribas, Víctor; Zhang, Zhenda; Nikova, Svetla

doi:10.1109/tifs.2021.3123527

Cited by 5 publications

(10 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…and adds a fresh random mask r to the cross-domain products, that is, a 0 ⊗ b 1 and a 1 ⊗ b 0 . Then, to ensure resistance against glitches [4], registers (−→) store the resulting shares (x 0 , x 1 , x 2 , x 3 ), as we can see in (1). The non-linear layer produces (d + 1) 2 shares and is followed by a sharing compression layer -as shown in (2) for a first-order masking -to reduce the number of shares back to (d + 1), preventing a quadratic growth of the number of shares through the computation [28].…”

Section: A Maskingmentioning

confidence: 99%

“…With the increasing proliferation of IoT devices, secure low-latency and area-efficient cryptographic modules become therefore necessary to satisfy commercial demands. In this manner, many techniques have been proposed to balance the masking implementation costs, with recent efforts aiming at the design of low-latency schemes based on different architectural approaches [1], [8], [20], [22], [29], [31]. Nevertheless, the reduction in the overall clock cycle score is accompanied by higher implementation costs and, in some cases, lower throughput.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Low-Latency Masking with Arbitrary Protection Order Based on Click Elements

Simões

Bossuet

Bruneau

et al. 2023

2023 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)

View full text Add to dashboard Cite

Masking is the main countermeasure against sidechannel attacks due to its sound formal proof of security and the scalability of its protection parameters. However, effective masking increases the implementation complexity by requiring additional silicon area, random number generators and higher latency. Thus, reducing the masking implementation costs while conserving its robustness under side-channel attacks is a relevant branch of research in hardware security applications.Relying on the two-phase bundled-data protocol, this work presents a low-latency masking implementation with arbitrary protection order. In particular, we base our approach on the click elements to control the handshake logic, allowing us to implement asynchronous circuits using conventional synthesis tools. In this manner, we are able to obtain an effective single-cycle and protected implementation of the AES S-box requiring smaller silicon area and potentially lower power consumption compared to the state-of-the-art. Additionally, we detail the asynchronous design methodology that can be applied in different scenarios to improve the latency of secure hardware designs. Finally, we assess leakages to evaluate the robustness of our approach against side-channel attacks.

show abstract

Section: A Maskingmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Low-Latency Masking with Arbitrary Protection Order Based on Click Elements

Simões

Bossuet

Bruneau

et al. 2023

2023 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)

View full text Add to dashboard Cite

show abstract

“…Most recently, Arribas et. al presented a low-latency masking technique based on threshold implementations called LLTI [AZN21] and implemented their technique on Prince and AES. Compared to the implementation by [Sas+20] the area is worse, however, their construction does not require any online randomness.…”

Section: Low-latency Maskingmentioning

confidence: 99%

“…Most recently, Arribas et. al presented a low-latency masking technique based on threshold implementations called LLTI, that has somewhat comparable area requirements to GLM but can eliminate the need of online randomness [AZN21]. Current approaches lead to unfavorable design trade-offs in terms area, latency, randomness requirement and design complexity.…”

Section: Introductionmentioning

confidence: 99%

Riding the Waves Towards Generic Single-Cycle Masking in Hardware

Nagpal

Gigerl

Primas

et al. 2022

TCHES

View full text Add to dashboard Cite

Research on the design of masked cryptographic hardware circuits in the past has mostly focused on reducing area and randomness requirements. However, many embedded devices like smart cards and IoT nodes also need to meet certain performance criteria, which is why the latency of masked hardware circuits also represents an important metric for many practical applications.The root cause of latency in masked hardware circuits is the need for additional register stages that synchronize the propagation of shares. Otherwise, glitches would violate the basic assumptions of the used masking scheme. This issue can be addressed to some extent, e.g., by using lightweight cryptographic algorithms with low-degree Sboxes, however, many applications still require the usage of schemes with higher-degree S-boxes like AES. Several recent works have already proposed solutions that help reduce this latency yet they either come with noticeably increased area/randomness requirements, limitations on masking orders, or specific assumptions on the general architecture of the crypto core.In this work, we introduce a generic and efficient method for designing single-cycle glitch-resistant (higher-order) masked hardware of cryptographic S-boxes. We refer to this technique as (generic) Self-Synchronized Masking (“SESYM”). The main idea of our approach is to replace register stages with a partial dual-rail encoding of masked signals that ensures synchronization within the circuit. More concretely, we show that WDDL gates and Muller C-elements can be used in combination with standard masking schemes to design single-cycle S-box circuits that, especially in case of higher-degree S-boxes, have noticeably lower requirements in terms of area and online randomness. We apply our method to DOM-based S-boxes of Ascon and AES and compare the resulting circuits to existing latency optimized circuits based on TI, GLM, and LMDPL. The latency of all three designs is reduced to single-cycle operation and are dth-order secure. Compared to GLM-masked Ascon, our approach comes with a 6.4 times reduction in online randomness for all protection orders. Compared to 1st-order LMDPL-masked AES, our approach achieves comparable results, while it is more generic, amongst others, by also supporting higher-order designs. We also underline the practical protection of our constructions against power analysis attacks via empirical and formal verification approaches.

show abstract

“…The essential idea of the GLM scheme is to skip the shares compression stage after the nonlinear operation, thereby eliminating the need for a register stage to increase the number of shared values. Arribas et al later proposed a Low-Latency Threshold Implementations (LLTI) technique [AZN22] using a divide-and-conquer strategy for nonlinear functions with an algebraic degree greater than two to reduce area and delay.…”

Section: Introductionmentioning

confidence: 99%

A Low-Latency High-Order Arithmetic to Boolean Masking Conversion

Liu,

Zhao,

Peng

et al. 2024

TCHES

View full text Add to dashboard Cite

Masking, an effective countermeasure against side-channel attacks, is commonly applied in modern cryptographic implementations. Considering cryptographic algorithms that utilize both Boolean and arithmetic masking, the conversion algorithm between arithmetic masking and Boolean masking is required. Conventional high-order arithmetic masking to Boolean masking conversion algorithms based on Boolean circuits suffer from performance overhead, especially in terms of hardware implementation. In this work, we analyze high latency for the conversion and propose an improved high-order A2B conversion algorithm. For the conversion of 16-bit variables, the hardware latency can be reduced by 47% in the best scenario. For the case study of second-order 32-bit conversion, the implementation results show that the improved scheme reduces the clock cycle latency by 42% in hardware and achieves a 30% speed performance improvement in software. Theoretically, a security proof of arbitrary order is provided for the proposed high-order A2B conversion. Experimental validations are performed to verify the second-order DPA resistance of second-order implementation. The Test Vector Leakage Assessment does not observe side-channel leakage for hardware and software implementations.

show abstract

LLTI: Low-Latency Threshold Implementations

Cited by 5 publications

References 39 publications

Low-Latency Masking with Arbitrary Protection Order Based on Click Elements

Low-Latency Masking with Arbitrary Protection Order Based on Click Elements

Riding the Waves Towards Generic Single-Cycle Masking in Hardware

A Low-Latency High-Order Arithmetic to Boolean Masking Conversion

Contact Info

Product

Resources

About