Masking AES with $$d+1$$ Shares in Hardware

Abstract

Abstract. Masking requires splitting sensitive variables into at least d + 1 shares to provide security against DPA attacks at order d. To this date, this minimal number has only been deployed in software implementations of cryptographic algorithms and in the linear parts of their hardware counterparts. So far there is no hardware construction that achieves this lower bound if the function is nonlinear and the underlying logic gates can glitch. In this paper, we give practical implementations of the AES using d + 1 shares aiming at first-and second-order security even in the presence of glitches. To achieve this, we follow the conditions presented by Reparaz et al. at CRYPTO 2015 to allow hardware masking schemes, like Threshold Implementations, to provide theoretical higher-order security with d + 1 shares. The decrease in number of shares has a direct impact in the area requirements: our second-order DPA resistant core is the smallest in area so far, and its S-box is 50% smaller than the current smallest Threshold Implementation of the AES S-box with similar security and attacker model. We assess the security of our masked cores by practical side-channel evaluations. The security guarantees are met with 100 million traces.

New second‐order threshold implementation of AES

“…5) to ensure the uniformity of the output masking shares after the multiplication operation. Therefore, a total number of random bits per round for our masking scheme is 116, which is 10 bits less than the work of [18] and significantly less (about 28.4%) compared to implementation in [19] which uses 46 bits in extent but requires a slightly smaller chip area.…”

“…In 2016, De Cnudde et al . [19] introduced a general method to protect AES‐128 against d th‐order DPA attacks using masking shares. In particular, to implement the second‐order masking of AES‐128, this approach uses 162 random bits per round and the cost of hardware implementation is around 10 kGE.…”

“…The amount of random bits used in our scheme is therefore 28.4% smaller compared to the currently most efficient implementation of a second‐order TI masking scheme proposed by De Cnudde et al . [19], though the chip area is slightly increased by ∼13.7% (see also Section 5.2). In more detail, to make the masking expressions uniform some fresh random values are added as depicted in Fig.…”

“…1. This approach implies a reduction of their size compared to the structure of masking scheme in [19]. On the other hand, our method of masking S‐boxes requires four masking shares which is one more than that of the scheme in [19], and therefore the total chip area is slightly increased.…”

“…This approach implies a reduction of their size compared to the structure of masking scheme in [19]. On the other hand, our method of masking S‐boxes requires four masking shares which is one more than that of the scheme in [19], and therefore the total chip area is slightly increased. The security of our masking scheme of AES‐128 is verified against second‐order DPA attacks in an actual attack scenario and the implementation is confirmed to be secure even under the assumption that the attacker is capable of collecting a huge amount of power traces.…”