Re-Consolidating First-Order Masking Schemes

Abstract

Application of masking, known as the most robust and reliable countermeasure to side-channel analysis attacks, on various cryptographic algorithms has dedicated a lion’s share of research to itself. The difficulty originates from the fact that the overhead of application of such an algorithmic-level countermeasure might not be affordable. This includes the area- and latency overheads and the amount of fresh randomness required to fulfill the resulting design’s security properties. There are already techniques applicable in hardware platforms that consider glitches into account. Among them, classical threshold implementations force the designers to use at least three shares in the underlying masking. The other schemes, which can deal with two shares, often necessitates the use of fresh randomness.Here, in this work, we present a technique allowing us to use two shares to realize the first-order glitch-extended probing secure masked realization of several functions, including the S-box of Midori, PRESENT, PRINCE, and AES ciphers without any fresh randomness.

MS-LW-TI: Primitive-Based First-Order Threshold Implementation for 4 × 4 S-boxes

“…We implement MS-LW-TI on the S-boxes of PRESENT, GIFT, and PICCOLO, which consume only 17, 15, and 13 look-up-tables (LUTs); 16, 9, and 16 flip-flops (FFs); 6, 5, and 6 slices; and 3, 3, and 2 clock cycles, respectively. Compared with the existing lightweight TI design, our two-shares scheme for PRESENT S-box has a 22%, 38%, and 25% reduction of LUTs, FFs, and slices to the design by Shahmirzadi and Moradi at TCHES 2021 [23], and our three-shares scheme for GIFT Sbox has a 6%, 25%, and 28% reduction of LUTs, FFs, and slices to the design by Jati et al [17], which is the smallest one presently.…”

“…These equations have 23 AND gates and 23 XOR gates. And the ANF equations of two shares TI of the S-box are shown in [23], which have 200 AND gates and 164 XOR gates.…”

“…Chen et al [22] adopted the decomposed S-box of Kutzner et al [15] to realize two shares TI of PRESENT S-box. Subsequently, Shahmirzadi and Moradi [23] proposed lightweight two shares TI of S-boxes of lightweight block ciphers.…”

Guarding the First Order: The Rise of AES Maskings

“…The bus width is thus n_shares × 8 bits. The state registers and key registers can be viewed as 4 × 4 arrays, similar to the serialized encryption modules by Shahmirzadi and Moradi [24] and De Meyer et al [10]. Each masked byte after AddRoundKey, or after RotWord in the key expansion, is fed into the masked Sbox.…”

“…Design II reduces 10 cycles of latency in the AES encryption with the trade-off on a 56.75% larger area and a 37.11% lower maximum frequency. Shahmirzadi and Moradi [24] present a randomness-free 2-share AES implementation with a 5.2% smaller area and a design using one bit per S-box with a 12.2% smaller area. Both designs require a lower maximum frequency compared to design I, although the UMC 180 standard cell library was used.…”