Simplified Adaptive Multiplicative Masking for AES

Abstract

Software counter measures against side channel attacks considerably hinder performance of cryptographic algorithms in terms of memory or execution time or both. The challenge is to achieve secure implementation with as little extra cost as possible. In this paper we optimize a counter measure for the AES block cipher consisting in transforming a boolean mask to a multiplicative mask prior to a non-linear Byte Substitution operation (thus, avoiding S-box re-computations for every run or storing multiple S-box tables in RAM), while preserving a boolean mask everywhere else. We demonstrate that it is possible to achieve such transformation for a cost of two additional multiplications in the field. However, due to an inherent vulnerability of multiplicative masking to so-called zero attack, an additional care must be taken to securize its implementation. We describe one possible, although not perfect, approach to such an implementation which combines algebraic techniques and partial re-computation of S-boxes. This adds one more multiplication operation, and either occasional S-box re-computations or extra 528 bytes of memory to the total price of the counter measure.

A Side-Channel Analysis Resistant Description of the AES S-Box

“…In case of the AES algorithm, several algorithmic countermeasures have been proposed [2], [6], and [13]. They are all based on masking, i.e., the addition of a random value (the mask) to the intermediate AES values.…”

“…They are all based on masking, i.e., the addition of a random value (the mask) to the intermediate AES values. However two of them, [2] and [13], are both susceptible to a certain type of (first-order) differential side-channel attack, the zero-value attack. The latter one has turned out to be vulnerable even to standard differential side-channel attacks as well [1].…”

Side-Channel Leakage of Masked CMOS Gates

“…For example, there are several publications on how to mask DES [1,8] and AES [1,2,7,24]. However, there also exist two publications [3,9] that discuss masking in a more generic way.…”

“…Applying masking at the algorithm level means that an algorithm is rewritten such that all intermediate results are randomized, while the input and the output of the algorithm are identical to those of the unmasked version. There are several publications that discuss how symmetric [1,7,8,24] and asymmetric ciphers [5,15] can be rewritten this way.…”

Provably Secure S-Box Implementation Based on Fourier Transform

“…Then, the computation can be securely carried out by performing calculations with these random blocks. The second method, called the re-computation method [1,2,29], involves a recomputation of the lookup tables corresponding to the S-Box with one or several random value(s) which must be changed each time the algorithm is executed. The third generic method, that we call here S-Box secure calculation, has been essentially applied to protect AES implementations [5,15,28,32] due to the strong algebraic structure of the AES S-Box.…”