Threshold Implementations of All 3 ×3 and 4 ×4 S-Boxes

Abstract

Abstract. Side-channel attacks have proven many hardware implementations of cryptographic algorithms to be vulnerable. A recently proposed masking method, based on secret sharing and multi-party computation methods, introduces a set of sufficient requirements for implementations to be provably resistant against first-order DPA with minimal assumptions on the hardware. The original paper doesn't describe how to construct the Boolean functions that are to be used in the implementation. In this paper, we derive the functions for all invertible 3×3, 4×4 S-boxes and the 6 × 4 DES S-boxes. Our methods and observations can also be used to accelerate the search for sharings of larger (e.g. 8 × 8) S-boxes. Finally, we investigate the cost of such protection.

A More Efficient AES Threshold Implementation

“…With this approach, the GF (2 4 ) inverter can be seen as a four bit permutation and the GF (2 4 ) multiplier as a four bit multiplication both of which are well studied in [4]. Therefore, we can find uniform TIs for these non-linear blocks directly which implies using less fresh random bits.…”

“…To have a uniform sharing for this function, which belongs to class C 4 282 [5], we consider two options. Either using four shares which is the minimum number of shares necessary for a uniform implementation in that class and decomposing the function into three uniform sub-functions as Inv(x) = F (G (H(x))), or using five shares without any decomposition.…”

“…It has been shown that all 3 × 3, 4 × 4 and the DES 6 × 4 S-boxes have a TI sharing with 3, 4 or 5 shares [5]. The TI approach has been applied to only few entire algorithms: PRESENT [21], AES [18] and Keccak [3].…”

Fides: Lightweight Authenticated Cipher with Side-Channel Resistance for Constrained Hardware

“…Being secure even against the leakage caused by the presence of the glitches, TI provides a relatively cheap countermeasure. While protecting linear functions is trivial [27], it becomes a challenging task to properly address the security of non-linear functions such as S-boxes [5,23]. As mentioned in Section 2.1, we pay special attention while choosing the S-box such that it can be securely implemented in a single clock cycle, yet having a small area footprint.…”

A Novel Design Flow for a Security-Driven Synthesis of Side-Channel Hardened Cryptographic Modules

“…We favored the latter method for the following reasons: For each application, the masking scheme has to be adapted to the specific S-box of the applied cipher, which works for all S-box variants up to four bits only, cf. [32,33]. Even for five bits, the search space for a suitable solution becomes so large that it is not traversable in a realistic search time.…”