Yet Another Size Record for AES: A First-Order SCA Secure AES S-Box Based on $$\mathrm {GF}(2^8)$$ GF ( 2 8 ) Multiplication

Wegener, Felix; Moradi, Amir

doi:10.1007/978-3-030-15462-2_8

Cited by 2 publications

(2 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The AES S-box consists of an inversion in GF (2 8 ), and an affine layer. The inversion in GF (2 8 ), which has algebraic degree seven, can be decomposed into two simpler cubic functions: x −1 = x 254 = (x 26 ) 49 [16], [46]. We leverage this decomposition to split our implementation into two stages with one register layer in between the two functions.…”

Section: Aesmentioning

confidence: 99%

See 1 more Smart Citation

LLTI: Low-Latency Threshold Implementations

Arribas

Zhang

Nikova

2021

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

With the enormous increase in portable cryptographic devices, physical attacks are becoming similarly popular. One of the most common physical attacks is Side-Channel Analysis (SCA), extremely dangerous due to its non-invasive nature. Threshold Implementations (TI) was proposed as the first countermeasure to provide provable security in masked hardware implementations. While most works on hardware masking are focused on optimizing the area requirements, with the newer and smaller technologies area is taking a backseat, and lowlatency is gaining importance. In this work, we revisit the scheme proposed by Arribas et al. in TCHES 2018 to secure unrolled implementations. We formalize and expand this methodology, to devise a masking scheme, derived from TI, designed to secure hardware implementations optimized for latency named Low-Latency Threshold Implementations (LLTI). By applying the distributive property and leveraging a divide-and-conquer strategy, we split a non-linear operation in layers which are masked separately. The result is a more efficient scheme than the former TI for any operation of algebraic degree greater than two, achieving great optimizations both in terms of speed and area. We compare the performance of first-order LLTI with first-order TI in securing a cubic gate and a degree-7 AND gate without using any registers in between. We achieve a 137% increase in maximum frequency and a 60% reduction in area for the cubic gate, and 3131 times reduction in area in the case of a degree-7 AND gate compared to TI. To further illustrate the power of our scheme we take a low-latency PRINCE implementation from the literature and, by simply changing the secure S-box with the LLTI version, we achieve a 46% max. frequency improvement and a 38% area reduction. Moreover, we apply LLTI to a secure a low-latency AES implementation and compare it with the TI version, achieving a 6.9 times max. freq. increase and a 47.2% area reduction.

show abstract

Section: Aesmentioning

confidence: 99%

“…There are multiple strategies to implement a masked AES S-box, the most common being the tower filed decomposition [11], [12], [13], [14], [8]. An also popular approach is the power maps decomposition [15], [4], [16], [17]. All these methods need several register layers to cope with the high non-linearity.…”

Section: Introductionmentioning

confidence: 99%