A Fast and Provably Secure Higher-Order Masking of AES S-Box

Abstract

Abstract. This paper proposes an efficient and secure higher-order masking algorithm for AES S-box that consumes the most computation time of the higher-order masked AES. During the past few years, much of the research has focused on finding higher-order masking schemes for this AES S-box, but these are still slow for embedded processors use. Our proposed higher-order masking of AES S-box is constructed based on the inversion operation over the composite field. We replace the subfield operations over the composite field into the table lookup operation, but these precomputation tables do not require much ROM space because these are the operations over GF (2 4 ). In the implementation results, we show that the higher-order masking scheme using our masked S-box is about 2.54 (second-order masking) and 3.03 (third-order masking) times faster than the fastest method among the existing higher-order masking schemes of AES.

Higher-Order Masking Schemes for S-Boxes

“…The masked s-box processing is 5 (resp. 10) times slower than the efficiency of the AES s-box protected thanks to [15] (resp. [27]), though its input dimension is smaller.…”

“…For comparison, we also give performances of some higher-order masking schemes for the AES s-box, as well as performances of existing schemes for DES and PRESENT s-boxes at orders 1 and 2. For the AES s-box processing, we implemented Rivain and Prouff's method [27] and its improvement by Kim et al [15]. We did not implement Genelle et al 's scheme [12] since it addresses the masking of an overall AES and is not interesting while focusing on a single s-box processing.…”

“…One may also want to minimize the number of nonlinear multiplications in the ( -variate) s-box representation over F 2 k for some k (and = n/k ). This approach has actually already been followed in [15], where Kim et al speeds up the scheme in [27] by using the fact that the AES s-box can be processed with 5 nonlinear multiplications over F 16 rather than 4 nonlinear multiplications over F 256 . Although requiring an additional nonlinear multiplication, the resulting implementation is faster since multiplications over F 16 can be tabulated while multiplications over F 256 are computed based on the slower log/alog approach.…”

“…Subsequently, Kim, Hong and Lim have presented in [15] an extension of Rivain and Prouff's scheme, which is based on the tower-field approach from [28]. On the other hand, Genelle, Prouff and Quisquater have proposed in [12] a higher-order scheme based on the alternate use of Boolean masking and multiplicative masking.…”

“…On the other hand, Genelle, Prouff and Quisquater have proposed in [12] a higher-order scheme based on the alternate use of Boolean masking and multiplicative masking. Although schemes in [15] and [12] achieve better performances than [27], they are still restricted to the AES s-box and their generalization to any s-box (or subclasses) is an open issue.…”