A Low-Randomness Second-Order Masked AES

Abstract

We propose a second-order masking of the AES in hardware that requires an order of magnitude less random bits per encryption compared to previous work. The design and its security analysis are based on recent results by Beyne et al. from Asiacrypt 2020. Applying these results to the AES required overcoming significant engineering challenges by introducing new design techniques. Since the security analysis is based on linear cryptanalysis, the masked cipher needs to have sufficient diffusion and the S-box sharing must be highly nonlinear. Hence, in order to apply the changing of the guards technique, a detailed study of its effect on the diffusion of the linear layer becomes important. The security analysis is automated using an SMT solver. Furthermore, we propose a sharpening of the glitch-extended probing model that results in improvements to our concrete security bounds. Finally, it is shown how to amortize randomness costs over multiple evaluations of the masked cipher.

Characteristic automated search of cryptographic algorithms for distinguishing attacks (CASCADA)

“…The primitive module implements many cryptographic primitives, namely AES [54], a masked AES [55], CHAM [56], Chaskey [57], FEAL [58], HIGHT [59], LEA [60], MULTI2 [61], π ‐cipher [62], SHACAL‐1 [63], SHACAL‐2 [64], Simeck [65], Simon [45], Speck [45], SKINNY [66], TEA [67], and XTEA [68].…”