An Efficient Masking Scheme for AES Software Implementations

Oswald, Elisabeth; Schramm, Kai

doi:10.1007/11604938_23

Cited by 49 publications

(45 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In general, one S-box requires one MS table (General method) [21], [22]. In particular, the masking method for ARIA needs 1 kB ROM for four S-boxes and 1 kB RAM for four MS tables.…”

Section: A Methods To Generate the Ms Tables In Softwarementioning

confidence: 99%

Efficient Masking Methods Appropriate for the Block Ciphers ARIA and AES

Kim¹,

Kim²,

Han³

et al. 2010

ETRI J

View full text Add to dashboard Cite

In this paper, we propose efficient masking methods for ARIA and AES. In general, a masked S-box (MS) block can be constructed in different ways depending on the implementation platform, such as hardware and software. However, the other components of ARIA and AES have less impact on the implementation cost. We first propose an efficient masking structure by minimizing the number of mask corrections under the assumption that we have an MS block. Second, to make a secure and efficient MS block for ARIA and AES, we propose novel methods to solve the table size problem for the MS block in a software implementation and to reduce the cost of a masked inversion which is the main part of the MS block in the hardware implementation.

show abstract

“…In general, one S-box requires one MS table (General method) [21], [22]. In particular, the masking method for ARIA needs 1 kB ROM for four S-boxes and 1 kB RAM for four MS tables.…”

Section: A Methods To Generate the Ms Tables In Softwarementioning

confidence: 99%

Efficient Masking Methods Appropriate for the Block Ciphers ARIA and AES

Kim¹,

Kim²,

Han³

et al. 2010

ETRI J

View full text Add to dashboard Cite

show abstract

“…Second, we can also reduce the RAM size because the proposed method does not generate the MS 1 table. Compared with the general method for generating MS tables [2], [3], [5]- [8], the proposed method reduces the required clock cycles and memory usage for the 8-bit implementation (Table 1). This numerical value was measured in an ATmega128 [16].…”

Section: Performance Analysismentioning

confidence: 99%

Efficient Masked Implementation for SEED Based on Combined Masking

Kim¹,

Cho²,

Choi

et al. 2011

ETRI J

View full text Add to dashboard Cite

This paper proposes an efficient masking method for the block cipher SEED that is standardized in Korea. The nonlinear parts of SEED consist of two S-boxes and modular additions. However, the masked version of these nonlinear parts requires excessive RAM usage and a large number of operations. Protecting SEED by the general masking method requires 512 bytes of RAM corresponding to masked S-boxes and a large number of operations corresponding to the masked addition. This paper proposes a new-style masked S-box which can reduce the amount of operations of the masking addition process as well as the RAM usage. The proposed masked SEED, equipped with the new-style masked S-box, reduces the RAM requirements to 288 bytes, and it also reduces the processing time by 38% compared with the masked SEED using the general masked S-box. The proposed method also applies to other block ciphers with the same nonlinear operations.

show abstract

“…Indeed, as it can be seen in [25] or [31] for instance, it induces a very high (timing and/or memory) overhead, especially because one must always ensure that the sensitive data are securely manipulated and that the mask-correction algorithm itself thwarts DPA.…”

Section: Procedures 1 S-box Calculationmentioning

confidence: 99%

Provably Secure S-Box Implementation Based on Fourier Transform

Prouff

Giraud

Aumônier

2006

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Cryptographic algorithms implemented in embedded devices must withstand Side Channel Attacks such as the Differential Power Analysis (DPA). A common method of protecting symmetric cryptographic implementations against DPA is to use masking techniques. However, clever masking of non-linear parts such as S-Boxes is difficult and has been the flaw of many countermeasures. In this article, we take advantage of some remarkable properties of the Fourier Transform to propose a new method to thwart DPA on the implementation of every S-Box. After introducing criteria so that an implementation is qualified as DPA-resistant, we prove the security of our scheme. Finally, we apply the method to FOX and AES S-Boxes and we show in the latter case that the resulting implementation is one of the most efficient.

show abstract

An Efficient Masking Scheme for AES Software Implementations

Cited by 49 publications

References 11 publications

Efficient Masking Methods Appropriate for the Block Ciphers ARIA and AES

Efficient Masking Methods Appropriate for the Block Ciphers ARIA and AES

Efficient Masked Implementation for SEED Based on Combined Masking

Provably Secure S-Box Implementation Based on Fourier Transform

Contact Info

Product

Resources

About