Efficient Masking Methods Appropriate for the Block Ciphers ARIA and AES

Abstract

In this paper, we propose efficient masking methods for ARIA and AES. In general, a masked S-box (MS) block can be constructed in different ways depending on the implementation platform, such as hardware and software. However, the other components of ARIA and AES have less impact on the implementation cost. We first propose an efficient masking structure by minimizing the number of mask corrections under the assumption that we have an MS block. Second, to make a secure and efficient MS block for ARIA and AES, we propose novel methods to solve the table size problem for the MS block in a software implementation and to reduce the cost of a masked inversion which is the main part of the MS block in the hardware implementation.

Efficient Masked Implementation for SEED Based on Combined Masking

“…In the first two NMA operations in each round, the CarryCorrection function performs the following algorithm by using λ and the carry tables, C 1 and C 2 , generated before en/decryption. A similar idea was published in [15]. However, our idea reduces RAM usage rather than ROM usage because we exploit the relation between two S-boxes rather than the relation between an S-box and its inverse; RAM is typically much more expensive than ROM.…”

“…We first show the equation between S 1 and S 2 as follows, where B is an 8×8 matrix such that B(x)=x 2 : ( ) (( ) ) ( ( ( ) )) ( ( ( ) )) ( ) ( ) ( ) ( ) . A similar idea was published in [15]. However, our idea reduces RAM usage rather than ROM usage because we exploit the relation between two S-boxes rather than the relation between an S-box and its inverse; RAM is typically much more expensive than ROM.…”

New Type of Collision Attack on First-Order Masked AESs

“…Although it is possible to compute this m a value without the exposure of intermediate values, this method requires both memory (to keep track of all mask values) and a large number of operations. To fulfill this function, a first-order masked AES generally generates an MS table by computing MS(x  m) = S(x)  m with new random numbers m and m before an encryption or decryption, as shown in Algorithm 1 [5], [7]. 4 and k Nr  masked by (m||m||m||m) 4 where (a 3 ||a 2 ||a 1 ||a 0 ) 4 is (2 96 + 2 64 + 2 32 + 1) (a 3 2 24 + a 2 2 16 + a 1 2 8 + a 0 ) (a survey is given in […”

A Fast and Provably Secure Higher-Order Masking of AES S-Box

“…During the past few years, much of the research on DPA attacks has focused on finding secure countermeasures. Among these countermeasures, a masking method based on algorithmic techniques is known to be inexpensive and secure against a first-order DPA (FODPA) [3,5,9,11,15,16].…”