Lightweight Implementation of the LowMC Block Cipher Protected Against Side-Channel Attacks

Abstract

LowMC is a parameterizable block cipher developed for use in Multi-Party Computation (MPC) and Fully Homomorphic Encryption (FHE). In these applications, linear operations are much less expensive in terms of resource utilization compared to the nonlinear operations due to their low multiplicative complexity. In this work, we implemented two versions of LowMC-unrolled and lightweight. Both implementations are realized using RTL VHDL. To the best of our knowledge, we report the first lightweight implementation of LowMC and the first implementation protected against side-channel analysis (SCA). For the SCA protection, we used a hybrid 2/3 shares Threshold Implementation (TI) approach, and for the evaluation, the Test Vector Leakage Assessment (TVLA) method, also known as the T-test. Our unprotected implementations show information leakage at 10K traces, and after protection, they could successfully pass the T-test for 1 million traces. The Xilinx Vivado is used for the synthesis, implementation, functional verification, timing analysis, and programming of the FPGA. The target FPGA family is Artix-7, selected due to its widespread use in multiple applications. Based on our results, the numbers of LUTs are 867 and 3,328 for the lightweight and the unrolled architecture with unrolling factor = 16, respectively. It takes 14.21 s for the lightweight architecture and 1.29 s for the unrolled design with = 16 to generate one 128-bit block of the ciphertext. The fully unrolled architecture beats the best previous implementation by Kales et al. in terms of the number of LUTs by a factor of 4.5. However, this advantage comes at the cost of having 2.9 higher latency.

Leakage Power Analysis in Different S-Box Masking Protection Schemes

“…Threshold Implementation (TI): TI is an algorithmic countermeasure against power SCA, which benefits from multiparty computation and secret sharing [27]. TI, alike ISW, divides input bits into d + 1 shares.…”