LS-Designs: Bitslice Encryption for Efficient Masked Software Implementations

Abstract

Side-channel analysis is an important issue for the security of embedded cryptographic devices, and masking is one of the most investigated solutions to mitigate such attacks. In this context, efficient masking has recently been considered as a possible criteria for new block cipher designs. Previous proposals in this direction were applicable to different types of masking schemes (e.g. Boolean and polynomial). In this paper, we study possible optimizations when specializing the designs to Boolean masking. For this purpose, we first observe that bitslice ciphers have interesting properties for improving both the efficiency and the regularity of masked software implementations. Next we specify a family of block ciphers (denoted as LS-designs) that can systematically take advantage of bitslicing in a principled manner. Eventually, we evaluate both the security and performance of such designs and two of their instances, confirming excellent properties for physically secure applications. 3 LED and PRESENT have the same number of non-linear gates, but encrypt only 64-bit. So we do not expect them to bring improvements in our masked setting.

Triathlon of lightweight block ciphers for the Internet of things

“…The S-box structure simplifies the implemen tation of masking. There is no key-schedule: the master key is added at every round [27]. At the time of writing, there was to the best of our knowledge no attack on this very recently designed block cipher.…”

“…The look-up table-based diffusion layers and the structure of the S-boxes makes the family ciphers good candidates for Boolean masking in bitslice software implementations [27]. There exists a set of weak keys of density 2 −32 for this cipher which, if used, leads to attack on the full primitive [34].…”

Reverse-Engineering the S-Box of Streebog, Kuznyechik and STRIBOBr1

“…For example, S-Boxes used in Whirlpool [20], Zorro [38], Iceberg [39], Khazad [40], CLEFIA [41], and Robin and Fantomas [42] are permutations of 8 bits based on smaller S-Boxes. In many cases, such a structure is used to allow an efficient implementation of the S-Box in hardware or using a bit-sliced approach.…”

Observations on the SIMON Block Cipher Family

“…This research direction is driven by a demand for cost-effective, small-scale communicating devices such as RFID tags that are a cornerstone in the Internet of Things. Most often the constrained resource is taken to be the chip-area but other performance metrics such as latency [7], code-size [2] and ease of side-channel protection [12]) have been considered as well. Some of these criteria were already treated in Noekeon [9].…”