PICARO – A Block Cipher Allowing Efficient Higher-Order Side-Channel Resistance

Piret, Gilles; Roche, Thomas; Carlet, Claude

doi:10.1007/978-3-642-31284-7_19

Cited by 72 publications

(40 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…As one goal of this paper is to find an adequate trade-off between these conflicting goals, this section briefly summarizes the main cryptographic properties we will consider. As mentioned in introduction, we will focus in bijective S-boxes since (a) non-bijective S-boxes have already been investigated in [47] and (b) non-bijective S-boxes are more exposed to structural attacks [21,52] and also more sensitive to so-called generic (nonprofiled) SCAs [61]. We now recall some tools used for evaluating the resistance of S-boxes against linear, differential and algebraic attacks.…”

Section: A Backgroundmentioning

confidence: 99%

See 1 more Smart Citation

Block Ciphers That Are Easier to Mask: How Far Can We Go?

Gérard

Grosso

Naya-Plasencia

et al. 2013

Lecture Notes in Computer Science

114

View full text Add to dashboard Cite

Abstract. The design and analysis of lightweight block ciphers has been a very active research area over the last couple of years, with many innovative proposals trying to optimize different performance figures. However, since these block ciphers are dedicated to low-cost embedded devices, their implementation is also a typical target for side-channel adversaries. As preventing such attacks with countermeasures usually implies significant performance overheads, a natural open problem is to propose new algorithms for which physical security is considered as an optimization criteria, hence allowing better performances again. We tackle this problem by studying how much we can tweak standard block ciphers such as the AES Rijndael in order to allow efficient masking (that is one of the most frequently considered solutions to improve security against side-channel attacks). For this purpose, we first investigate alternative Sboxes and round structures. We show that both approaches can be used separately in order to limit the total number of non-linear operations in the block cipher, hence allowing more efficient masking. We then combine these ideas into a concrete instance of block cipher called Zorro. We further provide a detailed security analysis of this new cipher taking its design specificities into account, leading us to exploit innovative techniques borrowed from hash function cryptanalysis (that are sometimes of independent interest). Eventually, we conclude the paper by evaluating the efficiency of masked Zorro implementations in an 8-bit microcontroller, and exhibit their interesting performance figures.

show abstract

Section: A Backgroundmentioning

confidence: 99%

“…[14,44]), in order to reduce its implementation overheads. More recently, the opposite approach has been undertaken by Piret et al [47]. In a paper presented at ACNS 2012, the authors suggested that improved SCA security could be achieved at a lower implementation cost by specializing a block cipher for efficient masking.…”

Section: Introductionmentioning

confidence: 99%

Block Ciphers That Are Easier to Mask: How Far Can We Go?

Gérard

Grosso

Naya-Plasencia

et al. 2013

Lecture Notes in Computer Science

114

View full text Add to dashboard Cite

show abstract

“…In [33], the vulnerability of PRINCE and RECTANGLE against DPA is studied. A second line of research focussed on the design of new ligthweight primitives that can be efficiently protected against DPA via masking; representative examples include PICARO [30], Zorro [15], and the LS-designs Robin and Fantomas [17].…”

Section: Introductionmentioning

confidence: 99%

Correlation Power Analysis of Lightweight Block Ciphers: From Theory to Practice

Biryukov

Dinu

Großschädl

2016

Applied Cryptography and Network Security

View full text Add to dashboard Cite

Abstract. Side-Channel Analysis (SCA) represents a serious threat to the security of millions of smart devices that form part of the so-called Internet of Things (IoT). Choosing the "right" cryptographic primitive for the IoT is a highly challenging task due to the resource constraints of IoT devices and the variety of primitives. An important criterion to assess the suitability of a lightweight cipher with respect to SCA is the amount of leakage available to an adversary. In this paper, we analyze the efficiency of different selection functions that are commonly used in Correlation Power Analysis (CPA) attacks on symmetric primitives. To this end, we attacked implementations of the lightweight block ciphers AES, Fantomas, LBlock, Piccolo, PRINCE, RC5, Simon, and Speck on an 8-bit AVR processor. By exploring the relation between the nonlinearity of the studied selection functions and the measured leakages, we discovered some imperfections when using nonlinearity to quantify the resilience against CPA. Then, we applied these findings in an evaluation of the "intrinsic" CPA-resistance of unprotected implementations of the eight mentioned ciphers. We show that certain implementation aspects can influence the leakage level and try to explain why. Our results shed new light on the resilience of basic operations executed by these ciphers against CPA and help to bridge the gap between theory and practice.

show abstract

“…Figure 3 summarizes our results in terms of number of cycles for Mysterion-128, together with natural competitors, i.e. Robin and Fantomas [18], Zorro [16], Noekeon [13], PICARO [27] and the AES [28]. Security order 0 means unprotected implementation i.e.…”

Section: Performancesmentioning

confidence: 98%

Improving the security and efficiency of block ciphers based on LS-designs

Journault

Standaert

Varıcı

2016

Des. Codes Cryptogr.

View full text Add to dashboard Cite

LS-designs are a family of bitslice ciphers aiming at efficient masked implementations against side-channel analysis. This paper discusses their security against invariant subspace attacks, and describes an alternative family of eXtended LS-designs (XLS-designs), that enables additional options to prevent such attacks. LS-and XLS-designs provide a large family of ciphers from which efficient implementations can be obtained, possibly enhanced with countermeasures against physical attacks. We argue that they are interesting primitives in order to discuss the general question of "how simple can block ciphers be?".

show abstract

PICARO – A Block Cipher Allowing Efficient Higher-Order Side-Channel Resistance

Cited by 72 publications

References 41 publications

Block Ciphers That Are Easier to Mask: How Far Can We Go?

Block Ciphers That Are Easier to Mask: How Far Can We Go?

Correlation Power Analysis of Lightweight Block Ciphers: From Theory to Practice

Improving the security and efficiency of block ciphers based on LS-designs

Contact Info

Product

Resources

About