SILVER – Statistical Independence and Leakage Verification

Knichel, David; Sasdrich, Pascal; Moradi, Amir

doi:10.1007/978-3-030-64837-4_26

Cited by 48 publications

(58 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As an outcome of our research, we provide three-share second-order glitch-extended probing-secure implementations of Keccak with no fresh randomness and the S-box of SKINNY, Midori, PRESENT, and PRINCE ciphers using only 8-bit fresh masks per clock cycle. We would like to highlight that we confirm the second-order security of our constructions by SILVER [KSM20] under glitch-extended probing model and by FPGA-based practical experiments. Our programs as well as the hardware implementations (HDL codes) are fully provided in the GitHub.…”

Section: Our Contributionssupporting

confidence: 74%

“…Hence, 8-bit r 2 used for the second composition of the first S-box is re-used by the first stage of the second S-box. After synthesizing the circuit, which receives 24 fresh mask bits and an 8-bit input and provides an 8-bit output (both shared with three shares), we gave the corresponding netlist to SILVER [KSM20], which confirmed its second-order security under glitch-extended probing model and uniformity of its output sharing. Note that this optimization is possible since each function F , G and H is individually second-order glitch-extended probing secure with uniform output sharing, and the fresh masks are only used to avoid multivariate leakages with respect to probes places on different functions.…”

Section: Fresh Mask-reuse In Prince S-boxmentioning

confidence: 78%

“…As the first analysis step, we employed SILVER [KSM20] to examine our S-box constructions under glitch-extended probing model, dedicated to masked hardware designs. SILVER is a formal verification tool, developed to check the design based on the proofs to avoid writing the proofs for every design.…”

Section: Discussionmentioning

confidence: 99%

See 2 more Smart Citations

Second-Order SCA Security with almost no Fresh Randomness

Shahmirzadi

Moradi

2021

TCHES

Self Cite

View full text Add to dashboard Cite

Masking schemes are among the most popular countermeasures against Side-Channel Analysis (SCA) attacks. Realization of masked implementations on hardware faces several difficulties including dealing with glitches. Threshold Implementation (TI) is known as the first strategy with provable security in presence of glitches. In addition to the desired security order d, TI defines the minimum number of shares to also depend on the algebraic degree of the target function. This may lead to unaffordable implementation costs for higher orders.For example, at least five shares are required to protect the smallest nonlinear function against second-order attacks. By cuttingsuch a dependency, the successor schemes are able to achieve the same security level by just d + 1 shares, at the cost of high demand for fresh randomness, particularly at higher orders. In this work, we provide a methodology to realize the second-order glitch-extended probing-secure implementation of a group of quadratic functions with three shares and no fresh randomness. This allows us to construct second-order secure implementations of several cryptographic primitives with very limited number of fresh masks, including Keccak, SKINNY, Midori, PRESENT, and PRINCE.

show abstract

Section: Our Contributionssupporting

confidence: 74%

Section: Fresh Mask-reuse In Prince S-boxmentioning

confidence: 78%

See 1 more Smart Citation

Second-Order SCA Security with almost no Fresh Randomness

Shahmirzadi

Moradi

2021

TCHES

Self Cite

View full text Add to dashboard Cite

show abstract

“…Compared to state of the art, it is the only design with such a low latency at higher orders while keeping the number of shares at minimum, leading to smaller area overhead. The security of our new approach and the generic design is verified in two ways: first, using the recently-introduced verification tool SILVER [KSM20] under the glitch-extended probing model, and second, by FPGA-based experimental evaluations, namely the Welch's t-test.…”

Section: Our Contributionsmentioning

confidence: 99%

“…Since our main focus in this paper is hardware implementation of masking schemes, we consider such a glitch-extended probing model in our designs and evaluations. To this end, we further use the recently-introduced open-source verification tool SILVER [KSM20] under robust probing model to assess the security of our constructions.…”

Section: Probing Securitymentioning

confidence: 99%

Low-Latency Keccak at any Arbitrary Order

Zarei¹,

Shahmirzadi²,

Soleimany³

et al. 2021

TCHES

Self Cite

View full text Add to dashboard Cite

Correct application of masking on hardware implementation of cryptographic primitives necessitates the instantiation of registers in order to achieve the non-completeness (commonly said to stop the propagation of glitches). This sometimes leads to a high latency overhead, making the implementation not necessarily suitable for the underlying application. As a concrete example, this holds for Keccak. Application of d + 1 Domain Oriented Masking (DOM) on a round-based implementation of Keccak leads to the introduction of two register stages per round, i.e., two times higher latency. On the other hand, Rhythmic-Keccak, introduced in CHES 2018, unrolls two rounds to half the latency compared to an unprotected ordinary round-based implementation. To that end, td + 1 masking is used which requires a notable area, and – apart from the difficulty to construct – its extension to higher orders seems beyond the bounds of feasibility.In this paper, we focus on d + 1 masking and introduce a methodology which enables us to stay with the latency of an unprotected round-based implementation, i.e., one register stage per round. While being secure under glitch-extended probing model, we provide a general design where the desired security order can be easily adjusted without any effect on the above-given latency. Compared to the Rhythmic-Keccak, the synthesis results show that our first-order design is able to accomplish the entire operations of Keccak-f[200] in the same period of time while decreasing the area by 74.5%. Notably, our implementations achieve around 30% less delay compared to the corresponding original DOM-Keccak designs.

show abstract

Fast Verification of Masking Schemes in Characteristic Two

Bordes

Karpman

2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

SILVER – Statistical Independence and Leakage Verification

Cited by 48 publications

References 43 publications

Second-Order SCA Security with almost no Fresh Randomness

Second-Order SCA Security with almost no Fresh Randomness

Low-Latency Keccak at any Arbitrary Order

Fast Verification of Masking Schemes in Characteristic Two

Contact Info

Product

Resources

About