Spin Me Right Round Rotational Symmetry for FPGA-Specific AES

Abstract

The effort in reducing the area of AES implementations has largely been focused on Application-Specific Integrated Circuits (ASICs) in which a tower field construction leads to a small design of the AES S-box. In contrast, a naïve implementation of the AES S-box has been the status-quo on Field-Programmable Gate Arrays (FPGAs). A similar discrepancy holds for masking schemes – a wellknown side-channel analysis countermeasure – which are commonly optimized to achieve minimal area in ASICs.In this paper we demonstrate a representation of the AES S-box exploiting rotational symmetry which leads to a 50% reduction of the area footprint on FPGA devices. We present new AES implementations which improve on the state of the art and explore various trade-offs between area and latency. For instance, at the cost of increasing 4.5 times the latency, one of our design variants requires 25% less look-up tables (LUTs) than the smallest known AES on Xilinx FPGAs by Sasdrich and Güneysu at ASAP 2016. We further explore the protection of such implementations against first-order side-channel analysis attacks. Targeting the small area footprint on FPGAs, we introduce a heuristic-based algorithm to find a masking of a given function with d + 1 shares. Its application to our new construction of the AES S-box allows us to introduce the smallest masked AES implementation on Xilinx FPGAs, to-date.

Second-Order SCA Security with almost no Fresh Randomness

“…The target FPGA receives masked input (plaintext) and issues output (ciphertext) also in the same sharing form. The fresh mask bits (if needed) are generated on the fly inside the target FPGA by means of 31-bit LFSRs optimized for Xilinx FPGAs [DMW18]. For each mask bit, we instantiated one LFSR seeded at random right after the power-up of the FPGA.…”

New First-Order Secure AES Performance Records

“…Indeed, none of them has been designed to efficiently utilize FPGA resources, e.g., slices, LUTs, and BRAMs. Instead, in [DMW18] (improved in [WMM20]) an FPGA-specific masked AES has been presented. Following the same concept as in [WM18], the authors decomposed the inversion in GF (2 8 ) into two cubic functions and reduced the area footprint on FPGA by exploiting the rotational symmetry [RBF08].…”

“…Alternatively, Pseudo-Random Number Generators (PRNGs) can be used, which are seeded by a TRNG at power-up. Therefore, we followed the concept applied in [DMW18] to efficiently construct a PRNG using the FPGA building blocks. More precisely, for each required fresh mask bit (updated every clock cycle), we implemented a Linear Feedback Shift Register (LFSR) with feedback polynomial x 31 + x 28 + 1.…”

“…More precisely, for each required fresh mask bit (updated every clock cycle), we implemented a Linear Feedback Shift Register (LFSR) with feedback polynomial x 31 + x 28 + 1. Based on the instruction given in [DMW18], each LFSR can be implemented by only 3 LUTs in Xilinx FPGAs: two LUTs as Shift-Register LUT and another one for the feedback function. In Table 2 we report the same comparative performance figures including the PRNG.…”

Low-Latency Keccak at any Arbitrary Order

“…Therefore, we instantiated Pseudo-Random Number Generators (PRNGs) to supply such fresh randomness. To this end, we made use of the FPGA-optimized construction illustrated in [MMW18], which realizes a 31-bit Linear Feedback Shift Register (LFSR) with the feedback polynomial x 31 + x 28 + 1 by means of only three 6-to-1 Look-Up Tables (LUTs). More precisely, for each required fresh mask bit, we instantiated an LFSR seeded randomly at the power up of the device and updated at every clock cycle.…”