Toward More Efficient DPA-Resistant AES Hardware Architecture Based on Threshold Implementation

Ueno, Rei; Homma, Naofumi; Aoki, Takafumi

doi:10.1007/978-3-319-64647-3_4

Cited by 22 publications

(22 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Results It is difficult to compare these results to state-of-the-art masked AES implementations [5,21,31,61] since they target an ASIC platform. We can let Xilinx map these designs to Spartan-6 resources, but unlike our design, they have not been optimized specifically for this purpose.…”

Section: Methodsmentioning

confidence: 99%

“…This S-box implementation is the smallest to date. These S-box designs have all been successfully used to create the stateof-the-art smallest masked AES implementations [5,21,31,61]. However, when it comes to look-up table (LUT)-based FPGA implementations, these optimized constructions do not perform better than the 8 slices that are required for any 8-bit to 8-bit mapping such as the AES S-box.…”

Section: Aes S-boxmentioning

confidence: 99%

See 1 more Smart Citation

Spin Me Right Round Rotational Symmetry for FPGA-Specific AES: Extended Version

2020

View full text Add to dashboard Cite

The effort in reducing the area of AES implementations has largely been focused on application-specific integrated circuits (ASICs) in which a tower field construction leads to a small design of the AES S-box. In contrast, a naive implementation of the AES S-box has been the status-quo on field-programmable gate arrays (FPGAs). A similar discrepancy holds for masking schemes-a well-known side-channel analysis countermeasure-which are commonly optimized to achieve minimal area in ASICs. In this paper, we demonstrate a representation of the AES S-box exploiting rotational symmetry which leads to a 50% reduction in the area footprint on FPGA devices. We present new AES implementations which improve on the state-of-the-art and explore various trade-offs between area and latency. For instance, at the cost of increasing 4.5 times the latency, one of our design variants requires 25% less look-up tables (LUTs) than the smallest known AES on Xilinx FPGAs by Sasdrich and Güneysu at ASAP 2016. We further explore the protection of such implementations against side-channel attacks. We introduce a generic methodology for masking any n-bit Boolean functions of degree t with protection order d. The methodology is exact for first-order and heuristic for higher orders. Its application to our new construction of the AES S-box allows us to improve previous results and introduce the smallest first-order masked AES implementation on Xilinx FPGAs, to date.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Aes S-boxmentioning

confidence: 99%

Spin Me Right Round Rotational Symmetry for FPGA-Specific AES: Extended Version

2020

View full text Add to dashboard Cite

show abstract

“…Our approach is thus radically different. We cannot compare easily with [UHA17] because of different synthesis libraries, though they seem to have a similar area footprint for larger randomness requirement (64 bits per S-box). Also, they only provide a first-order implementation.…”

Section: Implementation Costmentioning

confidence: 99%

“…The similarities and differences between TI and the Private Circuits scheme [ISW03], which provides provable security if the circuit behaves ideally (no glitches), were analysed by Reparaz et [GMK16], which is also related to the original Private Circuits scheme [ISW03] with additional registers againts glitches and a different randomness consumption. These masking schemes have all been applied to Canright's tower-field AES S-box [Can05] due to its small foot-print and structure, resulting in a multitude of masked AES implementations [MPL + 11, BGN + 14b, CRB + 16, GMK17,UHA17]. Those of Ueno et al [UHA17], De Cnudde et al [CRB + 16] and Gross et al [GMK17] are the smallest to date, with the latter requiring much less randomness.…”

Section: Introductionmentioning

confidence: 99%

“…These masking schemes have all been applied to Canright's tower-field AES S-box [Can05] due to its small foot-print and structure, resulting in a multitude of masked AES implementations [MPL + 11, BGN + 14b, CRB + 16, GMK17,UHA17]. Those of Ueno et al [UHA17], De Cnudde et al [CRB + 16] and Gross et al [GMK17] are the smallest to date, with the latter requiring much less randomness.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Multiplicative Masking for AES in Hardware

Meyer

Reparaz

Bilgin

2018

TCHES

View full text Add to dashboard Cite

Hardware masked AES designs usually rely on Boolean masking and perform the computation of the S-box using the tower-field decomposition. On the other hand, splitting sensitive variables in a multiplicative way is more amenable for the computation of the AES S-box, as noted by Akkar and Giraud. However, multiplicative masking needs to be implemented carefully not to be vulnerable to first-order DPA with a zero-value power model. Up to now, sound higher-order multiplicative masking schemes have been implemented only in software. In this work, we demonstrate the first hardware implementation of AES using multiplicative masks. The method is tailored to be secure even if the underlying gates are not ideal and glitches occur in the circuit. We detail the design process of first- and second-order secure AES-128 cores, which result in the smallest die area to date among previous state-of-the-art masked AES implementations with comparable randomness cost and latency. The first- and second-order masked implementations improve resp. 29% and 18% over these designs. We deploy our construction on a Spartan-6 FPGA and perform a side-channel evaluation. No leakage is detected with up to 50 million traces for both our first- and second-order implementation. For the latter, this holds both for univariate and bivariate analysis.

show abstract

Yet Another Size Record for AES: A First-Order SCA Secure AES S-Box Based on $$\mathrm {GF}(2^8)$$ GF ( 2 8 ) Multiplication

Wegener

Moradi

2019

Smart Card Research and Advanced Applications

View full text Add to dashboard Cite

Toward More Efficient DPA-Resistant AES Hardware Architecture Based on Threshold Implementation

Cited by 22 publications

References 22 publications

Spin Me Right Round Rotational Symmetry for FPGA-Specific AES: Extended Version

Spin Me Right Round Rotational Symmetry for FPGA-Specific AES: Extended Version

Multiplicative Masking for AES in Hardware

Yet Another Size Record for AES: A First-Order SCA Secure AES S-Box Based on $$\mathrm {GF}(2^8)$$ GF ( 2 8 ) Multiplication

Contact Info

Product

Resources

About