Variety of Scalable Shuffling Countermeasures against Side Channel Attacks

Abstract

IoT devices have very strong requirements on all the resources such as memory, randomness, energy and execution time. This paper proposes a number of scalable shuffling techniques as countermeasures against side channel analysis. Some extensions of an existing technique called Random Start Index (RSI) are suggested in this paper. Moreover, two new shuffling techniques Reverse Shuffle (RS) and Sweep Swap Shuffle (SSS) are described within their possible extensions. Extensions of RSI, RS and SSS might be implemented in a constrained environment with a small data and time overhead. Each of them might be implemented using different amount of randomness and thus, might be fine-tuned according to requirements and constraints of a cryptographic system such as time, memory, available number of random bits, etc. RSI, RS, SSS and their extensions are described using SubBytes operation of AES-128 block cipher as an example, but they might be used with different operations of AES as well as with other algorithms. This paper also analyses RSI, RS and SSS by comparing their properties such as number of total permutations that might be generated using a fixed number of random bits, data complexity, time overhead and evaluates their resistance against some known side-channel attacks such as correlation power analysis and template attack.

Systematization of Shuffling Countermeasures: With an Application to CRYSTALS-Dilithium

“…• Random Start Index (RSI): In this approach, the starting index of operations is randomized [17]. Each time the operations are executed, a different starting point is chosen, leading to varying execution orders and introducing additional variability.…”

“…• Reverse Shuffle (RS): This method allows the selection of either a forward or reverse execution order for the operations [17]. By enabling the reverse direction as an option, it introduces further randomness in the order of operations, making it more challenging to establish patterns.…”

“…• Sweep Swap Shuffle (SSS): This technique expands the operation sequence into a matrix form and performs the operations based on row or column order [17]. By reshaping the operation sequence and executing based on row or column order, it introduces randomness in the execution order.…”

Secure Wire Shuffling in the Probing Model

“…Namely the shuffling prevents a second-order DPA attack against the SBOX masking countermeasure; the authors can then quantify the efficiency of the main attack paths. The authors of [VMKS12] improve the software implementation of random permutation shuffling, with an efficient permutation generator; see also [VML16,Pap18] for a description of shuffling countermeasures with low randomness usage. The main attack against the shuffling countermeasure is the "integrated DPA" introduced in [CCD00]; it consists in summing the signal over a sliding window.…”

Low Randomness Masking and Shuffling: An Evaluation Using Mutual Information

“…Charvillon et al [VMKS12] have analyzed the security provided by shuffling, in addition to investigating several implementation techniques. Motivated by the increased cost of RNG, Veshchikov et al [VML16] investigated cheaper shuffling methods. We will refer to a permutation that shuffles n independent operations of a specific cipher layer as P {o1,...,on} n , where o i the ith operation in the layer.…”