Riding the Waves Towards Generic Single-Cycle Masking in Hardware
Research on the design of masked cryptographic hardware circuits in the past has mostly focused on reducing area and randomness requirements. However, many embedded devices like smart cards and IoT nodes also need to meet certain performance criteria, which is why the latency of masked hardware cir...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2022-08-01
|
| Series: | Transactions on Cryptographic Hardware and Embedded Systems |
| Subjects: | |
| Online Access: | https://tches.iacr.org/index.php/TCHES/article/view/9837 |
| _version_ | 1797326069031763968 |
|---|---|
| author | Rishub Nagpal Barbara Gigerl Robert Primas Stefan Mangard |
| author_facet | Rishub Nagpal Barbara Gigerl Robert Primas Stefan Mangard |
| author_sort | Rishub Nagpal |
| collection | DOAJ |
| description |
Research on the design of masked cryptographic hardware circuits in the past has mostly focused on reducing area and randomness requirements. However, many embedded devices like smart cards and IoT nodes also need to meet certain performance criteria, which is why the latency of masked hardware circuits also represents an important metric for many practical applications.
The root cause of latency in masked hardware circuits is the need for additional register stages that synchronize the propagation of shares. Otherwise, glitches would violate the basic assumptions of the used masking scheme. This issue can be addressed to some extent, e.g., by using lightweight cryptographic algorithms with low-degree Sboxes, however, many applications still require the usage of schemes with higher-degree S-boxes like AES. Several recent works have already proposed solutions that help reduce this latency yet they either come with noticeably increased area/randomness requirements, limitations on masking orders, or specific assumptions on the general architecture of the crypto core.
In this work, we introduce a generic and efficient method for designing single-cycle glitch-resistant (higher-order) masked hardware of cryptographic S-boxes. We refer to this technique as (generic) Self-Synchronized Masking (“SESYM”). The main idea of our approach is to replace register stages with a partial dual-rail encoding of masked signals that ensures synchronization within the circuit. More concretely, we show that WDDL gates and Muller C-elements can be used in combination with standard masking schemes to design single-cycle S-box circuits that, especially in case of higher-degree S-boxes, have noticeably lower requirements in terms of area and online randomness. We apply our method to DOM-based S-boxes of Ascon and AES and compare the resulting circuits to existing latency optimized circuits based on TI, GLM, and LMDPL. The latency of all three designs is reduced to single-cycle operation and are dth-order secure. Compared to GLM-masked Ascon, our approach comes with a 6.4 times reduction in online randomness for all protection orders. Compared to 1st-order LMDPL-masked AES, our approach achieves comparable results, while it is more generic, amongst others, by also supporting higher-order designs. We also underline the practical protection of our constructions against power analysis attacks via empirical and formal verification approaches.
|
| first_indexed | 2024-03-08T06:18:17Z |
| format | Article |
| id | doaj.art-4281b992ec8943319dc20e2026cf98c5 |
| institution | Directory Open Access Journal |
| issn | 2569-2925 |
| language | English |
| last_indexed | 2024-03-08T06:18:17Z |
| publishDate | 2022-08-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | Transactions on Cryptographic Hardware and Embedded Systems |
| spelling | doaj.art-4281b992ec8943319dc20e2026cf98c52024-02-04T16:20:42ZengRuhr-Universität BochumTransactions on Cryptographic Hardware and Embedded Systems2569-29252022-08-0120224Riding the Waves Towards Generic Single-Cycle Masking in HardwareRishub Nagpal0Barbara Gigerl1Robert Primas2Stefan Mangard3Lamarr Security Research GmbH, Graz, Austria; Institute for Applied Information Processing and Communication (IAIK), Graz University of Technology, Graz, AustriaInstitute for Applied Information Processing and Communication (IAIK), Graz University of Technology, Graz, AustriaInstitute for Applied Information Processing and Communication (IAIK), Graz University of Technology, Graz, AustriaLamarr Security Research GmbH, Graz, Austria; Institute for Applied Information Processing and Communication (IAIK), Graz University of Technology, Graz, Austria Research on the design of masked cryptographic hardware circuits in the past has mostly focused on reducing area and randomness requirements. However, many embedded devices like smart cards and IoT nodes also need to meet certain performance criteria, which is why the latency of masked hardware circuits also represents an important metric for many practical applications. The root cause of latency in masked hardware circuits is the need for additional register stages that synchronize the propagation of shares. Otherwise, glitches would violate the basic assumptions of the used masking scheme. This issue can be addressed to some extent, e.g., by using lightweight cryptographic algorithms with low-degree Sboxes, however, many applications still require the usage of schemes with higher-degree S-boxes like AES. Several recent works have already proposed solutions that help reduce this latency yet they either come with noticeably increased area/randomness requirements, limitations on masking orders, or specific assumptions on the general architecture of the crypto core. In this work, we introduce a generic and efficient method for designing single-cycle glitch-resistant (higher-order) masked hardware of cryptographic S-boxes. We refer to this technique as (generic) Self-Synchronized Masking (“SESYM”). The main idea of our approach is to replace register stages with a partial dual-rail encoding of masked signals that ensures synchronization within the circuit. More concretely, we show that WDDL gates and Muller C-elements can be used in combination with standard masking schemes to design single-cycle S-box circuits that, especially in case of higher-degree S-boxes, have noticeably lower requirements in terms of area and online randomness. We apply our method to DOM-based S-boxes of Ascon and AES and compare the resulting circuits to existing latency optimized circuits based on TI, GLM, and LMDPL. The latency of all three designs is reduced to single-cycle operation and are dth-order secure. Compared to GLM-masked Ascon, our approach comes with a 6.4 times reduction in online randomness for all protection orders. Compared to 1st-order LMDPL-masked AES, our approach achieves comparable results, while it is more generic, amongst others, by also supporting higher-order designs. We also underline the practical protection of our constructions against power analysis attacks via empirical and formal verification approaches. https://tches.iacr.org/index.php/TCHES/article/view/9837MaskingLow-LatencyDual-Rail LogicAESAscon |
| spellingShingle | Rishub Nagpal Barbara Gigerl Robert Primas Stefan Mangard Riding the Waves Towards Generic Single-Cycle Masking in Hardware Transactions on Cryptographic Hardware and Embedded Systems Masking Low-Latency Dual-Rail Logic AES Ascon |
| title | Riding the Waves Towards Generic Single-Cycle Masking in Hardware |
| title_full | Riding the Waves Towards Generic Single-Cycle Masking in Hardware |
| title_fullStr | Riding the Waves Towards Generic Single-Cycle Masking in Hardware |
| title_full_unstemmed | Riding the Waves Towards Generic Single-Cycle Masking in Hardware |
| title_short | Riding the Waves Towards Generic Single-Cycle Masking in Hardware |
| title_sort | riding the waves towards generic single cycle masking in hardware |
| topic | Masking Low-Latency Dual-Rail Logic AES Ascon |
| url | https://tches.iacr.org/index.php/TCHES/article/view/9837 |
| work_keys_str_mv | AT rishubnagpal ridingthewavestowardsgenericsinglecyclemaskinginhardware AT barbaragigerl ridingthewavestowardsgenericsinglecyclemaskinginhardware AT robertprimas ridingthewavestowardsgenericsinglecyclemaskinginhardware AT stefanmangard ridingthewavestowardsgenericsinglecyclemaskinginhardware |