Time sharing was a novel approach to small area and low latency first-order masking in hardware presented by Kumar S.V. et al. at IACR TCHES 2024. The principal underlying idea behind the approach was to separate the processing of shares in the time domain in order to achieve non-completeness. The authors used this approach to construct masked round-based implementations of the PRINCE and AES-128 block ciphers which were considerably smaller than state of the art. In this paper, we observe that the cost in terms of number of gates and amount of random bits required for the time sharing approach is considerably smaller, if the algebraic degree of the underlying S-box is small. Using the well known decomposition of the inverse power map, (i.e. \(f(x)=x^{254}\) over \(GF(2^8)\) as \(f(x)=x^{26}\circ x^{49}\) ) we present a more efficient approach to mask the AES S-box that requires much lower gate area and randomness to implement and only 2 additional clock cycles. Using this technique we present three implementations of AES-128: (a) Bit-Serial, b) Byte-Serial and (c) Round based circuit, all of which require much lower gate area and randomness to construct. We present synthesis results from three different Standard Cell libraries to validate our results.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Efficient Time Share Masking of AES

  • Subhadeep Banik,
  • Francesco Regazzoni

摘要

Time sharing was a novel approach to small area and low latency first-order masking in hardware presented by Kumar S.V. et al. at IACR TCHES 2024. The principal underlying idea behind the approach was to separate the processing of shares in the time domain in order to achieve non-completeness. The authors used this approach to construct masked round-based implementations of the PRINCE and AES-128 block ciphers which were considerably smaller than state of the art. In this paper, we observe that the cost in terms of number of gates and amount of random bits required for the time sharing approach is considerably smaller, if the algebraic degree of the underlying S-box is small. Using the well known decomposition of the inverse power map, (i.e. \(f(x)=x^{254}\) over \(GF(2^8)\) as \(f(x)=x^{26}\circ x^{49}\) ) we present a more efficient approach to mask the AES S-box that requires much lower gate area and randomness to implement and only 2 additional clock cycles. Using this technique we present three implementations of AES-128: (a) Bit-Serial, b) Byte-Serial and (c) Round based circuit, all of which require much lower gate area and randomness to construct. We present synthesis results from three different Standard Cell libraries to validate our results.