The changing of the guards technique achieve uniformity masking by replacing fresh randomness with unrelated parts of the cipher state. In addressing the decomposition and masking of the AES S-box, Askeland et al. proposed the changing of the guards technique with reused randomness. However, this technique does not extend the guard bit deep into the internal structure of the S-box for masking. Building upon this approach, we further enhance the technique by incorporating the guard bit into the internal decomposition of the S-box, thereby reducing the need for reused randomness. Based on this optimization and in combination with the Cagdas Calik AES S-box, we propose a low-randomness, low-area first-order masked AES hardware implementation. This approach eliminates the need for online fresh randomness while achieving minimal shares and providing provable security in the glitch+register-transition-robust probing model. Additionally, we perform leakage detection experiments using PROLEAD and Test Vector Leakage Assessment (TVLA). The masked AES requires only 7671 GE (NanGate 45 nm open cell library) with 236 clock cycles on Application-Specific Integrated Circuit (ASIC). On Xilinx Spartan-6 Field Programmable Gate Arrays (FPGA), it requires only 212 slices with 125 Mbps, which achieves a throughput-per-slice of 0.319 Mbps/slice. To the best of our knowledge, this is the lowest randomness, area, and latency among existing masked AES without online fresh randomness.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

New First-Order Secure AES Implementation Without Online Fresh Randomness Records

  • Botao Liu,
  • Ming Tang

摘要

The changing of the guards technique achieve uniformity masking by replacing fresh randomness with unrelated parts of the cipher state. In addressing the decomposition and masking of the AES S-box, Askeland et al. proposed the changing of the guards technique with reused randomness. However, this technique does not extend the guard bit deep into the internal structure of the S-box for masking. Building upon this approach, we further enhance the technique by incorporating the guard bit into the internal decomposition of the S-box, thereby reducing the need for reused randomness. Based on this optimization and in combination with the Cagdas Calik AES S-box, we propose a low-randomness, low-area first-order masked AES hardware implementation. This approach eliminates the need for online fresh randomness while achieving minimal shares and providing provable security in the glitch+register-transition-robust probing model. Additionally, we perform leakage detection experiments using PROLEAD and Test Vector Leakage Assessment (TVLA). The masked AES requires only 7671 GE (NanGate 45 nm open cell library) with 236 clock cycles on Application-Specific Integrated Circuit (ASIC). On Xilinx Spartan-6 Field Programmable Gate Arrays (FPGA), it requires only 212 slices with 125 Mbps, which achieves a throughput-per-slice of 0.319 Mbps/slice. To the best of our knowledge, this is the lowest randomness, area, and latency among existing masked AES without online fresh randomness.