This paper describes how to to embed data masking technique at a hardware level for an AES coprocessor. We concentrate on inversion in the field since it is the only non-linear operation that was assumed to require complex transformations on masked data and on masks. Our paper demonstares that it is possible to compute inverses directly on masked data, without ever revealing unmasked intermediate results in the process.
Our approach consists in transition to composite fields, where inversion can be efficiently implemented in combinational logic using only bitwise XOR and AND operations. A breakthrough idea is to replace these operations on masked data by simple combinational circuits operating on bits of masked data and on bits of a mask in such a manner that a proper "mask correction" is computed on-the fly. Combining these elementary building blocks, we obtain a complete hardware solution for a "masked AES", thus effectively resolving the problem of a secure AES co-processor.Category / Keywords: implementation / AES, side channel analysis, data masking, inversion Publication Info: Not published elsewhere. Date: received 11 Nov 2003 Contact author: e v trichina at samsung com Available format(s): PDF | BibTeX Citation Note: I paln to submit a revised and extended version with details of an actual hardware design into an IEEE Journal. Version: 20031112:135420 (All versions of this report) Short URL: ia.cr/2003/236 Discussion forum: Show discussion | Start new discussion