Cryptology ePrint Archive: Report 2015/066

Arithmetic Addition over Boolean Masking - Towards First- and Second-Order Resistance in Hardware

Tobias Schneider and Amir Moradi and Tim GŁneysu

Abstract: A common countermeasure to thwart side-channel analysis attacks is algorithmic masking. For this, algorithms that mix Boolean and arithmetic operations need to either apply two different masking schemes with secure conversions or use dedicated arithmetic units that can process Boolean masked values. Several proposals have been published that can realize these approaches securely and efficiently in software. But to the best of our knowledge, no hardware design exists that fulfills relevant properties such as efficiency and security at the same time. In this paper, we present two design strategies to realize a secure and efficient arithmetic adder for Boolean-masked values. First, we introduce an architecture based on the ripple-carry adder that targets low-cost applications. The second architecture is based on a pipelined Kogge-Stone adder and targets high-performance applications. In particular, all our implementations adopt the threshold implementation approach to improve their resistance against SCA attacks even in the presence of glitches. We evaluated the security of our designs practically against SCA using a non-specific statistical t-test. Based on our analysis, we show that our constructions not only achieve resistance against first- and (univariate) second-order attacks but also require fewer random bits per operation compared to any existing software-based approach.

Category / Keywords: implementation / side-channel analysis, threshold implementation, Boolean masking, arithmetic modular addition

Original Publication (in the same form): ACNS 2015

Date: received 29 Jan 2015, last revised 8 Apr 2015

Contact author: amir moradi at rub de

Available format(s): PDF | BibTeX Citation

Version: 20150408:072131 (All versions of this report)

Short URL: ia.cr/2015/066

Discussion forum: Show discussion | Start new discussion


[ Cryptology ePrint archive ]