Cryptology ePrint Archive: Report 2017/1023

Several Masked Implementations of the Boyar-Peralta AES S-Box

Ashrujit Ghoshal and Thomas De Cnudde

Abstract: Threshold implementation is a masking technique that provides provable security for implementations of cryptographic algorithms against power analysis attacks. In recent publications, several different threshold implementations of AES have been designed. However in most of the threshold implementations of AES, the Canright S-Box has been used. The Boyar-Peralta S-Box is an alternative implementation of the AES S-Box with a minimal circuit depth and is comparable in size to the frequently used Canright AES S-Box. In this paper, we present several versions of first-order threshold implementations of the Boyar-Peralta AES S-Box with different number of shares and several trade-offs in area, randomness and speed. To the best of our knowledge these are the first threshold implementations of the Boyar-Peralta S-Box. Our implementations compare favourably with some of the existing threshold implementations of Canright S-Box along the design trade-offs, e.g. while one of our S-Boxes is 49\% larger in area than the smallest known threshold implementation of the Canright AES S-Box, it uses 63\% less randomness and requires only 50\% of the clock cycles. We provide results of a practical security evaluation based on real power traces to confirm the first-order attack resistance of our implementations.

Category / Keywords: AES, Boyar-Peralta S-box, Countermeasure, DPA, Masking, SCA, Threshold Implementations.

Original Publication (in the same form): Indocrypt 2017: 18th International Conference on Cryptology in India.

Date: received 15 Oct 2017, last revised 25 Oct 2017

Contact author: ashrujit ck at gmail com

Available format(s): PDF | BibTeX Citation

Version: 20171025:081135 (All versions of this report)

Short URL: ia.cr/2017/1023

Discussion forum: Show discussion | Start new discussion


[ Cryptology ePrint archive ]