Cryptology ePrint Archive: Report 2017/1223

Generic Low-Latency Masking

Hannes Gross and Rinat Iusupov and Roderick Bloem

Abstract: In this work, we introduce a generalized concept for low-latency masking that is applicable to any implementation and protection order, and (in its extremest form) does not require on-the-fly randomness. The main idea of our approach is to avoid collisions of shared variables in nonlinear circuit parts, and to skip the share compression step. We show the feasibility of our approach on a full implementation of a one round unrolled Ascon variant and an AES S-box case study. We then discuss possible trade-offs to make our approach interesting for practical implementations. As a result we obtain a first-order masked AES S-box that is calculated in a single clock cycle with rather high implementation costs (17.8 kGE), and a two cycle variant requiring only 6.7 kGE. The side-channel resistance of our Ascon S-box designs up to order three are then verified using the formal analysis tool of [6]. Furthermore, we introduce a taint checking based verification approach that works specifically for our low-latency approach and allows faster verification which enables us to verify larger circuits like our low-latency AES S-box design.

Category / Keywords: implementation / masking, low latency, AES, hardware security, threshold implementations, domain-oriented masking

Date: received 19 Dec 2017, last revised 15 Jan 2018

Contact author: hannes gross at iaik tugraz at

Available format(s): PDF | BibTeX Citation

Version: 20180115:132051 (All versions of this report)

Short URL: ia.cr/2017/1223

Discussion forum: Show discussion | Start new discussion


[ Cryptology ePrint archive ]