### Multiplicative Masking for AES in Hardware

Lauren De Meyer, Oscar Reparaz, and Begül Bilgin

##### Abstract

Hardware masked AES designs usually rely on Boolean masking and perform the computation of the S-box using the tower-field decomposition. On the other hand, splitting sensitive variables in a multiplicative way is more amenable for the computation of the AES S-box, as noted by Akkar and Giraud. However, multiplicative masking needs to be implemented carefully not to be vulnerable to first-order DPA with a zero-value power model. Up to now, sound higher-order multiplicative masking schemes have been implemented only in software. In this work, we demonstrate the first hardware implementation of AES using multiplicative masks. The method is tailored to be secure even if the underlying gates are not ideal and glitches occur in the circuit. We detail the design process of first- and second-order secure AES-128 cores, which result in the smallest die area to date among previous state-of-the-art masked AES implementations with comparable randomness cost and latency. The first- and second-order masked implementations improve resp. 29% and 18% over these designs. We deploy our construction on a Spartan-6 FPGA and perform a side-channel evaluation. No leakage is detected with up to 50 million traces for both our first- and second-order implementation. For the latter, this holds both for univariate and bivariate analysis.

Available format(s)
Category
Implementation
Publication info
A minor revision of an IACR publication in TCHES 2018
Keywords
Contact author(s)
lauren demeyer @ esat kuleuven be
History
Short URL
https://ia.cr/2018/865

CC BY

BibTeX

@misc{cryptoeprint:2018/865,
author = {Lauren De Meyer and Oscar Reparaz and Begül Bilgin},
title = {Multiplicative Masking for AES in Hardware},
howpublished = {Cryptology ePrint Archive, Paper 2018/865},
year = {2018},
note = {\url{https://eprint.iacr.org/2018/865}},
url = {https://eprint.iacr.org/2018/865}
}

Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.