Paper 2026/026

A General Randomness Recycling Framework for First-Order Masking with Application to AES

Abstract

Masking is a principal countermeasure against side-channel attacks, yet its practical deployment is often constrained by the high cost of randomness. Existing approaches for reducing randomness overhead generally follow two directions. The first focuses on designing low-randomness gadgets, which often introduces considerable area and latency overheads for complex boolean functions. The second relies on architecture-level randomness reuse, but securely managing the resulting algebraic dependencies typically still requires additional fresh randomness or extra initial randomness. In this work, we introduce a dependency-tracking abstraction, termed unique randomness guard (URG), for reasoning about randomness reuse in masked hardware circuits. We develop a randomness recycling methodology that eliminates historical randomness dependencies before safely reusing the historical randomness to subsequent computations. This enables secure randomness reuse without requiring additional fresh randomness. To demonstrate the practicality of the proposed methodology, we apply it to first-order masked AES hardware implementations in both parallel and serial architectures. The security of these architectures is proven under the robust probing model and practically validated via TVLA on an FPGA platform. Furthermore, hardware synthesis results demonstrate that our implementations achieve highly competitive area and latency performance compared to state-of-the-art low-randomness designs, while using randomness solely for input encoding.