Paper 2026/2591

Sotto Maschera: Masking the Sota-Voce Fixed-Weight Vector Sampling

Abstract

Sparse fixed-weight vector sampling is a highly critical primitive in several post-quantum cryptography schemes. It has also been the target of multiple side-channel attacks, demonstrating the need for robust implementations. While such implementations do exist, they are not necessarily practical in terms of runtime, and some have already been shown to be insecure. At CHES 2026, Filho et al. presented a runtime-optimized, but not side-channel protected, sparse fixed-weight vector sampling algorithm named Sota Voce. It consists of the Sota support sampler and MWSupport support-to-vector conversion, where the latter is planned to be included in the next HQC implementation. This work explores how both parts of Sota Voce can be transformed into a power side-channel protected implementation using masking gadgets for embedded devices. At the same time, we aim to preserve its competitive performance advantage over other masked implementations. By bitslicing core components of the algorithm, including sorting, merging, and compaction, we achieve high parallelism of the computation, improving the overall runtime. Moreover, we avoid slow masking conversions by masking exclusively in the Boolean domain. Thereby, our masked implementation is orders of magnitude faster than the state-of-the-art, while showing no power side-channel leakage in TVLA evaluations. For instance, for HQC, we achieve a speedup of up to 45x in comparison to previous work.