smart card research and advanced application conference - yet … · 2018. 12. 10. · example...
TRANSCRIPT
![Page 1: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/1.jpg)
Yet Another Size Record for AES: A First-Order SCA Secure AES S-box Based on 𝑮𝑭(𝟐𝟖)
Multiplication
Cardis 2018, Montpellier
Felix Wegener, Amir Moradi
Ruhr University Bochum, Horst Görtz Institute for IT-Security, Germany
Grant. Nr.
16KIS0666
SYSKIT_HW
![Page 2: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/2.jpg)
2
Embedded Security Group
Problem: How to find a small AES S-box implementation
(with side-channel protection)?
Cardis 2018, Montpellier Felix Wegener
![Page 3: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/3.jpg)
3
Embedded Security Group
Cardis 2018, Montpellier Felix Wegener
AES S-box Implementations
▪ Naive implementation:
AES S-boxdeg = 78 8
![Page 4: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/4.jpg)
4
Embedded Security Group
Cardis 2018, Montpellier Felix Wegener
AES S-box Implementations
▪ Canright:
▪ Boyar, Matthews, Peralta:
Canright. A Very Compact S-box for AES. CHES 2005
195 Gates
115 Gates
Linear Non-linear Linear8 22 18 8
Boyar et al., Logic Minimization Techniques with Applications to Cryptology, J. Cryptology 2013
![Page 5: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/5.jpg)
5
Embedded Security Group
Cardis 2018, Montpellier Felix Wegener
Issue I: Registers for Bypass Wires
▪ Canright:
▪ Boyar, Matthews, Peralta:
Canright. A Very Compact S-box for AES. CHES 2005
195 Gates
115 Gates
Linear Non-linear Linear8 22 18 8
Boyar et al., Logic Minimization Techniques with Applications to Cryptology, J. Cryptology 2013
![Page 6: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/6.jpg)
6
Embedded Security Group
Cardis 2018, Montpellier Felix Wegener
Issue II: No Serialization Possible
▪ Canright:
▪ Boyar, Matthews, Peralta:
Canright. A Very Compact S-box for AES. CHES 2005
195 Gates
115 Gates
Linear Non-linear Linear8 22 18 8
Boyar et al., Logic Minimization Techniques with Applications to Cryptology, J. Cryptology 2013
![Page 7: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/7.jpg)
7
Embedded Security Group
Cardis 2018, Montpellier Felix Wegener
A Different Structure
▪ In previous work:
cubic cubic8 8 8
Wegener, Moradi. A first-order SCA resistant AES without fresh randomness. COSADE 2018
![Page 8: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/8.jpg)
8
Embedded Security Group
Cardis 2018, Montpellier Felix Wegener
A Different Structure: Multiplication-based
▪ In previous work:
▪ This work:
cubic cubic8 8 8
Wegener, Moradi. A first-order SCA resistant AES without fresh randomness. COSADE 2018
Mult Mult
linea
r
linea
r
Mult Multlin
ear
linea
r
![Page 9: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/9.jpg)
9
Embedded Security Group
Decomposition into Multiplications
Cardis 2018, Montpellier Felix Wegener
![Page 10: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/10.jpg)
10
Embedded Security Group
Structure of AES S-box
▪ AES-Sbox (x): 𝐴𝑓𝑓( 𝑥−1)
▪ Inversion in 𝐺𝐹 28 : 𝑥−1 = 𝑥254
Cardis 2018, Montpellier Felix Wegener
![Page 11: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/11.jpg)
11
Embedded Security Group
Structure of AES S-box
▪ AES-Sbox (x): 𝐴𝑓𝑓( 𝑥−1)
▪ Inversion in 𝐺𝐹 28 : 𝑥−1 = 𝑥254
▪ How many multiplications are necessary?
→ Find shortest multiplication chain
Cardis 2018, Montpellier Felix Wegener
![Page 12: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/12.jpg)
12
Embedded Security Group
Multiplication Chain
▪ Start: 𝑖𝑑 = 𝑥1
▪ Step:
– Square a previous element → cost = 0
– Multiply two previous elements → cost = 1
Cardis 2018, Montpellier Felix Wegener
![Page 13: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/13.jpg)
13
Embedded Security Group
Multiplication Chain
▪ Start: 𝑖𝑑 = 𝑥1
▪ Step:
– Square a previous element → cost = 0
– Multiply two previous elements → cost = 1
▪ Example chain for 𝑥13 :
Chain: 𝑥1,
Cost: 0,
Cardis 2018, Montpellier Felix Wegener
![Page 14: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/14.jpg)
14
Embedded Security Group
Multiplication Chain
▪ Start: 𝑖𝑑 = 𝑥1
▪ Step:
– Square a previous element → cost = 0
– Multiply two previous elements → cost = 1
▪ Example chain for 𝑥13 :
Chain: 𝑥1, 𝑥2,
Cost: 0, 0,
Cardis 2018, Montpellier Felix Wegener
![Page 15: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/15.jpg)
15
Embedded Security Group
Multiplication Chain
▪ Start: 𝑖𝑑 = 𝑥1
▪ Step:
– Square a previous element → cost = 0
– Multiply two previous elements → cost = 1
▪ Example chain for 𝑥13 :
Chain: 𝑥1, 𝑥2, 𝑥4,
Cost: 0, 0, 0,
Cardis 2018, Montpellier Felix Wegener
![Page 16: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/16.jpg)
16
Embedded Security Group
Multiplication Chain
▪ Start: 𝑖𝑑 = 𝑥1
▪ Step:
– Square a previous element → cost = 0
– Multiply two previous elements → cost = 1
▪ Example chain for 𝑥13 :
Chain: 𝑥1, 𝑥2, 𝑥4, 𝑥8,
Cost: 0, 0, 0, 0,
Cardis 2018, Montpellier Felix Wegener
![Page 17: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/17.jpg)
17
Embedded Security Group
Multiplication Chain
▪ Start: 𝑖𝑑 = 𝑥1
▪ Step:
– Square a previous element → cost = 0
– Multiply two previous elements → cost = 1
▪ Example chain for 𝑥13 :
Chain: 𝑥1, 𝑥2, 𝑥4, 𝑥8, 𝑥12 ,
Cost: 0, 0, 0, 0, 1,
Cardis 2018, Montpellier Felix Wegener
![Page 18: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/18.jpg)
18
Embedded Security Group
Multiplication Chain
▪ Start: 𝑖𝑑 = 𝑥1
▪ Step:
– Square a previous element → cost = 0
– Multiply two previous elements → cost = 1
▪ Example chain for 𝑥13 :
Chain: 𝑥1, 𝑥2, 𝑥4, 𝑥8, 𝑥12 , 𝑥13
Cost: 0, 0, 0, 0, 1, 2
Cardis 2018, Montpellier Felix Wegener
![Page 19: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/19.jpg)
19
Embedded Security Group
Multiplication Chain
▪ Start: 𝑖𝑑 = 𝑥1
▪ Step:
– Square a previous element → cost = 0
– Multiply two previous elements → cost = 1
▪ Example chain for 𝑥13 :
Chain: 𝑥1, 𝑥2, 𝑥4, 𝑥8, 𝑥12 , 𝑥13
Cost: 0, 0, 0, 0, 1, 2
▪ Lowest cost of chain for 𝑥254: 4
Cardis 2018, Montpellier Felix Wegener
![Page 20: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/20.jpg)
20
Embedded Security Group
Multiplication Chain
▪ Start: 𝑥1
▪ Step:
– Square a previous element → cost = 0
– Multiply two previous elements → cost = 1
▪ Example chain for 𝑥13 :
– Chain: 𝑥1, 𝑥2, 𝑥4, 𝑥8, 𝑥12, 𝑥13
– Cost: 0, 0, 0, 0, 1, 2
▪ Lowest cost for 𝑥254 : 4
Cardis 2018, Montpellier Felix Wegener
What is the “best“ way to implement 𝑥254 with 4 multiplications?
![Page 21: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/21.jpg)
21
Embedded Security Group
Area Reduction Techniques
Cardis 2018, Montpellier Felix Wegener
Mult Mult
linea
r
linea
r
Mult Mult
linea
r
linea
r
![Page 22: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/22.jpg)
22
Embedded Security Group
▪ Limit bypass wires
Area Reduction Techniques
Cardis 2018, Montpellier Felix Wegener
Mult Mult
linea
r
linea
r
Mult Mult
linea
r
linea
r
![Page 23: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/23.jpg)
23
Embedded Security Group
▪ Limit bypass wires
▪ Minimize linear components
Area Reduction Techniques
Cardis 2018, Montpellier Felix Wegener
Mult Mult
linea
r
linea
r
Mult Mult
linea
r
linea
r
![Page 24: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/24.jpg)
24
Embedded Security Group
▪ Limit bypass wires
▪ Minimize linear components
▪ Serialize: One Multiplier instance
Area Reduction Techniques
Cardis 2018, Montpellier Felix Wegener
Mult Mult
linea
r
linea
r
Mult Mult
linea
r
linea
r
![Page 25: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/25.jpg)
25
Embedded Security Group
▪ One multiplier instance
Our Design: High-Level Structure
Cardis 2018, Montpellier Felix Wegener
𝐴𝑓𝑓 ∘ 𝑜𝑝5
𝐺𝐹 28
Mult
𝑋
𝑌
𝑜𝑝1 𝑜𝑝2 𝑜𝑝3 𝑜𝑝4
![Page 26: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/26.jpg)
26
Embedded Security Group
▪ One multiplier instance
▪ One bypass wire
Our Design: High-Level Structure
Cardis 2018, Montpellier Felix Wegener
𝐴𝑓𝑓 ∘ 𝑜𝑝5
𝐺𝐹 28
Mult
𝑋
𝑌
𝑜𝑝1 𝑜𝑝2 𝑜𝑝3 𝑜𝑝4
![Page 27: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/27.jpg)
27
Embedded Security Group
▪ One multiplier instance
▪ One bypass wire
▪ 𝑌 = 𝑆𝑏𝑜𝑥(𝑋) (after 4 iterations)
Our Design: High-Level Structure
Cardis 2018, Montpellier Felix Wegener
𝐴𝑓𝑓 ∘ 𝑜𝑝5
𝐺𝐹 28
Mult
𝑋
𝑌
𝑜𝑝1 𝑜𝑝2 𝑜𝑝3 𝑜𝑝4
![Page 28: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/28.jpg)
28
Embedded Security Group
▪ One multiplier instance
▪ One bypass wire
▪ 𝑌 = 𝑆𝑏𝑜𝑥(𝑋) (after 4 iterations)
▪ Linear power functions of form
𝑜𝑝𝑖 = 𝑥2𝑘
Our Design: High-Level Structure
Cardis 2018, Montpellier Felix Wegener
𝐴𝑓𝑓 ∘ 𝑜𝑝5
𝐺𝐹 28
Mult
𝑋
𝑌
𝑜𝑝1 𝑜𝑝2 𝑜𝑝3 𝑜𝑝4
![Page 29: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/29.jpg)
29
Embedded Security Group
▪ One multiplier instance
▪ One bypass wire
▪ 𝑌 = 𝑆𝑏𝑜𝑥(𝑋) (after 4 iterations)
▪ Linear power functions of form
𝑜𝑝𝑖 = 𝑥2𝑘
Goal: Minimize total area
Our Design: High-Level Structure
Cardis 2018, Montpellier Felix Wegener
𝐴𝑓𝑓 ∘ 𝑜𝑝5
𝐺𝐹 28
Mult
𝑋
𝑌
𝑜𝑝1 𝑜𝑝2 𝑜𝑝3 𝑜𝑝4
![Page 30: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/30.jpg)
30
Embedded Security Group
Area Minimization
Two Steps:
▪ Determine area of eachlinear component
▪ Choose op1, …, op5 tominimize the total area
Cardis 2018, Montpellier Felix Wegener
Function Area (GE)
UMC 180 nm
![Page 31: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/31.jpg)
31
Embedded Security Group
Area Minimal Choice
Cardis 2018, Montpellier Felix Wegener
𝐺𝐹 28
Mult
𝑋
𝑖𝑑 𝑥8 𝑥4 𝑖𝑑
𝐴𝑓𝑓 ∘ 𝑥2
𝑌
![Page 32: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/32.jpg)
32
Embedded Security Group
▪ Iteration 1:𝑥12 = 𝑀𝑢𝑙𝑡(𝑥8, 𝑥4)
Area Minimal Choice
Cardis 2018, Montpellier Felix Wegener
𝐺𝐹 28
Mult
𝑋
𝑖𝑑 𝑥8 𝑥4 𝑖𝑑
𝐴𝑓𝑓 ∘ 𝑥2
𝑌
![Page 33: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/33.jpg)
33
Embedded Security Group
▪ Iteration 1:𝑥12 = 𝑀𝑢𝑙𝑡(𝑥8, 𝑥4)
▪ Iteration 2:
𝑥13 = 𝑀𝑢𝑙𝑡 𝑥1, 𝑥12 =: 𝑧
Area Minimal Choice
Cardis 2018, Montpellier Felix Wegener
𝐺𝐹 28
Mult
𝑋
𝑖𝑑 𝑥8 𝑥4 𝑖𝑑
𝐴𝑓𝑓 ∘ 𝑥2
𝑌
![Page 34: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/34.jpg)
34
Embedded Security Group
Area Minimal Choice
Cardis 2018, Montpellier Felix Wegener
𝐺𝐹 28
Mult
𝑋
𝑖𝑑 𝑥8 𝑥4 𝑖𝑑
𝐴𝑓𝑓 ∘ 𝑥2
𝑌
▪ Iteration 1:𝑥12 = 𝑀𝑢𝑙𝑡(𝑥8, 𝑥4)
▪ Iteration 2:
𝑥13 = 𝑀𝑢𝑙𝑡 𝑥1, 𝑥12 =: 𝑧
▪ Iteration 3:
𝑧12 = 𝑀𝑢𝑙𝑡(𝑧8, 𝑧4)
![Page 35: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/35.jpg)
35
Embedded Security Group
Area Minimal Choice
Cardis 2018, Montpellier Felix Wegener
𝐺𝐹 28
Mult
𝑋
𝑖𝑑 𝑥8 𝑥4 𝑖𝑑
𝐴𝑓𝑓 ∘ 𝑥2
𝑌
▪ Iteration 1:𝑥12 = 𝑀𝑢𝑙𝑡(𝑥8, 𝑥4)
▪ Iteration 2:
𝑥13 = 𝑀𝑢𝑙𝑡 𝑥1, 𝑥12 =: 𝑧
▪ Iteration 3:
𝑧12 = 𝑀𝑢𝑙𝑡(𝑧8, 𝑧4)
▪ Iteration 4:
𝑧49 = 𝑀𝑢𝑙𝑡(𝑧1, 𝑧48)
![Page 36: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/36.jpg)
36
Embedded Security Group
Area Minimal Choice
Cardis 2018, Montpellier Felix Wegener
𝐺𝐹 28
Mult
𝑋
𝑖𝑑 𝑥8 𝑥4 𝑖𝑑
𝐴𝑓𝑓 ∘ 𝑥2
𝑌
▪ Iteration 1:𝑥12 = 𝑀𝑢𝑙𝑡(𝑥8, 𝑥4)
▪ Iteration 2:
𝑥13 = 𝑀𝑢𝑙𝑡 𝑥1, 𝑥12 =: 𝑧
▪ Iteration 3:
𝑧12 = 𝑀𝑢𝑙𝑡(𝑧8, 𝑧4)
▪ Iteration 4:
𝑧49 = 𝑀𝑢𝑙𝑡(𝑧1, 𝑧48)
▪ Output:
𝑌 = 𝐴𝑓𝑓(𝑥13⋅49⋅2) = 𝐴𝑓𝑓 𝑥254
![Page 37: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/37.jpg)
37
Embedded Security Group
Achieving SCA Security
Cardis 2018, Montpellier Felix Wegener
![Page 38: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/38.jpg)
38
Embedded Security Group
Domain-oriented Masking
Cardis 2018, Montpellier Felix Wegener
𝐺𝐹 2𝑛 Mult 𝐺𝐹 2𝑛 Mult𝐺𝐹 2𝑛 Mult 𝐺𝐹 2𝑛 Mult
𝑋𝐴 𝑋𝐵
𝑍𝐴 𝑍𝐵
𝑌𝐴 𝑌𝐵𝑅
⊕ ⊕
⊕ ⊕
First-order DOM-independent multiplier:
Groß et al. Domain-Oriented Masking: Compact Masked Hardware Implementations with Arbitrary Protection Order, CCS 2016
![Page 39: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/39.jpg)
39
Embedded Security Group
Domain-oriented Masking
Cardis 2018, Montpellier Felix Wegener
𝐺𝐹 2𝑛 Mult 𝐺𝐹 2𝑛 Mult𝐺𝐹 2𝑛 Mult 𝐺𝐹 2𝑛 Mult
𝑋𝐴 𝑋𝐵
𝑍𝐴 𝑍𝐵
𝑌𝐴 𝑌𝐵𝑅
⊕ ⊕
⊕ ⊕
First-order DOM-independent multiplier:
Preconditions: ▪ X, Y are independently masked▪ R provides n bits of randomness
Groß et al. Domain-Oriented Masking: Compact Masked Hardware Implementations with Arbitrary Protection Order, CCS 2016
![Page 40: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/40.jpg)
40
Embedded Security Group
First-order Secure Design (Generic)
Cardis 2018, Montpellier Felix Wegener
![Page 41: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/41.jpg)
41
Embedded Security Group
First-order Secure Design (Generic)
Cardis 2018, Montpellier Felix Wegener
![Page 42: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/42.jpg)
42
Embedded Security Group
First-order Secure Design (Generic)
Cardis 2018, Montpellier Felix Wegener
![Page 43: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/43.jpg)
43
Embedded Security Group
Design I: Fully-Parallel Multiplier
Cardis 2018, Montpellier Felix Wegener
![Page 44: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/44.jpg)
44
Embedded Security Group
First-order Secure Design (Fully-parallel)
Cardis 2018, Montpellier Felix Wegener
1 clock cycle
![Page 45: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/45.jpg)
45
Embedded Security Group
First-order Secure Design (Fully-parallel)
Cardis 2018, Montpellier Felix Wegener
randomness(alternating)
![Page 46: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/46.jpg)
46
Embedded Security Group
First-order Secure Design (Fully-parallel)
Cardis 2018, Montpellier Felix Wegener
Latency:
8 cycles
Randomness:
8 bits / cyc.
Area:
2321 GE
![Page 47: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/47.jpg)
47
Embedded Security Group
Design II: Serial-Parallel Multiplier
Cardis 2018, Montpellier Felix Wegener
![Page 48: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/48.jpg)
48
Embedded Security Group
First-order Secure Design (Serial-parallel)
Cardis 2018, Montpellier Felix Wegener
8 clock cycles
![Page 49: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/49.jpg)
49
Embedded Security Group
First-order Secure Design (Serial-parallel)
Cardis 2018, Montpellier Felix Wegener
Restoringindependence
![Page 50: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/50.jpg)
50
Embedded Security Group
▪ Goal: 1 bit of randomness / cycle
– Different path for MSB
– Re-masked value from Register
Restoring Independence
Cardis 2018, Montpellier Felix Wegener
𝐵
𝑏𝑖 ⊕ 𝑟𝑖
𝑅
⊕
⊕
0
![Page 51: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/51.jpg)
51
Embedded Security Group
First-order Secure Design (Serial-parallel)
Cardis 2018, Montpellier Felix Wegener
Cross-domainremasking
![Page 52: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/52.jpg)
52
Embedded Security Group
×𝑎0 ×𝑎1 ×𝑎2 ×𝑎3 ×𝑎4 ×𝑎5 ×𝑎6 ×𝑎7
𝑏𝑖
𝐶
⊕𝑅 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕
Serial-Parallel Multiplier▪ Inputs:
– a: 8 bits parallel
– b: 1 bit serial
Cardis 2018, Montpellier Felix Wegener
![Page 53: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/53.jpg)
53
Embedded Security Group
×𝑎0 ×𝑎1 ×𝑎2 ×𝑎3 ×𝑎4 ×𝑎5 ×𝑎6 ×𝑎7
𝑏𝑖
𝐶
⊕𝑅 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕
Serial-Parallel Multiplier▪ Inputs:
– a: 8 bits parallel
– b: 1 bit serial
▪ Inject 1 random bit over 8 cycles
Cardis 2018, Montpellier Felix Wegener
![Page 54: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/54.jpg)
54
Embedded Security Group
First-order Secure Design (Serial-parallel)
Cardis 2018, Montpellier Felix Wegener
Latency:
36 cycles
Randomness:
2 bits / cyc.
Area:
1378 GE
![Page 55: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/55.jpg)
55
Embedded Security Group
Side-Channel Evaluation
Cardis 2018, Montpellier Felix Wegener
![Page 56: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/56.jpg)
56
Embedded Security Group
SCA Evaluation: Method and Setup
Cardis 2018, Montpellier Felix Wegener
▪ MC-DPA evaluation
▪ Sequential execution of S-box
– First: Derive Power Model
– Second: CPA
Sample Trace
Setup:• Sakura-G board @ 6Mhz• Picoscope 6000 @ 625 MS/s• No. traces: 10 million
![Page 57: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/57.jpg)
57
Embedded Security Group
SCA Evaluation: Results
Cardis 2018, Montpellier Felix Wegener
Serial Design Parallel Design1st order 1st order
2nd order 2nd order
![Page 58: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/58.jpg)
58
Embedded Security Group
Comparison: Unprotected Designs
Cardis 2018, Montpellier Felix Wegener
Design Latency(cycles)
Crit. Path(ns)
Size(GE)
Boyar et al. 1 5.6 205
Serial Design(unprotected)
32 1.5 520
![Page 59: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/59.jpg)
59
Embedded Security Group
Comparison: Protected Designs
Cardis 2018, Montpellier Felix Wegener
Design Shares Latency(cycles)
Crit. Path(ns)
Rand/Cyc(bits)
Size(GE)
Bilgin et al. 3 3 N/A 16 2224
Cnudde et al. 2 6 N/A 46 1872
Groß et al. 2 8 N/A 18 2600
Ueno et al. 2 5 1.5 56 1656
Former Work 4 16 3.3 0 4200
Parallel Design 2 8 1.6 8 2321
Serial Design 2 36 1.5 2 1378
![Page 60: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/60.jpg)
60
Embedded Security Group
Summary
▪ New first-order secure AES S-box designs:
– Parallel Design: Interesting trade-off
– Serial Design:
• Smallest first-order secure AES S-box
• Only 2 bits of randomness per cycle
▪ Methodology:
Smallest unprotected design
⇒
Smallest protected design
Cardis 2018, Montpellier Felix Wegener
![Page 61: Smart Card Research and Advanced Application Conference - Yet … · 2018. 12. 10. · Example chain for 𝑥13: –Chain: 𝑥1,𝑥2,𝑥4,𝑥8,𝑥12,𝑥13 –Cost: 0, 0, 0,](https://reader034.vdocuments.net/reader034/viewer/2022051822/5fecd91deb64ee7f705204dc/html5/thumbnails/61.jpg)
Thanks!
any questions?
Ruhr University Bochum, Horst Görtz Institute for IT-Security, Germany