Abstract:A recent study suggests that arithmetic masking in prime fields leads to stronger security guarantees against passive physical adversaries than Boolean masking. Indeed, it is a common observation that the desired security amplification of Boolean masking collapses when the noise level in the measurements is too low. Arithmetic encodings in prime fields can help to maintain an exponential increase of the attack complexity in the number of shares even in such a challenging context. In this work, we contribute to this emerging topic in two main directions. First, we propose novel masked hardware gadgets for secure squaring in prime fields (since squaring is non-linear in non-binary fields) which prove to be significantly more resource-friendly than corresponding masked multiplications. We then formally show their local and compositional security for arbitrary orders. Second, we attempt to >experimentally evaluate the performance vs. security tradeoff of prime-field masking. In order to enable a first comparative case study in this regard, we exemplarily consider masked implementations of the AES as well as the recently proposed AESprime. AES-prime is a block cipher partially resembling the standard AES, but based on arithmetic operations modulo a small Mersenne prime. We present cost and performance figures for masked AES and AES-prime implementations, and experimentally evaluate their susceptibility to low-noise side-channel attacks. We consider both the dynamic and the static power consumption for our low-noise analyses and emulate strong adversaries. Static power attacks are indeed known as a threat for side-channel countermeasures that require a certain noise level to be effective because of the adversary’s ability to reduce the noise through intra-trace averaging. Our results show consistently that for the noise levels in our practical experiments, the masked prime-field implementations provide much higher security for the same number of shares. This compensates for the overheads prime computations lead to and remains true even if / despite leaking each share with a similar Signal-to-Noise Ratio (SNR) as their binary equivalents. We hope our results open the way towards new cipher designs tailored to best exploit the advantages of prime-field masking.

Quasi-linear Masking to Protect Kyber against both SCA and FIA

Quasi-linear masking against SCA and FIA, with cost amortization

On the Masking-Friendly Designs for Post-Quantum Cryptography

Masked Accelerators and Instruction Set Extensions for Post-Quantum Cryptography

A High-Performance Masking Design Approach for Saber against High-order Side-channel Attack

Hardware Implementation and Security Analysis of Local-Masked NTT for CRYSTALS-Kyber

An Improved Two-Step Attack on Kyber

Side-channel and Fault-injection attacks over Lattice-based Post-quantum Schemes (Kyber, Dilithium): Survey and New Results

A Hardware-Friendly Shuffling Countermeasure Against Side-Channel Attacks for Kyber

Polynomial direct sum masking to protect against both SCA and FIA

Magnifying Side-Channel Leakage of Lattice-Based Cryptosystems with Chosen Ciphertexts: The Case Study of Kyber

Carry Your Fault: A Fault Propagation Attack on Side-Channel Protected LWE-based KEM

On Efficient and Secure Code-based Masking: A Pragmatic Evaluation.

HI-Kyber: A Novel High-Performance Implementation Scheme of Kyber Based on GPU

Password authenticated key exchange-based on Kyber for mobile devices

Prime-Field Masking in Hardware and its Soundness against Low-Noise SCA Attacks

Tight Analysis of Decrypton Failure Probability of Kyber in Reality.

When NTT Meets SIS: Efficient Side-channel Attacks on Dilithium and Kyber

A Compact Hardware Implementation of CCA-Secure Key Exchange Mechanism CRYSTALS-KYBER on FPGA

A Configurable CRYSTALS-Kyber Hardware Implementation with Side-Channel Protection

Combined Fault and DPA Protection for Lattice-Based Cryptography