Optimized threshold implementations: securing cryptographic accelerators for low-energy and low-latency applications

Abstract

Threshold implementations have emerged as one of the most popular masking countermeasures for hardware implementations of cryptographic primitives. In this work, we provide three TI optimization techniques: First, a generic construction for $d+1$ TI sharing achieves the minimal number of output shares for any n-input Boolean function of degree $t=n-1$ and for any d. Next, we present a methodology for finding minimal number of output shares in $d+1$ TI when $t<n-1$. Third, a heuristic for minimizing the number of output shares for higher-order $td + 1$ TI for any n, any t and $d \le 2$ is proposed. In addition, we describe an optimization for the secure AES schedule which achieves maximum throughput for a serial implementation. Then, we demonstrate the applicability of our results on $d+1$ and $td+1$ TI versions, for first- and second-order secure, low-latency and low-energy implementations of the PRINCE block cipher. We show the fastest and the most energy efficient known TI-protected implementations of PRINCE.

Appendices

Appendix A

1.1 A.1. First-order secure $td+1$ TI of $Q_{294}$

We use first-order $td + 1$ direct TI sharing [11] with three shares. Here, we recall that $d=1$ and $t=2$. The actual sharing is given in Eq. (21).

$$\begin{aligned} x_1&= a_1 \qquad \qquad&z_1&= a_1b_1 \oplus a_1b_2 \oplus a_2b_1 \oplus c_1\nonumber \\ x_2&= a_2 \qquad \qquad&z_2&= a_2b_2 \oplus a_2b_3 \oplus a_3b_2 \oplus c_2\nonumber \\ x_3&= a_3 \qquad \qquad&z_3&= a_3b_3 \oplus a_3b_1 \oplus a_1b_3 \oplus c_3\nonumber \\ y_1&= b_1 \qquad \qquad&w_1&= a_1c_1 \oplus a_1c_2 \oplus a_2c_1 \oplus d_1\nonumber \\ y_2&= b_2 \qquad \qquad&w_2&= a_2c_2 \oplus a_2c_3 \oplus a_3c_2 \oplus d_2\nonumber \\ y_3&= b_3 \qquad \qquad&w_3&= a_3c_3 \oplus a_3c_1 \oplus a_1c_3 \oplus d_3. \nonumber \\ \end{aligned}$$

(21)

Fig. 13

First-order secure sharing of $Q_{294}$ with $td+1$ TI

Figure 13 depicts the hardware implementation of the $td + 1$ version of $Q_{294}$.

1.2 A.2. Second-order secure $td+1$ TI of $Q_{294}$

We use the second-order $td + 1$ TI sharing of $Q_{294}$ with five input shares and ten output shares as shown in Eq. (22). In this case, we have $d=2$ and $t=2$. The shares are first processed and thus expanded, then refreshed and stored into a register. Next, they are compressed into five shares using the method explained in [6]. Values in Eq. (22) denoted with the overline represent the output after the compression step.

$$\begin{aligned} x_1&= a_1&&&y_1&= b_1\nonumber \\ x_2&= a_2&&&y_2&= b_2\nonumber \\ x_3&= a_3&&&y_3&= b_3\nonumber \\ x_4&= a_4&&&y_4&= b_4\nonumber \\ x_5&= a_5&&&y_5&= b_5\nonumber \\ z_1&= a_1b_3 \oplus a_3b_1 \qquad \qquad&z_6&= a_1b_1 \oplus a_1b_2 \oplus a_2b_1 \oplus c_1 \qquad \qquad&\bar{z}_1&= z_1 \oplus z_6\nonumber \\ z_2&= a_2b_4 \oplus a_4b_2 \qquad \qquad&z_7&= a_2b_2 \oplus a_2b_3 \oplus a_3b_2 \oplus c_2 \qquad \qquad&\bar{z}_2&= z_2 \oplus z_7\nonumber \\ z_3&= a_3b_5 \oplus a_5b_3 \qquad \qquad&z_8&= a_3b_3 \oplus a_3b_4 \oplus a_4b_3 \oplus c_3 \qquad \qquad&\bar{z}_3&= z_3 \oplus z_8\nonumber \\ z_4&= a_4b_1 \oplus a_1b_4 \qquad \qquad&z_9&= a_4b_4 \oplus a_4b_5 \oplus a_5b_4 \oplus c_4 \qquad \qquad&\bar{z}_4&= z_4 \oplus z_9\nonumber \\ z_5&= a_5b_2 \oplus a_2b_5 \qquad \qquad&z_{10}&= a_5b_5 \oplus a_5b_1 \oplus a_1b_5 \oplus c_5 \qquad \qquad&\bar{z}_5&= z_5 \oplus z_{10}\nonumber \\ w_1&= a_1c_3 \oplus a_3c_1 \qquad \qquad&w_6&= a_1c_1 \oplus a_1c_2 \oplus a_2c_1 \oplus d_1 \qquad \qquad&\bar{w}_1&= w_1 \oplus w_6\nonumber \\ w_2&= a_2c_4 \oplus a_4c_2 \qquad \qquad&w_7&= a_2c_2 \oplus a_2c_3 \oplus a_3c_2 \oplus d_2 \qquad \qquad&\bar{w}_2&= w_2 \oplus w_7\nonumber \\ w_3&= a_3c_5 \oplus a_5c_3 \qquad \qquad&w_8&= a_3c_3 \oplus a_3c_4 \oplus a_4c_3 \oplus d_3 \qquad \qquad&\bar{w}_3&= w_3 \oplus w_8\nonumber \\ w_4&= a_4c_1 \oplus a_1c_4 \qquad \qquad&w_9&= a_4c_4 \oplus a_4c_5 \oplus a_5c_4 \oplus d_4 \qquad \qquad&\bar{w}_4&= w_4 \oplus w_9\nonumber \\ w_5&= a_5c_2 \oplus a_2c_5 \qquad \qquad&w_{10}&= a_5c_5 \oplus a_5c_1 \oplus a_1c_5 \oplus d_5 \qquad \qquad&\bar{w}_5&= w_5 \oplus w_{10}. \end{aligned}$$

(22)

Please note that in order to avoid multivariate attacks, where the attacker probes values from different time samples, only nonlinear parts need to be refreshed, namely $z_1, \ldots , z_{5}$ and $w_1, \ldots , w_5$. Therefore, we need ten random bits for each shared $Q_{294}$ function.

The sub-circuit used to generate two output bits of a partial evaluation of shared nonlinear function $xy + z$ is shown in Fig. 14. Figure 15 showcases the hardware implementation of the $td+1$ Version of $Q_{294}$.

Fig. 14

Generating two outputs bits for partial evaluation of $xy + z$

Fig. 15

Second-order secure sharing of $Q_{294}$ with $td+1$ TI

1.3 A.3. First-order secure $d+1$ TI of $Q_{294}$

We use the first-order sharing given in [41] and shown in Eq. (23). In this case, it holds $d=1$. Unlike $td+1$ TI, the first-order secure sharing here has four output shares for the nonlinear component functions. For the linear parts, however, we need only two shares instead of three. Compression and mask refreshing are needed to reduce the number of output shares and make the output uniform, respectively.

$$\begin{aligned} x_1&= a_1&y_1&= b_1\nonumber \\ x_2&= a_2&y_2&= b_2\nonumber \\ z_1&= a_1b_1 \oplus c_1 \qquad \qquad&w_1&= a_1c_1 \oplus d_1\nonumber \\ z_2&= a_1b_2&w_2&= a_1c_2 \qquad \nonumber \\ z_3&= a_2b_2 \oplus c_2&w_3&= a_2c_2 \oplus d_2\nonumber \\ z_4&= a_2b_1&w_4&= a_2c_1\nonumber \\ \bar{z}_1&= z_1 \oplus z_2&\bar{w}_1&= w_1 \oplus w_2\nonumber \\ \bar{z}_2&= z_3 \oplus z_4&\bar{w}_2&= w_3 \oplus w_4. \end{aligned}$$

(23)

Fig. 16

First-order secure sharing of $Q_{294}$ with $d+1$ TI

Shares that contain quadratic terms are refreshed as given in Eq. (2) before storing into a register. We have two shared output component functions with four shares, for which we need six random bits. As in the second-order secure $td+1$ version we set appropriate register bits to 0 during initial loading to ensure correctness of the execution. A detailed hardware implementation of the $d+1$ TI sharing of $Q_{294}$ is depicted in Fig. 16.

1.4 A.4. Second-order secure $d+1$ TI of $Q_{294}$

Next, we create a second-order secure masking of $Q_{294}$ following the work of [41]. In this case, $d=2$. Three input shares are needed for all the operations. However, sharing a nonlinear operation $xy + z$ produces nine output shares that need to be first refreshed, then stored into a register and finally compressed. We give the formula for $d+1$ second-order secure sharing in Eq. (24).

$$\begin{aligned} x_1&= a_1&y_1&= b_1\nonumber \\ x_2&= a_2&y_2&= b_2\nonumber \\ x_3&= a_3&y_3&= b_3\nonumber \\ z_1&= a_1b_1 \oplus c_1 \qquad \qquad&w_1&= a_1c_1 \oplus d_1\nonumber \\ z_2&= a_1b_2 \qquad&w_2&= a_1c_2\nonumber \\ z_3&= a_1b_3 \qquad&w_3&= a_1b_3\nonumber \\ z_4&= a_2b_1&w_4&= a_2c_1\nonumber \\ z_5&= a_2b_2 \oplus c_2&w_5&= a_2c_2 \oplus d_2 \nonumber \\ z_6&= a_2b_3&w_6&= a_2c_3 \nonumber \\ z_7&= a_3b_1&w_7&= a_3c_1 \nonumber \\ z_8&= a_3b_2&w_8&= a_3c_2 \nonumber \\ z_9&= a_3b_3 \oplus c_3&w_9&= a_3c_3 \oplus d_3 \nonumber \\ \bar{z}_1&= z_1\oplus z_2 \oplus z_3 \qquad&\bar{w}_1&= w_1\oplus w_2 \oplus w_3\nonumber \\ \bar{w}_2&= w_4\oplus w_5 \oplus w_6 \qquad&\bar{w}_2&= w_4\oplus w_5 \oplus w_6\nonumber \\ \bar{w}_3&= w_7\oplus w_8 \oplus w_9 \qquad&\bar{w}_3&= w_7\oplus w_8 \oplus w_9. \end{aligned}$$

(24)

A hardware diagram of this sharing is depicted in Fig. 17.

Fig. 17

Second-order secure sharing of $Q_{294}$ with $d+1$ TI

Fig. 18

S-box pipeline schedule with six-cycle latency

Appendix B

Scheduling for the AES control for single S-box implementation where S-box latency is 6, 7, 8, 10 or 11 cycles is given with Figs. 18, 19, 20, 21, 22. For 11-cycle S-box latency schedule, MixColumn input of the last byte is obtained directly from the S-box output and is not being written being read from the state, unlike in other cases presented here.

Fig. 19

S-box pipeline schedule with seven-cycle latency

Fig. 20

S-box pipeline schedule with eight-cycle latency

Fig. 21

S-box pipeline schedule with ten-cycle latency

Fig. 22

S-box pipeline schedule with 11-cycle latency

Appendix C

Here, we give a quick reference for the found sharings for the cases examined in Sect. 3.3. Again, we use the succinct notation, where we only given chosen shares in their lexicographical order.