Abstract
Glitches entail a great issue when securing a cryptographic implementation in hardware. Several masking schemes have been proposed in the literature that provide security even in the presence of glitches. The key property that allows this protection was introduced in threshold implementations as non-completeness. We address crucial points to ensure the right compliance of this property especially for low-latency implementations. Specifically, we first discuss the existence of a flaw in DSD 2017 implementation of Keccak by Gross et al. in violation of the non-completeness property and propose a solution. We perform a side-channel evaluation on the first-order and second-order implementations of the proposed design where no leakage is detected with up to 55 million traces. Then, we present a method to ensure a non-complete scheme of an unrolled implementation applicable to any order of security or algebraic degree of the shared function. By using this method we design a two-rounds unrolled first-order Keccak-
Highlights
Physical attacks are a serious threat to cryptographic implementations, capable of retrieving important information such as the secret key
We focus on Threshold Implementations (TI) [NRR06, NRS08, NRS11] and Domain Oriented Masking (DOM) [GMK16], which are based on secret sharing schemes and techniques from MultiParty Computation (MPC)
The differences between our design and that of [Sch17] are [1] we do not use negative-edge triggering for the cross-domain shares for ease of analysis leading to a two cycle per round implementation; and [2] we always use fresh randomness to ensure that a possible problem is not caused by the degradation of uniformity
Summary
Physical attacks are a serious threat to cryptographic implementations, capable of retrieving important information such as the secret key. We focus on Threshold Implementations (TI) [NRR06, NRS08, NRS11] and Domain Oriented Masking (DOM) [GMK16], which are based on secret sharing schemes and techniques from MultiParty Computation (MPC). They have the advantage of providing theoretical security on hardware if implemented according to the non-completeness property defined in [NRR06, BGN+14a], if fed with enough entropy and if the device works under the independent leakage assumption as described in [DFS15]. We analyze the recently published higher-order DOM Keccak implementations [GSM17a] and point out a flaw that can possibly lead to successful attacks. We present a first-order secure low latency Keccak implementation that performs an encryption in 20.61ns making it the fastest SCA secure implementation published to date (Sect. 5)
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call
