Masked Implementations Research Articles

Masking vs. multiparty computation: how large is the gap for AES?

In this paper, we evaluate the performances of state-of-the-art higher order masking schemes for the AES. Doing so, we pay a particular attention to the comparison between specialized solutions introduced exclusively as countermeasures against side-channel analysis, and a recent proposal by Roche and Prouff exploiting multiparty computation (MPC) techniques. We show that the additional security features this latter scheme provides (e.g., its glitch-freeness) come at the cost of large performance overheads. We then study how exploiting standard optimization techniques from the MPC literature can be used to reduce this gap. In particular, we show that “packed secret sharing” based on a modified multiplication algorithm can speed up MPC-based masking when the order of the masking scheme increases. Eventually, we discuss the randomness requirements of masked implementations. For this purpose, we first show with information theoretic arguments that the security guarantees of masking are only preserved if this randomness is uniform, and analyze the consequences of a deviation from this requirement. We then conclude the paper by including the cost of randomness generation in our performance evaluations. These results should help actual designers to choose a masking scheme based on security and performance constraints.

Organic Solar Cells with Graphene Electrodes and Vapor Printed Poly(3,4-ethylenedioxythiophene) as the Hole Transporting Layers

For the successful integration of graphene as a transparent conducting electrode in organic solar cells, proper energy level alignment at the interface between the graphene and the adjacent organic layer is critical. The role of a hole transporting layer (HTL) thus becomes more significant due to the generally lower work function of graphene compared to ITO. A commonly used HTL material with ITO anodes is poly(3,4-ethylenedioxythiophene) (PEDOT) with poly(styrenesulfonate) (PSS) as the solid-state dopant. However, graphene's hydrophobic surface renders uniform coverage of PEDOT:PSS (aqueous solution) by spin-casting very challenging. Here, we introduce a novel, yet simple, vapor printing method for creating patterned HTL PEDOT layers directly onto the graphene surface. Vapor printing represents the implementation of shadow masking in combination with oxidative chemical vapor deposition (oCVD). The oCVD method was developed for the formation of blanket (i.e., unpatterened) layers of pure PEDOT (i.e., no PSS) with systematically variable work function. In the unmasked regions, vapor printing produces complete, uniform, smooth layers of pure PEDOT over graphene. Graphene electrodes were synthesized under low-pressure chemical vapor deposition (LPCVD) using a copper catalyst. The use of another electron donor material, tetraphenyldibenzoperiflanthene, instead of copper phthalocyanine in the organic solar cells also improves the power conversion efficiency. With the vapor printed HTL, the devices using graphene electrodes yield comparable performances to the ITO reference devices (η(p,LPCVD) = 3.01%, and η(p,ITO) = 3.20%).

Efficient Masked Implementation for SEED Based on Combined Masking

This paper proposes an efficient masking method for the block cipher SEED that is standardized in Korea. The nonlinear parts of SEED consist of two S-boxes and modular additions. However, the masked version of these nonlinear parts requires excessive RAM usage and a large number of operations. Protecting SEED by the general masking method requires 512 bytes of RAM corresponding to masked S-boxes and a large number of operations corresponding to the masked addition. This paper proposes a new-style masked S-box which can reduce the amount of operations of the masking addition process as well as the RAM usage. The proposed masked SEED, equipped with the new-style masked S-box, reduces the RAM requirements to 288 bytes, and it also reduces the processing time by 38% compared with the masked SEED using the general masked S-box. The proposed method also applies to other block ciphers with the same nonlinear operations.

Mutual Information Analysis: a Comprehensive Study

Mutual Information Analysis is a generic side-channel distinguisher that has been introduced at CHES 2008. It aims to allow successful attacks requiring minimum assumptions and knowledge of the target device by the adversary. In this paper, we compile recent contributions and applications of MIA in a comprehensive study. From a theoretical point of view, we carefully discuss its statistical properties and relationship with probability density estimation tools. From a practical point of view, we apply MIA in two of the most investigated contexts for side-channel attacks. Namely, we consider first-order attacks against an unprotected implementation of the DES in a full custom IC and second-order attacks against a masked implementation of the DES in an 8-bit microcontroller. These experiments allow to put forward the strengths and weaknesses of this new distinguisher and to compare it with standard power analysis attacks using the correlation coefficient.

Theoretical and practical aspects of mutual information-based side channel analysis

A large variety of side channel analyses performed on embedded devices involve the linear correlation coefficient as wrong-key distinguisher. This coefficient is actually a sound statistical tool to quantify linear dependencies between univariate variables. At CHES 2008, Gierlichs et al. proposed to use the mutual information measure as an alternative to the correlation coefficient since it detects any kind of statistical dependency. Substituting it for the correlation coefficient may indeed be considered as a natural extension of the existing attacks. Nevertheless, the first published applications have raised several open issues. In this paper, we conduct a theoretical analysis of MIA in the Gaussian leakage model to explore the reasons why and when it is a sound key recovery attack. Also, we generalise MIA to higher-orders (i.e., against masked implementations). Secondly, we address the main practical issue of MIA: the mutual information estimation which itself relies on the estimation of statistical distributions. We describe three classical estimation methods and we apply them in the context of MIA. Eventually, we present various attack simulations and practical attack experiments that allow us to check the efficiency of MIA in practice and to compare it to classical correlation-based attacks.

Effect of glitches against masked AES S-box implementation and countermeasure

Masking of gates is one of the most popular techniques to prevent differential power analysis (DPA) of AES algorithm. It has been shown that the logic circuits used in the implementation of cryptographic algorithms leak side-channel information inspite of masking, which can be exploited, in differential power attacks. The phenomenon in CMOS circuits responsible for the leakage of masked circuits is known as glitching. Motivated by this fact, the authors analyse the effect of glitches in CMOS circuits against masked implementation of the AES S-box. The authors explicitly demonstrate that glitches do not affect always. There exists a relation between combinational path delay of the circuit and timing difference of input vectors to the circuit, which has a bearance on the amount of information leaked by the masked gates. A balanced masked S-box circuit is proposed where the inputs are synchronised by sequential components. Detailed SPICE results are shown to support the claim that the modifications indeed reduce the vulnerability of the masked AES S-box against DPA attacks.

An Evidence-Based Systematic Review on the Management of Irritable Bowel Syndrome

An Evidence-Based Systematic Review on the Management of Irritable Bowel Syndrome

A Real-Time Implementation of Nonlinear Unsharp Masking with FPLDs

Real-time performance of image enhancement algorithms is required in many applications. In this paper we present a real-time image contrast enhancement scheme using non-linear unsharp masking, implemented with FPLDs (Field Programmable Logic Devices). A quadratic filter has been chosen for the nonlinear unsharp masking. The implementation performs well on real images from medical and non-medical fields. Performance figures of the nonlinear filter on mammograms show substantial improvements over software-only and other filter implementations using linear schemes, thus achieving real-time image enhancement of large images. The implementation has been tested as an application-specific co-processor to a standard PC, but can also be used as a functional unit of an application-specific image enhancement processor.

Soft-clipping postprocessor scaling decoded audio signal frame saturation regions to approximate original waveform shape and maintain continuity

An audio coder/decoder ("codec") that is suitable for real-time applications due to reduced computational complexity, and a novel adaptive sparse vector quantization (ASVQ) scheme and algorithms for general purpose data quantization. The codec provides low bit-rate compression for music and speech, while being applicable to higher bit-rate audio compression. The codec includes an in-path implementation of psychoacoustic spectral masking, and frequency domain quantization using the novel ASVQ scheme and algorithms specific to audio compression. More particularly, the inventive audio codec employs frequency domain quantization with critically sampled subband filter banks to maintain time domain continuity across frame boundaries. The input audio signal is transformed into the frequency domain in which in-path spectral masking can be directly applied. This in-path spectral masking usually results in sparse vectors. The ASVQ scheme is a vector quantization algorithm that is particularly effective for quantizing sparse signal vectors. In the preferred embodiment, ASVQ adaptively classifies signal vectors into six different types of sparse vector quantization, and performs quantization accordingly. The ASVQ technique applies to general purpose data quantization as well as to quantization in the context of audio compression. The invention also includes a "soft clipping" algorithm in the decoder as a post-processing stage. The soft clipping algorithm preserves the waveform shapes of the reconstructed time domain audio signal in a frame- or block-oriented stateless manner while maintaining continuity across frame or block boundaries. The invention includes related methods, apparatus, and computer programs.

Audio codec using adaptive sparse vector quantization with subband vector classification

An audio coder/decoder ("codec") that is suitable for real-time applications due to reduced computational complexity, and a novel adaptive sparse vector quantization (ASVQ) scheme and algorithms for general purpose data quantization. The codec provides low bit-rate compression for music and speech, while being applicable to higher bit-rate audio compression. The codec includes an in-path implementation of psychoacoustic spectral masking, and frequency domain quantization using the novel ASVQ scheme and algorithms specific to audio compression. More particularly, the inventive audio codec employs frequency domain quantization with critically sampled subband filter banks to maintain time domain continuity across frame boundaries. The input audio signal is transformed into the frequency domain in which in-path spectral masking can be directly applied. This in-path spectral masking usually results in sparse vectors. The ASVQ scheme is a vector quantization algorithm that is particularly effective for quantizing sparse signal vectors. In the preferred embodiment, ASVQ adaptively classifies signal vectors into six different types of sparse vector quantization, and performs quantization accordingly. The ASVQ technique applies to general purpose data quantization as well as to quantization in the context of audio compression. The invention also includes a "soft clipping" algorithm in the decoder as a post-processing stage. The soft clipping algorithm preserves the waveform shapes of the reconstructed time domain audio signal in a frame- or block-oriented stateless manner while maintaining continuity across frame or block boundaries. The invention includes related methods, apparatus, and computer programs.

Multi-window Gabor expansion for evolutionary spectral analysis

In this paper, we connect a new multi-window discrete Gabor expansion of finite extent, deterministic signals with their evolutionary spectra. In our method both the signal representation and its corresponding evolutionary spectrum are obtained simultaneously. Including a scale parameter in the discrete Gabor expansion, we develop a multi-window representation which can be related to the deterministic version of the Wold-Cramer decomposition of non-stationary signals. By choosing Gaussian windows and appropriate scales, the expansion can be used to represent the narrow- and wide-band components of a signal. The evolutionary spectrum is then easily calculated from the Gabor coefficients. The computation of the evolutionary spectrum using this approach can be efficiently done by means of the Fast Fourier Transform algorithm. As an application, we present an approximate implementation of time-frequency masking. This implementation only requires that the support of the Gabor coefficients be restricted in the time-frequency plane. Examples illustrating the evolutionary spectral analysis and the proposed time-frequency masking are given.