Insights into Two-Share Threshold Implementation in Lightweight Cryptography
undefined
A Tale of Two Shares: Why Two-Share Threshold
Implementation Seems Worthwhile and Why it is Not
C
o
n
g
C
h
e
n
,
M
o
h
a
m
m
a
d
F
a
r
m
a
n
i
a
n
d
T
h
o
m
a
s
E
i
s
e
n
b
a
r
t
h
Vernam Group at Worcester Polytechnic Institute, USA
ASIACRYPT 2016, Hanoi, Dec 8, 2016
1
9/17/2024
Outline
9/17/2024
2
Motivation and Background
Two-share TI masking
Implementation results
Leakage Analysis
Conclusion
Motivation
9/17/2024
3
Tailored for constrained applications – Lightweight Cryptography.
Physical security, e.g., side-channel leakage resistance.
Efficient Implementations in terms of area and other costs.
Threshold Implementation(TI)
9/17/2024
4
C
o
r
r
e
c
t
n
e
s
s
;
N
o
n
-
c
o
m
p
l
e
t
e
n
e
s
s
;
U
n
i
f
o
r
m
i
t
y
Nikova, S., Rechberger, C., Rijmen, V.:
Threshold implementations against side-channel attacks and glitches
. ICICS 2006.
How many shares?
9/17/2024
5
t
:
degree of nonlinearity
;
d
:
protection order
De Cnudde, T., Reparaz, O., Bilgin, B., Nikova, S., Nikov, V., Rijmen, V.:
Masking AES with
d
+ 1 Shares in Hardware.
CHES 2016
.
Hannes Gross and Stefan Mangard and Thomas Korak.
Domain-Oriented Masking: Compact Masked Hardware Implementations with Arbitrary Protection Order
.
CARDIS 2016
Reparaz, O., Bilgin, B., Nikova, S., Gierlichs, B., Verbauwhede, I.:
Consolidating Masking Schemes.
CRYPTO 2015
Simon
9/17/2024
6
Optimized for hardware
Algebraic degree: 2
Fully bit-serializ
able
I
n
t
e
r
e
s
t
i
n
g
F
e
a
t
u
r
e
s
:
Outline
9/17/2024
7
Motivation and Background
Two-share TI masking
Implementation results
Leakage Analysis
Conclusion
From 3-share to 2-share
9/17/2024
8
Trivial for linear function:
Correct;
Non-Complete;
Uniform;
From 3-share to 2-share
9/17/2024
9
Non-linear function:
Correct;
Non-Complete;
Uniform;
Compared with 3-share:
-
Less randomness
-
Less logic operations
-
Two extra flip-flops
-
Two stages
Pipelining!
A potential pitfall
9/17/2024
10
P
D
F
f
o
r
2
-
s
h
a
r
e
o
f
1
b
i
t
P
D
F
f
o
r
3
-
s
h
a
r
e
o
f
1
b
i
t
Same mean;
Different variance;
Same mean;
Same variance;
Application on Simon (round-based)
9/17/2024
11
S
o
l
i
d
l
i
n
e
:
1
s
t
c
l
o
c
k
c
y
c
l
e
;
D
o
t
t
e
d
l
i
n
e
:
2
n
d
c
l
o
c
k
c
y
c
l
e
Two stages each
round;
- Two clock cycles;
Correctness;
Non-completeness
Uniformity
Application on Simon (bit-serialized)
9/17/2024
12
Poschmann, A., Moradi, A., Khoo, K., Lim, C.W., Wang, H., Ling, S.:
SideChannel Resistant Crypto for less than 2,300 GE.
Journal of Cryptology 24(2) 2011
Shahverdi, A., Taha, M., Eisenbarth, T.: Silent Simon:
A Threshold Implementation under 100 Slices.
HOST 2015.
Bit-serialized;
Pipelining;
Correctness;
Non-completeness
Uniformity
Outline
9/17/2024
13
Motivation and Background
Two-share TI masking
Implementation results
Leakage Analysis
Conclusion
Slice Registers
9/17/2024
14
Slice LUTs
9/17/2024
15
Throughput (Mbps)
9/17/2024
16
Outline
9/17/2024
17
Motivation and Background
Two-share TI masking
Implementation results
Leakage Analysis
Conclusion
Theoretical Analysis
9/17/2024
18
2-TI Present Sbox as a target.
Hamming weight leakage model.
1
st
order and 2
nd
order analyses
T-test and CPA attack
Theoretical Analysis
9/17/2024
19
1st order analyses on Present Sbox
Theoretical Analysis
9/17/2024
20
2nd order analyses on Present Sbox
Practical Analysis
9/17/2024
21
Targets: 2TI/3TI round-based Simon, 2TI
Present
Platform: SASEBO-GII clocked at 3MHz;
Oscilloscope: Tektronix DPO; 100MS/sec;
Analyses on Simon (2TI Round-based)
9/17/2024
22
T-test analyses on 2TI Simon
Analyses on Simon (3TI Round-based)
9/17/2024
23
T-test analyses on 3TI Simon
2
nd
order CPA on 2-TI Simon
9/17/2024
24
Number of traces vs. Correlation Coefficient
2
nd
order CPA on 2-TI Present
9/17/2024
25
Number of traces vs. Correlation Coefficient
Outline
9/17/2024
26
Motivation and Background
Two-share TI masking
Implementation results
Leakage Analysis
Conclusion
Conclusion
9/17/2024
27
P
i
p
e
l
i
n
i
n
g
a
n
d
S
e
r
i
l
i
z
a
t
i
o
n
.
- Reduced area and randomness.
- Maintained performance.
F
i
t
f
o
r
l
i
g
h
t
w
e
i
g
h
t
c
r
y
p
t
o
g
r
a
p
h
y
.
F
i
r
s
t
o
r
d
e
r
s
i
d
e
-
c
h
a
n
n
e
l
l
e
a
k
a
g
e
r
e
s
i
s
t
a
n
c
e
.
S
t
r
o
n
g
s
e
c
o
n
d
o
r
d
e
r
l
e
a
k
a
g
e
i
s
o
b
s
e
r
v
e
d
i
n
2
-
T
I
.
28
9/17/2024
H
T
N
A
S
K
Present
9/17/2024
29
Application on Present
9/17/2024
30
2-share datapath of Present Sbox
Application on Present
9/17/2024
31
2-sharing of G function
How many shares?
9/17/2024
32
Tailored for constrained applications, two-share threshold implementation offers efficient and secure solutions, analyzed against side-channel attacks. Exploring the motivation, background, results, and comparison with three-share schemes, this study provides valuable insights into the viability of this approach in secure hardware implementations.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
A Tale of Two Shares: Why Two-Share Threshold Implementation Seems Worthwhile and Why it is Not Cong Chen Cong Chen, Mohammad Farmani and Thomas Eisenbarth Vernam Group at Worcester Polytechnic Institute, USA ASIACRYPT 2016, Hanoi, Dec 8, 2016 1 9/17/2024
Outline Motivation and Background Two-share TI masking Implementation results Leakage Analysis Conclusion 2 9/17/2024
Motivation Tailored for constrained applications Lightweight Cryptography. Physical security, e.g., side-channel leakage resistance. Efficient Implementations in terms of area and other costs. 3 9/17/2024
Threshold Implementation(TI) Correctness; Non Correctness; Non- -completeness; Uniformity completeness; Uniformity Nikova, S., Rechberger, C., Rijmen, V.: Threshold implementations against side-channel attacks and glitches. ICICS 2006. 4 9/17/2024
How many shares? ? ? + 1 t: degree of nonlinearity; d: protection order Reparaz, O., Bilgin, B., Nikova, S., Gierlichs, B., Verbauwhede, I.: Consolidating Masking Schemes. CRYPTO 2015 De Cnudde, T., Reparaz, O., Bilgin, B., Nikova, S., Nikov, V., Rijmen, V.: Masking AES with d + 1 Shares in Hardware. CHES 2016. Hannes Gross and Stefan Mangard and Thomas Korak.Domain-Oriented Masking: Compact Masked Hardware Implementations with Arbitrary Protection Order. CARDIS 2016 5 9/17/2024
Simon Interesting Features: Interesting Features: Optimized for hardware Algebraic degree: 2 Fully bit-serializable 6 9/17/2024
Outline Motivation and Background Two-share TI masking Implementation results Leakage Analysis Conclusion 7 9/17/2024
From 3-share to 2-share Trivial for linear function: ? = ? + ? Correct; Non-Complete; Uniform; 8 9/17/2024
From 3-share to 2-share Non-linear function: ? = ? ? + ? Pipelining! ?2= (?2 ?2+ ?2) + ?1 ?2 ?1= (?1 ?1+ ?1) + ?2 ?1 Correct; Non-Complete; Uniform; Compared with 3-share: - Less randomness - Less logic operations - Two extra flip-flops - Two stages 9 9/17/2024
A potential pitfall PDF for 2 PDF for 2- -share of 1 bit share of 1 bit PDF for 3 PDF for 3- -share of 1 bit share of 1 bit Same mean; Same variance; Same mean; Different variance; 10 9/17/2024
Application on Simon (round-based) Two stages each round; - Two clock cycles; Correctness; Non-completeness Uniformity Solid line: 1st clock cycle; Solid line: 1st clock cycle; Dotted line: 2nd clock cycle Dotted line: 2nd clock cycle 11 9/17/2024
Application on Simon (bit-serialized) Bit-serialized; Pipelining; Correctness; Non-completeness Uniformity Poschmann, A., Moradi, A., Khoo, K., Lim, C.W., Wang, H., Ling, S.: SideChannel Resistant Crypto for less than 2,300 GE. Journal of Cryptology 24(2) 2011 Shahverdi, A., Taha, M., Eisenbarth, T.: Silent Simon: A Threshold Implementation under 100 Slices. HOST 2015. 12 9/17/2024
Outline Motivation and Background Two-share TI masking Implementation results Leakage Analysis Conclusion 13 9/17/2024
Slice Registers Slice Registers 3.5 3 2.5 2 1.5 1 0.5 0 Round-based Simon(Virtex5) Bit-serialized Simon(Spartan3) Unprotected 2-TI 3-TI 14 9/17/2024
Slice LUTs Slice LUTs 3 2.5 2 1.5 1 0.5 0 Round-based Simon(Virtex5) Bit-serialized Simon(Spartan3) Unprotected 2-TI 3-TI 15 9/17/2024
Throughput (Mbps) Throughput 1.4 1.2 1 0.8 0.6 0.4 0.2 0 Round-based Simon(Virtex5) Bit-serialized Simon(Spartan3) Unprotected 2-TI 3-TI 16 9/17/2024
Outline Motivation and Background Two-share TI masking Implementation results Leakage Analysis Conclusion 17 9/17/2024
Theoretical Analysis 2-TI Present Sbox as a target. Hamming weight leakage model. 1st order and 2nd order analyses T-test and CPA attack 18 9/17/2024
Theoretical Analysis 1st order analyses on Present Sbox 19 9/17/2024
Theoretical Analysis 2nd order analyses on Present Sbox 20 9/17/2024
Practical Analysis Targets: 2TI/3TI round-based Simon, 2TI Present Platform: SASEBO-GII clocked at 3MHz; Oscilloscope: Tektronix DPO; 100MS/sec; 21 9/17/2024
Analyses on Simon (2TI Round-based) T-test analyses on 2TI Simon 22 9/17/2024
Analyses on Simon (3TI Round-based) T-test analyses on 3TI Simon 23 9/17/2024
2nd order CPA on 2-TI Simon Number of traces vs. Correlation Coefficient 24 9/17/2024
2nd order CPA on 2-TI Present Number of traces vs. Correlation Coefficient 25 9/17/2024
Outline Motivation and Background Two-share TI masking Implementation results Leakage Analysis Conclusion 26 9/17/2024
Conclusion Pipelining and Pipelining and Serilization - Reduced area and randomness. - Maintained performance. Fit for lightweight cryptography. Fit for lightweight cryptography. Serilization. . First order side First order side- -channel leakage resistance. channel leakage resistance. Strong second order leakage is observed in 2 Strong second order leakage is observed in 2- -TI. TI. 27 9/17/2024
T H A N K S 28 9/17/2024
Present 29 9/17/2024
Application on Present 2-share datapath of Present Sbox 30 9/17/2024
Application on Present 2-sharing of G function 31 9/17/2024
How many shares? Area Performance Randomness Security 32 9/17/2024
