A Fast and Provably Secure Higher-Order Masking of AES S-Box
This paper proposes an efficient and secure higher-order masking algorithm for AES S-box that consumes the most computation time of the higher-order masked AES. During the past few years, much of the research has focused on finding higher-order masking schemes for this AES S-box, but these are still slow for embedded processors use. Our proposed higher-order masking of AES S-box is constructed based on the inversion operation over the composite field. We replace the subfield operations over the composite field into the table lookup operation, but these precomputation tables do not require much ROM space because these are the operations over GF(24). In the implementation results, we show that the higher-order masking scheme using our masked S-box is about 2.54 (second-order masking) and 3.03 (third-order masking) times faster than the fastest method among the existing higher-order masking schemes of AES.
KeywordsAES side channel attack higher-order masking higher-order DPA differential power analysis
- 1.NIST, FIPS 197: Advanced Encryption Standard (2001)Google Scholar
- 2.Atmel Corporation: Datasheet: ATmega128(L), http://www.atmel.com/products/avr/
- 6.O’Connor, L.: On the Distribution of Characteristics in Bijective Mappings. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 360–370. Springer, Heidelberg (1994)Google Scholar
- 13.Kocher, P.C., Jaffe, J., Jun, B.: Differential Power Analysis. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 388–397. Springer, Heidelberg (1999)Google Scholar
- 19.Rivain, M., Prouff, E.: Provably Secure Higher-Order Masking of AES, Cryptology ePrint Archive (2010), http://eprint.iacr.org/