Compress: Generate Small and Fast Masked Pipelined Circuits

• Published in: IACR transactions on cryptographic hardware and embedded systems Vol. 2024; no. 3; pp. 500 - 529
• Main Authors: Cassiers, Gaëtan, Gigerl, Barbara, Mangard, Stefan, Momin, Charles, Nagpal, Rishub
• Format: Journal Article
• Language: English
• Published: Ruhr-Universität Bochum 18.07.2024
• Subjects: HPC; Masking; Side-channel
• ISSN: 2569-2925; 2569-2925
• DOI: 10.46586/tches.v2024.i3.500-529

Masking is an effective countermeasure against side-channel attacks. It replaces every logic gate in a computation by a gadget that performs the operation over secret sharings of the circuit’s variables. When masking is implemented in hardware, care should be taken to protect against leakage from glitches, which could otherwise undermine the security of masking. This is generally done by adding registers, which stop the propagation of glitches, but introduce additional latency and area cost. In masked pipeline circuits, a high latency further increases the area overheads of masking, due to the need for additional registers that synchronize signals between pipeline stages. In this work, we propose a technique to minimize the number of such pipeline registers, which relies on optimizing the scheduling of the computations across the pipeline stages. We release an implementation of this technique as an open-source tool, Compress. Further, we introduce other optimizations to deduplicate logic between gadgets, perform an optimal selection of masked gadgets, and introduce new gadgets with smaller area. Overall, our optimizations lead to circuits that improve the state-of-the art in area and achieve state-of-the-art latency. For example, a masked AES based on an S-box generated by Compress reduces latency by 19% and area by 27% over a state-of-the-art implementation, or, for the same latency, reduces area by 45%.