scholarly journals Multiplicative Masking for AES in Hardware

Author(s):  
Lauren De Meyer ◽  
Oscar Reparaz ◽  
Begül Bilgin

Hardware masked AES designs usually rely on Boolean masking and perform the computation of the S-box using the tower-field decomposition. On the other hand, splitting sensitive variables in a multiplicative way is more amenable for the computation of the AES S-box, as noted by Akkar and Giraud. However, multiplicative masking needs to be implemented carefully not to be vulnerable to first-order DPA with a zero-value power model. Up to now, sound higher-order multiplicative masking schemes have been implemented only in software. In this work, we demonstrate the first hardware implementation of AES using multiplicative masks. The method is tailored to be secure even if the underlying gates are not ideal and glitches occur in the circuit. We detail the design process of first- and second-order secure AES-128 cores, which result in the smallest die area to date among previous state-of-the-art masked AES implementations with comparable randomness cost and latency. The first- and second-order masked implementations improve resp. 29% and 18% over these designs. We deploy our construction on a Spartan-6 FPGA and perform a side-channel evaluation. No leakage is detected with up to 50 million traces for both our first- and second-order implementation. For the latter, this holds both for univariate and bivariate analysis.

Cybersecurity ◽  
2021 ◽  
Vol 4 (1) ◽  
Author(s):  
Jingdian Ming ◽  
Yongbin Zhou ◽  
Huizhong Li ◽  
Qian Zhang

AbstractDue to its provable security and remarkable device-independence, masking has been widely accepted as a noteworthy algorithmic-level countermeasure against side-channel attacks. However, relatively high cost of masking severely limits its applicability. Considering the high tackling complexity of non-linear operations, most masked AES implementations focus on the security and cost reduction of masked S-boxes. In this paper, we focus on linear operations, which seems to be underestimated, on the contrary. Specifically, we discover some security flaws and redundant processes in popular first-order masked AES linear operations, and pinpoint the underlying root causes. Then we propose a provably secure and highly efficient masking scheme for AES linear operations. In order to show its practical implications, we replace the linear operations of state-of-the-art first-order AES masking schemes with our proposal, while keeping their original non-linear operations unchanged. We implement four newly combined masking schemes on an Intel Core i7-4790 CPU, and the results show they are roughly 20% faster than those original ones. Then we select one masked implementation named RSMv2 due to its popularity, and investigate its security and efficiency on an AVR ATMega163 processor and four different FPGA devices. The results show that no exploitable first-order side-channel leakages are detected. Moreover, compared with original masked AES implementations, our combined approach is nearly 25% faster on the AVR processor, and at least 70% more efficient on four FPGA devices.


1995 ◽  
Vol 74 (6) ◽  
pp. 2665-2684 ◽  
Author(s):  
Y. Kondoh ◽  
Y. Hasegawa ◽  
J. Okuma ◽  
F. Takahashi

1. A computational model accounting for motion detection in the fly was examined by comparing responses in motion-sensitive horizontal system (HS) and centrifugal horizontal (CH) cells in the fly's lobula plate with a computer simulation implemented on a motion detector of the correlation type, the Reichardt detector. First-order (linear) and second-order (quadratic nonlinear) Wiener kernels from intracellularly recorded responses to moving patterns were computed by cross correlating with the time-dependent position of the stimulus, and were used to characterize response to motion in those cells. 2. When the fly was stimulated with moving vertical stripes with a spatial wavelength of 5-40 degrees, the HS and CH cells showed basically a biphasic first-order kernel, having an initial depolarization that was followed by hyperpolarization. The linear model matched well with the actual response, with a mean square error of 27% at best, indicating that the linear component comprises a major part of responses in these cells. The second-order nonlinearity was insignificant. When stimulated at a spatial wavelength of 2.5 degrees, the first-order kernel showed a significant decrease in amplitude, and was initially hyperpolarized; the second-order kernel was, on the other hand, well defined, having two hyperpolarizing valleys on the diagonal with two off-diagonal peaks. 3. The blockage of inhibitory interactions in the visual system by application of 10-4 M picrotoxin, however, evoked a nonlinear response that could be decomposed into the sum of the first-order (linear) and second-order (quadratic nonlinear) terms with a mean square error of 30-50%. The first-order term, comprising 10-20% of the picrotoxin-evoked response, is characterized by a differentiating first-order kernel. It thus codes the velocity of motion. The second-order term, comprising 30-40% of the response, is defined by a second-order kernel with two depolarizing peaks on the diagonal and two off-diagonal hyperpolarizing valleys, suggesting that the nonlinear component represents the power of motion. 4. Responses in the Reichardt detector, consisting of two mirror-image subunits with spatiotemporal low-pass filters followed by a multiplication stage, were computer simulated and then analyzed by the Wiener kernel method. The simulated responses were linearly related to the pattern velocity (with a mean square error of 13% for the linear model) and matched well with the observed responses in the HS and CH cells. After the multiplication stage, the linear component comprised 15-25% and the quadratic nonlinear component comprised 60-70% of the simulated response, which was similar to the picrotoxin-induced response in the HS cells. The quadratic nonlinear components were balanced between the right and left sides, and could be eliminated completely by their contralateral counterpart via a subtraction process. On the other hand, the linear component on one side was the mirror image of that on the other side, as expected from the kernel configurations. 5. These results suggest that responses to motion in the HS and CH cells depend on the multiplication process in which both the velocity and power components of motion are computed, and that a putative subtraction process selectively eliminates the nonlinear components but amplifies the linear component. The nonlinear component is directionally insensitive because of its quadratic non-linearity. Therefore the subtraction process allows the subsequent cells integrating motion (such as the HS cells) to tune the direction of motion more sharply.


2019 ◽  
Vol 3 (4) ◽  
pp. 382-396 ◽  
Author(s):  
Ioannis Karageorgos ◽  
Mehmet M. Isgenc ◽  
Samuel Pagliarini ◽  
Larry Pileggi

AbstractIn today’s globalized integrated circuit (IC) ecosystem, untrusted foundries are often procured to build critical systems since they offer state-of-the-art silicon with the best performance available. On the other hand, ICs that originate from trusted fabrication cannot match the same performance level since trusted fabrication is often available on legacy nodes. Split-Chip is a dual-IC approach that leverages the performance of an untrusted IC and combines it with the guaranties of a trusted IC. In this paper, we provide a framework for chip-to-chip authentication that can further improve a Split-Chip system by protecting it from attacks that are unique to Split-Chip. A hardware implementation that utilizes an SRAM-based PUF as an identifier and public key cryptography for handshake is discussed. Circuit characteristics are provided, where the trusted IC is designed in a 28-nm CMOS technology and the untrusted IC is designed in an also commercial 16-nm CMOS technology. Most importantly, our solution does not require a processor for performing any of the handshake or cryptography tasks, thus being not susceptible to software vulnerabilities and exploits.


2015 ◽  
Vol 5 (6) ◽  
pp. 115
Author(s):  
Lei Qiu

<p>Along with the general trends of research from traditional Gricean approach to postmodern approach, politeness has been conceptualized as facework, social indexing concept, relational work and interactional work. Based on examination of debates over East group-oriented and Western individual-oriented politeness, first-order and second-order politeness, as well as the universality and relativity of conceptualizations, this paper has roughly demonstrated that the tension between universality and relativity of politeness can help to explain the reason for lack of uniform definition and concept in this field. It is essential for researchers to seek a universal second-order culture-general theoretical construct on one hand, and to look at first-order culture-specific constructs on the other hand.</p>


2018 ◽  
Vol 382 ◽  
pp. 80-85 ◽  
Author(s):  
Xin Su ◽  
Shu Qiang Guo ◽  
Meng Ran Qiao ◽  
Hong Yan Zheng ◽  
Li Bin Qin

Based on the predecessors of thermodynamic data, the relationship between aluminum contents and oxygen contents of the aluminum deoxidization reaction was calculated. And the influence of activity coefficient to the reaction equilibrium in bearing-steel is analyzed. First-order and second-order interaction coefficients were used to calculate and draw the equilibrium curves, respectively. The effects of different temperature and different interaction parameters on the deoxidization equilibrium curves were studied. And through the curve the influence of the change of aluminum contents to the activity can be known. The trend of the curve with first-order interaction parameters is consistent with the curve with first-order and second-order interaction parameters at the low Al concentration region. And the oxygen contents of curve with first-order interaction parameters are higher than the other curve at the high Al concentration region


1980 ◽  
Vol 47 (1) ◽  
pp. 75-81 ◽  
Author(s):  
R. T. Shield

When a mechanical system has a potential energy, it is a simple matter to show that if the generalized force corresponding to a coordinate p is known to first order in p for a range of the other coordinates of the system, then the other generalized forces can be found immediately to second order in p, without requiring a second-order analysis of the system. By this method the second-order change in the axial force when a finitely extended elastic cylinder is twisted is found from the first-order value of the twisting moment. Numerical results for a realistic form of the strain-energy function for an incompressible material suggest that the second-order expression for the axial force is very accurate for a wide range of twist for circular cylinders of rubber-like materials extended 100 percent or more.


1991 ◽  
Vol 56 (3) ◽  
pp. 1038-1063 ◽  
Author(s):  
Gaisi Takeuti

In [1] S. Buss introduced systems of bounded arithmetic , , , (i = 1, 2, 3, …). and are first order systems and and are second order systems. and are closely related to and respectively in the polynomial hierarchy, and and are closely related to PSPACE and EXPTIME respectively. One of the most important problems in bounded arithmetic is whether the hierarchy of bounded arithmetic collapses, i.e. whether = or = for some i, or whether = , or whether is a conservative extension of S2 = ⋃i. These problems are relevant to the problems whether the polynomial hierarchy PH collapses or whether PSPACE = PH or whether PSPACE = EXPTIME. It was shown in [4] that = implies and consequently the collapse of the polynomial hierarchy. We believe that the separation problems of bounded arithmetic and the separation problems of computational complexities are essentially the same problem, and the solution of one of them will lead to the solution of the other.


1979 ◽  
Vol 57 (17) ◽  
pp. 1777-1782 ◽  
Author(s):  
Alastair D. Macdonald

The female inflorescence of Fagus grandifolia comprises two flowers; one flower terminates the first-order inflorescence axis, the other flower terminates the second-order inflorescence axis. Each flower is flanked by two cupular valves each of which arise in the axil of a bract. The two valves flanking the flower terminating the first-order inflorescence axis represent second-order inflorescence axes and the two valves flanking the flower terminating the second-order inflorescence axis represent third-order inflorescence axes. The four valves remain discrete. Each female flower of Quercus macrocarpa terminates a second-order inflorescence axis and is surrounded by a continuous cupule. The cupule first forms as two primordia in the axils of each of the two transversal second-order bracts. These cupular primordia represent third-order inflorescence branches. The cupule primordia become continuous about the pedicel by meristem extension. The cupules of Fagus and Quercus are homologous to the extent that they are modified axes of the inflorescence. This serves as a model to interpret the morphological nature of the fagaceous cupule.


2015 ◽  
Vol 2015 ◽  
pp. 1-10 ◽  
Author(s):  
Alexander DeTrano ◽  
Naghmeh Karimi ◽  
Ramesh Karri ◽  
Xiaofei Guo ◽  
Claude Carlet ◽  
...  

Masking countermeasures, used to thwart side-channel attacks, have been shown to be vulnerable to mask-extraction attacks. State-of-the-art mask-extraction attacks on the Advanced Encryption Standard (AES) algorithm target S-Box recomputation schemes but have not been applied to scenarios where S-Boxes are precomputed offline. We propose an attack targeting precomputed S-Boxes stored in nonvolatile memory. Our attack targets AES implemented in software protected by a low entropy masking scheme and recovers the masks with 91% success rate. Recovering the secret key requires fewer power traces (in fact, by at least two orders of magnitude) compared to a classical second-order attack. Moreover, we show that this attack remains viable in a noisy environment or with a reduced number of leakage points. Eventually, we specify a method to enhance the countermeasure by selecting a suitable coset of the masks set.


2006 ◽  
Vol 23 (5) ◽  
pp. 815-824 ◽  
Author(s):  
NICK BARRACLOUGH ◽  
CHRIS TINSLEY ◽  
BEN WEBB ◽  
CHRIS VINCENT ◽  
ANDREW DERRINGTON

We measured the responses of single neurons in marmoset visual cortex (V1, V2, and the third visual complex) to moving first-order stimuli and to combined first- and second-order stimuli in order to determine whether first-order motion processing was influenced by second-order motion. Beat stimuli were made by summing two gratings of similar spatial frequency, one of which was static and the other was moving. The beat is the product of a moving sinusoidal carrier (first-order motion) and a moving low-frequency contrast envelope (second-order motion). We compared responses to moving first-order gratings alone with responses to beat patterns with first-order and second-order motion in the same direction as each other, or in opposite directions to each other in order to distinguish first-order and second-order direction-selective responses. In the majority (72%, 67/93) of cells (V1 73%, 45/62; V2 70%, 16/23; third visual complex 75%, 6/8), responses to first-order motion were significantly influenced by the addition of a second-order signal. The second-order envelope was more influential when moving in the opposite direction to the first-order stimulus, reducing first-order direction sensitivity in V1, V2, and the third visual complex. We interpret these results as showing that first-order motion processing through early visual cortex is not separate from second-order motion processing; suggesting that both motion signals are processed by the same system.


Sign in / Sign up

Export Citation Format

Share Document