2
$\begingroup$

I was going through a side channel protection. It seems in the 3-shares (Appendix A) or 4-shares (Appendix B) has some computations that grows with the number of AND operations.

My question: Is there any standard metric by which I can measure the cost for side channel protection (under a given requirement, such as 3-shares) for an Exclusive-OR operation and an AND operation? Something like, 'For 3-shares, the cost for an Exclusive-OR operation is 3 Gate Equivalents and that of an AND operation is 5 Gate Equivalents. This grows to respectively 6 and 12 for 4-shares'.

Improve this question
$\endgroup$
1

1 Answer 1

Reset to default
1
$\begingroup$

For ISW masking scheme and its variants, for an AND on $t$ shares you would need $O(t^2)$ operations, while for XOR it's simply XOR of the shares componentwise, so $t$ XORs. Furthermore, for AND you need to refresh shares by using fresh randomness (there are works trying to reduce the necessary number of refreshes for a given circuit, and so this quantity depends on the circuit being protected).

Concrete numbers of gates depend on the masking scheme and the scenario (e.g. masking bits or masking field elements, how randomness is generated, are glitches considered, etc.).

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.