1
$\begingroup$

There is this cool paper https://eprint.iacr.org/2017/395.pdf exposing a side channel protected implementation of keccak, in particular Domain Oriented Masking for the Chi function. The Chi function is a 5bit S-Box, so can also be seen as a lookup table of 32 5bit values. My question is, in an hardware implementation with no cache allowing a cache attack (I guess), why bother implementing the masked algebraic version of Chi instead of a straightforward LUT? Is it for security? Gate count? Performances? As you may have guessed, I'm not a hardware designer...

$\endgroup$
3
  • 1
    $\begingroup$ "The Chi function is a 5bit S-Box"; huh? The Chi step uses the operation (in C): x(new) = x ^ (~y & z); that's either 2 or 3 bits (depending on whether you include the xor in the sbox). In any case, either in software or in hardware, masked or unmasked, a LUT wouldn't make sense - it'd be a lot easier in both cases to use the straightforward logic. $\endgroup$
    – poncho
    Jul 12, 2023 at 12:42
  • $\begingroup$ I meant a row is 5 bits, that will be substituted by another 5 bits, which leaves 2^5 possibilities. $\endgroup$
    – Gux
    Jul 12, 2023 at 19:05
  • 1
    $\begingroup$ Ok, in that case: for hardware, doing it directly (for 5 entries) would take 10-15 gates, while a 5 bit S-box would take circa 100 gates. You do the math... $\endgroup$
    – poncho
    Jul 12, 2023 at 19:57

1 Answer 1

1
$\begingroup$

Using a masked version of some function is for security; specifically here, for secrecy of what's hashed, which is secret when Keccak is used to build a MAC, or when it's hashed some secret towards signing it.

Gate count and performance are rather harmed by masking, thus are not the goal of masking. Rather, masking strives to not too much harm gate count and performance.

Indeed, natural implementation of a 5-bit S-box would use no cache, and thus be immune from cache-related attacks.

$\endgroup$
2
  • $\begingroup$ Thanks for our comment. It occurs also to me that masking harms performances and gate count. This is why I thought that a hardwired substitution table could make sense. But thinking more about it, I realized that this substitution has to occur for the 5 rows of a slice, and for the 64 slices, preferably at the same time. Maybe this is why an algebraic implementation is more efficient in hardware? But I still wonder, for a single substitution, if an hardware 5 bit lookup table implementation would be susceptible of leakage. $\endgroup$
    – Gux
    Jul 12, 2023 at 19:14
  • $\begingroup$ @gux masking doesn't necessarily harm performance because often you pass S and /S. Also, considering how terrible un-hinted routers are, every time you recompile, you'll get a different power number. I found that paper to be uninspired as there was nothing new there. $\endgroup$
    – b degnan
    Aug 11, 2023 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.