# Does clustering the AES Sbox look up table to 32 bit entry per index, help reduce vulnerability to cache timing attacks?

I've been searching for some, easy methods to help mitigate, a cache timing attack on software AES implementations.

Currently, my implementation uses, a usual 256 byte S-box

uint8_t sbox[256] = {0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30... /* and so on*/}


My goal as a developer, is to prevent/increase difficulty for an attacker to know the substitutions or the result of substitutions as a result of the AES SubBytes() operation.

This is a solution that I devised: Rather than using a 256 entry Sbox table, I decided to cluster the Sbox table into a 32 bit per entry table, where four bytes are grouped to form an unsigned integer, like this:

uint32_t sboxu32[64] = {0x637C777B, 0xF26B6FC5,  /* and so on */}


Now if I want to get the S-box substitution, for a byte x : I do ExtractByte(sboxu32[x>>2], x&3) where, ExtractByte is :

#define ExtractByte(x, n) (uint8_t)(((x) >> (24 - 8 * (n))) & 0xff)


Now, this is my reason for doing this, hoping that the above modifications will help protect my implementation from cache timing attack, without impacting my performance.

For every access to the entry of sboxu32, I'm accessing the index x>>2 which is the truncated division of x by 4, Assuming that the attacker does not have any knowledge of x&3 , can the above modifications increase the difficulty for the attacker ? If the attacker knows x >> 2 , then there are 4 possibilities for the exact x and hence x&3 , Since AES operates on 16 byte blocks, I'm guessing the attacker would have to guess $$4^{16}$$ for the correct sequence of bytes.

• I realize that it is trivially brute forceable, but are there other methods, to, use this as a starting point, to build further camouflage my access to the actual sbox substitutions, without impacting performance?
• Are there better performance friendly methods to mitigate side channel attacks on my AES implementation ?

Every help will be greatly appreciated!

• I tried another method to eliminate lookup table in my implementation: #define SboxU32(x) ((0x637C777B) * (x==0) ) ^ ((0xF26B6FC5) *(x==1)) ^ .... and so on...  , but it's very performance draining, since all 64 conditional statements are checked and the expression evaluated ! Can you please suggest methods to improve it ? Commented May 16, 2020 at 17:21