In order to protect “data-at-rest” in storage area networks from the risk of differential power analysis attacks without degrading performance, a high-throughput masked advanced encryption standard (AES) engine is proposed. However, this engine usually adopts the unrolling technique which requires extremely large field programmable gate array (FPGA) resources. In this brief, we aim to optimize the area for a masked AES with an unrolled structure. We achieve this by mapping its operations from to as much as possible. We reduce the number of mapping [ to ] and inverse mapping [ to ] operations of the masked SubBytes step from ten to one. In order to be compatible, the masked MixColumns, masked AddRoundKey, and masked ShiftRows including the redundant masking values are carried over . We also use FPGA block RAM (BRAM) to further reduce hardware resources. Compared with a state-of-the-art design, our implementation reduces the overall area by 36.2% (20.5% is contributed by the main method, and 15.7% is contributed by the BRAM optimization). It achieves 40.9-Gbits/s at 4.5-Mbits/s/slice on the Xilinx XC6VLX240T platform. We have attacked the iterative version of this masked AES in hardware. Results show that none of the bytes can be guessed from the masked AES with the collected 10 000 power traces, but 14 out of 16 bytes can be guessed from the unprotected AES with the same number of traces.

FPGA-Based 40.9-Gbits/s Masked AES With Area Optimization for Storage Area Network

In recent years, the study of lightweight symmetric ciphers has gained interest due to the increasing demand for security services in constrained computing environments, such as in the Internet of Things. However, when there are several algorithms to choose from and different implementation criteria and conditions, it becomes hard to select the most adequate security primitive for a specific application. This paper discusses the hardware implementations of Present, a standardized lightweight cipher called to overcome part of the security issues in extremely constrained environments. The most representative realizations of this cipher are reviewed and two novel designs are presented. Using the same implementation conditions, the two new proposals and three state-of-the-art designs are evaluated and compared, using area, performance, energy, and efficiency as metrics. From this wide experimental evaluation, to the best of our knowledge, new records are obtained in terms of implementation size and energy consumption. In particular, our designs result to be adequate in regards to energy-per-bit and throughput-per-slice.

Lightweight Hardware Architectures for the Present Cipher in FPGA

The HMAC algorithm is widely used to provide authentication and message integrity to digital communications However, if the HMAC algorithm is implemented in embedded hardware, it is vulnerable to side-channel attacks In this paper, we describe a DPA attack strategy for the HMAC algorithm, based on the SHA-2 hash function family Using an implementation on a commercial FPGA board, we show that such attacks are practical in reality In addition, we present a masked implementation of the algorithm, which is designed to counteract first-order DPA attacks

/pdf/differential-power-analysis-of-hmac-based-on-sha-2-and-1lo0j0t1x4.pdf

Differential power analysis of HMAC based on SHA-2, and countermeasures

A common countermeasure to thwart side-channel analysis attacks is algorithmic masking. For this, algorithms that mix Boolean and arithmetic operations need to either apply two different masking schemes with secure conversions or use dedicated arithmetic units that can process Boolean masked values. Several proposals have been published that can realize these approaches securely and efficiently in software. But to the best of our knowledge, no hardware design exists that fulfills relevant properties such as efficiency and security at the same time.

/pdf/arithmetic-addition-over-boolean-masking-198z17mpg5.pdf

Arithmetic Addition over Boolean Masking

Masking methods are popularly used to defend against power analysis attacks in embedded systems. Apart from power analysis attack, there also exists glitch attack when porting the design to gate level. In this paper, we firstly divided the existing masking methods into different types according to their functions, masking value and applications. Secondly, we compared different masked S-box hardware implementation. Finally, we proposed the masked AES encryption with 32-bit and 128-bit data path hardware implementation. The experimental results show that our proposed design takes up less hardware resources and has the ability to defend against differential power analysis(DPA) and glitch attacks.

FPGA based optimization for masked AES implementation

A new technique for Boolean random masking of the logic and operation in terms of nand logic gates is proposed and applied for masking the integer addition. The new technique can be used for masking arbitrary cryptographic functions and is more efficient than previously known techniques, recently applied to the Advanced Encryption Standard (AES). New techniques for the conversions from Boolean to arithmetic random masking and vice versa are also developed. They are hardware oriented and do not require additional random bits. Unlike the previous, software-oriented techniques showing a substantial difference in the complexity of the two conversions, they have a comparable complexity being about the same as that of one integer addition only. All the techniques proposed are in theory secure against the first-order differential power analysis on the logic gate level. They can be applied in hardware implementations of various cryptographic functions, including AES, (keyed) SHA-1, IDEA, and RC6

J.D. Golic

Papers

Techniques for Random Masking in Hardware