Time-Memory Trade-Offs for Side-Channel Resistant Implementations of Block Ciphers

详细信息    查看全文

• 关键词：Side ; channel attacks ; Masking ; S ; box compression ; Time ; memory trade ; off ; AES ; 128
• 刊名：Lecture Notes in Computer Science
• 出版年：2017
• 出版时间：2017
• 年：2017
• 卷：10159
• 期：1
• 页码：115-130
• 丛书名：Topics in Cryptology ?CT-RSA 2017
• ISBN：978-3-319-52153-4
• 卷排序：10159

文摘

Currently, the most efficient first-order masked implementations use the classical randomized table countermeasure, which induces a penalty factor of around 2–3 in execution time compared to an unmasked implementation. However, an S-box with n-bit input and m-bit output requires \(2^nm\) bit memory; for example, AES requires 256 bytes of RAM. Conversely, generic S-box computation method due to Rivain-Prouff requires almost no memory, but the penalty factor to achieve first-order resistance is roughly 30–35. Therefore, we suggest studying time-memory trade-offs for block-cipher implementations based on an adaptation of a table compression technique proposed by IBM. We use the similar approach to study time-memory trade-offs for second-order masked implementations as well. We show that for the case of AES, reasonably efficient implementations can be obtained with just 40 bytes of RAM in both the cases and hence they can be used in highly memory constrained devices.