Open AccessRedundancy AES Masking Basis for Attack Mitigation (RAMBAM)
Author(s) -
Yaacov Belenky,
Vadim Bugaenko,
Leonid Azriel,
Hennadii Chernyshchyk,
Ira Dushar,
Oleg Karavaev,
Oleh Maksimenko,
Yulia Ruda,
Valery Teper,
Yury Kreimer
Publication year - 2022
Publication title -
iacr transactions on cryptographic hardware and embedded systems
Language(s) - English
Resource type - Journals
ISSN - 2569-2925
DOI - 10.46586/tches.v2022.i2.69-91
Subject(s) - field programmable gate array , side channel attack , computer science , robustness (evolution) , advanced encryption standard , masking (illustration) , embedded system , computer engineering , cryptography , computer security , art , biochemistry , chemistry , visual arts , gene
In this work, we present RAMBAM, a novel concept of designing countermeasures against side-channel attacks and the Statistical Ineffective Fault Attack (specifically SIFA-1) on AES that employs redundant representations of finite field elements. From this concept, we derive a family of protected hardware implementations of AES. A fundamental property of RAMBAM is a security parameter d that along with other attributes of the scheme allows for making trade-offs between gate count, maximal frequency, performance, level of robustness to the first and higher-order side-channel attacks, and protection against SIFA-1. We present an analytical model that explains how the scheme reduces the leakage and how the design choices affect it. Furthermore, we demonstrate experimentally how different design choices achieve the required goals. In particular, the compact version exhibits a gate count as low as 12.075 kGE, while maintaining adequate protection. The performance-oriented version provides latency as low as one round per cycle, thus combining protection against SCA and SIFA-1 with high performance which is one of the original design goals of AES. Finally, we assess the leakage of the scheme for the first and the second (bivariate) orders using TVLA methodology on an FPGA implementation and observe resilience to at least 348M traces with 16 Sboxes.