E􀀋ective and E􀀎cient Masking with Low Noise using Small-Mersenne-Prime Ciphers

Aug 24, 2026

Embedded devices in security applications are frequent targets for physical side-channel attacks, making side-channel resistance a key research challenge. Boolean masking schemes can provide strong guarantees by increasing security exponentially with the number of shares when leakage is sufficiently noisy and independent. However, on low-end devices this noise assumption often fails. The study proposes prime-field arithmetic encodings and evaluates an AES-prime cipher, showing major security gains with low-noise leakage and limited overhead on common MCUs and FPGAs, validated by Cortex-M3 and Xilinx Spartan-6 implementations.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages32

Reading Time1 h 21 min

AccessFree to download

Abstract

1 Introduction

Research question

Seed results

E􀀋ective and E􀀎cient Masking with Low Noise using Small-Mersenne-Prime Ciphers Lo􀁿􀀐c Masure 1[0000􀀀0003􀀀2978􀀀4067], Pierrick M􀀓eaux2[0000􀀀0001􀀀5733􀀀4341], Thorben Moos 1[0000􀀀0003􀀀3809􀀀9803], Fran􀀘cois-Xavier Standaert 1[0000􀀀0001􀀀7444􀀀0285] 1 Crypto Group, ICTEAM Institute, UCLouvain, Louvain-la-Neuve, Belgium. 2 Luxembourg University, SnT, Luxembourg. Abstract. Embedded devices used in security applications are natural targets for physical attacks. Thus, enhancing their side-channel resistance is an important research challenge. A standard solution for this purpose is the use of Boolean masking schemes, as they are well adapted to current block ciphers with e􀀎cient bitslice representations. Boolean masking guarantees that the security of an implementation grows exponentially in the number of shares under the assumption that leakages are su􀀎 -ciently noisy (and independent) . Unfortunately, it has been shown that this noise assumption is hardly met on low-end devices. In this paper, we therefore investigate techniques to mask cryptographic algorithms in such a way that their resistance can survive an almost complete lack of noise. Building on seed theoretical results of Dziembowski et al., we put forward that arithmetic encodings in prime 􀀌elds can reach this goal. We 􀀌rst exhibit the gains that such encodings lead to thanks to a simulated information theoretic analysis of their leakage (with up to six shares) . We then provide 􀀌gures showing that on platforms where optimized arithmetic adders and multipliers are readily available (i.e., most MCUs and FPGAs), performing masked operations in small to medium Mersenneprime 􀀌elds as opposed to binary extension 􀀌elds will not lead to notable implementation overheads. We compile these observations into a new AES-like block cipher, called AES-prime, which is well-suited to illustrate the remarkable advantages of masking in prime 􀀌elds. We also con􀀌rm the practical relevance of our 􀀌ndings by evaluating concrete software (ARM Cortex-M3) and hardware (Xilinx Spartan-6) implementations. Our experimental results show that security gains over Boolean masking (and, more generally, binary encodings) can reach orders of magnitude despite the same amount of information being leaked per share. 1 Introduction Research question. Masking is an important countermeasure against sidechannel attacks. Introduced in [46,27], it has attracted signi􀀌cant attention thanks to the strong security guarantees it can provide [53,76 ,36 ,37] . Since leading to e􀀎cient implementations in software [79, 13], bitslice software [47,49] and hardware [50,23], additive (Boolean) masking is for now the most investigated type of encoding. Concretely, assuming that the shares' leakage is su􀀎ciently noisy and independent, Boolean masking can amplify the noise of an implementation (and therefore its security) exponentially in the number of shares. Yet, and despite these strong theoretical guarantees, ensuring the noise and independence conditions may not be easy in practice. The independence issue is a well investigated one. Physical defaults such as glitches [61,62] or transitions [30,8] can cause leakage about re-combined shares. Fortunately, these defaults can be circumvented (at some cost) thanks to well understood design techniques [72,44 ,24] . To the best of our knowledge, the noise issue is for now a less investigated one. Concrete results of so-called horizontal attacks such as [12,20] showed that a lack of noise can lead to devastating attacks against Boolean masking. Improved security against horizontal attacks has been captured with the notion of noise rate [5,25] . But gadgets with limited noise rate only reduce the number of manipulations of the shares (in order to prevent reducing the noise by averaging) . Therefore, they have limited impact when the noise level of an implementation is already small without averaging, as it is for example the case for small embedded devices (e.g., 32-

FAQs

Why does Boolean masking weaken on low-end embedded devices?

Because the theoretical security relies on leakage being sufficiently noisy and independent, assumptions that are often not met on low-end platforms.

What is the paper’s main idea to achieve secure low-noise masking?

Use arithmetic encodings in prime fields (based on prime-order group results), aiming to preserve resistance even when noise is almost absent.

How are the proposed techniques validated experimentally?

By evaluating software and hardware implementations, including ARM Cortex-M3 and Xilinx Spartan-6, and comparing security gains and practical overheads versus Boolean masking.

Aug 24, 2026

Upload by นรินทร์