Let’s Share a Secret: Share-Reduced Design of M&M for the AES S-Box
摘要
Masks and Macs (M&M), proposed at TCHES 2019, is a powerful countermeasure against physical attacks. This scheme combines masking and circuit duplication with information-theoretic MAC tags. Specifically, masking mitigates side-channel analysis, while circuit redundancy protects against fault analysis. However, it was reported that the AES encryption circuit protected by M&M is vulnerable to zero-value attacks, and an extended countermeasure was proposed to address this issue. Counteracting the attacks is mandatory due to their ease of execution, but this proposed method requires additional circuits to detect faults. While the implementation cost remains reasonable for lower-security-order designs, it becomes considerable for higher-security-order implementations. In this paper, we propose an area-efficient implementation of M&M that reduces the number of shares while preserving its functionality. We focus on the S-box and compare our approach’s security and implementation cost to the original M&M. Furthermore, we discuss the limitations of share reduction in maintaining the security of the original M&M scheme.