Splitting up sensitive data into multiple shares – termed masking – has proven an effective countermeasure against various types of Side-Channel Analysis (SCA) on cryptographic implementations. However, in software this approach leads to dramatic performance overheads for non-linear operations. This problem can be addressed with hardware accelerators particularly designed to process masked data securely. In this context, Gao et al.  [24] presented a RISC-V Instruction Set Extension (ISE) with masked Boolean and arithmetic instructions to accelerate masked software implementations of block ciphers. In this work, we demonstrate how this ISE can be applied to and extended for Post-Quantum Cryptography (PQC) components, forming a crypto-agile solution. We provide masked implementations based on three different ISE constellations for multiple highly relevant components, including Cumulative Distribution Table (CDT) sampling and polynomial rotation. With the masked instructions, we measure speedups of up to a factor 4.2 compared to sophisticated bitsliced implementations and even up to more than two orders of magnitude for non-bitsliced implementations. We assert the first-order security of our new instructions with a practical evaluation.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

To Extend or Not to Extend: Agile Masking Instructions for PQC

  • Markus Krausz,
  • Georg Land,
  • Florian Stolz,
  • Jan Richter-Brockmann,
  • Tim Güneysu

摘要

Splitting up sensitive data into multiple shares – termed masking – has proven an effective countermeasure against various types of Side-Channel Analysis (SCA) on cryptographic implementations. However, in software this approach leads to dramatic performance overheads for non-linear operations. This problem can be addressed with hardware accelerators particularly designed to process masked data securely. In this context, Gao et al.  [24] presented a RISC-V Instruction Set Extension (ISE) with masked Boolean and arithmetic instructions to accelerate masked software implementations of block ciphers. In this work, we demonstrate how this ISE can be applied to and extended for Post-Quantum Cryptography (PQC) components, forming a crypto-agile solution. We provide masked implementations based on three different ISE constellations for multiple highly relevant components, including Cumulative Distribution Table (CDT) sampling and polynomial rotation. With the masked instructions, we measure speedups of up to a factor 4.2 compared to sophisticated bitsliced implementations and even up to more than two orders of magnitude for non-bitsliced implementations. We assert the first-order security of our new instructions with a practical evaluation.