To Extend or Not to Extend: Agile Masking Instructions for PQC
摘要
Splitting up sensitive data into multiple shares – termed masking – has proven an effective countermeasure against various types of Side-Channel Analysis (SCA) on cryptographic implementations. However, in software this approach leads to dramatic performance overheads for non-linear operations. This problem can be addressed with hardware accelerators particularly designed to process masked data securely. In this context, Gao et al. [24] presented a RISC-V Instruction Set Extension (ISE) with masked Boolean and arithmetic instructions to accelerate masked software implementations of block ciphers. In this work, we demonstrate how this ISE can be applied to and extended for Post-Quantum Cryptography (PQC) components, forming a crypto-agile solution. We provide masked implementations based on three different ISE constellations for multiple highly relevant components, including Cumulative Distribution Table (CDT) sampling and polynomial rotation. With the masked instructions, we measure speedups of up to a factor 4.2 compared to sophisticated bitsliced implementations and even up to more than two orders of magnitude for non-bitsliced implementations. We assert the first-order security of our new instructions with a practical evaluation.