Gaston is a cryptographic permutation introduced by El Hirch et al. at Crypto 2023. It uses the same number of bitwise operations as Ascon-p, the core permutation of the NIST-selected standard for lightweight authenticated encryption Ascon. Despite this similarity in complexity, Gaston provides stronger resistance to differential and linear cryptanalysis, making it a promising option for lightweight cryptographic applications. In this work, we evaluate the hardware performance of Gaston and Ascon-p, and conduct power side-channel analysis on the initialization phase of Ascon when instantiated with each permutation on an FPGA. We propose a majority voting technique that leverages the structure of Ascon-p, where the diffusion layer follows the non-linear layer. This method improves the key recovery success rate for Ascon instantiated with Ascon-p, even with fewer traces than in previous studies. To explore the role of layer ordering, we also consider a modified version of Gaston, named Gaston-R, in which the non-linear and diffusion layers are swapped. While this modification does not affect theoretical security, it may influence both the hardware cost and the effectiveness of the specific side-channel attack applied in this study. Our hardware analysis shows a small overhead for Gaston-R, and the side-channel results indicate noticeably reduced key recovery success compared to the original Gaston. To our knowledge, this is the first work to investigate how layer ordering impacts the complexity of side-channel attacks of this kind. Our findings suggest that this aspect may deserve further exploration in the design of side-channel-aware cryptographic permutations.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Comparing Gaston with Ascon-p: Side-Channel Analysis and Hardware Evaluation

  • Parisa Amiri Eliasi,
  • Lejla Batina,
  • Silvia Mella

摘要

Gaston is a cryptographic permutation introduced by El Hirch et al. at Crypto 2023. It uses the same number of bitwise operations as Ascon-p, the core permutation of the NIST-selected standard for lightweight authenticated encryption Ascon. Despite this similarity in complexity, Gaston provides stronger resistance to differential and linear cryptanalysis, making it a promising option for lightweight cryptographic applications. In this work, we evaluate the hardware performance of Gaston and Ascon-p, and conduct power side-channel analysis on the initialization phase of Ascon when instantiated with each permutation on an FPGA. We propose a majority voting technique that leverages the structure of Ascon-p, where the diffusion layer follows the non-linear layer. This method improves the key recovery success rate for Ascon instantiated with Ascon-p, even with fewer traces than in previous studies. To explore the role of layer ordering, we also consider a modified version of Gaston, named Gaston-R, in which the non-linear and diffusion layers are swapped. While this modification does not affect theoretical security, it may influence both the hardware cost and the effectiveness of the specific side-channel attack applied in this study. Our hardware analysis shows a small overhead for Gaston-R, and the side-channel results indicate noticeably reduced key recovery success compared to the original Gaston. To our knowledge, this is the first work to investigate how layer ordering impacts the complexity of side-channel attacks of this kind. Our findings suggest that this aspect may deserve further exploration in the design of side-channel-aware cryptographic permutations.