Masking is one of the most popular countermeasures to protect implementations against power and electromagnetic side-channel attacks because it offers provable security.Masking has been shown secure against d-threshold probing adversaries by Ishai et al. at CRYPTO'03, but this adversary's model doesn't consider any physical hardware defaults and thus such masking schemes were shown to be still vulnerable when implemented as hardware circuits.To address these limitations glitch-extended probing adversaries and correspondingly glitch-immune masking schemes have been introduced.This paper introduces glitch-stopping circuits, which coincide with circuits protected via glitch-immune masking when instantiated with registers.Then we show that one can instantiate glitch-stopping circuits without registers by using clocked logic gates or latches.This is illustrated for both ASIC and FPGA, offering a promising alternative to conventional register-based masked implementations.Compared to the traditional register-based approach, these register-free solutions can reduce the latency to a single cycle and achieve a lower area cost.We prove and experimentally confirm that the proposed solution is as secure as the register-based one.In summary, this paper proposes a novel method to address the latency of register-based hardware masking without jeopardizing their security.This method not only reduces the latency down to one clock cycle but also improves the area costs of the implementations. CCS CONCEPTS• Security and privacy → Side

Car-to-car and car-to-infrastructure messages exchanged in intelligent transportation systems can reach reception rates over 1000 messages per second. As these messages contain elliptic curve digital signature algorithm (ECDSA) signatures, this puts a very heavy load onto the verification hardware. In fact, the load is so high that, currently, it can only be achieved by implementations running on high-end CPUs and field-programmable gate arrays. These implementations are far from cost-effective or energy efficient. In this paper, we present an application-specified integrated circuit implementation of a dedicated ECDSA verification engine that can reach verification rates of up to 27 000 verifications per second, which is by far the fastest implementation on a single core reported in the literature.

Embedded cryptographic devices are vulnerable to power analysis attacks. Threshold implementations (TIs) provide provable security against first-order power analysis attacks for hardware and software implementations. Like masking, the approach relies on secret sharing but it differs in the implementation of logic functions. While masking can fail to provide protection due to glitches in the circuit, TIs rely on few assumptions about the hardware and are fully compatible with standard design flows. We investigate two important properties of TIs in detail and point out interesting trade-offs between circuit area and randomness requirements. We propose two new TIs of AES that, starting from a common previously published implementation, illustrate possible trade-offs. We provide concrete ASIC implementation results for all three designs using the same library, and we evaluate the practical security of all three designs on the same FPGA platform. Our analysis allow us to directly compare the security provided by the different trade-offs, and to quantify the associated hardware cost.

A new cryptographic hash function Whirlwind is presented. We give the full specification and explain the design rationale. We show how the hash function can be implemented efficiently in software and give first performance numbers. A detailed analysis of the security against state-of-the-art cryptanalysis methods is also provided. In comparison to the algorithms submitted to the SHA-3 competition, Whirlwind takes recent developments in cryptanalysis into account by design. Even though software performance is not outstanding, it compares favourably with the 512-bit versions of SHA-3 candidates such as LANE or the original CubeHash proposal and is about on par with ECHO and MD6.

Luo and Lu proposed URSA proactive signature scheme, the core of which is based on a new threshold signature protocol - the so-called t-bounded offsetting algorithm. Jarecki et al. have shown that the t-bounded offsetting algorithm leaks information for the shared secret which can be extended to a key-recovery attack on the URSA proactive signature scheme. Jarecki and Saxena proposed a fix to the scheme of Luo and Lu, turning it to a provably secure proactive RSA signature scheme. The authors also posed two open questions on the proactive RSA signature schemes. In this paper we give a solution to the second open problem posed by Jarecki and Saxena. Namely, we propose a proactive RSA signature scheme which does not require all participants to be active in the signature generation protocol.