Threshold Implementation (TI) is a well-known Boolean masking technique that provides provable security against side-channel attacks. In the presence of glitches, the probing model was replaced by the so-called glitch-extended probing model which specifies a broader security framework. In CHES 2021, Shahmirzadi et al. introduced a general search method for finding first-order 2-share TI schemes without fresh randomness (under the presence of glitches) for a given encryption algorithm. Although it handles well single-output Boolean functions, this method has to store output shares in registers when extended to vector Boolean functions, which results in more chip area and increased latency. Therefore, the design of TI schemes that have low implementation cost under the glitch-extended probing model appears to be an important research challenge. In this paper, we propose an approach to design the first-order glitch-extended probing secure TI schemes when quadratic functions are employed in the substitution layer. This method only requires a small amount of fresh random bits and a single clock cycle for its implementation. In particular, the random bits in our approach are reusable and compatible with the changing of the guards technique. Our dedicated TI scheme for the AES cipher gives 20.23% smaller implementation area and 4.2% faster encryption compared to the TI scheme of AES (without using fresh randomness) proposed in CHES 2021. Additionally, we propose a parallel implementation of two S-boxes that further reduces latency (about 39.83%) at the expense of increasing the chip area by 9%. We have positively confirmed the security of AES under the glitch-extended probing model using the verification tool -SILVER and the side-channel leakage assessment method -TVLA.

Statistical tests for randomness play an essential role in cryptography, but the reliability of these tests is rarely taken into account, which may mislead our judgement of randomness especially with extremely large samples. In this paper, we make a two-stage error analysis of the commonly used two-level randomness tests in the NIST SP 800-22 test suite. Especially, we give the estimates of thep-value deviations of chi-square approximation in the basic tests based on our proposed continuity constraints, and mathematically express the reliability of uniformity test used in the test suite with the fact of noncentral chi-square approximation. Finally, we analyze the respective error factors and derive the corresponding probability deviation estimation for the tests, explaining some false positive issues in practical test experiments. With our derived error analysis models, one can get a more reliable randomness test strategy with extremely large samples and wider parameter selections.

SIMON is a new family of lightweight block ciphers proposed by the National Security Agency (NSA) in 2013. Since its publication, it has attracted much research interest and a number of analysis results have been presented. As a popular kind of implementation attack method, the fault attack also works when it is applied to SIMON. In this paper, we propose an effective fault attack on SIMON under the random byte fault model. Compared with the previous attack results, our attack can successfully recover the whole master key with injecting the faults into only one intermediate round for six instances of SIMON. In our attack, we fully utilize a class of differential propagation properties of SIMON to determine the fault injection position as long as the full diffusion of the fault has not been obtained. On the basis of it, we can recover the last round key with the differential analysis technique. The differential propagation properties make it possible to inject the faults into the earlier intermediate round at the beginning than that of the previous attacks. Meanwhile, the same faulty ciphertext set can also help to recover other round keys. So we do not have to inject the faults into any other intermediate rounds to reveal the whole master key. Moreover, in this paper we also give a detailed mathematical analysis on the average number of the fault injections under the random byte fault model. The data complexity analysis shows that less fault injections are required in our attack compared with other work under the same attack model. Finally, we also verify the effectiveness and correctness of our attack with experiments.