Side-Channel Analysis (SCA) constitutes a serious threat to the security of implemented cryptosystems. In SCA, the attacker can obtain information leakage from a device executing cryptographic algorithms by means of the measure of side-channels such as power consumption, electromagnetic radiation and execution time. For this reason, effective countermeasures against SCA are indispensable in implemented cryptographic devices. The use of masking schemes (in which intermediate computations are independent from the sensible input data) constitutes the most effective approach to achieve resistance against physical attacks. Among the different masking methods proposed for hardware, domain-oriented masking is one of the most promising due to its lower implementation costs, level of security and glitch resistance. In this paper, a new bit-parallel first-order domain-oriented masked finite field multiplier is presented which incorporates the addition of fresh random values without increasing the computation delay. Explicit expressions for the computation of the new masked multiplier for the binary extension field used in the Advanced Encryption Standard (AES) are also given.

Threshold implementation is a method based on secret sharing to secure cryptographic ciphers (and in particular S-boxes) against differential power analysis side-channel attacks which was proposed by Nikova, Rechberger, and Rijmen in 2006. Until now, threshold implementations were only constructed for specific types of functions and some small S-boxes, but no generic construction was ever presented. In this paper, we present the first universal threshold implementation with$t+2$shares that is applicable to any bijective S-box, where$t$is its algebraic degree (or is larger than the algebraic degree). While being universal, our construction is also optimal with respect to the number of shares, since the theoretically smallest possible number,$t+1$, is not attainable for some bijective S-boxes. Our results enable low latency secure hardware implementations without the need for additional randomness. In particular, we apply this result to find two uniform sharings of the AES S-box. The first sharing is obtained by using the threshold implementation of the inversion in$\mathbb {F}_{2^{8}}$and the second by using two threshold implementations of two cubic power permutations that decompose the inversion. Area and performance figures for hardware implementations are provided.

In this paper, we introduce a second-order masking of the AES using the minimal number of shares and a total of 1268 bits of randomness including the sharing of the plaintext and key. The masking of the S-box is based on the tower field decomposition of the inversion over bytes where the changing of the guards technique is used in order to re-mask the middle branch of the decomposition. The sharing of the S-box is carefully crafted such that it achieves first-order probing security without the use of randomness and such that the sharing of its output is uniform. Multi-round security is achieved by re-masking the state where we use a theoretical analysis based on the propagation of probed information to reduce the demand for fresh randomness per round. The result is a second-order masked AES which competes with the state-of-the-art in terms of latency and area, but reduces the randomness complexity over eight times over the previous known works. In addition to the corresponding theoretical analysis and proofs for the security of our masked design, it has been implemented on FPGA and evaluated via lab analysis.