Masking is one of the most popular countermeasures to protect implementations against power and electromagnetic side-channel attacks because it offers provable security.Masking has been shown secure against d-threshold probing adversaries by Ishai et al. at CRYPTO'03, but this adversary's model doesn't consider any physical hardware defaults and thus such masking schemes were shown to be still vulnerable when implemented as hardware circuits.To address these limitations glitch-extended probing adversaries and correspondingly glitch-immune masking schemes have been introduced.This paper introduces glitch-stopping circuits, which coincide with circuits protected via glitch-immune masking when instantiated with registers.Then we show that one can instantiate glitch-stopping circuits without registers by using clocked logic gates or latches.This is illustrated for both ASIC and FPGA, offering a promising alternative to conventional register-based masked implementations.Compared to the traditional register-based approach, these register-free solutions can reduce the latency to a single cycle and achieve a lower area cost.We prove and experimentally confirm that the proposed solution is as secure as the register-based one.In summary, this paper proposes a novel method to address the latency of register-based hardware masking without jeopardizing their security.This method not only reduces the latency down to one clock cycle but also improves the area costs of the implementations. CCS CONCEPTS• Security and privacy → Side

With the enormous increase in portable cryptographic devices, physical attacks are becoming similarly popular. One of the most common physical attacks is Side-Channel Analysis (SCA), extremely dangerous due to its non-invasive nature. Threshold Implementations (TI) was proposed as the first countermeasure to provide provable security in masked hardware implementations. While most works on hardware masking are focused on optimizing the area requirements, with the newer and smaller technologies area is taking a backseat, and lowlatency is gaining importance. In this work, we revisit the scheme proposed by Arribas et al. in TCHES 2018 to secure unrolled implementations. We formalize and expand this methodology, to devise a masking scheme, derived from TI, designed to secure hardware implementations optimized for latency named Low-Latency Threshold Implementations (LLTI). By applying the distributive property and leveraging a divide-and-conquer strategy, we split a non-linear operation in layers which are masked separately. The result is a more efficient scheme than the former TI for any operation of algebraic degree greater than two, achieving great optimizations both in terms of speed and area. We compare the performance of first-order LLTI with first-order TI in securing a cubic gate and a degree-7 AND gate without using any registers in between. We achieve a 137% increase in maximum frequency and a 60% reduction in area for the cubic gate, and 3131 times reduction in area in the case of a degree-7 AND gate compared to TI. To further illustrate the power of our scheme we take a low-latency PRINCE implementation from the literature and, by simply changing the secure S-box with the LLTI version, we achieve a 46% max. frequency improvement and a 38% area reduction. Moreover, we apply LLTI to a secure a low-latency AES implementation and compare it with the TI version, achieving a 6.9 times max. freq. increase and a 47.2% area reduction.