Skip to main content
SpringerLink
Log in

Decomposed S-Boxes and DPA Attacks: A Quantitative Case Study Using PRINCE

  • Conference paper
  • First Online:
Security, Privacy, and Applied Cryptography Engineering (SPACE 2016)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 10076))

Abstract

Lightweight ciphers become indispensable and inevitable in the ubiquitous smart devices. However, the security of ciphers is often subverted by various types of attacks, especially, implementation attacks such as side-channel attacks. These attacks emphasise the necessity of providing efficient countermeasures. In this paper, our contribution is threefold: First, we propose a method to choose the efficient decomposition of S-box in terms of area. Then we slightly alter the widely used formula to improve the accuracy for weighted sum estimation of the shared S-Box and present the practical implementation of two level decomposition using PRINCE S-Box. Finally, we present the first quantitative study on the efficacy of Transparency Order (TO) of decomposed S-Boxes in thwarting a side-channel attack. For PRINCE S-Box we observe that TO-based decomposed implementation has better DPA resistivity than the naive implementation. To benchmark the DPA resistivity of TO(decomposed S-Box) implementation we arrive at an efficient threshold implementation of PRINCE, which itself merits to be an interesting contribution.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Bilgin, B.: Threshold Implementations: As Countermeasure Against Higher-Order Differential Power Analysis. Ph.D. thesis, KU Leuven and UTwente (2015). Pieter Hartel and Vincent Rijmen (promotors)

    Google Scholar 

  2. Borghoff, J., Canteaut, A., Güneysu, T., Kavun, E.B., Knezevic, M., Knudsen, L.R., Leander, G., Nikov, V., Paar, C., Rechberger, C., Rombouts, P., Thomsen, S.S., Yalçın, T.: PRINCE – a low-latency block cipher for pervasive computing applications. In: Wang, X., Sako, K. (eds.) ASIACRYPT 2012. LNCS, vol. 7658, pp. 208–225. Springer, Heidelberg (2012). doi:10.1007/978-3-642-34961-4_14

    Chapter  Google Scholar 

  3. Carlet, C.: On highly nonlinear S-boxes and their inability to thwart DPA attacks. In: Maitra, S., Veni Madhavan, C.E., Venkatesan, R. (eds.) INDOCRYPT 2005. LNCS, vol. 3797, pp. 49–62. Springer, Heidelberg (2005). doi:10.1007/11596219_5

    Chapter  Google Scholar 

  4. Chakraborty, K., Sarkar, S., Maitra, S., Mazumdar, B., Mukhopadhyay, D., Prouff, E.: Redefining the transparency order. In: WCC2015 - 9th International Workshop on Coding and Crypography 2015 (2015)

    Google Scholar 

  5. Kocher, P., Jaffe, J., Jun, B.: Differential power analysis. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 388–397. Springer, Heidelberg (1999). doi:10.1007/3-540-48405-1_25

    Google Scholar 

  6. Kutzner, S., Nguyen, P.H., Poschmann, A., Wang, H.: On 3-share threshold implementations for 4-bit S-boxes. In: Prouff, E. (ed.) COSADE 2013. LNCS, vol. 7864, pp. 99–113. Springer, Heidelberg (2013). doi:10.1007/978-3-642-40026-1_7

    Chapter  Google Scholar 

  7. Leander, G., Poschmann, A.: On the classification of 4 bit S-boxes. In: Carlet, C., Sunar, B. (eds.) WAIFI 2007. LNCS, vol. 4547, pp. 159–176. Springer, Heidelberg (2007). doi:10.1007/978-3-540-73074-3_13

    Chapter  Google Scholar 

  8. Mazumdar, B., Mukhopadhyay, D., Sengupta, I.: Constrained search for a class of good bijective S-boxes with improved DPA resistivity. IEEE Trans. Inf. Forensics Secur. 8(12), 2154–2163 (2013)

    Article  Google Scholar 

  9. Mazumdar, B., Mukhopadhyay, D., Sengupta, I.: Design and implementation of rotation symmetric S-boxes with high nonlinearity and high DPA resilience. In: 2013 IEEE International Symposium on Hardware-Oriented Security and Trust, HOST 2013, pp. 87–92. IEEE Computer Society (2013)

    Google Scholar 

  10. Nikova, S., Rijmen, V., Schläffer, M.: Secure hardware implementation of non-linear functions in the presence of glitches. In: Lee, P.J., Cheon, J.H. (eds.) ICISC 2008. LNCS, vol. 5461, pp. 218–234. Springer, Heidelberg (2009). doi:10.1007/978-3-642-00730-9_14

    Chapter  Google Scholar 

  11. Nikova, S., Rechberger, C., Rijmen, V.: Threshold implementations against side-channel attacks and glitches. In: Ning, P., Qing, S., Li, N. (eds.) ICICS 2006. LNCS, vol. 4307, pp. 529–545. Springer, Heidelberg (2006). doi:10.1007/11935308_38

    Chapter  Google Scholar 

  12. Petkova-Nikova, S.: TI Tools for the 3 x 3 and 4 x 4 S-boxes. http://homes.esat.kuleuven.be/~snikova/ti_tools.html. Accessed April 2016

  13. Picek, S., Ege, B., Batina, L., Jakobovic, D., Chmielewski, L., Golub, M.: On using genetic algorithms for intrinsic side-channel resistance: the case of AES s-box. In: Knoop, J., Salapura, V., Koren, I., Pelosi, G. (eds.), Proceedings of the First Workshop on Cryptography and Security in Computing Systems (CS2@HiPEAC) 2014, pp. 13–18. ACM (2014)

    Google Scholar 

  14. Picek, S., Ege, B., Papagiannopoulos, K., Batina, L., Jakobovic, D.: Optimality and beyond: the case of 4 * 4 s-boxes. In: 2014 IEEE International Symposium on Hardware-Oriented Security and Trust, HOST 2014, pp. 80–83. IEEE Computer Society (2014)

    Google Scholar 

  15. Poschmann, A., Moradi, A., Khoo, K., Lim, C.-W., Wang, H., Ling, S.: Side-channel resistant crypto for less than 2,300 GE. J. Cryptology 24(2), 322–345 (2010)

    Article  MathSciNet  MATH  Google Scholar 

  16. Prouff, E.: DPA attacks and S-boxes. In: Gilbert, H., Handschuh, H. (eds.) FSE 2005. LNCS, vol. 3557, pp. 424–441. Springer, Heidelberg (2005). doi:10.1007/11502760_29

    Chapter  Google Scholar 

  17. Saarinen, M.-J.O.: Cryptographic analysis of all 4\(\times \)4-bit S-boxes. In: Miri, A., Vaudenay, S. (eds.) SAC 2011. LNCS, vol. 7118, pp. 118–133. Springer, Heidelberg (2012). doi:10.1007/978-3-642-28496-0_7

    Chapter  Google Scholar 

  18. Sasdrich, P., Moradi, A., Güneysu, T.: Affine equivalence and its application to tightening threshold implementations. Cryptology ePrint Archive, Report 2015/749 (2015). http://eprint.iacr.org/

  19. Selvam, R., Shanmugam, D., Annadurai, S.: Vulnerability analysis of prince and rectangle using CPA. In: Proceedings of the 1st ACM Workshop on Cyber-Physical System Security, CPSS 2015, pp. 81–87. ACM (2015)

    Google Scholar 

Download references

Acknowledgments

This Research work was funded by Department of Atomic Energy (DAE), Govt. of India under the grant 12-R&D-IMS-5.01.0204. We would like to thank Prof. Svetla Nikova and anonymous reviewers for their useful comments.

Author information

Authors and Affiliations

  1. Society for Electronic Transactions and Security, Chennai, India

    Ravikumar Selvam, Dillibabu Shanmugam, Suganya Annadurai & Jothi Rangasamy

Authors
  1. Ravikumar Selvam
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Dillibabu Shanmugam
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Suganya Annadurai
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Jothi Rangasamy
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding authors

Correspondence to Ravikumar Selvam , Dillibabu Shanmugam , Suganya Annadurai or Jothi Rangasamy .

Editor information

Editors and Affiliations

  1. Universities of Paris 8 and Paris 13, LAGA, Paris, France

    Claude Carlet

  2. University of Waterloo, Waterloo, Ontario, Canada

    M. Anwar Hasan

  3. CRRao AIMSCS, Hyderabad, India

    Vishal Saraswat

A TI Solution

A TI Solution

This section elaborates the selection of efficient solution and its implementation approach.

Fig. 8.
figure 8

Architecture of PRINCE non-linear function with TI

Full size image

The Architecture of PRINCE non-linear function with the decomposition is depicted in Fig. 8. The weighted sum were calculated for 644 decomposed function and the value of the efficient function is given in Table 7. To implement the TI countermeasures on PRINCE non-linear function 766 GE were required.

Table 7. Weighted sum.
Full size table

We observed that the S-Box and Inverse S-Box has same \('G'\) function. This leads us to optimize the architecture by sharing the \('G'\) function between S-Box (F,G,H) and Inverse S-Box (\(F^{-1}\),G,\(H^{-1}\)). Hence the gate count is reduced to 643.

Listed below are the algebraic normal forms (ANFs) of the PRINCE S-Box decomposition with 3-shares for TI countermeasure.

F and H function

  • \(F_1(w_2, x_2, y_2, z_2, w_3, x_3, y_3, z_3) = (f_{13}, f_{12}, f_{11}, f_{10})\)

  • \(f_{10} = x_2 + w_2y_2 + w_2y_3 + w_3y_2 + w_2z_2 + w_2z_3 + w_3z_2\)

  • \(f_{11} = z_2 + y_2 + w_2\)

  • \(f_{12} = w_2\)

  • \(f_{13} = z_2 + w_2 + x_2z_2 + x_2z_3 + x_3z_2 + x_2y_2 + x_2y_3 + x_3y_2\)

  • \(F_2(w_3, x_3, y_3, z_3, w_1, x_1, y_1, z_1) = (f_{23}, f_{22}, f_{21}, f_{20})\)

  • \(f_{20} = x_3 + w_3y_3 + w_3y_1 + w_1y_3 + w_3z_3 + w_3z_1 + w_1z_3\)

  • \(f_{21} = z_3 + y_3 + w_3\)

  • \(f_{22} = w_3\)

  • \(f_{23} = z_3 + w_3 + x_3z_3 + x_3z_1 + x_1z_3 + x_3y_3 + x_3y_1 + x_1y_3\)

  • \(F_3(w_1, x_1, y_1, z_1, w_2, x_2, y_2, z_2) = (f_{33}, f_{32}, f_{31}, f_{30})\)

  • \(f_{30} = x_1 + w_1y_1 + w_1y_2 + w_2y_1 + w_1z_1 + w_1z_2 + w_2z_1 \)

  • \(f_{31} = z_1 + y_1 + w_1 \)

  • \(f_{32} = w_1 \)

  • \(f_{33} = z_1 + w_1 + x_1z_1 + x_1z_2 + x_2z_1 + x_1y_1 + x_1y_2 + x_2y_1\)

  • \(H_1(w_2, x_2, y_2, z_2, w_3, x_3, y_3, z_3) = (h_{13}, h_{12}, h_{11}, h_{10}) \)

  • \(h_{10} = 1 + z_2 + x_2 + w_2y_2 + w_2y_3 + w_3y_2 \)

  • \(h_{11} = 1 + y_2 + w_2x_2 + w_2x_3 + w_3x_2 \)

  • \(h_{12} = z_2 + y_2 + w_2 + w_2y_2 + w_2y_3 + w_3y_2 + w_2x_2 + w_2x_3 + w_3x_2 \)

  • \(h_{13} = y_2 + x_2 + w_2x_2 + w_2x_3 + w_3x_2\)

  • \(H_2(w_3, x_3, y_3, z_3, w_1, x_1, y_1, z_1) = (h_{23}, h_{22}, h_{21}, h_{20})\)

  • \(h_{20} = z_3 + x_3 + w_3y_3 + w_3y_1 + w_1y_3\)

  • \(h_{21} = y_3 + w_3x_3 + w_3x_1 + w_1x_3\)

  • \(h_{22} = z_3 + y_3 + w_3 + w_3y_3 + w_3y_1 + w_1y_3 + w_3x_3 + w_3x_1 + w_1x_3\)

  • \(h_{23} = y_3 + x_3 + w_3x_3 + w_3x_1 + w_1x_3\)

  • \(H_3(w_1, x_1, y_1, z_1, w_2, x_2, y_2, z_2) = (h_{33}, h_{32}, h_{31}, h_{30})\)

  • \(h_{30} = z_1 + x_1 + w_1y_1 + w_1y_2 + w_2y_1 \)

  • \(h_{31} = y_1 + w_1x_1 + w_1x_2 + w_2x_1 \)

  • \(h_{32} = z_1 + y_1 + w_1 + w_1y_1 + w_1y_2 + w_2y_1 + w_1x_1 + w_1x_2 + w_2x_1 \)

  • \(h_{33} = y_1 + x_1 + w_1x_1 + w_1x_2 + w_2x_1\)

\(F^{-1}\) and \(H^{-1}\) function of inverse S-box:

  • \(F^{-1}_1(w_2, x_2, y_2, z_2, w_3, x_3, y_3, z_3) = (f^{-1}_{13}, f^{-1}_{12} f^{-1}_{11}, f^{-1}_{10}) \)

  • \(f^{-1}_{10} = 1 + w_2 + x_2z_2 + x_2z_3 + x_3z_2 \)

  • \(f^{-1}_{11} = 1 + z_2 \)

  • \(f^{-1}_{12} = x_2 \)

  • \(f^{-1}_{13} = z_2 + y_2 + w_2 + w_2z_2 + w_2z_3 + w_3z_2 + w_2x_2 + w_2x_3 + w_3x_2\)

  • \(F^{-1}_2(w_3, x_3, y_3, z_3, w_1, x_1, y_1, z_1) = (f^{-1}_{23}, f^{-1}_{22}, f^{-1}_{21}, f^{-1}_{20}) \)

  • \(f^{-1}_{20} = w_3 + x_3z_3 + x_3z_1 + x_1z_3 \)

  • \(f^{-1}_{21} = z_3 \)

  • \(f^{-1}_{22} = x_3 \)

  • \(f^{-1}_{23} = z_3 + y_3 + w_3 + w_3z_3 + w_3z_1 + w_1z_3 + w_3x_3 + w_3x_1 + w_1x_3\)

  • \(F^{-1}_3(w_1, x_1, y_1, z_1, w_2, x_2, y_2, z_2) = (f^{-1}_{33}, f^{-1}_{32}, f^{-1}_{31}, f^{-1}_{30}) \)

  • \(f^{-1}_{30} = w_1 + x_1z_1 + x_1z_2 + x_2z_1 \)

  • \(f^{-1}_{31} = z_1 \)

  • \(f^{-1}_{32} = x_1 \)

  • \(f^{-1}_{33} = z_1 + y_1 + w_1 + w_1z_1 + w_1z_2 + w_2z_1 + w_1x_1 + w_1x_2 + w_2x_1\)

  • \(H^{-1}_1(w_2, x_2, y_2, z_2, w_3, x_3, y_3, z_3) = (h^{-1}_{13}, h^{-1}_{12}, h^{-1}_{11}, h^{-1}_{10})\)

  • \(h^{-1}_{10} = y_2 + w_2x_2 + w_2x_3 + w_3x_2 \)

  • \(h^{-1}_{11} = x_2 + w_2 \)

  • \(h^{-1}_{12} = 1 + y_2 + x_2 + w_2x_2 + w_2x_3 + w_3x_2 \)

  • \(h^{-1}_{13} = z_2 + y_2 + w_2 + w_2x_2 + w_2x_3 + w_3x_2 + w_2y_2 + w_2y_3 + w_3y_2\)

  • \(H^{-1}_2(w_3, x_3, y_3, z_3, w_1, x_1, y_1, z_1) = (h^{-1}_{23}, h^{-1}_{22}, h^{-1}_{21}, h^{-1}_{20})\)

  • \(h^{-1}_{20} = y_3 + w_3x_3 + w_3x_1 + w_1x_3 \)

  • \(h^{-1}_{21} = x_3 + w_3\)

  • \(h^{-1}_{22} = y_3 + x_3 + w_3x_3 + w_3x_1 + w_1x_3\)

  • \(h^{-1}_{23} = z_3 + y_3 + w_3 + w_3x_3 + w_3x_1 + w_1x_3 + w_3y_3 + w_3y_1 + w_1y_3 \)

  • \(H^{-1}_3(w_1, x_1, y_1, z_1, w_2, x_2, y_2, z_2) = (h^{-1}_{33}, h^{-1}_{32}, h^{-1}_{31}, h^{-1}_{30})\)

  • \(h^{-1}_{30} = y_1 + w_1x_1 + w_1x_2 + w_2x_1 \)

  • \(h^{-1}_{31} = x_1 + w_1 \)

  • \(h^{-1}_{32} = y_1 + x_1 + w_1x_1 + w_1x_2 + w_2x_1 \)

  • \(h^{-1}_{33} = z_1 + y_1 + w_1 + w_1x_1 + w_1x_2 + w_2x_1 + w_1y_1 + w_1y_2 + w_2y_1\)

Common G function of both S-box and inverse S-box:

  • \(G_1(w_2, x_2, y_2, z_2, w_3, x_3, y_3, z_3) = (g_{13}, g_{12}, g_{11}, g_{10}) \)

  • \(g_{10} = w_2 \)

  • \(g_{11} = 1 + z_2 + y_2 + w_2 + w_2y_2 + w_2y_3 + w_3y_2 \)

  • \(g_{12} = 1 + x_2 + y_2 + w_2 + w_2z_2 + w_2z_3 + w_3z_2 \)

  • \(g_{13} = 1 + z_2 + y_2 + x_2 + w_2x_2 + w_2x_3 + w_3x_2\)

  • \(G_2(w_3, x_3, y_3, z_3, w_1, x_1, y_1, z_1) = (g_{23}, g_{22}, g_{21}, g_{20}) \)

  • \(g_{20} = w_3 \)

  • \(g_{21} = z_3 + y_3 + w_3 + w_3y_3 + w_3y_1 + w_1y_3 \)

  • \(g_{22} = x_3 + y_3 + w_3 + w_3z_3 + w_3z_1 + w_1z_3 \)

  • \(g_{23} = z_3 + y_3 + x_3 + w_3x_3 + w_3x_1 + w_1x_3\)

  • \(G_3(w_1, x_1, y_1, z_1, w_2, x_2, y_2, z_2) = (g_{33}, g_{32}, g_{31}, g_{30})\)

  • \(g_{30} = w_1\)

  • \(g_{31} = z_1 + y_1 + w_1 + w_1y_1 + w_1y_2 + w_2y_1 \)

  • \(g_{32} = x_1 + y_1 + w_1 + w_1z_1 + w_1z_2 + w_2z_1 \)

  • \(g_{33} = z_1 + y_1 + x_1 + w_1x_1 + w_1x_2 + w_2x_1\)

Rights and permissions

Reprints and permissions

Copyright information

© 2016 Springer International Publishing AG

About this paper

Cite this paper

Selvam, R., Shanmugam, D., Annadurai, S., Rangasamy, J. (2016). Decomposed S-Boxes and DPA Attacks: A Quantitative Case Study Using PRINCE. In: Carlet, C., Hasan, M., Saraswat, V. (eds) Security, Privacy, and Applied Cryptography Engineering. SPACE 2016. Lecture Notes in Computer Science(), vol 10076. Springer, Cham. https://doi.org/10.1007/978-3-319-49445-6_10

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-49445-6_10

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-49444-9

  • Online ISBN: 978-3-319-49445-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation