A Fast Search Method for 3-Share Second-Order Masking Schemes for Lightweight S-Boxes

Abstract

Masking schemes are widely adopted strategies for countering side-channel analysis (SCA) attacks. The initial hardware masking strategy, threshold implementation (TI), provides robust security against glitches in hardware platforms. The minimum number of shares required for a TI scheme depends not only on the desired security order but also on the algebraic degree of the target function. For instance, implementing a second-order TI scheme for quadratic nonlinear functions requires at least five shares to ensure security, leading to substantially high implementation costs for higher order TI schemes. To address this issue, Shahmirzadi et al. proposed a method in CHES 2021 for constructing a 3-share second-order masking scheme. Despite its advancements, their search method is complex and time consuming. Our study presents a more efficient search method for a 3-share second-order masking scheme, ensuring both uniformity and second-order probing security. Our approach can find a valid second-order scheme in under a minute, making it tens to over a 1000 times faster than the method described in CHES 2021. Utilizing our methodology, we have effectively constructed second-order secure implementations for several cryptographic primitives (e.g., Keccak, SKINNY, Midori, PRESENT, PRINCE, GIFT, and RECTANGLE) and evaluated their implementation costs and security.