Improving First-Order Threshold Implementations of SKINNY

Abstract

Threshold Implementations have become a popular generic technique to construct circuits resilient against power analysis attacks. In this paper, we look to devise efficient threshold circuits for the lightweight block cipher family SKINNY. The only threshold circuits for this family are those proposed by its designers who decomposed the 8-bit S-box into four quadratic S-boxes, and constructed a 3-share byte-serial threshold circuit that executes the substitution layer over four cycles. In particular, we revisit the algebraic structure of the S-box and prove that it is possible to decompose it into (a) three quadratic S-boxes and (b) two cubic S-boxes. Such decompositions allow us to construct threshold circuits that require three shares and executes each round function in three cycles instead of four, and similarly circuits that use four shares requiring two cycles per round. Our constructions significantly reduce latency and energy consumption per encryption operation. Notably, to validate our designs, we synthesize our circuits on standard CMOS cell libraries to evaluate performance, and we conduct leakage detection via statistical tests on power traces on FPGA platforms to assess security. (For reproducibility’s sake, we provide a public repository containing the source code to all proposed schemes together with a script to run the SILVER verification suite [8].)

A Algebraic Expressions for SKINNY S-box S

$$\begin{aligned} z_0 =&~ x_7 x_6 x_3 x_2 x_1 x_0 + x_7 x_6 x_3 x_2 x_0 + x_7 x_6 x_3 x_2 + x_7 x_6 x_3 x_1 x_0 + x_7 x_6 x_2 x_1 + \\ {}&~ x_7 x_6 x_1 x_0 + x_7 x_3 x_2 x_1 x_0 + x_7 x_3 x_2 x_0 + x_7 x_3 x_1 x_0 + x_7 x_3 x_0 + x_7 x_2 x_1 +\\ {}&~ x_7 x_2 + x_7 x_1 x_0 + x_7 x_1 + x_7 x_0 + x_7 + x_6 x_5 x_3 x_2 + x_6 x_5 x_3 x_0 + x_6 x_5 x_2 +\\ {}&~ x_6 x_5 x_1 + x_6 x_5 x_0 + x_6 x_5 + x_6 x_4 x_3 x_2 x_1 + x_6 x_4 x_3 x_1 + x_6 x_4 x_3 x_0 +\\ {}&~ x_6 x_4 x_3 + x_6 x_4 x_2 x_1 + x_6 x_4 x_1 x_0 + x_6 x_3 x_2 x_1 x_0 + x_6 x_3 x_2 x_1 + x_6 x_3 x_2 x_0 +\\ {}&~ x_6 x_3 x_1 x_0 + x_6 x_3 x_1 + x_6 x_3 + x_6 x_2 + x_6 x_1 + x_6 x_0 + x_6 + x_5 x_3 x_2 x_1 x_0 +\\ {}&~ x_5 x_3 x_2 x_0 + x_5 x_3 x_2 + x_5 x_3 x_1 x_0 + x_5 x_2 x_1 x_0 + x_5 x_2 x_1 + x_5 x_2 x_0 +\\ {}&~ x_5 x_1 x_0 + x_4 x_3 x_2 x_1 x_0 + x_4 x_3 x_2 x_0 + x_4 x_3 x_2 + x_4 x_3 x_1 x_0 + x_4 x_2 x_1 +\\ {}&~ x_4 x_1 x_0 + x_3 x_2 x_1 x_0 + x_3 x_2 x_0 + x_3 x_1 x_0 + x_3 x_0 + x_2 x_1 x_0 + x_2 x_1 +\\ {}&~ x_2 x_0 + x_1 x_0 + x_1 + x_0 + 1 \\ z_1 =&~ x_7 x_6 x_3 x_2 x_1 + x_7 x_6 x_3 x_1 + x_7 x_6 x_2 x_1 x_0 + x_7 x_6 x_2 x_0 + x_7 x_6 x_2 +\\ {}&~ x_7 x_6 x_1 x_0 + x_7 x_3 x_2 x_1 + x_7 x_3 x_1 + x_7 x_2 x_1 x_0 + x_7 x_2 x_0 + x_7 x_2 +\\ {}&~ x_7 x_1 x_0 + x_7 + x_6 x_5 + x_6 x_4 x_3 x_2 + x_6 x_4 x_3 + x_6 x_4 x_2 + x_6 x_4 x_0 +\\ {}&~ x_6 x_3 x_2 x_1 + x_6 x_3 x_2 + x_6 x_3 x_1 + x_6 x_3 + x_6 x_2 x_1 x_0 + x_6 x_2 x_0 +\\ {}&~ x_6 x_1 x_0 + x_6 x_0 + x_6 + x_5 x_2 x_1 + x_5 x_2 + x_5 x_1 + x_4 x_3 x_2 x_1 + x_4 x_3 x_1 +\\ {}&~ x_4 x_2 x_1 x_0 + x_4 x_2 x_0 + x_4 x_2 + x_4 x_1 x_0 + x_2 x_1 + x_2 + x_1 \\ z_2 =&~ x_6 + x_2 x_1 + x_2 + x_1 + 1,~ z_3 = x_3 x_2 + x_3 x_0 + x_2 + x_1 + x_0\\ z_4 =&~ x_7 x_6 x_5 + x_7 x_6 x_3 x_2 + x_7 x_6 x_3 + x_7 x_6 x_2 + x_7 x_6 x_0 + x_7 x_6 + x_7 x_5 +\\ {}&~ x_7 x_3 x_2 + x_7 x_3 + x_7 x_2 + x_7 x_0 + x_7 + x_6 x_5 + x_6 x_3 x_2 + x_6 x_3 + x_6 x_2 +\\ {}&~ x_6 x_0 + x_6 + x_5 x_4 + x_4 x_3 x_2 + x_4 x_3 + x_4 x_2 + x_4 x_0 + x_4 + x_3\\ z_5 =&~ x_3 x_2 + x_3 + x_2 + x_0 + 1,~ z_6 = x_7 x_6 + x_7 + x_6 + x_4 + 1\\ z_7 =&~ x_7 x_6 x_3 x_2 + x_7 x_6 x_3 + x_7 x_6 x_2 + x_7 x_6 x_0 + x_7 x_3 x_2 + x_7 x_3 + x_7 x_2 +\\ {}&~ x_7 x_0 + x_6 x_3 x_2 + x_6 x_3 + x_6 x_2 + x_6 x_0 + x_5 + x_4 x_3 x_2 + x_4 x_3 +\\ {}&~ x_4 x_2 + x_4 x_0 \end{aligned}$$