Side-Channel Protection by Randomizing Look-Up Tables on Reconfigurable Hardware - Pitfalls of Memory Primitives.
Pascal Sasdrich, Oliver Mischke, Amir Moradi, Tim E. Güneysu · 2015
Abstract. Block Memory Content Scrambling (BMS), presented at CHES 2011, enables an effective way of first-order side-channel protection for cryptographic primitives at the cost of a significant reconfiguration time for the mask update. In this work we analyze alternative ways to im-plement dynamic first-order masking of AES with randomized look-up tables that can reduce this mask update time. The memory prim-itives we consider in this work include three distributed RAM compo-nents (RAM32M, RAM64M, and RAM256X1S) and one BRAM primi-tive (RAMB8BWER). We provide a detailed study of the area and time overheads of each implementation technique with respect to the oper-ation (encryption) as well as reconfiguration (mask update) phase. We further compare the achieved security of each technique to prevent first-order side-channel leakages. Our evaluation is based on one of the most general forms of leakage assessment methodology known as non-specific t-test. Practical SCA evaluations (using a Spartan-6 FPGA platform) demonstrate that solely the BRAM primitive but none of the distributed RAM elements can be used to realize an SCA-protected implementation. 1