Software solutions in embedded systems allow for a flexible, portable, and cost-effective alternative to hardware designs. However, like their pure hardware counterparts, Side-channel Analysis (SCA) attacks pose a significant threat to these implementations running within embedded systems. A common countermeasure is masking, yet implementing it securely in software is challenging for third-party developers, as CPU micro-architectures are typically opaque due to intellectual property protection. As a result, developers lack awareness of micro-architectural design choices that may undermine the security of masked implementations. To ease the generation of masked software, the tool PoMMES was presented at CHES 2024. It takes a masked C code as input and generates ARM assembly code that is in line with the Central Processing Unit (CPU)-independent leakage model presented at CHES 2023. In particular, PoMMES proposes a constrained register allocation procedure to stay secure under the CPU-independent leakage model. The primary drawback of PoMMES, however, is its significant performance overhead, ranging from 1.3x to 3.5x compared to GCC compiled with optimization level -O0. In this work, we show how to drastically reduce this disadvantage, effectively nullifying the performance penalty while ensuring the same security under the same conservative leakage model. We back our claims and results by evaluating 6 masked software implementations in a two-stage assessment comprising simulation-based verification and experimental power measurements on ARM Cortex-M0 and Cortex-M3 processors.
Cold boot attacks, first introduced by Halderman et al. (USENIX’08), are a class of attacks that aim at recovering cryptographic secrets stored in volatile memory after a computer is powered off, using the fact that DRAM modules retain their contents to a large extent for some time, especially at low temperatures. Cold boot attackers can recover the original contents of memory with some flipped bits, with bit flip probabilities of < 10% for one-to-zero and much lower (< 0.1%) for zero-to-one shown to be easily achievable. The cryptanalytic goal is then to recover full secret keys based on this noisy data. Successful key recoveries from cold boot attacks have been shown to be feasible for various symmetric and public-key schemes, including AES, RSA, and more recently some lattice-based encryption schemes with secret keys stored in the number-theoretic transform (NTT) domain. In this paper, we investigate cold boot attacks against NTRU-based signature scheme Falcon and its ancestor, the signature scheme of Ducas–Lyubashevsky–Prest (DLP). Those schemes significantly differ from other schemes previously considered for cold boot attacks, since, in particular, the memory representation of secret signing keys mostly consists of floating point values. As a result, the various relations existing between key coefficients only hold up to floating point errors, which makes key recovery more complex. Nevertheless, at the typical bit flip probabilities achievable with cold boot attacks, we manage to fully recover Falcon and DLP keys with good probability across all parameters in simulations carried out in a simple bit flip model. Furthermore, we validate our techniques using concrete cold boot experiments against Falcon on a Raspberry Pi single board computer. Finally, we propose countermeasures with negligible computational cost that significantly reduce the memory footprint of signing keys for Falcon and DLP, and at the same time make cold boot attacks considerably harder.
In this paper, we propose an enhanced variant of the F4 algorithm specifically designed for efficiently solving multivariate quadratic (MQ) problems, which are central to many post-quantum cryptographic schemes. Our approach overcomes a major inefficiency of conventional F4 by integrating a Hilbert-driven strategy that determines the optimal number of S-polynomials to generate at each degree, thereby reducing unnecessary zero reductions. We further introduce refined pair selection techniques that prioritize candidates yielding S-polynomials with smaller leading terms, which in turn minimizes the dimensions of intermediate matrices used during reduction. Experimental results show that our implementation outperforms state-of-the-art systems such as M4GB and Magma’s F4 in both single-core and multi-core environments. Notably, our method sets new records in the Fukuoka MQ Challenge for Type VI problems over F31 with m = 21, 22, 23, 24 demonstrating the robustness and practical impact of our approach in solving highly challenging MQ instances. According to the computational complexity estimation formula given in [24], the problem with m = 24 is approximately 47,627 times harder than the previous record case with m = 20.
This paper presents an optimized implementation of the Hamming Quasi- Cyclic (HQC) key encapsulation mechanism, leveraging the additive fast Fourier transform (FFT) for polynomial multiplication. A primary challenge in applying FFT-based multiplication to HQC is that the polynomial degrees slightly exceed powers of two, making standard FFT approaches inefficient. To address this, we propose a new method combining the Frobenius additive FFT (FAFFT) with the Chinese Remainder Theorem (CRT) to efficiently multiply polynomials of these specific degrees. Such a combination is made possible by our new interpretation of FAFFT’s Encode step as ring isomorphisms, from which we derive an exact formula for the modulus of any FAFFT-based polynomial multiplier. In addition to the multiplication algorithm, we replace the Berlekamp-Massey decoder with an Extended Euclidean Algorithm (EEA) based method. The regular data flow of EEA facilitates the use of our highly optimized F256 SIMD arithmetic, leading to a faster execution speed. Benchmarks demonstrate that our FFT-based approach significantly outperforms traditional Toom-Karatsuba methods, even at lower degrees, on the Arm Cortex-M4 platform. Our integrated optimizations result in a 19.5% and 20.4% speedups for the encapsulation and the decapsulation processes compared to the current state-of-the-art HQC-1 implementation.
Modern processors are largely fixed at the time of fabrication, rendering post-silicon security updates infeasible. This lack of flexibility is especially problematic for speculative execution attacks, which exploit microarchitectural optimizations to leak sensitive information through transient execution. However, existing defenses are typically hardwired, narrowly scoped, and non-adaptive. Once deployed, these defenses lack the flexibility to respond to new attack variants, creating a critical security gap. This paper presents SPLASH, a novel and adaptive framework for comprehensively mitigating speculative execution vulnerabilities across processor components. SPLASH introduces two primary contributions: (i) we introduce Speculative Information Flow Tracking (SIFT), which enables fine-grained tracking of speculative data propagation throughout the microarchitecture; (ii) the reconfigurable speculative table provides, for the first time, enforceable and fully configurable control over speculative behavior across the processor pipeline. SPLASH is runtime-configurable, allowing dynamic security policy adjustments post-fabrication, such as tuning the speculative window size or selectively protecting specific microarchitectural structures, without requiring hardware redesign. We implement SPLASH on both the small and medium BOOM processors and evaluate its effectiveness in mitigating speculative leakage vulnerabilities. SPLASH successfully mitigates all types of speculative execution attacks. In terms of computation overhead, SPLASH incurs only 0.05% overhead on small BOOM and 1.23% on medium BOOM on average compared with the baseline. Compared to the best performing state-ofthe- art defenses, SPLASH reduces overhead by 129.2x and 1.2x, respectively, with negligible hardware cost.
The Learning With Physical Rounding (LWPR) problem is a variant of the Learning With Rounding (LWR) problem, where the rounding operation is performed by a physical leakage function (like the Hamming weight function or variants thereof). It has been introduced as a potentially useful building block towards designing cryptographic algorithms with affordable leakage-resilience guarantees. LWPR has direct applications for fresh re-keying schemes in symmetric cryptography, and potential applications for post-quantum encryption and signature schemes relying on hard learning problems. However, for now its hardness has only been evaluated heuristically, thanks to algebraic cryptanalysis. In this paper, we show that a natural generalization of the LWPR problem with noisy samples, which we denote as Learning With Physical Rounding and Noise (LWPRN), is as hard as the Learning With Errors (LWE) problem. This generalization is motivated by the fact that concrete leakage functions are usually affected by a mild level of physical noise. It targets the same applications as LWPR, yet with much stronger confidence given its reduction from a standard mathematical assumption. By combining proof techniques from lattice-based cryptography and statistical concepts used in the side-channel / masking literature, we argue that the level of noise required in our reduction is concretely affordable. Besides, we show that the generalization from LWPR to LWPRN is not only motivated by the goal of obtaining provable security guarantees, since our reduction applies to the serial implementation setting, in which LWPR has been shown insecure.
In this paper, we propose a new widely applicable technique for constructing low-depth S-box circuits, which we call SLICE (Segmented Low-depth Iterative Circuit Exploration). SLICE reduces circuit depth by partitioning circuits into subcircuits and applying bit-level optimizations. To mitigate the optimization cost of subcircuits with large bit-widths or high AND depth, SLICE temporarily reduces their bit-width during the search, making low-depth circuit construction feasible for various S-box sizes. Furthermore, we refine the eBPD algorithm with the aim of minimizing XOR gate count in terms of area, and apply it to the constructed circuits to achieve an additional reduction. Our proposed method is simple yet powerful, especially in practical applications. This work focuses on three practically deployed cases, namely the AES, Ascon S-box circuits and Dillon’s 6-bit APN S-box used in FIDES, and additionally considers the cube x3 S-box. For the AES S-box, we present 14-, 13- and 12-depth circuits, whereas the previous lowest depth was 14. Notably, the 12-depth design sets a new overall depth record for AES S-box circuits, while the 13-depth design records the most hardware-efficient circuit in terms of the areaxdelay metric (ADP). For the Ascon S-box, we present the first 4-depth circuit. For Dillon’s S-box and the cube x3 S-box, we also derive new low-depth circuits that improve upon the best previously known depths. All of our proposed S-box circuits achieve better ADPs than previous designs. We believe that SLICE will be useful for evaluating both existing and novel S-box designs.
During the past decade, Deep Neural Networks (DNNs) have proven their value across a wide variety of applications; however, despite their importance, protecting their intellectual property remains an open issue. Recent work has successfully extracted DNNs using cryptanalytic methods in hard-label settings, showing that it is possible to copy a DNN with high fidelity, i.e., a high degree of similarity in correct/incorrect output predictions which corresponds to the proportion of samples for which the extracted model produces the same prediction as the original model. However, these methods have only been demonstrated on Multi-Layer Perceptrons (MLPs) and are sensitive to non–fully connected layers and special-case neurons. To overcome these limitations, we base our contribution on a divide-and-conquer paradigm. We introduce a new black-box side-channel attack that splits the targeted DNN into several linear components, for which cryptanalytic extraction can be performed. Building on this decomposition, we propose an end-to-end framework specifically designed for hard-label settings, not limited to fully connected layers, and robust to special-case neurons, while improving extraction fidelity. We validate our contribution by successfully extracting all architectures previously targeted in the literature, as well as several new architectures implemented on a microcontroller unit. These include an MLP with 1.7 million parameters, nearly doubling the previous largest number of extracted weights, and a shortened MobileNetv1, which for the first time includes pooling layers and depthwise separable convolutions. Our framework successfully extracts all of these DNNs with high fidelity (88.4% for MobileNetv1 and 93.2% for the MLP). Finally, we use the copied model to generate adversarial examples and achieve near white-box performance on the victim model (95.8% and 96.7% transfer rates).
Threshold signatures distribute trust across multiple parties, eliminating single points of failure and reducing insider and key-exfiltration risks—properties that are increasingly important for high-assurance deployments and recently emphasized by NIST’s Multi-Party Threshold Cryptography (MPTC) initiative. We present a practical t-out-of-n threshold variant and emulation of MAYO, a post-quantum signature candidate to NIST’s call for additional signatures. Our proposal builds upon the threshold MAYO design of Celi, Escudero and Niot (PQCrypto 2025), which we significantly refine to achieve practical performance. To this end, we introduce two algorithmic modifications to MAYO tailored for the distributed setting: (1) Explicit- Salt MAYO, which allows for pre-determined salts to enable a single-round online phase; and (2) Depth-Reduced MAYO, which restructures the signing algorithm to minimize the depth of secret-dependent operations. We then propose a unified protocol framework that integrate these techniques, plus other MPC specific optimizations, with the goal of minimizing online latency. Finally, we provide a concrete instantiation and local emulation in the dishonest majority setting, secure against active adversaries. Our emulation shows that threshold signing is practical at typical threshold sizes and amenable to deployment. By releasing an open-source implementation and reporting end-to-end performance, this work offers a concrete reference for the thresholdization of post-quantum signatures. Clearly the aforementioned framework is not limited to MAYO, and can be applied to the UOV family of signatures more generally.
SPHINCS+ is a stateless hash-based digital signature algorithm (SLHDSA), standardized by NIST (FIPS 205). However, it is vulnerable to fault attacks, especially in embedded and IoT systems where devices are often more accessible to attackers. Additionally, existing countermeasures against fault attacks on SPHINCS+ generally require either additional hardware resources, substantial memory capacity, or redundant computations. The fault attacks in SPHINCS+ arise from the reuse of a WOTS+ instance, leading to security degradation and signature forgery. Prior research on this security degradation was limited to inaccurate probabilistic assumptions or slow computations. In this paper, we introduce a novel analytical method based on Generating Functions to efficiently and precisely compute the post-reuse security of WOTS+. Through this rigorous analysis, we discover that the security degradation follows a bimodal distribution, and the key to improving the security floor lies in the number of possible values for the checksum’s most significant block. Based on this insight, we propose WOTS+ with Checksum Segmentation (WOTS+CS), the first enhancement of the WOTS+ designed to improve post-reuse security (e.g., raising the security floor from 34.9 to 49.8 bits in the 256-bit instance) by structurally eliminating the weak instances. To strengthen protection further, we introduce the Subtree Root Children Caching (SRCC) scheme, which validates the subtree root to prevent WOTS+ from signing an incorrect root. By caching the subtree roots of the top few layers, the storage overhead remains manageable. Finally, we conducted fault injection experiments on SPHINCS+ using a ChipWhisperer to evaluate the difficulty of fault injection. Subsequently, we evaluated the effectiveness of our countermeasures in a complete fault attack, demonstrating that our methods increase the attacker’s difficulty across all phases of fault attacks.
Accurate localization of Cryptographic Operations (COs) in long, noisy side-channel traces is important for effective Side-Channel Analysis (SCA). Existing techniques either search for repeated temporally contiguous patterns directly in raw traces or rely on profiling devices to derive templates or learned models. In this paper, we present SpectroLoc, a profiling-free framework for CO localization based on a spectral activity projection derived from the trace spectrogram. In this representation, narrowband noise components tend to form a relatively stable baseline, while CO-related activity remains distinguishable over time. Building on this representation, SpectroLoc supports three common localization tasks: (i) localization of single recurring COs through intra-trace self-templating; (ii) unsupervised coarse-grained segmentation of complex COs via change-point detection; and (iii) distinction of interleaved COs via motif discovery. Experiments on multiple public datasets, including long ECDSA traces and AES-128 implementations protected by random-delay countermeasures, show that SpectroLoc achieves competitive hit rates and lower runtime than the prior non-profiling baseline on the evaluated tasks. These results suggest that SpectroLoc provides a practical CO localization tool for side-channel analysis.
CSIDH (Commutative Supersingular Isogeny Diffie–Hellman) is a classgroup- based key-exchange protocol operated on supersingular elliptic curves, which, at the time of its proposal, exhibited several attractive selling points such as noninteractivity. Unfortunately, CSIDH is vulnerable to the sub-exponentiation attack– Kuperberg’s algorithm, thereby requiring large parameters to ensure security. A recent work based on oriented elliptic curves with large discriminants, proposed by Houben, allows for a significantly small base field (around 255 bits). We name this protocol CSIDH-LDO. However, the practicality of CSIDH-LDO is currently hindered by the necessity of performing multiple group actions and its huge public-key size. In this paper, we address these bottlenecks by presenting highly optimized constanttime implementations alongside an effective public-key compression framework for CSIDH-LDO. We combine algorithmic improvements, specifically scalar multiplication by differential addition chains and isogeny computation on the twisted Edwards model, with limb-slicing to exploit parallelism via Intel’s AVX-512 instructions. To resolve the architectural mismatch when mapping r ∈ {7, 13} group actions to 8-lane SIMD registers, we evaluate two parallel scheduling strategies. While a dummy-based approach allows us to leverage efficient Fp2-arithmetic, our dummy-free strategy systematically exploits internal parallelism to fully saturate the 512-bit vectors without redundant computations. Benchmarks on an Intel Tiger Lake processor demonstrate our parallel implementations achieve speedups of up to 3.40x (AVX-512F) and 7.30x (AVX-512IFMA) over an optimized x64 assembly baseline. Furthermore, we establish a formal framework for public-key compression tailored for CSIDH-LDO. Specifically, we propose two efficient techniques that achieve a compact public key representation of approximately (r + 2) log2(p) bits, thereby significantly reducing communication bandwidth. To the best of our knowledge, this work is the first to demonstrate the efficacy of SIMD parallelization combined with optimized compression for isogenybased protocols derived from orientations of large discriminants.
Under a more practical fault model assumption, namely with no prior knowledge of the fault, conducting ciphertext-only attacks becomes challenging. In the multiple-byte fault setting, the time complexity of existing Persistent Fault Analyses (PFAs) increases polynomially with the the number of fault values (N f) in the S-box. Furthermore, these methods are either inapplicable to the single-byte fault setting or require a large number of ciphertexts to achieve a success rate close to 1 in such a setting. To address these limitations, we propose a new persistent-fault-based analysis method called DSPFA. It exploits the similarity between the statistical distributions of two ciphertext bytes to deduce the difference between the corresponding bytes of the last subkey. Three distinct similarity measurement methods are utilized to construct three types of distinguishers for generating key candidates. DSPFA applies to both settings. More importantly, its time complexity is constant—specifically, O(212) similarity computations—independent of N f . Moreover, when N f is large, our method simultaneously reduces both the number of key candidates and the required amount of ciphertext, thereby further lowering the cost of the unique key recovery process. DSPFA also remains efficient against AES implementations without S-box and against certain Feistel ciphers. Finally, practical experiments conducted on an FPGA confirm the feasibility of instruction modification and validate the effectiveness of our analysis.
Discrete Gaussian sampling (DGS) is a fundamental method for generating random noise in various post-quantum cryptographic key generation and signature schemes. However, DGS has been shown to be highly susceptible to side-channel analysis, and several countermeasures have been developed. Masking, a robust countermeasure, is widely employed to secure these schemes against side-channel attacks. Due to the non-linear arithmetic operations involved, DGS has traditionally been considered unsuitable for efficient masked implementations. In this work, we propose MAGNET: an efficient masking design for the novel discrete Gaussian sampler based on Boolean circuits introduced byWei et al. at ACM CCS 2023. With MAGNET, we demonstrate that DGS can be implemented in a masking-friendly manner. Previous masked DGS approaches in the literature have relied on computation-intensive floating point operations or table-lookup-based techniques using Cumulative Distribution Tables (CDT). In contrast, we show that DGS can be efficiently masked for moderate orders without relying on heavy computation or precomputed large lookup tables. In addition to delivering good performance at a small standard deviation σ, the efficiency of MAGNET becomes increasingly significant in large σ settings. MAGNET achieves up to 17x speed-up at σ = 256, and 56x speed-up at σ = 1024 over the CDT-based sampler of Gérard and Rossi (2019). We provide an arbitrary-order C implementation and a first-order ARM Cortex-M4 implementation of MAGNET. We validate the practical security of the first-order implementation through Test Vector Leakage Assessment (TVLA) and systematic hardening of gadgets that exhibit side-channel leakage.
This paper presents an effective approach for aging FPGAs by creating localized hotspots without relying on any external equipment to elevate lifetime stress conditions. We demonstrate how aging mechanisms such as Hot Carrier Injection (HCI) and Bias Temperature Instability (BTI) impact FPGAs under both high power density and overall high power dissipation. Our analysis is based on fine-grained timing characterization with a time resolution of 0.7 ps, covering over 95% of the FPGA resources, providing broader coverage than any related work to date. We conducted accelerated aging experiments on two different UltraScale+ devices, where the average degradation rate reached 1.47% within just two weeks. The maximum degradation reached 10% and 70% in the two examined devices, which means that circuits may no longer operate reliably on the attacked chips. Furthermore, we highlight the importance of runtime monitoring for tracking power consumption and localized temperature across different clock regions to prevent power hammering attacks in cloud FPGAs. We also show that the available on-chip temperature sensors are not sufficient to detect power wasting attacks.
The elliptic curve discrete logarithm problem (ECDLP) is the foundation of the security of elliptic curve cryptography. The baby-step giant-step (BSGS) method is a generic deterministic algorithm, based on a space-time tradeoff, to solve the discrete logarithm problem. Elliptic divisibility sequences (EDSs) are a class of non-linear divisibility sequences related to elliptic curves, which possess many interesting arithmetic properties. We propose a new variant of BSGS using EDSs to speed up the BSGS algorithm for solving ECDLP. Afterward, we introduce some improvements to this version, including employing the negation terms of the sequence and implementing parallel computation in the baby steps. Following that, we suggest an interleaving BSGS algorithm that integrates these improvements. It is known that the cost of an inversion operation in a finite field is far greater than that of a multiplication operation. Let M, S and I represent the cost of multiplication, squaring, and inversion in Fq, respectively. We show that each walk of the online phase of our new variant only needs 3.5M+ 0.5S, without any inversion operation. Assuming I = 8M and S = 0.8M, our variant achieves a 64% speedup in the online phase and a 19.44% speedup in the offline phase compared with the textbook BSGS algorithm.
Recent work by Houben (Asiacrypt’25) introduced a new formulation for class group actions on supersingular elliptic curves oriented by an imaginary quadratic order for an arbitrarily large discriminant. The algorithm is not only constant-time but also fully deterministic, dummy-free, and branch-free. As a result, it gives the fastest isogeny-based non-interactive key exchange (NIKE) in theory, referred to as OSIDHLD in this paper. However, the current proof-of-concept SageMath implementation remains substantially slower than mainstream post-quantum key-exchange candidates. In this paper, we develop an efficient implementation of OSIDH-LD with several approaches. First, we provide algorithmic-level optimizations: (i) we develop the "tail pruning" approach such that key agreement avoids redundant orientation updates. This optimization maintains the fully deterministic and dummy-free feature of OSIDHLD; (ii) we adapt a faster codomain isomorphism identification adapted from the technique used in the SQIsign implementations; and (iii) we present effective isogenycomputation strategies tailored to the cost profile of OSIDH-LD. Second, we adapt the parallelism technique. We apply the fork-join parallel execution model to optimize the class group action performance, and achieve a near perfect parallelism in key generation, and a better performance in key agreement. We provide two kinds of implementations to show the impacts of our improvements. The first one is in C with assembly language for field arithmetic, which verifies the correctness of our optimization techniques targeting OSIDH-LD. The experimental results show that our techniques lead to an overall 1.56x and 1.87x acceleration for key generation and key agreement, respectively. Second, we provide parallel implementations that exploit multi-threads and AVX-512 vector extensions, respectively, by batching independent subroutines in the class group action. In particular, the AVX-512 vectorized implementation is 4.97x faster than the improved C+assembly implementation in key generation, which is close to the theoretical optimum.
Existing leakage-resistant AEADs are rarely compatible with single-length key blockciphers (BCs), i.e., blockciphers with key-length equaling block-length. We present UEDTDM and UEDTMX, two single-length key BC-based leakage-resistant AEAD constructions. Both of them are one-pass with rate 1/4, use “partially fixedkey” BC to maximize practical efficiency, and gather the strongest level of Grade-3 leakage-resistance (a terminology due to Bellizia et al., CRYPTO 2020) with a satisfactory black-box security bound. Their concrete security bounds are comparable with state-of-the-art construction TEDT of Berti et al. (TCHES 2020). Even more, they achieve birthday-bound context-committing security. To prove these claims, we introduce a framework UEDT that generalizes and expands the usability of the EDT construction of Berti et al. (ToSC 2017), prove unified provable security results, and then derive concrete bounds for the two instances, UEDTDM and UEDTMX. This framework may be of independent interest. We also demonstrate the performance advantage of our algorithms, especially in software. On x86 architectures where the AES-NI instructions are supported, our algorithms are twice faster than the closest competitor; LR-BC-3 (Bronchain et al., TCHES 2021). In addition, the ability to use the efficient MJH hash function and to reduce the amount of rekeying makes the algorithms faster across multiple platforms, as well.
TFHE is one of the most promising scheme in the literature for an adoption of Fully Homomorphic Encryption (FHE) in practice. The core reason of its good performances is the powerful Programmable Bootstrapping (PBS) operation, that enables to homomorphically evaluate a Look-Up Table (LUT) on a ciphertext while simultaneously reducing its noise. However, the computational cost of running a PBS degrades severely when the size of the plaintext space increases, making it intractable for precision larger than 8 bits. So, evaluating a LUT larger than 28 is not considered possible with the “vanilla” TFHE scheme. In this paper, we propose a technique to accelerate LUT evaluation at high precision, that significantly enhances the state of the art. Our method beats the original PBS for spaces larger than 6 bits, and is competitive with the WoP-PBS (the reference of the state of art) while being conceptually simpler. Additionally, our method relies only on the standard PBS of TFHE, and therefore does not require the design of new advanced homomorphic operators, facilitating its integration into larger homomorphic compilation systems.
Cryptographic hardware implementations often leak secret information through side channels. This can allow attackers to learn secret data, such as a cryptographic key, without any vulnerability in the cryptographic algorithm itself. A popular countermeasure to such attacks is masking, which ensures that processed data is independent of the secrets by splitting them into multiple independent shares, often at the cost of significant overhead in terms of required area, latency, and randomness. The composable PINI notion in the glitch-extended probing model ensures some degree of security against such side-channel analysis attacks, and guarantees that the circuit may be arbitrarily composed with other PINI circuits while maintaining the same security level. This allows for the secure implementation of arbitrary circuits using trivial composition, replacing elementary gates with “gadgets” realizing the same functionality in a PINI-secure manner. Up to now, PINI gadgets at arbitrary security order are limited to quadratic functions, i.e., 2-input gates, with the best known as HPC3.X realizing a 2-input multiplier in one clock cycle. In this work, we present HPCC, the first low-latency 3-input multiplication gadget for arbitrary fields that maintains a constant latency of one cycle, independent of the number of shares. HPCC additionally allows for the computation of any number of multiplications in a single cycle with relatively little overhead when two of the three operands are identical. When instantiated with two shares and for F2, HPCC halves the previous record for lowest number of fresh masks required at comparable area cost. With more shares, HPCC is the only single-cycle gadget realizing 3- input multiplications in arbitrary fields. We leverage HPCC to implement the first composable AES S-Box with two cycles of latency with an arbitrary number of shares. This S-Box design significantly outperforms the previous record in terms of area and randomness when instantiated with three shares and stands as the only two-cycle solution for more shares.
