Compact and secure design of masked AES S-box

Abstract

Composite field arithmetic is known as an alternative method for lookup tables in implementation of S-box block of AES algorithm. The idea is to breakdown the computations to lower order fields and compute the inverse there. Recently this idea have been used both for reducing the area in implementation of S-boxes and masking implementations of AES algorithm. The most compact design using this technique is presented by Canright using only 92 gates for an S-box block. In another approach, IAIK laboratory has presented a masked implementation of AES algorithm with higher security comparing common masking methods using Composite field arithmetic. Our work in this paper is to use basic ideas of the two approaches above to get a compact masked S-box. We shall use the idea of masking inversion of IAIK's masked S-box but we will rewrite the equations using normal basis. We arrange the terms in these equations in a way that the optimized functions in Canright's compact S-box can be used for our design. An implementation of IAIK's masked S-box is also presented using Canright's polynomial functions to have a fair comparison between our design and IAIK's design. Moreover, we show that this design which uses two special normal basis for GF(16) and GF(4) is the smallest. We shall also prove the security of this design using some lemmas. © Springer-Verlag Berlin Heidelberg 2007.