{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,12]],"date-time":"2025-10-12T03:02:39Z","timestamp":1760238159961,"version":"build-2065373602"},"reference-count":40,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2022,6,28]],"date-time":"2022-06-28T00:00:00Z","timestamp":1656374400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100006595","name":"Romanian Ministry of Education and Research","doi-asserted-by":"publisher","award":["PN-III-P1-1.1-TE-2019-2245"],"award-info":[{"award-number":["PN-III-P1-1.1-TE-2019-2245"]}],"id":[{"id":"10.13039\/501100006595","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Cryptography"],"abstract":"<jats:p>In this paper, we provide a detailed analysis of CPA and Template Attacks on masked implementations of bitsliced AES, targeting a 32-bit platform through the ChipWhisperer side-channel acquisition tool. Our results show that Template Attacks can recover the full AES key successfully within 300 attack traces even on the masked implementation when using a first-order attack (no pre-processing). Furthermore, we confirm that the SubBytes operation is overall a better target for Template Attacks due to its non-linearity, even in the case of bitsliced implementations, where we can only use two bits per key byte target. However, we also show that targeting the AddRoundKey can be used to attack bitsliced implementations and that, in some cases, it can be more efficient than the SubBytes attack.<\/jats:p>","DOI":"10.3390\/cryptography6030031","type":"journal-article","created":{"date-parts":[[2022,6,28]],"date-time":"2022-06-28T23:59:22Z","timestamp":1656460762000},"page":"31","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Side-Channel Attacks on Masked Bitsliced Implementations of AES"],"prefix":"10.3390","volume":"6","author":[{"given":"Anca","family":"R\u0103dulescu","sequence":"first","affiliation":[{"name":"Faculty of Automatic Control and Computer Science, University Politehnica Bucharest, 060042 Bucharest, Romania"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Marios O.","family":"Choudary","sequence":"additional","affiliation":[{"name":"Faculty of Automatic Control and Computer Science, University Politehnica Bucharest, 060042 Bucharest, Romania"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2022,6,28]]},"reference":[{"unstructured":"Rijmen, V., and Joan, D. (2022, March 03). Advanced Encryption Standard. Federal Information Processing Standards Publication 197. 2001; pp. 1\u201347, Available online: https:\/\/nvlpubs.nist.gov\/nistpubs\/fips\/nist.fips.197.pdf.","key":"ref_1"},{"doi-asserted-by":"crossref","unstructured":"Rebeiro, C., Selvakumar, D., and Devi, A. (2006, January 8\u201310). Bitslice Implementation of AES. Proceedings of the International Conference on Cryptology and Network Security, Suzhou, China.","key":"ref_2","DOI":"10.1007\/11935070_14"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"2211","DOI":"10.1109\/TPDS.2019.2911278","article-title":"Fast AES Implementation: A High-Throughput Bitsliced Approach","volume":"30","author":"Hajihassani","year":"2019","journal-title":"IEEE Trans. Parallel Distrib. Syst."},{"unstructured":"K\u00f6nighofer, R. (2008, January 8\u201311). A Fast and Cache-Timing Resistant Implementation of the AES. Proceedings of the Cryptographers\u2019 Track at the RSA Conference (CT-RSA 2008), San Francisco, CA, USA.","key":"ref_4"},{"unstructured":"Mangard, S., Oswald, E., and Popp, T. (2007). Power Analysis Attacks: Revealing the Secrets of Smart Cards, Springer.","key":"ref_5"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"29","DOI":"10.1007\/3-540-36400-5_4","article-title":"The EM Side\u2014Channel(s)","volume":"Volume 2523","author":"Kaliski","year":"2003","journal-title":"Cryptographic Hardware and Embedded Systems\u2014CHES 2002"},{"key":"ref_7","first-page":"398","article-title":"Towards Sound Approaches to Counteract Power-Analysis Attacks","volume":"Volume 1666","author":"Chari","year":"1999","journal-title":"Advances in Cryptology\u2014CRYPTO\u2019 99. CRYPTO 1999. Lecture Notes in Computer Science"},{"key":"ref_8","first-page":"18","article-title":"LS-Designs: Bitslice Encryption for Efficient Masked Software Implementations","volume":"Volume 8540","author":"Cid","year":"2015","journal-title":"Fast Software Encryption. FSE 2014"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"599","DOI":"10.1007\/978-3-662-48324-4_30","article-title":"DPA, bitslicing and masking at 1 GHZ","volume":"Volume 9293","author":"Balasch","year":"2015","journal-title":"Cryptographic Hardware and Embedded Systems\u2014CHES 2015"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"567","DOI":"10.1007\/978-3-319-56620-7_20","article-title":"How Fast Can Higher-Order Masking Be in Software?","volume":"Volume 10210","author":"Coron","year":"2017","journal-title":"Advances in Cryptology\u2014EUROCRYPT 2017"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"620","DOI":"10.1007\/978-3-662-48324-4_31","article-title":"SoC It to EM: ElectroMagnetic Side-Channel Attacks on a Complex System-on-Chip","volume":"Volume 9293","author":"Handschuh","year":"2015","journal-title":"Cryptographic Hardware and Embedded Systems\u2014CHES 2015"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"91","DOI":"10.1007\/978-3-319-55714-4_7","article-title":"Bitsliced Masking and ARM: Friends or Foes?","volume":"Volume 10098","author":"Bogdanov","year":"2017","journal-title":"Lightweight Cryptography for Security and Privacy. LightSec 2016"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"623","DOI":"10.1007\/978-3-319-66787-4_30","article-title":"Very High Order Masking: Efficient Implementation and Security Evaluation","volume":"Volume 10529","author":"Fischer","year":"2017","journal-title":"Cryptographic Hardware and Embedded Systems\u2014CHES 2017"},{"doi-asserted-by":"crossref","unstructured":"Azouaoui, M., Bronchain, O., Grosso, V., Papagiannopoulos, K., and Standaert, F.X. (2022, February 22). Bitslice Masking and Improved Shuffling: How and When to Mix Them in Software? 2021. Available online: hal.archives-ouvertes.fr.","key":"ref_14","DOI":"10.46586\/tches.v2022.i2.140-165"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"39387","DOI":"10.1109\/ACCESS.2022.3163852","article-title":"Improved Correlation Power Analysis on Bitslice Block Ciphers","volume":"10","author":"Han","year":"2022","journal-title":"IEEE Access"},{"doi-asserted-by":"crossref","unstructured":"Brier, E., Clavier, C., and Olivier, F. (2004, January 11\u201313). Correlation Power Analysis with a Leakage Model. Proceedings of the Cryptographic Hardware and Embedded Systems, Cambridge, MA, USA.","key":"ref_16","DOI":"10.1007\/978-3-540-28632-5_2"},{"key":"ref_17","first-page":"13","article-title":"Template Attacks","volume":"Volume 2523","author":"Kaliski","year":"2002","journal-title":"Cryptographic Hardware and Embedded Systems\u2014CHES 2002"},{"unstructured":"Gierlichs, B., Batina, L., Tuyls, P., and Preneel, B. (2008, January 10\u201313). Mutual information analysis. Proceedings of the International Workshop on Cryptographic Hardware and Embedded Systems, Washington, DC, USA.","key":"ref_18"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"490","DOI":"10.1109\/TIFS.2017.2757440","article-title":"Efficient, Portable Template Attacks","volume":"13","author":"Choudary","year":"2017","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_20","first-page":"799","article-title":"Statistical Analysis of Second Order Differential Power Analysis","volume":"646","author":"Prouff","year":"2010","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"459","DOI":"10.1007\/978-3-642-55220-5_26","article-title":"How to Certify the Leakage of a Chip?","volume":"Volume 8441","author":"Nguyen","year":"2014","journal-title":"Advances in Cryptology\u2014EUROCRYPT 2014"},{"key":"ref_22","first-page":"158","article-title":"DES and Differential Power Analysis The \u201cDuplication\u201d Method","volume":"Volume 1717","author":"Paar","year":"1999","journal-title":"Cryptographic Hardware and Embedded Systems. CHES 1999"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"208","DOI":"10.1007\/11605805_14","article-title":"Higher Order Masking of the AES","volume":"Volume 3860","author":"Pointcheval","year":"2006","journal-title":"Topics in Cryptology\u2014CT-RSA 2006"},{"doi-asserted-by":"crossref","unstructured":"Coron, J.S., Prouff, E., Rivain, M., and Roche, T. (2013, January 11\u201313). Higher-order side channel security and mask refreshing. Proceedings of the International Workshop on Fast Software Encryption, Singapore.","key":"ref_24","DOI":"10.1007\/978-3-662-43933-3_21"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"441","DOI":"10.1007\/978-3-642-55220-5_25","article-title":"Higher Order Masking of Look-Up Tables","volume":"Volume 8441","author":"Nguyen","year":"2014","journal-title":"Advances in Cryptology\u2014EUROCRYPT 2014"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"413","DOI":"10.1007\/978-3-642-15031-9_28","article-title":"Provably Secure Higher-Order Masking of AES","volume":"Volume 6225","author":"Mangard","year":"2010","journal-title":"Cryptographic Hardware and Embedded Systems, CHES 2010"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"764","DOI":"10.1007\/978-3-662-47989-6_37","article-title":"Consolidating Masking Schemes","volume":"Volume 9215","author":"Gennaro","year":"2015","journal-title":"Advances in Cryptology\u2014CRYPTO 2015"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"238","DOI":"10.1007\/3-540-44499-8_19","article-title":"Using Second-Order Power Analysis to Attack DPA Resistant Software","volume":"Volume 1965","author":"Paar","year":"2000","journal-title":"Cryptographic Hardware and Embedded Systems\u2014CHES 2000"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"112","DOI":"10.1007\/978-3-642-17373-8_7","article-title":"The World Is Not Enough: Another Look on Second-Order DPA","volume":"Volume 6477","author":"Abe","year":"2010","journal-title":"Advances in Cryptology\u2014ASIACRYPT 2010"},{"doi-asserted-by":"crossref","unstructured":"Canright, D. (2004). A Very Compact Rijndael S-Box, Naval Postgraduate School, Department of Mathematics.","key":"ref_30","DOI":"10.21236\/ADA434781"},{"key":"ref_31","first-page":"1","article-title":"Combinational Logic Design for AES SubByte Transformation on Masked Data","volume":"236","author":"Trichina","year":"2003","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1007\/11545262_3","article-title":"A Stochastic Model for Differential Side Channel Cryptanalysis","volume":"Volume 3659","author":"Rao","year":"2005","journal-title":"Cryptographic Hardware and Embedded Systems\u2014CHES 2005"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1007\/978-3-319-16763-3_6","article-title":"Efficient Stochastic Methods: Profiled Attacks Beyond 8 Bits","volume":"Volume 8968","author":"Joye","year":"2015","journal-title":"Smart Card Research and Advanced Applications. CARDIS 2014"},{"unstructured":"Standaert, F.X., Malkin, T.G., and Yung, M. (June, January 30). A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks. Proceedings of the Annual International Conference on the Theory and Applications of Cryptographic Techniques, Trondheim, Norway.","key":"ref_34"},{"key":"ref_35","first-page":"117","article-title":"Simpler and More Efficient Rank Estimation for Side-Channel Security Assessment","volume":"Volume 9054","author":"Glowacz","year":"2015","journal-title":"International Workshop on Fast Software Encryption. FSE 2015"},{"unstructured":"Mangard, S., Pramstaller, N., and Oswald, E. (September, January 29). Successfully Attacking Masked AES Hardware Implementations. Proceedings of the International Workshop on Cryptographic Hardware and Embedded Systems, Edinburgh, UK.","key":"ref_36"},{"unstructured":"Oswald, E., and Mangard, S. (2007, January 5\u20139). Template Attacks on Masking\u2014Resistance Is Futile. Proceedings of the Cryptographers\u2019 Track at the RSA Conference (CT-RSA 2007), San Francisco, CA, USA.","key":"ref_37"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"282","DOI":"10.1007\/978-3-319-64647-3_17","article-title":"Mind the Gap: Towards Secure 1st-Order Masking in Software","volume":"Volume 10348","author":"Guilley","year":"2017","journal-title":"Constructive Side-Channel Analysis and Secure Design. COSADE 2017"},{"doi-asserted-by":"crossref","unstructured":"O\u2019Flynn, C., and Chen, Z.D. (2014, January 13\u201315). Chipwhisperer: An open-source platform for hardware embedded security research. Proceedings of the International Workshop on Constructive Side-Channel Analysis and Secure Design, Paris, France.","key":"ref_39","DOI":"10.1007\/978-3-319-10175-0_17"},{"unstructured":"(2021, January 10). ChipWhispererLite 32-Bit API. Available online: https:\/\/chipwhisperer.readthedocs.io\/en\/latest\/api.html.","key":"ref_40"}],"container-title":["Cryptography"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2410-387X\/6\/3\/31\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T23:39:51Z","timestamp":1760139591000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2410-387X\/6\/3\/31"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,6,28]]},"references-count":40,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2022,9]]}},"alternative-id":["cryptography6030031"],"URL":"https:\/\/doi.org\/10.3390\/cryptography6030031","relation":{},"ISSN":["2410-387X"],"issn-type":[{"type":"electronic","value":"2410-387X"}],"subject":[],"published":{"date-parts":[[2022,6,28]]}}}