{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,6]],"date-time":"2026-10-06T10:29:33Z","timestamp":1791282573664,"version":"4.1.0"},"reference-count":25,"publisher":"International Association for Cryptologic Research","issue":"1","license":[{"start":{"date-parts":[[2025,1,13]],"date-time":"2025-01-13T00:00:00Z","timestamp":1736726400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IACR CiC"],"accepted":{"date-parts":[[2025,3,11]]},"abstract":"<jats:p>We investigate the side-channel security of ISAP against Algebraic Side-Channel Attacks (ASCA) in a simulated setting where the Hamming weight leakages of its intermediate computations can be recovered. For this purpose, we first describe how these attacks, so far only used to target 8-bit implementations, can be applied to 16-bit or 32-bit implementations. We then use ASCA to discuss the side-channel security claims of ISAP's re-keying, where a single bit of nonce is absorbed per permutation call. Theoretically, this re-keying aims to ensure that attacking more than one permutation call jointly does not improve over attacking the same number of permutation calls independently. Yet, while this expectation is expected to be met for ISAP's conservative parameters (where permutation calls are made of 12 Ascon rounds), the extent to which it does (not) hold for ISAP's aggressive parameters (where permutation calls are made of a single Ascon round) remains an open question. We contribute to this question by showing that for 16-bit implementations, combining the leakages of multiple permutation calls can improve over attacking the same number of permutation calls independently, which contradicts ISAP's (theoretical) leakage-resistance claims. By contrast, for 32-bit leakages, we only show similar weaknesses by guessing a large part of the target state (i.e., more than 128 bits), which only impacts the initialization of ISAP's re-keying and does not contradict its security reduction. These results confirm that for hardware implementations with a sufficient level of parallelism, ISAP's aggressive parameters are probably sufficient, but that for more serial (e.g., software) implementations, slightly more conservative parameters, or the addition of implementation-level countermeasures, are needed.<\/jats:p>","DOI":"10.62056\/aesgvurzn","type":"journal-article","created":{"date-parts":[[2025,4,8]],"date-time":"2025-04-08T17:23:17Z","timestamp":1744132997000},"update-policy":"https:\/\/doi.org\/10.62056\/adfjwm02dj","source":"Crossref","is-referenced-by-count":1,"title":["Algebraic Side-Channel Attacks against ISAP's Re-Keying: one Ascon Round May not be Enough for Serial Implementations"],"prefix":"10.62056","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3874-7527","authenticated-orcid":false,"given":"Vincent","family":"Grosso","sequence":"first","affiliation":[{"id":[{"id":"https:\/\/ror.org\/0028p8r67","id-type":"ROR","asserted-by":"publisher"}],"name":"Universit\u00e9 Jean Monnet Saint-Etienne, CNRS, Institut d Optique Graduate School, Laboratoire Hubert Curien UMR 5516, F-42023, SAINT-ETIENNE, France","place":["Saint-\u00c9tienne, France"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7444-0285","authenticated-orcid":false,"given":"Fran\u00e7ois-Xavier","family":"Standaert","sequence":"additional","affiliation":[{"id":[{"id":"https:\/\/ror.org\/02495e989","id-type":"ROR","asserted-by":"publisher"}],"name":"UCLouvain, ICTEAM Institute, Crypto Group","place":["Louvain-la-Neuve, Belgium"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"48349","published-online":{"date-parts":[[2025,4,8]]},"reference":[{"key":"ref1:DBLP:journals\/tosc\/DobraunigEMMU17","doi-asserted-by":"publisher","first-page":"80","DOI":"10.13154\/tosc.v2017.i1.80-105","article-title":"ISAP - Towards Side-Channel Secure Authenticated\n  Encryption","volume":"2017","author":"Christoph Dobraunig","year":"2017","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref2:DBLP:journals\/tosc\/DobraunigEMMMPU20","doi-asserted-by":"publisher","first-page":"390","DOI":"10.13154\/tosc.v2020.iS1.390-416","article-title":"Isap v2.0","volume":"2020","author":"Christoph Dobraunig","year":"2020","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref3:DBLP:conf\/crypto\/BelliziaBCGGMPP20","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"369","DOI":"10.1007\/978-3-030-56784-2_13","article-title":"Mode-Level vs. Implementation-Level Physical Security in\n  Symmetric Cryptography - A Practical Guide Through the Leakage-Resistance\n  Jungle","volume":"12170","author":"Davide Bellizia","year":"2020"},{"key":"ref4:DBLP:conf\/asiacrypt\/DegabrieleJS19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"209","DOI":"10.1007\/978-3-030-34621-8_8","article-title":"Sponges Resist Leakage: The Case of Authenticated\n  Encryption","volume":"11922","author":"Jean Paul Degabriele","year":"2019"},{"key":"ref5:DBLP:conf\/asiacrypt\/DobraunigM19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"225","DOI":"10.1007\/978-3-030-34618-8_8","article-title":"Leakage Resilience of the Duplex Construction","volume":"11923","author":"Christoph Dobraunig","year":"2019"},{"key":"ref6:DBLP:journals\/tosc\/GuoPPS20","doi-asserted-by":"publisher","first-page":"6","DOI":"10.46586\/tosc.v2020.i1.6-42","article-title":"Towards Low-Energy Leakage-Resistant Authenticated\n  Encryption from the Duplex Sponge Construction","volume":"2020","author":"Chun Guo","year":"2020","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref7:DBLP:conf\/ccs\/YuSPY10","doi-asserted-by":"publisher","first-page":"141","DOI":"10.1145\/1866307.1866324","article-title":"Practical leakage-resilient pseudorandom generators","author":"Yu Yu","year":"2010"},{"key":"ref8:DBLP:journals\/joc\/DobraunigEMS21","doi-asserted-by":"publisher","first-page":"33","DOI":"10.1007\/s00145-021-09398-9","article-title":"Ascon v1.2: Lightweight Authenticated Encryption and\n  Hashing","volume":"34","author":"Christoph Dobraunig","year":"2021","journal-title":"J. Cryptol."},{"key":"ref9:B+11","volume-title":"Cryptographic Sponge Functions","author":"Guido Bertoni","year":"2011"},{"key":"ref10:DBLP:conf\/cisc\/RenauldS09","series-title":"Lecture Notes in Computer Science","isbn-type":"print","doi-asserted-by":"publisher","first-page":"393","DOI":"10.1007\/978-3-642-16342-5_29","article-title":"Algebraic Side-Channel Attacks","volume":"6151","author":"Mathieu Renauld","year":"2009","ISBN":"https:\/\/id.crossref.org\/isbn\/9783642163418"},{"key":"ref11:DBLP:conf\/ches\/RenauldSV09","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"97","DOI":"10.1007\/978-3-642-04138-9_8","article-title":"Algebraic Side-Channel Attacks on the AES: Why Time also\n  Matters in DPA","volume":"5747","author":"Mathieu Renauld","year":"2009"},{"key":"ref12:setasca","volume-title":"2011 Conference on Cryptographic Algorithms and\n  Cryptographic Chips, CASC","author":"Xinjie Zhao","year":"2011"},{"key":"ref13:DBLP:journals\/tches\/KannwischerPP20","doi-asserted-by":"publisher","first-page":"243","DOI":"10.1007\/978-3-030-97348-3_1","article-title":"Single-Trace Attacks on Keccak","volume":"2020","author":"Matthias J. Kannwischer","year":"2020","journal-title":"IACR Trans. Cryptogr. Hardw. Embed. Syst."},{"key":"ref14:DBLP:conf\/asiacrypt\/Veyrat-CharvillonGS14","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"282","DOI":"10.1007\/978-3-662-45611-8_15","article-title":"Soft Analytical Side-Channel Attacks","volume":"8873","author":"Nicolas Veyrat-Charvillon","year":"2014"},{"key":"ref15:DBLP:conf\/cardis\/YouK21","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1007\/978-3-030-97348-3_1","article-title":"Single-Trace Fragment Template Attack on a 32-Bit\n  Implementation of Keccak","volume":"13173","author":"Shih-Chun You","year":"2021"},{"key":"ref16:DBLP:journals\/tches\/CassiersDSU23","doi-asserted-by":"publisher","first-page":"270","DOI":"10.46586\/tches.v2023.i3.270-293","article-title":"Efficient Regression-Based Linear Discriminant Analysis for\n  Side-Channel Security Evaluations Towards Analytical Attacks against 32-bit\n  Implementations","volume":"2023","author":"Ga\u00ebtan Cassiers","year":"2023","journal-title":"IACR Trans. Cryptogr. Hardw. Embed. Syst."},{"key":"ref17:DBLP:journals\/jce\/BelaidSHMMSST14","doi-asserted-by":"publisher","first-page":"157","DOI":"10.1007\/s13389-014-0079-5","article-title":"Towards fresh re-keying with leakage-resilient PRFs:\n  cipher design principles and analysis","volume":"4","author":"Sonia Bela\u00efd","year":"2014","journal-title":"J. Cryptogr. Eng."},{"key":"ref18:tseitin1983complexity","first-page":"466","article-title":"On the complexity of derivation in propositional calculus","author":"Grigori S Tseitin","year":"1983"},{"key":"ref19:DBLP:conf\/cp\/Sinz05","series-title":"Lecture Notes in Computer Science","isbn-type":"print","doi-asserted-by":"publisher","first-page":"827","DOI":"10.1007\/11564751_73","article-title":"Towards an Optimal CNF Encoding of Boolean Cardinality\n  Constraints","volume":"3709","author":"Carsten Sinz","year":"2005","ISBN":"https:\/\/id.crossref.org\/isbn\/3540292381"},{"key":"ref20:DBLP:conf\/ches\/OrenKPW10","series-title":"Lecture Notes in Computer Science","isbn-type":"print","doi-asserted-by":"publisher","first-page":"428","DOI":"10.1007\/978-3-642-15031-9_29","article-title":"Algebraic Side-Channel Analysis in the Presence of Errors","volume":"6225","author":"Yossef Oren","year":"2010","ISBN":"https:\/\/id.crossref.org\/isbn\/9783642150302"},{"key":"ref21:DBLP:conf\/ches\/OrenRSW12","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"140","DOI":"10.1007\/978-3-642-33027-8_9","article-title":"Algebraic Side-Channel Attacks Beyond the Hamming Weight\n  Leakage Model","volume":"7428","author":"Yossef Oren","year":"2012"},{"key":"ref22:DBLP:conf\/cosade\/UdvarhelyiBS21","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"168","DOI":"10.1007\/978-3-030-89915-8_8","article-title":"Security Analysis of Deterministic Re-keying with Masking\n  and Shuffling: Application to ISAP","volume":"12910","author":"Balazs Udvarhelyi","year":"2021"},{"key":"ref23:DBLP:conf\/cisc\/2009","series-title":"Lecture Notes in Computer Science","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-16342-5","volume-title":"Information Security and Cryptology - 5th International\n  Conference, Inscrypt 2009, Beijing, China, December 12-15, 2009. Revised\n  Selected Papers","volume":"6151","year":"2011","ISBN":"https:\/\/id.crossref.org\/isbn\/9783642163418"},{"key":"ref24:DBLP:conf\/cp\/2005","series-title":"Lecture Notes in Computer Science","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/11564751","volume-title":"Principles and Practice of Constraint Programming - CP\n  2005, 11th International Conference, CP 2005, Sitges, Spain, October 1-5,\n  2005, Proceedings","volume":"3709","year":"2005","ISBN":"https:\/\/id.crossref.org\/isbn\/3540292381"},{"key":"ref25:DBLP:conf\/ches\/2010","series-title":"Lecture Notes in Computer Science","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-15031-9","volume-title":"Cryptographic Hardware and Embedded Systems, CHES 2010,\n  12th International Workshop, Santa Barbara, CA, USA, August 17-20, 2010.\n  Proceedings","volume":"6225","year":"2010","ISBN":"https:\/\/id.crossref.org\/isbn\/9783642150302"}],"container-title":["IACR Communications in Cryptology"],"original-title":[],"language":"en","deposited":{"date-parts":[[2025,4,8]],"date-time":"2025-04-08T17:25:21Z","timestamp":1744133121000},"score":1,"resource":{"primary":{"URL":"https:\/\/cic.iacr.org\/p\/2\/1\/34"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4,8]]},"references-count":25,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,4,8]]}},"URL":"https:\/\/doi.org\/10.62056\/aesgvurzn","archive":["Internet Archive","Internet Archive"],"relation":{},"ISSN":["3006-5496"],"issn-type":[{"value":"3006-5496","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,4,8]]},"assertion":[{"value":"2025-01-13","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-03-11","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"cc2-1-57"}}