Masking countermeasures for ML-KEM implementations

Short answer: Three papers describe masking, which splits secret data into randomized shares, to protect ML-KEM and ML-DSA hardware and software against side-channel attacks: a first-order masked unified ML-DSA and ML-KEM design on an FPGA, a Reed-Solomon code-based masking scheme, and HOPE-MLKEM, a high-order masked ML-KEM framework. Each reports leakage tests under stated conditions. They are research designs.

Hardware Integration of Masked Components

Implementing masking in hardware requires integrating specific cryptographic operations with protection mechanisms. One approach presents a unified hardware implementation for both ML-DSA and ML-KEM protected by first-order masking. Rather than proposing entirely new gadgets, this design focuses on hardware-optimized instantiations and the integration of existing state-of-the-art masked components. These components include masked domain conversions, sampling, and message decoders.

The architecture also proposes an optimized masked decomposition algorithm. This algorithm includes a formal security proof and reduces the number of required operations compared to prior approaches. The complete implementation was functionally verified against reference software implementations. Evaluation occurred on a Field Programmable Gate Array (FPGA) platform. Side-channel resistance was assessed using the Test Vector Leakage Assessment (TVLA) methodology. The authors report no first-order leakage under the tested conditions.

Reed-Solomon Code-Based Masking Advances

Another line of research advances Reed-Solomon Code-Based Masking (RS-CBM) for post-quantum applications. While RS-CBM has been investigated for AES with Boolean logic, recent work proposes arithmetic gadgets and constrained conversions between arithmetic and Boolean logic. This work also investigates Cost-Amortisation (CA), a method to encode several sensitive data items into one masked code word. Techniques are proposed to swap between un-amortised and amortised masking.

Security is experimentally verified by performing a Test Vector Leakage Assessment (TVLA) on a SAM4S target using a Chipwhisperer Husky. Formal proofs of security are provided in the SNI model. The research applies these gadgets to ML-KEM, proposing a full arithmetisation of the masked calculations for message compression and ciphertext comparison.

High-Order Protection Frameworks

Existing hardware implementations of ML-KEM often optimize for performance but lack protections against side-channel attacks. A framework named HOPE-MLKEM addresses this by providing the first configurable, open, and full-hardware implementation of ML-KEM with integrated high-order protection. The authors say it offers resistance against timing and power side-channel attacks. The modular architecture supports all security levels and operations, incorporating optimized building blocks for polynomial arithmetic, modular multiplication, and programmable control logic.

The authors say this methodology enables integration of masking countermeasures up to high orders. HOPE-MLKEM was evaluated on FPGA and ASIC platforms. It achieves competitive results compared to state-of-the-art unprotected designs while providing resistance against high-order side-channel attacks.

Limits

These are three separate research designs, evaluated on an FPGA, a SAM4S microcontroller target and FPGA/ASIC platforms respectively. The authors report leakage tests under stated conditions, and a passing test is not a proof of security against every attack. The papers say nothing here about deployed products.

FAQ

What masking order is used in the unified hardware?

The unified hardware implementation for ML-DSA and ML-KEM uses first-order masking. This protects against first-order power analysis attacks. The design integrates state-of-the-art masked components rather than proposing entirely new gadgets.

How is the security of the masking verified?

Security is verified using the Test Vector Leakage Assessment (TVLA) methodology. For the unified hardware, this showed no first-order leakage under tested conditions. For RS-CBM, TVLA was performed on a SAM4S target using a Chipwhisperer Husky.

Does the framework support high-order masking?

The HOPE-MLKEM authors say their methodology enables integration of masking countermeasures up to high orders. The authors report resistance against high-order side-channel attacks. The architecture is configurable and supports all security levels and operations.

What specific ML-KEM operations are arithmetised?

Recent work proposes a full arithmetisation of the masked calculations for message compression and ciphertext comparison in ML-KEM. This allows the application of Reed-Solomon Code-Based Masking to these specific post-quantum operations.