Efficient Time Share masking of AES

Time sharing was a novel approach to small area and low latency first-order masking in hardware presented by Kumar S.V. et al. at IACR TCHES 2024. The principal underlying idea behind the approach was to  separate the processing of shares in the time domain in order to achieve non-completeness. The authors used this       approach to construct masked round-based implementations of the PRINCE and AES-128 block ciphers which were considerably smaller than state of the art.      

In this paper, we observe that the cost in terms of number of gates and amount of random bits required for the time sharing approach is considerably smaller, if the algebraic degree of the underlying S-box is small. Using the well known decomposition of the inverse power map, (i.e. $f(x)=x^{254}$ over $GF(2^8)$ as $f(x)=x^{26}\circ x^{49}$) we present a more efficient approach to mask the AES S-box that requires much lower gate area and randomness to implement and only 2 additional         clock cycles. Using this technique we present three implementations of AES-128: (a) Bit-Serial, (b) Byte-Serial and  (c) Round based circuit, all of which require much lower gate area and randomness to construct. We present synthesis results  from three different Standard Cell libraries to validate our results.