International Association for Cryptologic Research

International Association
for Cryptologic Research

Transactions on Cryptographic Hardware and Embedded Systems, Volume 2024

Compress: Generate Small and Fast Masked Pipelined Circuits


README

COMPRESS artifact

This repository contains the artifact for the paper Compress: Reducing Area
and Latency of Masked Pipelined Circuits.
The artifact contains all the code on which the results presented in the paper
are based, except for COMPRESS itself, which is in a separate
repository (and is included as a
submodule of this repository).

Getting started

When getting this artifact from github, clone the repository with the
submodule:

git clone --recursive https://github.com/cassiersg/compress_artifact

The scripts in the repository assume a unix environment (bash, GNU make, coreutils, etc.), as well as the following dependencies:

Some part of the artifact additionally require:

(See below for detailed dependencies installation instructions.)

Contents

├── aes-round-compress # AES round fully-generated by COMPRESS.
├── agema # Automated masking of COMPRESS .txt files with AGEMA.
├── agema_direct # Masked circuit generation and synthesis of AGEMA example circuits.
├── canright # Masking of Canright AES Sbox with COMPRESS.
├── compress # Submodule containing COMPRESS, masked gadgets and simulation/synthesis scripts.
├── dom-sbox # Masking of Canright AES Sbox with DOM [GMK16]. 
├── full_aes
│   ├── 128-bit # round-based AES
│   └── 32-bit # AES with 32-bit serial architecture
├── gadget_verif # Verification of COMPRESS gadgets with SILVER.
├── low_random_second_order_aes # Masked TI AES Sbox of [DSM22]
├── Makefile # Top-level makefile for running all flows of this repository.
├── skinny_serialized_sbox # Masked serialized 8-bit Skinny Sbox of [VCS22].
├── skinny_ti # Masked TI 8-bit Skinny Sbox of [CCGB21].
└── work # Where all temporary and result files are generated.

Using COMPRESS directly

See compress/README.md or https://github.com/cassiersg/compress.

Reproducing results of the paper

All components of the artifact can be run through the top-level Makefile.

Required environment variables

Optional environment variables

Some of the Makefile targets detailed after may take a significant time to
complete. The time required to simulate the largest circuits can be of the
order of an hour for behavioral simulations, or several hours for structural
simulations. Besides, the execution time of COMPRESS is rather fast (seconds to
minutes) for small circuit, but increase with the circuit size due to the usage
of a CP solver (in the artifact, only some adder circuits take a long time).

The following environment variables provide configuration for the most time consuming steps:

SKIP_STRUCT_SIMU=1 make $TARGET

S-boxes

The following make targets generate masked AES and 8-bit Skinny S-box designs
using various automated tools.
These also synthesize the designs and report area, using yosys and
the NanGate45 library.

The reports for area usage and design generation execution time are in
work/{aes,skinny}_{opt,sep,base}/{aes_bp,skinny8}_area.csv for COMPRESS,
work/handcrafting/{aes_bp,skinny8}_area.csv for handcrafting, and
work/agema_{skinny,aes}/{aes_bp,skinny8}_areas.csv for AGEMA.

We also synthesize existing masked S-box designs with yosys and Nangate45:

Adders

Generation of masked adder circuits and their synthesis is very similar to the
S-boxes, with the following commands:

make adders_compress adders_handcrafting adders_agema

Area reports are generated respectively in work/adders/*.csv,
work/adders_handcrafting/*.csv and work/adders_agema/*.csv.

COMPRESS gadget verification

COMPRESS comes with some new gadgets. In addition to the security proofs in the
paper, these gadgets can be verified at the first- and second-order using
SILVER:

make silver

The first-order verification takes a few minutes, the second-order
verification of the larger gadgets ca take multiple hours.

If the first-order verification stalls, check that you are using the supported
SILVER version (see above).

Full AES designs

For the 32-bit datapath:

The synthesis results summary is then located in work/aes32synth/areas.csv. The file contains entries for the following designs:

For the 128-bit datapath (round-based):

The synthesis results summary is then located in work/aes128synth/areas.csv. The file contains entries for the following designs:

For the (128-bit datapath) AES of AGEMA:

make aes128agema

For a round-based implementation (fully) generated with compress (Boyard Peralta repr.):

make aes_round_compress

The synthesis results summary is located in work/aes_round_compress/aes_round_compress_area.csv. In the paper, these results are compared with the "handmade" implementation of the round based implementation (i.e., the results reported for new_1round above).

Installing Dependencies

In this section, we provide instructions for installing the dependencies on a
fresh Debian 12 install (bash shell).
These should be mostly portable to other linux distributions, we refer to the
individual tool's documentations for details.