# Gate-Level Hardware Countermeasure Comparison against Power Analysis Attacks
## 4 Gate-Level Masking
The MDPL AND gate, based on CMOS majority gates, is depicted in Figure 13c, having six dual-rail inputs (\(a_{m}\), \(\overline{a_{m}}\), \(b_{m}\), \(\overline{b_{m}}\), \(m\), \(\overline{m}\)) and producing two output values (\(Q_{m}\), \(\overline{Q_{m}}\)). The main design drawback of this implementation is the need to generate a random mask but a single one for the entire design. Unfortunately, later it was shown that the RSL and MDPL implementations were vulnerable to the well-known early propagation effects [27; 75], with successful attacks presented in [76; 77]. To solve this problem in RSL, a new logic style was presented, called DRSL (dual-rail random switching logic) [78]. DRSL prevents glitches by using a precharging protocol to reduce early propagation effects while removing routing constraints, introducing a random mask. DRSL is based on RSL (e.g., uses an RSL NAND gate with an evaluation-precharge detection unit (EPDU) to implement an NAND DRSL gate [78]) and MDPL, but as an advantage over MDPL by avoiding side-channel leakage caused by asynchronous inputs. However, according to the analysis in [76], DRSL does not completely avoid the early propagation effect in the precharge phase. The input signals arriving at different moments can still precharge the DRSL gates given that the EPDU still allows for some precharge to happen. The main design drawback is the need to generate a mask for the entire implementation and the differential implementation of the design, although it does not need special place and routing. Another improvement of DRSL is briefly presented in [79], consisting of implementing DRSL in positive logic. This solution has a cost in CMOS logic, since inverting gates are smaller than non-inverting ones. To solve the early propagation effect in MDPL, a new logic style called iMDPL (improved MDPL) was proposed [76], where the authors include an EPDU, which generates 0 at its output only if all input signals are in a differential state. Evaluation of iMDPL gates over CMOS and MDPL presented in [80] suggests that the main drawback of this design is the need to generate a random mask for the whole design. In [76], MDL was also shown to have lower security levels than DPL logics [7; 8; 37]. As in the case of MDPL, where both hiding and masking techniques are implemented together in the same logic style to withstand DPA attacks, masked-SABL is also presented [81]. In this case, the authors include in the SABL logic style the use of a mask \(m\) to prevent the unbalance produced in the circuit connections due to aging. Modification of the SALB logic style is performed in the DPDN structure, as shown in Figure 13d. In each of the differential branches, an NMOS transistor is placed, one controlled by the mask \(m\) and the other one with its complement signal \(\overline{m}\). This implies complementing or not the functionality of the gate depending on the mask value, having at the output \(Q(\overline{Q})\) the result of the function \(f(\overline{f})\) implemented by the gate if the mask is 0 and \(\overline{f}(f)\) if the mask is 1. It is important to note that the security level reached by SABL depends directly on the imbalances of the output capacitance, so this enhanced logic style is expected to improve the security level even if the problem of aging is not taken into account. However, it still requires a differential place and routing process to reach the highest security level. The main drawbacks are the area overhead, as the DPDN is almost duplicated compared with standard SABL, and the need for a full-custom design. Despite the masking logic styles presented above, using a single bit to mask is still susceptible to DPA attacks, as presented in [82]. The authors conclude that the mask bit value can be determined by a first analysis of the power consumption traces. For this reason, logic styles that use both masking and hiding techniques are potentially capable of achieving better security levels, as well as resistance against aging effects, as considered in [81].