## 3 A New Dual-Rail-Based Power-Balancing Countermeasure without Look-Up Tables
### Constant ADD Operation
We redesigned the software-based KS adder based on this fact. Lines 1, 3 in Algorithm 3 are the keys for handling a carry bit. We assume that the KS algorithm is computed in 1-bit units. The algorithm is of the form in which for loops after Line 4 are removed. Here, \(P^{\prime}\) denotes the result of the addition, and \(G\) denotes a carry bit. Now, suppose that we increase the size of the bits. However, even if the word size increases, the LSB of a result \(P^{\prime}\oplus 2G\) does not change. Based on these ideas, we initialized \(P^{\prime}\) to an XOR result of a lower carry bit and two input words (Line 1). In the case of \(G\), the LSB of \(G\) denotes the carry bit that is generated by a lower carry bit and the LSBs of inputs. We initialized \(G\) using the majority rule (Line 3). However, because the well-known majority rule includes three AND operators, we adjusted the formula with one AND operator. We further designed Algorithms 5 and 6 with PB methods. Algorithms A2, A4, and A6 in Appendix A show the algorithms of [PERSON] et al. and [PERSON] et al. with PB methods. ## 4 Side-Channel Security Evaluation

In this section, we evaluate the side-channel security ensured by the proposed method and those ensured by existing methods. We used the SCARF ARM (ARM920T) evaluation board, which has an operating frequency of approximately 100 MHz [23]. Power signals were collected using Wave Runner 204 Xi-A oscilloscope from LeCroy at a sample rate of 1 GS/s. We set two comparative groups, which include an 8-bit AND operation (u8 AND) without any countermeasures and a constant AND operation with [PERSON]'s method-1. We evaluated the address bits of [PERSON]'s method-1 to analyze the side-channel vulnerabilities in LUTs. The implementations verified (at the assembly level) that the registers were used as intended by the designer. Figures 1-3 present the evaluation results of the u8 AND operation, our ConstAND, and [PERSON]'s method-1, respectively. In the figures, the upper left side is a graph of 10 traces. The x-axis denotes the samples, and the y-axis denotes the relative magnitude. The upper right side shows an SNR graph of [24] according to HW. The x-axis denotes the samples, and the y-axis denotes the SNR. The lower left side shows a graph of CPA [25] results with 10,000 traces. The x-axis denotes the samples and the y-axis denotes the correlation coefficient. The lower right side is a graph of the highest CPA peaks according to the number of traces. The x-axis denotes the number of traces and the y-axis denotes the correlation coefficient. The SNR formula is as follows [24]. **Definition 1** (Signal-to-Noise Ratio (SNR) [24]). : _The signal-to-noise Ratio of a leakage is denoted by a random variable \(L\), which depends on the informative part denoted by \(I\), as follows._

\[SNR[L,I]=\frac{Var[\mathbb{E}[L|I]]}{\mathbb{E}[Var[L|I]]} \tag{1}\]

Figure 1 presents the results of the normal AND operation. These results illustrate the physical characteristics of the evaluation board. As observed from the CPA peaks, this board exhibits ideal side-channel leakages as in an HW model. The SNR is also approximately \(5\sim 8\), and this board exhibits strong leakages in power consumption like the register B.

Figure 1: Evaluation Results of the u8 AND. Figure 2 presents the results of our ConstAND. PB methods are known to reduce SNRs and decrease CPA peaks. In this experiment, the decreasing rates of SNR were 429% to 2697%. The decreasing rates of CPA peaks were 48% to 318%. The reason for the occurrence of strong side-channel leakages at approximately 1450 is that we assume the register B to have no ideal HW model. However, our countermeasure exhibits decreased SNRs and CPA peaks compared to the u8 AND experiments. The proposed method exhibits sufficient performance characteristics as PB methods. Figure 3 presents the results of [PERSON]'s method-1. We implemented a constant AND based on [PERSON]'s method-1 using the divide and conquer method on four 8-bit codewords.