## 1 Introduction  
Side-channel attacks are techniques that extract secret values using physical leakages, such as power consumption, electromagnetic radiation, and running time, which occur during the execution of cryptographic algorithms on real devices [1; 2; 3]. Power analyses, one of the best-known side-channel attacks, are statistical techniques that extrort a secret key based on the fact that total power consumed by a cryptographic module is strongly related to a computed value. To address these threats, countermeasure designers have attempted to break the link between computed data and physical measurements. However, it is very hard to completely break this relationship.  
Another type of countermeasure is the use of masking methods to blind secret data by using random numbers, and as a consequence of such a scheme, power measurements can be randomly generated [4]. However, because masking methods unconditionally require random numbers, they are not suited for resource-constrained environments in which it may be difficult to employ a cryptographic pseudorandom number generator (PRNG) [5]. For instance, a \(d\)th-order side-channel attack that exploits the leakages related to \(d\) intermediate variables at the same time are theoretically countered by a \(d\)th-order masking method that \(d\) random values are involved per sensitive variable [6].  
Power-balancing (PB) methods may ensure side-channel safety in an environment in which it is difficult to use PRNGs [7]. These methods encode data and construct operations to ensure that the number of 1s and/or transitions of bits (i.e., Hamming weight/distance (HW/HD)) is constant, and therefore power leakages can be similarly generated regardless of the secret values [8]. Because the power consumption of a crypto-module applied to PB methods contains small amounts of information related to the computed data, these schemes do not ensure perfect security against power analyses. However, in environments where random numbers cannot be used, these methods exhibit advantages that reduce the impact of power analyses. Moreover, these methods can be combined with other countermeasures such as shuffling and dummy operation schemes to achieve a higher level of security [9].  
The fundamental idea of PB methods was derived from dual-rail with precharge logic (DPL) styles in hardware [8]. In DPL styles, a logic bit \(a\) is represented by a 2-bit pair \((a,\overline{a})\), where \(\overline{a}\) is the complement bit of \(a\). [PERSON] et al. was the first to attempt to create DPL styles of hardware into software [7]. Since then, several studies, such as constant XOR and look-up table-based (LUT-based) operations, have applied these schemes to symmetric ciphers [10; 11; 12; 13; 14; 15; 16; 17; 18]. Here, constant operators, such as constant XOR, are modified into operations that always hold the same HW/HD in internal process by using only assembly language. The most recent attempt is the study by [PERSON] et al., which proposed constant ANDs by using only a small number of LUTs and applied these operations to the SIMON block cipher [19]. However, most studies that use LUTs exhibit vulnerabilities to power analyses targeted at address bits. Moreover, these implementations are inefficient in terms of memory usage [18]. In addition, both the data of LUTs and address bits should have the same HW as 0101, 0110, and 1001, whereas others can be unavailable.  
In this paper, we first propose constant AND and ADD operations without using LUTs. Our operations are based on a rule that encodes 8-bit data into a 32-bit codeword. The 32-bit codewords are optimized for 32-bit microcontrollers such as ARM and AVR32, and our suggestions are applicable to ARX ciphers in environments where PRNG is not available. Moreover, we evaluate the side-channel security and analyze the performances of the proposed countermeasures. The main contributions of this paper are as follows.