# Gate-Level Hardware Countermeasure Comparison against Power Analysis Attacks
## 4 Gate-Level Masking
Following the indications of the previous sections, the reader can go to the end of the section for a summary of all the main features and comparison. One of the first approaches of gate-level masking was presented in [12] in 2001, where functions are masked using one of the two different methods: look-up table masking or the use of multiplexer trees apparatus. Although these techniques are typically applicable on an higher design level, single masked gates can also be implemented. Specifically, the application of this multiplexer method was also studied in [69], where two additional techniques are presented to implement masking at the gate level, namely, the use of the XOR technique to mask the AND and OR gates, and the implementation of the multiplexer technique using AND and OR gates. This study was later extended in [70]. In 2003 [71], the masked-AND logic style was presented (further analyzed and studied in [69; 72] in 2004). This masked-AND gate, depicted in Figure 12(a), implements the AND operation of \(a\) and \(b\), with \(Q\) as output. The gate has as inputs the masked values \(a_{m}\) and \(b_{m}\), and the respective mask values \(m_{a}\) and \(m_{b}\) outputting the mask \(m_{Q}\) and the masked output value \(Q_{m}\). Given that, this work only focuses on the combinational logic for the advanced encryption standard (AES) substitution-box (Sbox) implementation, using XOR and AND gates, and given that the XOR gates are linear operation, not needing to be unmasked, the masking manipulation is performed on the AND gates. The masked-AND technique requires the generation of a mask for each of the signals, implying the generation of many masks as there are signals in the implementation. The area increase is approximately \(\times\)3.86, while the frequency degradation is \(\times\)0.58. The power consumption is expected to increase proportionally to the increase in area caused by the masked AND gates [10]. The previous presented implementations [12; 69; 71], although protected by \"secure\" schemes, still leak side-channel information in presence of glitches which can be exploited by DPA attacks [73]. Given this, a logical style based on standard cells resistant to DPA attacks in the presence of glitches called FGL was presented [74]. At the same time that gate-level masking countermeasures were presented, gate-level hiding countermeasures were also introduced, with great results in terms of security. Figure 13: Gate-level masking hardware countermeasures. The first approaches using gate-level hiding countermeasures try to equalize the power consumption of the gate using complementary operations, being dependent on wire length or fan-out, which often makes the design very difficult. To solve this problem, the authors in [10] propose the masked logic style called random switching logic (RSL). This logic style does not require complementary operations and processes original signals and a mask simultaneously having the following two properties: (i) RSL uses the same random mask for all the signals and (ii) needs an enable signal that executes operations while \(en=1\), otherwise drives 0. Figure 13b depicts a NAND gate implemented in RSL logic style, where \(a\), \(b\) are input signals, \(\overline{en}\) the complemented enable signal, \(m\) is the random mask, and \(Q\) is the output. The authors also present a solution for FPGA implementations, called RSLUT, based on look-up table implementations. The main design drawbacks of RSL are that it needs a full-custom gate design and the generation of the enable signal and the random mask. In [11], the authors present MDPL (masked dual-rail precharge logic), a masked logic style that prevents glitches by using the dual-rail precharge principle. It can be classified as a hiding or masking countermeasure as it is a mix of both techniques. Hence, for each masked signal \(a_{m}\), its complementary masked signal \(\overline{a_{m}}\) is also present in the circuit, every signal being masked with the same mask \(m\).