## 2 Preliminaries
### Masking Countermeasures  
A common and effective countermeasure against side-channel attacks is masking. Here, the relation between the sensitive data and the side-channel is obscured by removing the dependencies between the two to a certain degree. In a \(d\)-th order masking scheme, sensitive values are split into multiple (at least \(d+1\)) shares and a successful attacker is required to combine information from at least \(d+1\) of these shares to be able to deduce any information about the original value. As the measurement of a physical side-channel always introduces noise, the complexity of attacks increases exponentially with the masking order under most practical conditions [4]. Masking schemes for hardware implementations should provide security in the presence of glitches. A Threshold Implementation (TI) is a Boolean masking scheme, i.e., a sensitive value \(x\) is split into shares \(x^{i}\) such that \(x=\bigoplus x^{i}\). The number of input (\(d_{in}\)) and output (\(d_{out}\)) shares of a function following the TI notion depends on the masking order and the algebraic degree of the function. However, we will mainly focus on the first-order secure variant here, where \(d_{in}>d\) and \(d_{out}>d\). While higher-order TI instantiations are possible [8], their security is limited to univariate attacks in practice [3]. In order to correctly instantiate a threshold implementation, three properties have to be fulfilled. The _non-completeness_ property requires any subset of output shares smaller than \(d+1\) to be independent of at least one input share. The _correctness_ property guarantees that the output of a shared function can be unmasked yielding the result an unprotected realization of the function would produce, i.e., \(\bigoplus f_{shared}(x^{1},...,x^{d_{in}})=f_{unshared}(x)\). Finally, _uniformity_ requires each possible output sharing to be equally likely when the input sharing is drawn from a uniform distribution. Note, that this last property is usually the hardest to fulfill and frequently requires the addition of fresh randomness. As with most masking schemes, linear functions (e.g., XOR) are trivially shared by applying the unshared function to all input shares independently, while non-linear functions (e.g., AND) are more difficult to share correctly. To ensure the resistance of TI against leakage through glitches, registers have to be placed between components when composing larger circuits from multiple functions. Probe-Isolating Non-Interference and Hardware Private Circuits  
Several attack models have been developed in order to abstract the observation of side-channels in a meaningful way and allow the construction of masking schemes that are provably secure in the respective model. The probing model, formalized in [9], generally requires any set of values that can be accessed by up to \(d\) probes in a circuit to be indepen \begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Function** & \(g(i)\) & \(p(i)\) & \(g(\{i,j\})\) & \(p(\{i,j\})\) & \(s(i)\) \\ \hline AND & 1 & 0 & 1 & 1 & 0 \\ XOR & 0 & 1 & 1 & 0 & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Number of elementary XOR and AND operations per basic function. dent of the sensitive variables. As this property is insufficient to guarantee the security of a composition of gadgets, which are themselves secure in this model [10], the more restrictive notions of Non-Interference (NI) and Strong Non-Interference (SNI) [11] were introduced. In order to satisfy NI, a set of \(t\leq d\) probes on a gadget needs to be simulatable using at most \(t\) shares of each input. For SNI-secure gadgets, every set of \(t_{int}\) internal probes and \(t_{out}\) probes on the gadget output, where \(t_{in}+t_{out}\leq d\), can be simulated using only \(t_{int}\) shares of each input. While the authors of [11] showed that gadgets can be securely composed using NI or SNI gadgets, the area and randomness costs are typically high because refresh gadgets are needed to allow composition.