Two Low-Cost and Security-Enhanced Implementations Against Side-Channel Attacks of NTT for Lattice-Based Cryptography

Lattice-based cryptography is considered secure against quantum computing attacks. However, naive implementations on embedded devices are vulnerable to side-channel attacks (SCAs) with full key recovery possible through power and electromagnetic leakage analysis. This article presents two protection schemes, masking and shuffling, for the baseline Radix-2 multi-path delay commutator (R2MDC) number theoretic transform (NTT) architecture. The proposed masking NTT scheme introduces a random number to protect the secret key during the decryption phase and leverages the linear property of arithmetic transform in NTT polynomial multiplication. By adjusting the comparing decoding threshold, the masking method greatly reduces the ratio of <inline-formula><tex-math notation="LaTeX">$t$</tex-math></inline-formula>-<inline-formula><tex-math notation="LaTeX">$test$</tex-math></inline-formula> value exceeding the threshold of unprotected NTT scheme from 77.38% to 3.91%. An ingenious shuffling transform process is also proposed to disturb the calculation sequence of butterfly transformation, adapting to the high-throughput architecture of R2MDC-NTT. This shuffling NTT scheme does not require operations to remove shuffle or additional operation cycles, reducing the leakage ratio to 13.49% with minimal extra hardware resources and wide applicability. The proposed masking and shuffling techniques effectively suppress side-channel leakage, improving the security of hardware architecture while maintaining a balance between overall performance and additional hardware resources.