The candidates for the NIST Post-Quantum Cryptography standardization have undergone extensive studies on efficiency and theoretical security, but research on their side-channel security is largely lacking. This remains a considerable obstacle for their real-world deployment, where side-channel security can be a critical requirement. This work describes a side-channel-resistant instance of Saber, one of the lattice-based candidates, using masking as a countermeasure. Saber proves to be very efficient to masking due to two specific design choices: power-of-two moduli and limited noise sampling of learning with rounding. A major challenge in masking lattice-based cryptosystems is the integration of bit-wise operations with arithmetic masking, requiring algorithms to securely convert between masked representations. The described design includes a novel primitive for masked logical shifting on arithmetic shares and adapts an existing masked binomial sampler for Saber. An implementation is provided for an ARM Cortex-M4 microcontroller, and its side-channel resistance is experimentally demonstrated. The masked implementation features a 2.5x overhead factor, significantly lower than the 5.7x previously reported for a masked variant of NewHope. Masked key decapsulation requires less than 3,000,000 cycles on the Cortex-M4 and consumes less than 12kB of dynamic memory, making it suitable for deployment in embedded platforms.

中文翻译：

---

SABRE 的抗侧通道实现

NIST 后量子密码学标准化的候选者已经在效率和理论安全性方面进行了广泛的研究，但在很大程度上缺乏对其侧信道安全性的研究。这对于他们的实际部署来说仍然是一个相当大的障碍，其中侧通道安全性可能是一个关键要求。这项工作描述了 Saber 的抗侧信道实例，它是基于格的候选者之一，使用掩蔽作为对策。由于两种特定的设计选择，Sabre 被证明对掩蔽非常有效：二次幂模数和舍入学习的有限噪声采样。掩码基于格的密码系统的一个主要挑战是按位运算与算术掩码的集成，需要算法在掩码表示之间安全地转换。所描述的设计包括一个用于对算术份额进行掩码逻辑移位的新颖原语，并为 Sabre 调整了现有的掩码二项式采样器。为 ARM Cortex-M4 微控制器提供了一种实现，并通过实验证明了它的侧通道电阻。掩码实现具有 2.5 倍的开销因子，显着低于之前报告的 NewHope 掩码变体的 5.7 倍。掩码密钥解封装在 Cortex-M4 上需要少于 3,000,000 个周期，并且消耗少于 12kB 的动态内存，使其适合部署在嵌入式平台中。并通过实验证明了它的侧沟道电阻。掩码实现具有 2.5 倍的开销因子，显着低于之前报告的 NewHope 掩码变体的 5.7 倍。掩码密钥解封装在 Cortex-M4 上需要少于 3,000,000 个周期，并且消耗少于 12kB 的动态内存，使其适合部署在嵌入式平台中。并通过实验证明了它的侧沟道电阻。掩码实现具有 2.5 倍的开销因子，显着低于之前报告的 NewHope 掩码变体的 5.7 倍。掩码密钥解封装在 Cortex-M4 上需要少于 3,000,000 个周期，并且消耗少于 12kB 的动态内存，使其适合部署在嵌入式平台中。