SM4 Side-Channel Defence: LFSR Masking + Composite Field S-box

Project: This post is part of the SM4 Crypto Accelerator project.

TL;DR

A 3-layer defence system for SM4 on FPGA: LFSR-based randomization to mask intermediate values, a dual S-box architecture switching between LUT and GF((2⁴)²) composite field, and 3-level security control via safe_en. Avalanche effect hits 50.1%; key sensitivity lands at 50.0% — both statistically ideal.

Why Side-Channel Defence Matters

Mathematical security is necessary but not sufficient. The SM4 algorithm, published as GB/T 32907-2016, is provably secure against known analytical attacks. But a hardware implementation leaks information through side channels — the physical phenomena that accompany computation.

DPA (Differential Power Analysis) exploits the statistical correlation between power consumption and data values. By collecting thousands of encryption traces and applying statistical tests, an attacker can recover round keys one byte at a time. The correlation coefficient for a single S-box output bit can exceed 0.8 — trivially detectable.

EMA (Electromagnetic Analysis) takes this further by spatial localization. Near-field EM probes can pinpoint the exact silicon region processing a specific S-box, isolating the signal from noise. This makes attacks more targeted and harder to defend against with simple noise injection.

For a国密-standard cipher deployed in government or financial hardware, side-channel resistance isn’t optional — it’s a compliance requirement. The defence strategy here targets both DPA and EMA simultaneously.

LFSR-Based Randomization

The first defence layer randomizes the round key input to break the fixed relationship between data values and power consumption.

                      ┌──────────┐
  key_rk_i ──────────▶│   XOR    │──▶ masked_rk_i ──▶ Round 运算
                      └──────────┘
                           ▲
  LFSR_32 ─────────────────┘
  (每时钟周期产生不同伪随机数)

The core idea: before each round key enters the XOR/AddRoundKey operation, it’s XORed with a pseudo-random mask generated by a 32-bit LFSR. The LFSR advances one step per clock cycle, producing a different mask for every round.

LFSR polynomial: x³² + x⁷ + x⁵ + x³ + 1 (primitive polynomial over GF(2), period 2³² − 1).

// 32-bit LFSR, advances one bit per clock
always @(posedge clk) begin
    lfsr <= {lfsr[30:0], lfsr[31] ^ lfsr[6] ^ lfsr[4] ^ lfsr[2]};
end

The key insight: even though the attacker knows the LFSR polynomial, the XOR mask randomizes the instantaneous power signature of each round. Without knowing the mask state at the exact moment of measurement, statistical correlation attacks lose their leverage.

The LFSR occupies 32 flip-flops and 3 XOR gates — negligible area overhead for significant security gain.

Dual S-box Architecture

The S-box is the nonlinear heart of SM4 and the primary target for DPA attacks. The design implements two S-box variants behind a multiplexer.

                       ┌──────────────────────┐
  data_in[31:24] ─────▶│  sbox_replace (LUT)  │──▶ fast_out[31:24]
                       └──────────────────────┘
                                 │
  data_in[31:24] ─────▶ ┌───────┴───────────┐
                        │  sbox1 (GF(2^4)^2) │──▶ secure_out[31:24]
                        │  sbox2 (GF(2^4)^2) │
                        └────────────────────┘
                                 │
  safe_en ────────────▶ MUX 选择 ──▶ 最终输出

LUT S-box — a straight 256-entry lookup table. Fast (~1.5 ns), small (~160 ALM), but its power consumption pattern is a direct function of the input. Every unique input produces a unique, repeatable power trace. This is exactly what DPA exploits.

Composite field S-box — implements the S-box mathematically over GF((2⁴)²). The computation involves:

1. Isomorphism mapping — translate GF(2⁸) elements to GF((2⁴)²)
2. Inversion in GF((2⁴)²) — the nonlinear core, using Itoh-Tsujii
3. Scaling matrix multiplication — affine transformation back to GF(2⁸)

// Simplified composite field S-box pipeline (3 stages)
wire [7:0] iso_in  = iso_map(data_in);       // Stage 1: isomorphism
wire [7:0] inv_out = gf_inv(iso_in);          // Stage 2: inversion
wire [7:0] sbox_out = scale_matrix(inv_out);   // Stage 3: affine

The critical property: intermediate values during GF((2⁴)²) arithmetic are data-dependent in a non-linear way. The power consumption of a multiplication over GF((2⁴)²) doesn’t correlate simply with the input bits — it depends on the specific algebraic structure of the operands. This is intrinsic DPA resistance, not masking.

Round 0 and Round 31 instantiate both S-box variants. The safe_en signal selects which output reaches the datapath. This means you can trade security for speed in real-time — no recompilation needed.

3-Level Security Control

The safe_en[1:0] register selects the defence level at runtime:

  safe_en[1:0]
      │
      ├── 2'b00: No defence (pure LUT, lowest power)
      ├── 2'b01: LFSR masking only (medium security)
      └── 2'b10: LFSR + composite field S-box (highest security)

Level 0 (2'b00): Pure LUT S-box, no masking. Maximum throughput, minimum area. Use when the deployment environment is physically secured and side-channel attacks aren’t a threat vector.

Level 1 (2'b01): LFSR masking active, LUT S-box retained. The mask breaks the fixed input→power mapping for DPA. Protection is good against simple power analysis (SPA) and moderate DPA, but a determined attacker with 100K+ traces may still extract the mask.

Level 2 (2'b10): LFSR masking + composite field S-box. Both layers active simultaneously. The composite field provides intrinsic resistance while the LFSR adds randomization. Even with unlimited traces, the attacker faces two independent obstacles: the non-linear power profile of GF((2⁴)²) and the per-round mask randomization.

This is a hardware-level toggle — no firmware intervention, no reconfiguration latency. Switch security modes on the fly.

Verification: Avalanche Effect

The avalanche effect measures how a single-bit change in the plaintext propagates to the ciphertext. For a well-designed cipher, each output bit should flip with probability 50%.

Test methodology: 1000 random plaintext pairs, each differing by exactly 1 bit. For each pair, count the number of differing bits in the 128-bit ciphertext and compute the average ratio.

The 50.1% plaintext avalanche confirms that the S-box non-linearity and linear diffusion layers (L, L’) are working correctly. The diffusion spreads a single input change across all 128 output bits with no bias.

The 50.0% key sensitivity is even more telling — changing a single bit in any of the 32 round keys produces a ciphertext that is statistically indistinguishable from random. This is exactly what you’d expect from a correctly implemented SM4, but it’s a necessary sanity check for any hardware implementation.

Implementation Cost

Measured on Intel Cyclone V (5CEBA5F23C7):

The +15.3% ALM overhead covers the composite field S-box instances, LFSR, and MUX logic. The register increase (+24.7%) comes from pipeline registers added to maintain timing closure at the lower Fmax.

At 50 MHz, the defence-mode throughput is 6.4 Gbps (128-bit block × 50 MHz × 32 rounds, pipelined). That’s still well above typical network encryption requirements.

Active Bypass: Performance When You Need It

This is where the design connects to the SM4 Pipeline Timing architecture. The 32-stage pipeline achieves 94.19 MHz in unprotected mode — but that’s only when safe_en == 2'b00.

The critical path analysis tells the story:

• No defence: 2.5 ns critical path → 94.19 MHz → 12.1 Gbps
• LFSR only: ~3.5 ns critical path → ~70 MHz → ~9.0 Gbps
• Full defence: ~6 ns critical path → ~50 MHz → 6.4 Gbps

The pipeline doesn’t stall or reconfigure — the LUT/复合域 MUX is a pure combinational select. Switching from 2'b00 to 2'b10 takes one clock cycle. This is the “active bypass” principle: maximum performance when security constraints allow it, graceful degradation when they don’t.

For applications like high-speed network encryption where the physical environment is controlled, Level 0 delivers 12.1 Gbps. For smart card or embedded key management, Level 2 trades 47% of throughput for provable side-channel resistance.

Related Articles:

• SM4 32-Stage Pipeline: From 50MHz to 94MHz — How the pipeline architecture achieves 12.1 Gbps throughput.

Project: This post is part of the SM4 Crypto Accelerator project.

🔙 Back to Projects