---
title: 'Hardware Masking: Techniques & Security'
url: https://www.emergentmind.com/topics/hardware-masking
type: topic
---

# Hardware Masking: Techniques & Security

Hardware masking is a circuit-level countermeasure against side-channel leakage in which a sensitive value is replaced by randomized shares and the hardware manipulates those shares rather than the unshared secret. In the Boolean setting, a shared value is written as \(a = a_1 \oplus a_2 \oplus \cdots \oplus a_n\); in arithmetic masking for post-quantum cryptographic datapaths, a secret is shared as \(s = (s_0 + s_1) \bmod q\) or, equivalently, \(S_0 = (X - S_1)\bmod q\) [2106.12714] [2604.15249]. The topic spans attack models, gadget constructions, glitch-aware implementation rules, compositional security notions, high-level synthesis constraints, and formal verification. In contemporary work, it also extends beyond classical cryptography to masked processors and masked neural-network inference engines [2602.20285] [2006.09532].

## 1. Foundations and leakage models

The classical purpose of masking is to ensure that individual observations reveal no information about the underlying secret. In the survey taxonomy of circuit masking, the field is organized around attack models, gadgets, masking schemes, implementations, verification, and standardization [2106.12714]. The classical \(t\)-probing model assumes that an adversary can place up to \(t\) perfect, noiseless probes on wires; security requires that any \(t\) probed values are independent of the secret. This model underlies a large fraction of masking theory, but hardware-oriented work repeatedly stresses that it ignores glitches, transitions, coupling, and routing effects [2106.12714].

Boolean sharing is the standard starting point. For a shared value,
\[
a = a_1 \oplus a_2 \oplus \cdots \oplus a_n.
\]
Arithmetic sharing is natural for lattice-PQC datapaths over \(\mathbb{Z}_q\), where coefficients are shared as
\[
s = (s_0 + s_1) \bmod q.
\]
Recent verification work on masked NTT hardware makes the first-order objective explicit: a circuit is first-order probing secure if an adversary observing any single wire learns nothing about the secret \(s\) [2604.15249]. In that setting, a wire is modeled as
\[
w = f(s_0, s_1, r, p),
\]
where \(r\) denotes fresh randomness and \(p\) public inputs [2604.15249].

The modern hardware literature distinguishes several stronger notions than plain probing security. The survey identifies NI, SNI, and PINI as compositional notions, and also discusses robust probing, glitch-extended probing, and \(t\)-glitch immunity for hardware settings where transient values matter [2106.12714]. This distinction is central: a gadget may satisfy a local probing-style definition while failing after composition in real hardware because of glitches or recombination effects. A plausible implication is that hardware masking is defined as much by its leakage model as by its sharing algebra.

## 2. Gadget constructions and glitch-aware implementation

The core engineering difficulty in masked circuits is nonlinearity. In Boolean masking, XOR is linear and can be applied sharewise, whereas AND or multiplication must be replaced by secure masked gadgets. The classical ISW-style nonlinear construction uses random values \(z_{i,j}\) and computes output shares
\[
c_i = a_i b_i \oplus \bigoplus_{i \neq j} z_{i,j},
\]
with
\[
z_{j,i} = (z_{i,j} \oplus a_i b_j)\oplus a_j b_i
\]
for shared inputs \(a\) and \(b\) [2106.12714]. The survey also highlights Threshold Implementations, which rely on correctness, uniformity, and non-completeness, as well as CMS, DOM, UMA, and GLM as major scheme families [2106.12714].

For glitch-robust hardware, the placement of registers is security-critical. “MaskedHLS” treats masked hardware generation as a security-preserving translation problem rather than an ordinary optimization problem [2407.11806]. The paper shows why conventional HLS is misaligned with masking invariants: compiler reassociation, expression balancing, scheduling, and resource sharing preserve Boolean functionality but can destroy the intended masked structure. A representative DOMAND expression is
\[
y0 = ((a0 \otimes b1) \oplus z) \oplus (a0 \otimes b0),\qquad
y1 = ((a1 \otimes b0) \oplus z) \oplus (a1 \otimes b1),
\]
and front-end rewriting can move XORs across the wrong intermediate terms, yielding RTL that is logically correct but no longer masked [2407.11806].

The same work formalizes four state-of-the-art masked gadget families for hardware generation: DOM, HPC1, HPC2, and COMAR [2407.11806]. Their hardware versions differ from software not mainly in algebra, but in the requirement that registers appear at specific points to stop glitch propagation and that parallel paths be balanced. For instance, HPC2 is described with
\[
c0 = ((a0 \otimes r) \oplus (b1 \otimes r)) \oplus (a0 \otimes b0),\qquad
c1 = ((a1 \otimes r) \oplus (b0 \otimes r)) \oplus (a1 \otimes b1),
\]
with registers at all input shares and four intermediate locations [2407.11806]. This suggests that “masked hardware” is not only a matter of share algebra; it is also a retiming and path-balancing discipline.

## 3. Arithmetic masking and composability in PQC pipelines

Arithmetic masking has become central in PQC accelerators because NTT, INTT, butterfly units, and modular reductions are naturally expressed over \(\mathbb{Z}_q\). In recent formal work on masked NTT pipelines, a Cooley–Tukey butterfly with inputs \(a,b\) computes
\[
(a,b) \mapsto \left(a + \omega b \bmod q,\; a - \omega b \bmod q\right),
\]
and with a fresh output mask \(m\) the observed wires become
\[
a + \omega b - m,\quad m,\quad a - \omega b - m,\quad m.
\]
The key theorem is that each output wire has exactly one mask value producing each output value; equivalently, each wire is uniform over the fresh mask and independent of the secrets under the adopted first-order probing semantics [2604.20793].

That result matters because pointwise value-independence is false for butterfly outputs. If \(m\) is held fixed, \(a + \omega b - m\) changes with \(a\) or \(b\); the correct local invariant is therefore not pointwise constancy but per-context uniformity over the fresh mask [2604.20793]. The same paper proves that a \(k\)-stage NTT pipeline with fresh per-stage masking satisfies per-context uniformity at every stage under the ISW first-order probing model [2604.20793]. A plausible implication is that fresh-mask renewal is the arithmetic analogue of a compositional boundary condition.

A complementary line of work formalizes this idea through PF-PINI for prime fields. A PF-PINI gadget \((\texttt{compute}, k, \texttt{bound})\) satisfies
\[
\forall x,v \in \mathbb{Z}_q,\quad
\left|\{m \in \mathbb{Z}_q : \texttt{compute}(x,m)=v\}\right| \le k,
\]
so \(k\) is a maximum multiplicity parameter for single-wire probing over \(\mathbb{Z}_q\) [2604.25878]. The central renewal theorem states that for any \(G_1\),
\[
\left|\{(m_1,m_{\mathrm{fresh})} \in \mathbb{Z}_q^2 :
G_1(x,m_1)-m_{\mathrm{fresh}} = w\}\right| = q,
\]
which means that subtracting a fresh uniform mask makes the inter-stage wire perfectly uniform regardless of Stage 1’s PF-PINI parameter [2604.25878]. Consequently, if \(G_1\) is PF-PINI(\(k_1\)) and \(G_2\) is PF-PINI(\(k_2\)), then the composed two-stage pipeline with fresh masking satisfies PF-PINI(\(k_2\)) [2604.25878].

This quantitative arithmetic theory is tightly connected to Barrett reduction. The same paper proves a hardware-faithful equivalence between an algebraic Barrett internal map and its natural-number implementation, and then shows that the hardware form is PF-PINI(2) [2604.25878]. In parallel, a universal Lean proof for arithmetic masking verification establishes that for every \(q>0\), every wire function, and every pair of secrets, value-independence implies identical marginal distributions over \(\mathbb{Z}/q\mathbb{Z}\) [2604.18717]. The hardware significance is that arithmetic masking verification for ML-KEM and ML-DSA no longer depends on modulus-specific finite enumeration; the ring \(\mathbb{Z}/q\mathbb{Z}\) becomes the abstraction layer.

## 4. Synthesis flows, controller datapaths, and processor-level masking

The synthesis of masked hardware is itself a security problem. “MaskedHLS” starts from masked C/C++ with annotations of the form \(\langle lhs \rangle = reg(\langle rhs \rangle)\), constructs a retiming problem, and inserts both required security registers and balancing registers with minimum latency [2407.11806]. Its retiming model uses a directed graph \(G(V,E)\) with edge register counts \(w(e)\), delays \(d(\nu)\), and retiming labels \(r(\nu)\); after retiming,
\[
w_r(e_{u,\nu}) = r(\nu) + w(e_{u,\nu}) - r(u).
\]
On PRESENT and AES S-box benchmarks masked with DOM, HPC1, HPC2, and COMAR, the generated RTL shows on average \(73.9\%\) fewer registers and \(45.7\%\) less latency than manual balancing, while TVLA results are substantially stronger than Vivado HLS-generated variants [2407.11806].

Verification of HLS-generated masked RTL requires special treatment because HLS often produces controller-datapath architectures with resource-shared datapaths. “MaskedHLSVerif” addresses this by state-wise formal verification of controller-datapath RTL obtained via HLS, thereby avoiding false positives caused by resource-shared datapaths [2603.18939]. The toolflow correctly verifies standard cryptographic benchmarks and the PRESENT S-box masked with gadgets, where REBECCA reports false positives, and it can also detect masking flaws induced by HLS optimizations [2603.18939]. This suggests that hardware masking after HLS cannot be reduced to a purely combinational check on the flattened netlist.

A distinct architectural direction appears in processor-level masking. “CryptRISC” extends the CVA6 core with 64-bit scalar cryptography instructions and inserts a Field Detection Layer and a Masking Control Unit inside the pipeline [2602.20285]. Its masking engine uses the unified affine form
\[
x' = A \cdot x + B,
\]
specialized to Boolean masking over \(GF(2)\), arithmetic masking over \(\mathbb{Z}/2^n\mathbb{Z}\), and affine or multiplicative masking over \(GF(2^n)\) depending on the instruction’s dominant algebraic field [2602.20285]. The design reports speedups up to \(6.80\times\) over baseline software implementations with only a \(1.86\%\) hardware overhead relative to baseline CVA6, and its instruction-level TVLA stays below the standard \(\pm 4.5\) threshold [2602.20285]. The paper is explicit that the strongest claim is empirical first-order leakage suppression rather than a formal glitch-resistant proof [2602.20285].

## 5. Verification methodologies and formal assessment at scale

Hardware masking verification has moved from small gadgets to production arithmetic modules. The survey catalogs formal tools such as MaskVerif, VerMI, TightPROVE, REBECCA, and SILVER, reflecting the historical evolution from probing-based proofs to implementation-aware checks with glitches and composability conditions [2106.12714]. Recent work on PQC hardware introduces a four-stage hierarchy for large arithmetic datapaths:
\[
D0/D1 \;\rightarrow\; FM \;\rightarrow\; \text{Boolean SADC} \;\rightarrow\; \text{Arithmetic SADC} \;\rightarrow\; \text{Exact verification}.
\]
The first stage uses dependency queries
\[
D_0(w): \exists s_0,s_0',s_1,r,p:\; s_0 \neq s_0' \land f(s_0,s_1,r,p)\neq f(s_0',s_1,r,p),
\]
\[
D_1(w): \exists s_0,s_1,s_1',r,p:\; s_1 \neq s_1' \land f(s_0,s_1,r,p)\neq f(s_0,s_1',r,p),
\]
and treats a wire as structurally safe if it depends on at most one share group [2604.15249].

On the 1.17-million-cell Adams Bridge ML-DSA/ML-KEM accelerator, structural analysis completes in seconds across all 30 masked submodules, and a multi-cycle extension reclassifies 12 modules from structurally clean to structurally flagged [2604.15249]. For the 5,543-cell ML-KEM Barrett reduction module, the full pipeline verifies 198 of 363 structurally flagged wires as first-order secure, reports 165 as candidate insecure, and leaves 0 indeterminate; Z3 and CVC5 agree on all \(363/363\) arithmetic SADC queries with 0 disagreements [2604.15249]. The paper presents this as a sound upper bound on the insecure set rather than an exact classification.

Another recent direction is mixed-domain simulation from HDL. “aLEAKator” combines concrete simulation, symbolic expressions, LeakSets, and stability information to verify masked hardware accelerators and masked software running on CPUs under value, transition, glitch, and robust-but-relaxed 1-probing models [2512.07520]. The framework models circuits as Mealy machines,
\[
\forall t \ge 0,\quad \alpha^R_{t+1} = \delta(\alpha^I_t, \alpha^R_t),\qquad
\alpha^O_t = \lambda(\alpha^R_t, \alpha^I_t),
\]
and derives verification obligations such as
\[
\{\,{}^{e}\alpha_w^t, {}^{e}\alpha_w^{t-1}\,\}
\]
for transition leakage and
\[
\bigcup_i {}^{l}\alpha_w^t[i]
\]
for glitch leakage [2512.07520]. It verifies, among other case studies, a full first-order masked AES on various CPUs from HDL descriptions and correlates formal findings with ChipWhisperer measurements [2512.07520]. A plausible implication is that hardware masking verification is becoming architecture-aware rather than gadget-only.

## 6. Practical limits, controversies, and broader extensions

The strongest caveat in the literature is that masking proofs remain conditional on physical observability assumptions. “Real-World Snapshots vs. Theory” demonstrates Laser Logic State Imaging, a backside optical technique that can extract the logical state of all registers at an arbitrary clock cycle with a single measurement, effectively providing an “unlimited number of contactless probes” [2009.04263]. The paper’s point is not that the algebra of masking is wrong, but that the bounded-observation assumption of the \(t\)-probing model can fail in practice [2009.04263]. This sharply separates mathematical validity from physical adequacy.

A second practical controversy concerns FPGAs and aggressive parallelism. In a study of ML-KEM Fujisaki–Okamoto verification, unprotected, hash-based, and higher-order masked implementations are evaluated on both a microcontroller and an FPGA, and the higher-order masked FPGA designs still leak information about the underlying data because of hardware-level effects and data-dependent processing [2606.31681]. The paper reports that parallelized processing on FPGAs introduces sufficient first-order leakage for full secret-key recovery, even though the compared higher-order masked comparison is proven \(t\)-probing secure and the microcontroller implementation does not leak up to order \(t\) under the intended assumptions [2606.31681]. This suggests that formal masking order is not a reliable proxy for physical leakage in highly parallel programmable logic.

A third controversy concerns partial masking in PQC accelerators. In Adams Bridge, only the first INTT layer is protected with first-order Boolean masking using a DOM-style two-share implementation, while the remaining layers are defended mainly by Random Start Index shuffling [2604.03813]. RTL analysis shows that RSI provides 6 bits of entropy per layer, \(\log_2(64)=6\), rather than the \(\log_2(64!) \approx 296\) bits of a full random permutation over 64 items [2604.03813]. The same paper argues that observation topology, not count, determines recovery in full-graph BP attacks on the INTT factor graph, and recommends strategically masking 3 consecutive mid-layers as a practical compromise [2604.03813]. This suggests that partial masking must be audited against factor-graph inference rather than only against per-butterfly CPA arguments.

Although the field is centered on cryptographic hardware, masking has also been transferred to machine-learning accelerators. “BoMaNet” presents a fully masked neural-network inference engine using first-order Boolean masking, secure hardware primitives for all linear and non-linear operations, a pipelined Trichina-style AND for improved glitch resistance, and a throughput of one masked addition per cycle; its implementation on a Xilinx Spartan-6 reports \(3.5\%\) latency overhead, \(5.9\times\) area overhead, and security validation with 2M traces [2006.09532]. “MaskedNet” and “Guarding Machine Learning Hardware Against Physical Side-Channel Attacks” adapt masking to BNN inference engines, including masked adders, masked activation, and masked output-layer comparison, with reported overheads of \(2.8\times\) latency and \(2.3\times\) area in one design and area-delay overheads ranging from \(5.4\times\) to \(4.7\times\) in another, together with first-order security over millions of power traces and shuffling to impede straightforward second-order attacks [1910.13063] [2109.00187].

Taken together, these results portray hardware masking as a mature but conditional discipline. Its formal core now includes arithmetic composition theorems over \(\mathbb{Z}_q\), scalable RTL verification pipelines, and architecture-aware mixed-domain analyses. At the same time, real observability, FPGA parallelism, synthesis transformations, and incomplete mask renewal remain persistent fault lines. The cumulative evidence suggests that effective hardware masking is not a single technique but a coupled methodology: share algebra, gadget discipline, register placement, fresh randomness, stage-wise composability, and verification under leakage models that remain physically meaningful.

Source: https://www.emergentmind.com/topics/hardware-masking