Skip to content

Back to the catalog

New Constructions of Quadratic and Cubic Permutations Admitting Optimal Threshold Implementations
eprint.iacr.orgpaper

New Constructions of Quadratic and Cubic Permutations Admitting Optimal Threshold Implementations

ePrint paper giving four constructions of optimal threshold implementations (t+1 shares, no fresh randomness) for bijective S-boxes, a masking countermeasure against differential power analysis and glitch leakage in hardware. It shows that Q30^5 admits optimal TIs, gives a matrix criterion for quadratic permutations (yielding new 6-bit classes), and gives a weighted interpolation construction for power permutations that disproves the Piccione et al. 2023 conjecture. It also gives a derivative-uniform framework that proves every 4-bit cubic permutation admits optimal TIs. A companion repo has TIs for 5-bit quadratic permutations, 4-bit cubic permutations, the PRESENT S-box and GF(16) inversion.

TL;DR New constructions of minimal-share (t+1), randomness-free threshold implementations for quadratic, cubic and power permutation S-boxes, with code, hardening hardware against DPA and glitches.
Open original ↗
Document

What it is

Li and Tang's ePrint 2026/2416 (received 2026-10-08, approved 2026-10-11, preprint) addresses threshold implementations (TIs) of bijective S-boxes. "Optimal" here means t+1 shares for an algebraic degree t≥2 function, with no fresh randomness. A universal t+2-share construction already exists, so the question is which permutations can reach the t+1 bound.

What the summary leaves out

  • The first construction works by adjoining identity coordinate functions. This is the step that leads to the Q30^5 result.
  • The derivative-uniform framework is not practical. The authors say it is not algebraic-degree-preserving for TIs and "comes at a high cost of implementation". They present it as being of theoretical interest. It is what proves that every 4-bit cubic permutation admits an optimal TI, so that result shows existence, not an area-efficient design.
  • The matrix criterion covers all known quadratic examples. The authors say it "can yield" new 6-bit quadratic classes. The abstract does not say these classes were enumerated or implemented.
  • The companion repo is the usable artifact. It is at github.com/gggaaarrryyyabs/3-share-TIs-of-5-bit-quadratic-permuations. It holds ready-made 3-share TIs for 5-bit quadratic permutations and 4-bit cubic permutations, plus the PRESENT S-box and GF(16) inversion.

What to do

If you are masking a PRESENT-style 4-bit S-box or GF(16) inversion in hardware, start from the repo's TIs rather than the paper's constructions. Before adopting the 4-bit cubic TIs, check their area and cost against your budget, given the authors' warning about the framework behind them.

Caveats

The page is only the abstract. It gives no area, latency or security-evaluation figures, and I have not verified the proofs or the repo contents.

Organisations named here

  • differential power analysis
  • PRESENT S-box
  • Q30^5

Technologies named here

  • Hardware implementations of block ciphers

Techniques named here

  • Differential power analysis side-channel attack
  • Optimal threshold implementation

Also named here

  • Nikova et al.
  • Piccione et al.

Related in Hardware & RF