### Table 1. Hardware cost comparison for different inversion circuits with side-channel countermeasures.

2004

"... In PAGE 11: ... Finally, we point out that [25] which describes AES ASIC implementations over GF (((22)2)2) does not provide the actual circuits used to implement the AES S-box. Table1 provides a cost comparison among the different masking countermeasures. Ta- ble 2 summarizes the estimated hardware cost of the different countermeasures in the lit- erature including the one presented in this paper.... In PAGE 11: ... This results in a circuit which requires at least 731 AND and 766 XOR2 or about twice as many gates as our method. We can see from Table1 that the countermeasure of Table 1. Hardware cost comparison for different inversion circuits with side-channel countermeasures.... ..."

Cited by 13

### Table 1. Hardware cost comparison for difierent inversion circuits with side-channel countermeasures.

2004

"... In PAGE 11: ... Finally, we point out that [25] which describes AES ASIC implementations over GF (((22)2)2) does not provide the actual circuits used to implement the AES S-box. Table1 provides a cost comparison among the difierent masking countermeasures. Ta- ble 2 summarizes the estimated hardware cost of the difierent countermeasures in the lit- erature including the one presented in this paper.... In PAGE 11: ... This results in a circuit which requires at least 731 AND and 766 XOR2 or about twice as many gates as our method. We can see from Table1 that the countermeasure of Table 1. Hardware cost comparison for difierent inversion circuits with side-channel countermeasures.... ..."

Cited by 13

### Table 1. Hardware cost comparison for di erent inversion circuits with side-channel countermeasures.

2004

"... In PAGE 12: ... Finally, we point out that [22] which describes AES ASIC implementations over GF(((22)2)2) does not provide the actual circuits used to implement the AES S-box. Table1 provides a cost comparison among the di erent masking countermea- sures. We did not consider the method from [9] because its hardware implemen- tation requires too many hardware resources.... In PAGE 12: ... This results in a circuit which requires at least 731 AND and 766 XOR2 or about twice as many gates as our method. We can see from Table1 that the countermeasure of [25] implemented according to (1) has the best area/time product of all the implementations. However, as we have shown in Section 4, this countermeasure is susceptible to DPA attacks if the input byte is zero and, thus, it does not provide perfect masking.... ..."

Cited by 13

### Table 17. Summary of (theoretical) side channel susceptibility, profile 1 candidates

"... In PAGE 26: ... Further, we provide a first intuition about the cost of protecting an implementation. Table17 summarizes the analysis results for the software candidates. It seems that the criterion exploitable (cache) timing vulnerability is best suited to categorize the candidates.... ..."

### Table 2 presents a broader comparison with other architectures. We have included only those FPGA solutions that are either scalable [9, 10] or that are believed to be the state of the art in ECC hardware implementations. We give this comparison as a proof that a scalable and side-channel secure design can also lead to a solution that is competitive in perfor- mance.

in Side-channel aware design: Algorithms and architectures for elliptic curve cryptography over GF(2 n

2005

"... In PAGE 5: ...Table2 . Comparison with other rel.... ..."

Cited by 2