Side-channel attack resistant ROM-based AES S-Box

In the AES algorithm, the Substitution Box (S-Box) often dominates the area and delay of implementations. The S-Box performs a byte-wise substitution on the data based on an established code book, and most AES algorithm implementations use a large complex logic block consisting mainly of XORs to implement the S-Box. Direct implementation of the S-Box with a look-up table (LUT) has been eschewed due to difficulty in pipelining the structure, hence restricting the throughput. However, we present a custom ROM-based S-Box implementation that can achieve comparable throughput to logic-based implementations, yet is smaller in both area and power. Additionally, the symmetrical nature of the ROM is well suited towards achieving data-independent power dissipation, which is key in defending against power analysis side-channel attacks. We present both power-analysis hardened and unhardened ROM-based S-Box designs which significantly outperform logic-based designs in area, power, performance, and power-analysis resistance.