Building power analysis resistant implementations of Keccak

In this paper we report on Keccak implementations that offer a high level of resistance against power analysis by using the technique of masking (secret sharing). In software, we show that two shares are required and if implemented carefully, sufficient. In dedicated hardware, three shares are required. We show that Multi-Gbit/s. throughput can be obtained with cores of area around 100 KGates. We demonstrate that there is a trade-off between area and performance by detailing two different architectures. Finally, we give arguments why the technique of secret sharing offers a very high level of protection against power analysis.