A Side-Channel-Resistant Implementation of SABER

The candidates for the NIST Post-Quantum Cryptography standardization have undergone extensive studies on efficiency and theoretical security, but research their side-channel security is largely lacking. This remains a considerable obstacle real-world deployment, where can be critical requirement. work describes side-channel-resistant instance of Saber, one lattice-based candidates, using masking as countermeasure. Saber proves to very efficient due two specific design choices: power-of-two moduli limited noise sampling learning with rounding. A major challenge in cryptosystems integration bit-wise operations arithmetic masking, requiring algorithms securely convert between masked representations. described includes novel primitive logical shifting shares adapts an existing binomial sampler Saber. An implementation provided ARM Cortex-M4 microcontroller, its resistance experimentally demonstrated. features 2.5x overhead factor, significantly lower than 5.7x previously reported variant NewHope. Masked key decapsulation requires less 3,000,000 cycles consumes 12kB dynamic memory, making it suitable deployment embedded platforms.