Bitslicing Arithmetic/Boolean Masking Conversions for Fun and Profit

The performance of higher-order masked implementations lattice-based based key encapsulation mechanisms (KEM) is currently limited by the costly conversions between arithmetic and Boolean masking. While bitslicing has been shown to strongly speed up symmetric primitives, its use in arithmetic-to-Boolean Boolean-to-arithmetic masking conversion gadgets never thoroughly investigated. In this paper, we first show that can indeed accelerate existing gadgets. We then optimize these gadgets, exploiting degrees freedom offered bitsliced implementations. As a result, introduce new arbitrary-order addition, each two variants: modulo 2k p (for any integers k p). Practically, our achieve speedup 25x over state art. Turning KEM application, develop open-source embedded (Cortex-M4) Kyber768 Saber at arbitrary order. on 1.8x for Kyber 3x Saber, compared implementation state-of-the-art bottleneck bitslice Keccak-f[1600] permutation.