Revisiting Higher-Order Masked Comparison for Lattice-Based Cryptography: Algorithms and Bit-sliced Implementations

. Masked comparison is one of the most expensive operations in side-channel secure implementations of lattice-based post-quantum cryptography, especially for higher masking orders. First, we introduce two new masked comparison algorithms, which improve the arithmetic comparison of D’Anvers et al. [DHP + 21] and the hybrid comparison method of Coron et al. [CGMZ21a] respectively. We then look into implementation-speciﬁc optimizations, and show that small speciﬁc adaptations can have a signiﬁcant impact on the overall performance. Finally, we implement various state-of-the-art comparison algorithms and benchmark them on the same platform (ARM-Cortex M4) to allow a fair comparison between them. We improve on the arithmetic comparison of D’Anvers et al. with a factor ≈ 20% by using Galois Field multiplications and the hybrid comparison of Coron et al. with a factor ≈ 25% by streamlining the design. Our implementation-speciﬁc improvements allow a speedup of a straightforward comparison implementation of ≈ 33%. We discuss the diﬀerences between the various algorithms and provide the implementations and a testing framework to ease future research.