Leakage Assessment and Correlation Power Analysis of the MAYO Secret Linear Map on a Cortex-M4: A Reproducible Case Study and a Validated First-Order Countermeasure

1. Introduction

The convergence of post-quantum cryptographic standardisation with the deployment of security primitives on resource-constrained embedded devices has created the need for new requirements in the design and evaluation of signature schemes, in terms of resistance to physical attacks [1]. In this respect, the migration to post-quantum cryptography has entered a phase in which implementation security—and not only asymptotic hardness—is treated as a first-order selection criterion. Following the standardisation of lattice-based signatures, the National Institute of Standards and Technology (NIST) issued an additional call for general-purpose digital signatures, in order to diversify the mathematical assumptions underpinning deployed schemes [1]. Among the advancing candidates, the multivariate family—classical Unbalanced Oil and Vinegar (UOV) and its variants—is attractive for constrained devices thanks to short signatures and simple field arithmetic. The family remains well represented in the process: of the nine schemes advanced to the third round in May 2026, four (UOV, MAYO, QR-UOV and SNOVA) are UOV-based [1]. MAYO [2,3], which “whips up” a small UOV map into a larger one in order to shrink public keys, is the most embedded-friendly member of this family and has attracted dedicated hardware and micro-controller implementations [4,5].

Precisely because these schemes are candidates for deployment on smart cards, secure elements and micro-controllers, their resistance to physical attacks must be established empirically, on real silicon, rather than argued in the abstract. The signing operation of a UOV-type scheme necessarily manipulates the secret linear map that separates the oil and vinegar subspaces; any measurable dependence of power consumption on that secret constitutes a potential key-recovery vector. The community has responded with a rapidly growing body of physical attacks on MAYO, including fault injections [9,10] and single-trace side-channel analyses [11,12,13]. However, what is comparatively underdeveloped for MAYO is the defensive counterpart, i.e., countermeasures whose leakage reduction is quantified against an explicit decision threshold. The systematisation of UOV-family physical security [15] does supply first-order masked UOV and MAYO implementations for the Cortex-M4, with overhead benchmarked and a TVLA comparing protected against unprotected subroutines; masking of the Gaussian-elimination and $\mathrm{GF}\left(16\right)$ building blocks shared across UOV, MAYO, SNOVA and QR-UOV has otherwise been analysed at the level of probing-model cost rather than measured on-device leakage [17]. What is still missing is a MAYO countermeasure evaluated under a secret-dependent (fixed-versus-fixed) test and reported against the $\left|t\right|<4.5$ gate with a stated number of failing sample points.

1.1. Contributions

This paper presents a careful, fully reproducible leakage-assessment case study of the MAYO secret linear map on a widely available evaluation platform, and uses it as the concrete foundation for an evaluated countermeasure. The presented contributions are the following:

1.

A reference-faithful reduced target. The MAYO secret operation $\mathbf{O}{\mathbf{x}}_i=\mathbf{O}·{\mathbf{x}}_i$ over $\mathrm{GF}\left(16\right)$ is isolated exactly, reusing the MAYO-C reference $\mathrm{GF}\left(16\right)$ arithmetic verbatim, so that the measured leakage remains faithful to the reference while fitting the ∼48 KB SRAM of an STM32F303 on which full MAYO-1 signing does not fit (Section 5).

2.

An overwhelming leakage result. Non-specific fixed-versus-random TVLA yields a peak Welch statistic of $\left|t\right|=53.7$ (threshold $4.5$), and a more stringent fixed-versus-fixed test on two distinct secret matrices raises this to $\left|t\right|=195.7$ with $12,298/20,000$ sample points failing (corroborated by a ${\chi }^2$ leakage test peaking at 975)—an unambiguous, exploitable leak of the unprotected map (Section 7).

3.

An honest CPA analysis of a linear map. Two confounds inherent to attacking a linear $\mathrm{GF}\left(16\right)$ operation are identified and resolved, i.e., the multiplicative-identity input-load alias and temporal row-mixing, thus enabling a partial-correlation, points-of-interest CPA that recovers $5/8$ first-row nibbles exactly, achieving a mean true-key rank of $1.75/16$ and collapsing the row search space from ${16}^8$ to 24 candidates. Additionally, measured bounds on the end-to-end enumeration cost for full $\mathbf{O}$ recovery are reported, i.e., $2^{2089}$ across all 78 rows and $\approx 2^{1617}$ under per-row window calibration, against a nominal $2^{2496}$ (Section 7 and Section 9).

4.

An evaluated first-order countermeasure. A masked and shuffled $\mathrm{GF}\left(16\right)$ secret map is implemented—fresh Boolean sharing of $\mathbf{O}$ with two independently row-shuffled share passes—and evaluated on the same STM32F303. Drift-free fixed-versus-fixed TVLA drops the peak statistic from $\left|t\right|=195.7$ to $\left|t\right|=3.62$ (below $4.5$, with no failing point) at a measured overhead of $2.22\times$ cycles, while, unlike the unprotected map, its t-statistic does not grow with trace count (Section 8). The pairing of masking with independent per-pass row shuffling is shown to be necessary rather than merely prudent on this core, which converts the study from an attack-with-roadmap into a complete attack-and-defence contribution.

5.

Reproducibility. The firmware (protected and unprotected), capture and analysis scripts, and raw traces are released as a public artifact [23], and the acquisition rigour is characterised in terms of traces-to-detection, t-versus-N curves, independent acquisitions, and the drift-free block-interleaving required in order to measure the protected implementation correctly.

The attack is deliberately framed as a non-profiled, first-order leakage-assessment and methodology contribution, rather than as a novelty-driven attack. Single-trace profiled key recovery on MAYO has already been reported [11,12,13]. By contrast, the presented study adopts the weaker and more portable non-profiled adversary, following the same methodological stance as recent non-profiled evaluations of lattice PQC [21]. Furthermore, it makes explicit the linear-map pitfalls that a profiled attack bypasses but that a first-order evaluator must confront, on top of which the countermeasure evaluation is built.

The paper is organized as follows. Section 2 provides the necessary background on MAYO and on the leakage-assessment and correlation techniques employed. Section 3 places the study within the PQ-NEXT project framework, while Section 4 reviews the closest prior attacks and countermeasures and identifies the remaining research gap. Section 5 analyses the target primitive and states the threat model, and Section 6 details the measurement setup and the distinguisher. Section 7 reports the leakage-assessment and key-recovery results for the unprotected map, whereas Section 8 presents and evaluates the proposed masked and shuffled countermeasure. Section 9 discusses the implications and limitations of the presented approach. Finally, Section 10 concludes the paper.

2. Background

2.1. MAYO and the Secret Linear Map

MAYO [2,3] is a multivariate signature scheme derived from the Oil-and-Vinegar (OV) trapdoor. In OV, the secret is a linear subspace O (the “oil” space) of dimension o inside an n-dimensional space over a finite field; a public multivariate quadratic map $\mathcal{P}$ vanishes on O, and signing amounts to sampling vinegar values and then solving a linear system over the oil space so that $\mathcal{P}\left(\mathbf{s}\right)=\mathbf{t}$ for a message digest $\mathbf{t}$. MAYO reduces the OV public-key size by choosing an intentionally small oil space and then “whipping” the map k times into a larger emulated instance, recovering security while keeping keys compact.

For the NIST security level I parameter set, MAYO-1, the relevant parameters are $n=86$, $m=78$, $o=8$, $k=10$, $v=n-o=78$, and field order $q=16$, giving a public key of 1420 bytes and a signature of 454 bytes from a 24-byte seed secret key. During signing, each of the k signature blocks is formed by applying the secret oil matrix $\mathbf{O}\in \mathrm{GF}{\left(16\right)}^{v\times o}$ to a public vector ${\mathbf{x}}_i\in \mathrm{GF}{\left(16\right)}^o$:

$$\mathbf{O}{\mathbf{x}}_i=\mathbf{O}·{\mathbf{x}}_i,{\mathbf{s}}_i={\mathbf{v}}_i+\mathbf{O}{\mathbf{x}}_i,$$

(1)

after which ${\mathbf{x}}_i$ itself is copied into the signature block in the clear. The matrix $\mathbf{O}$ is the UOV secret; recovering it breaks the scheme. Crucially, ${\mathbf{x}}_i$ is public (it appears verbatim in the signature), so the elementary secret computation

$$\mathrm{prod}={\mathrm{mul}}_f\left(\mathbf{O}\left[r\right]\left[j\right],{\mathbf{x}}_i\left[j\right]\right)$$

(2)

multiplies one secret nibble by one known nibble in $\mathrm{GF}\left(16\right)\cong \mathrm{GF}\left(2\right)\left[x\right]/(x^4+x+1)$. Since a nibble takes only 16 values, a secret-key hypothesis for a single position has only 16 candidates. This is the textbook setting for a divide-and-conquer power-analysis attack, and it is the target of this study.

2.2. Leakage Assessment (TVLA)

Test Vector Leakage Assessment (TVLA) [6,7] is the de facto standard for detecting the presence of exploitable leakage without committing to a specific attack. In the non-specific fixed-versus-random variant, the device repeatedly processes either a single fixed input or freshly random inputs, and Welch’s two-sample t-test is applied point-wise to the two trace populations:

$$t={\displaystyle \frac{{\mu }_{\mathrm{fixed}}-{\mu }_{\mathrm{rand}}}{\sqrt{{\sigma }_{\mathrm{fixed}}^2/N_{\mathrm{fixed}}+{\sigma }_{\mathrm{rand}}^2/N_{\mathrm{rand}}}}}.$$

(3)

A commonly adopted decision threshold is $\left|t\right|>4.5$, corresponding to a very small false-positive probability for the null hypothesis of equal means at practical trace counts. Interleaving the fixed and random classes trace-by-trace (rather than in blocks) guards against slow environmental drift being misread as leakage. TVLA reports whether an implementation leaks, but—by design—not how much key a concrete adversary would recover; the two questions are complementary and are address both.

2.3. Correlation Power Analysis (CPA)

Correlation Power Analysis [8] recovers a secret by correlating measured power against a leakage model of a key-dependent intermediate. For each key hypothesis g and each trace with known input x, one predicts an intermediate $z_g=f(g,x)$ and models its leakage—classically the Hamming weight $\mathrm{HW}\left(z_g\right)$. Pearson’s correlation between the predicted leakage and the measured samples is computed over many traces; the hypothesis whose correlation peaks is taken as the key. Applied to Equation (2), the CPA intermediate is $\mathrm{HW}\left({\mathrm{mul}}_f({\mathbf{O}}_{\mathrm{guess}},x)\right)$ with 16 hypotheses per secret nibble. As shown below, the linearity of the map introduces confounds that a straightforward global-maximum CPA does not survive, and which motivate the partial-correlation treatment in Section 6.

3. The PQ-NEXT Framework and the Placement of This Study

This study is carried out within PQ-NEXT (Post-Quantum Networks for Energy-Efficient Transitions), a Horizon Europe research and innovation action that develops a framework and toolbox for migrating large-scale infrastructures from classical to post-quantum cryptography, continuing the earlier PQ-REACT project’s comparative evaluation of post-quantum signatures [24,25]. Figure 1 summarises the PQ-NEXT approach as a layered platform. The constituent layers are: (i) a PQC Algorithm Catalogue, which curates quantum-resistant primitives across the lattice, code, hash, isogeny, MPC-in-the-Head and multivariate families, together with hybridisation mechanisms; (ii) a Maintenance Tools layer, which provides energy monitoring, key management, system updates, compliance auditing and a crypto-agility module; (iii) a Network Security and Quantum-Resistant Communication layer, which secures next-generation networks; (iv) a Post-Quantum Programming Suite and Quantum Cryptanalysis foundation, built on Eclipse Qrisp and LLVM, which assesses candidate algorithms; and (v) a Migration Toolbox, which drives planning, implementation, compatibility, compliance, risk and cost analysis. The whole is exercised in large-scale pilot demonstrators spanning finance, telecommunications, critical infrastructure and municipal services.

Implementation security is an explicit concern of PQ-NEXT. Its network-security layer commits to mitigating side-channel and fault attacks through masking/blinding, randomness injection and control-flow integrity, “beyond the cryptographic algorithm level”; its benchmarking work package assesses the resilience and quality of post-quantum candidates on real and simulated platforms; and one of its cross-cutting needs is adaptation to resource-constrained devices. The algorithm catalogue explicitly spans the multivariate and MPC-in-the-Head families to which MAYO belongs. Both contributing institutions—NCSR “Demokritos” (project coordinator) and AGH University of Krakow—are PQ-NEXT partners.

Against this backdrop, the present study is the implementation-security control experiment for a multivariate candidate on a constrained target. It provides an on-hardware, reproducible leakage-assessment baseline (TVLA) and a first-order CPA key-recovery analysis of the MAYO secret linear map on a Cortex-M4, and it derives the masking-and-evaluation roadmap (Section 9) against which the project’s countermeasures are to be measured. Table 1 maps each element of the study onto the PQ-NEXT layer, work package and expected outcome it serves.

4. Related Work

Attacks on MAYO 

MAYO has accumulated a dense body of physical attacks. On the fault side, Aulbach et al. (“MAYo or MAY-not”, FDTC 2024) [9] mount loop-abort and zeroing faults on the official Cortex-M4 implementation with full key recovery from a single fault, Jendral and Dubrova [10] recover the key by fixing vinegar seeds, and Abdelmonem et al. [20] mount a component-wise fault injection attack against randomized MAYO, showing that re-randomisation alone does not neutralise the fault surface. On the passive side, Jendral and Dubrova [11] present a deep-learning single-trace attack exploiting leaky modular multiplication, with very high reported success. This line of work was later extended in the QRSEC’25 workshop [12] to full-key recovery from a single power trace, with success probabilities of $99.4\%$ and $93.1\%$ at two parameter sets. Most closely related to the presented platform, the SCA-MQDSA study [13] analyses a nibble-sliced MAYO on precisely the hardware class used here (a ChipWhisperer-Lite with an STM32F3 target on a CW308 UFO board) and frames a common side-channel methodology across UOV, MAYO, QR-UOV and SNOVA. Related single-trace work on classical UOV, “Separating Oil and Vinegar with a Single Trace” [14], established the template for attacking the secret linear structure of OV schemes on the same STM32F3 platform.

Countermeasures 

By contrast, defensive results for MAYO remain thin, though not absent. The physical security of UOV-based schemes has recently been systematised, mapping which attacks and protections transfer across the family [15]. That work is also the closest defensive antecedent to the presented study, in that it contributes first-order masked implementations of both UOV and MAYO for the Cortex-M4, and benchmarks their overhead on a NUCLEO-L4R5ZI board. Furthermore, it evaluates them by a TVLA of protected against unprotected subroutines, reporting substantially reduced t-values. The proposed countermeasure differs in three respects: (i) it targets the isolated $\mathbf{O}·\mathbf{x}$ map, rather than full signing subroutines; (ii) it combines masking with per-pass row shuffling, which is shown in Section 8.1 to be necessary, in that masking alone still yields $\left|t\right|=17.94$ on this core; and (iii) it is assessed with a fixed-versus-fixed test across two distinct secret matrices, thus isolating secret-dependent leakage. Additionally, the result is reported against the $4.5$ gate with an explicit count of failing sample points. The mUOV first- and higher-order masking [16] likewise targets classical UOV. The masking of Gaussian elimination at arbitrary order [17] provides a cost model for UOV, MAYO, SNOVA and QR-UOV but implements and benchmarks only UOV on Cortex-M4, explicitly leaving micro-architectural leakage evaluation out of scope. Two very recent works occupy adjacent ground: Coron, Gérard and Zhang mask the linear-equation solve in UOV signing at arbitrary order [18], and Krieger, Czuprynko and Sinha Roy blind the oil (secret) space of a UOV hardware accelerator against DPA [19]. Both are recent, both target UOV rather than MAYO, and neither reports an on-device micro-architectural TVLA of a MAYO $\mathrm{GF}\left(16\right)$ map. To the authors’ knowledge, no masked MAYO $\mathrm{GF}\left(16\right)$ secret map with a measured software overhead and an on-device fixed-versus-fixed TVLA below the $4.5$ gate has been published; the countermeasure implemented and evaluated here (Section 8) fills exactly this gap.

Differentiation from prior work. 

Table 2 places this study against the closest prior UOV/MAYO side-channel attacks and countermeasures. Relative to the attacks, the presented study is the only non-profiled, first-order evaluation of the isolated $\mathbf{O}·\mathbf{x}$ linear map, in that: the published MAYO key recoveries are profiled, deep-learning single-trace attacks [11,12] or nibble-sliced analyses framed across the multivariate family [13], all of which bypass—rather than confront—the multiplicative-identity and row-mixing confounds that dominate a first-order attack on a linear map. Additionally, relative to the countermeasures, the proposed approach is the only one accompanied by an on-device TVLA of a MAYO $\mathrm{GF}\left(16\right)$ map with a measured software overhead, in that: the masked-GE and mUOV gadgets are proven in the probing model and benchmarked on UOV [16,17,18], and the oil-space blinding of [19] is a hardware accelerator. The new contribution is therefore twofold: a reproducible non-profiled first-order baseline on the isolated linear map, and an evaluated first-order countermeasure measured on the same bench.

This positioning aligns the study with the PQ-NEXT objective of hardening post-quantum implementations against side-channel and fault attacks through masking, blinding and randomness injection. Additionally, by supplying both the baseline and the evaluated defence on a single bench, the presented study becomes directly reusable as the control experiment for future MAYO countermeasures.

5. Target Analysis and Threat Model

5.1. Isolating the Sensitive Primitive

In the MAYO-C reference, signing forms each signature block via a matrix–vector product implemented as an accumulation of $\mathrm{GF}\left(16\right)$ products, $\mathbf{O}{\mathbf{x}}_i\left[r\right]={\sum }_j{\mathrm{mul}}_f(\mathbf{O}\left[r\right]\left[j\right],{\mathbf{x}}_i\left[j\right])$, where ${\mathrm{mul}}_f$ is the $\mathrm{GF}\left(16\right)$ multiplication modulo $x^4+x+1$. The secret matrix $\mathbf{O}$ is stored one $\mathrm{GF}\left(16\right)$ nibble per byte, occupying 624 bytes for MAYO-1 ($v\times o=78\times 8$). The public multiplicand ${\mathbf{x}}_i$ is the last o bytes of every signature block. Equation (2) is therefore the elementary secret operation, and it is exactly what is bracketed for measurement.

5.2. Feasibility Constraint and the Reduced Target

A key engineering decision follows from the target’s memory. The reference key expansion inflates the 24-byte seed into roughly 144 KB of RAM-resident key material (a $P_1$ table of $\mathrm{120,159}$ bytes and a $P_2$ table of $\mathrm{24,336}$ bytes), whereas the STM32F303 provides only about 48 KB of SRAM. Full reference mayo_sign therefore cannot run on this device—it is roughly threefold over budget—and the Cortex-M4 pqm4 MAYO variants likewise target larger-SRAM parts. Accordingly, a reduced target is built that isolates exactly the secret linear map, which at 624 bytes fits trivially, while reusing the MAYO-C $\mathrm{GF}\left(16\right)$ arithmetic sources verbatim so that the instruction-level leakage of ${\mathrm{mul}}_f$ is identical to the reference. This is standard practice: bracketing the sensitive primitive is precisely what both TVLA and CPA are meant to interrogate, and it removes confounds from unrelated key expansion so that any measured leakage is attributable to the map itself.

5.3. Threat Model

The standard non-invasive power side-channel adversary is assumed. The attacker can trigger signing (or, here, the isolated map) on chosen or known public inputs ${\mathbf{x}}_i$, observe the device’s power consumption at the sampling rate of a commodity oscilloscope-class capture board, and knows the algorithm and its implementation. The attacker does not know the secret matrix $\mathbf{O}$ and cannot read internal memory. This is exactly the capability of a laboratory evaluator performing a leakage assessment on a candidate implementation, which is the role adopted here. In order to provide ground truth for the CPA distinguisher, the reduced target holds a fixed and known matrix ${\mathbf{O}}_{\mathrm{flat}}\left[i\right]=(7i+3)mod16$, giving a first row $\mathbf{O}\left[0\right]=[3,\mathrm{A},1,8,\mathrm{F},6,\mathrm{D},4]$. The attack code is never given this value, which is used only to score recovery after the fact.

6. Materials and Methods

6.1. Device Under Test and Instrumentation

The target is an STM32F303 (ARM Cortex-M4, ∼48 KB SRAM, 256 KB flash) on a CW308 UFO board, measured with a ChipWhisperer-Lite CW1173. The device runs a SimpleSerial (v1.1) firmware compiled with arm-none-eabi-gcc for the CW308_STM32F3 platform. The built image is compact—RAM occupancy 2392 bytes of 40 KB usable ($5.84\%$) and ROM 5148 bytes of 256 KB ($1.96\%$)—confirming that the isolated map leaves ample headroom.

We expose a single firmware command that accepts an 8-nibble public input ${\mathbf{x}}_i$, raises the capture trigger, computes $\mathbf{O}{\mathbf{x}}_i=\mathbf{O}·{\mathbf{x}}_i$, lowers the trigger, and returns the 16 output nibbles. Compiler memory barriers are placed immediately inside the trigger to prevent the -O2 scheduler from moving instructions across the trigger boundary:

trigger_high();

__asm__ volatile("" ::: "memory");

mat_mul(O, x, Ox, o, v, 1);

__asm__ volatile("" ::: "memory");

trigger_low();

We confirmed by inspection of the disassembly that ${\mathrm{mul}}_f$ is inlined between the trigger writes: the bit-mask partial products, the XOR accumulation and the $mod{x}^4+x+1$ reduction all appear inside the bracketed region, so the measured window faithfully spans the $\mathrm{GF}\left(16\right)$ multiply.

6.2. Capture Configuration

We capture at a $7.37$ MHz target clock with the ADC in $\times 4$ synchronous mode ($29.54$ MS/s), 25 dB gain, and a window of 5000 samples per trace; the trigger is on tio4 and serial on tio1/tio2. For the leakage assessment, the two TVLA classes are interleaved by a per-trace coin flip so that slow drift affects both classes equally. We persist the raw traces and the known inputs on every capture, so that the same data drive both the t-test and the subsequent CPA.

6.3. Leakage-Assessment Procedure

A non-specific fixed-versus-random TVLA is performed. The fixed class uses a constant ${\mathbf{x}}_i$; the random class draws a fresh uniform ${\mathbf{x}}_i$ per trace. Welch’s t-statistic (Equation (3)) is computed point-wise across the 5000-sample window and compared to the $\left|t\right|>4.5$ threshold. We report both a low-trace “smoke” run and a full run, so as to expose the expected growth of the statistic with trace count.

6.4. CPA Distinguisher and Confound Handling

The naive attack correlates $\mathrm{HW}\left({\mathrm{mul}}_f(g,x_j)\right)$ over all 16 hypotheses g at every sample. Two confounds, both intrinsic to a linear $\mathrm{GF}\left(16\right)$ map, defeat it:

1.

Multiplicative-identity input-load alias. Because ${\mathrm{mul}}_f(1,x)=x$ in $\mathrm{GF}\left(16\right)$, the hypothesis $g=1$ predicts exactly $\mathrm{HW}\left(x\right)$, which coincides with the strong, pervasive leakage of the public input being (re)loaded from memory on every row. A global-maximum CPA therefore returns $g=1$ for every nibble—correct only where the true nibble happens to be 1. This alias is removed by partial correlation, i.e., by linearly regressing $\mathrm{HW}\left(x_j\right)$ out of the traces before correlating, annihilating the $g=1$ predictor.

2.

Temporal row-mixing. Each public $x_j$ multiplies $\mathbf{O}\left[r\right]\left[j\right]$ for all 78 rows, so a full-trace search mixes contributions from many rows. Within the 5000-sample window the first row’s eight products are separated in time at a fixed cadence, empirically $\mathrm{POI}\left(j\right)=130+100j$ samples. Therefore, each nibble is correlated only within a tight window around its point of interest.

Partial correlation has one benign side effect that must be handled explicitly, as it is load-bearing for the reported key-space figures. Regressing out $\mathrm{HW}\left(x_j\right)$ annihilates the $g=1$ predictor, so a nibble whose true value is 1 becomes invisible to the partial-correlation spectrum—precisely the case the alias removal was designed to suppress. Such a nibble is nonetheless identifiable without knowledge of the key, by the conjunction of two attacker-observable conditions: the plain spectrum peaks at $g=1$, and the partial spectrum is flat. The adopted decision rule is “report 1 when the plain maximum is $g=1$ and the partial peak falls below $0.30$”, and score that nibble under the plain spectrum. On the acquired data the rule fires on exactly one nibble ($j=2$, whose true value is indeed 1) and does so with a wide margin: its partial peak is $0.151$, whereas every other nibble’s exceeds $0.476$. No ground-truth information enters the rule, so the reported ranks are attacker-computable throughout.

The final distinguisher combines points-of-interest windowing, partial-correlation removal of the input-load alias, and the identity disambiguation rule above. Recovery is scored by the rank of the true nibble in the sorted correlation list, where rank 1 denotes exact top-1 recovery and random guessing gives an expected rank of $8.5$ over 16 candidates. Additionally, recovery is scored by the product of per-nibble ranks, which bounds the residual key-space of the row under an enumerate-by-rank strategy.

6.5. Statistical Rigour of the Assessment

Beyond the point-wise Welch t-test, three additional rigour measures are reported. (i) A traces-to-detection curve—the peak $\left|t\right|$ as a function of the number of traces per class—which both quantifies how quickly the unprotected leak is detected and, for the protected map, distinguishes removed leakage (flat curve) from merely attenuated leakage (growing as $\sqrt{N}$). (ii) An independent ${\chi }^2$-based leakage-detection test [22], which bins each sample’s two class populations into a contingency table and is sensitive to higher-moment differences the mean-based t-test can miss; its peak is reported alongside the t peak. (iii) A same-secret control (one class split against itself), which has no secret-dependent leakage by construction and therefore measures the drift/noise floor of the acquisition—indispensable for a near-threshold protected implementation. All acquisitions fix the two secret matrices and the public-input sequence by seed and are repeated across independent runs; the protected-map assessment additionally interleaves the two classes in short blocks so that slow drift affects both equally.

7. Results

7.1. Leakage Assessment

The unprotected secret linear map leaks strongly and pervasively. Table 3 summarises the two runs: a 60-trace-per-class smoke test already exceeds the threshold with a peak $\left|t\right|=15.05$ ($969/5000$ points failing), and the full 1000-trace-per-class run reaches a peak $\left|t\right|=53.71$ with 2971 of 5000 points exceeding $4.5$. A peak t-statistic of $53.7$ against a $4.5$ bar is enormous: over half of the observation window carries first-order, input-dependent leakage. This is the headline defensive finding—an unprotected $\mathbf{O}·\mathbf{x}$ implementation would fail any leakage-assessment gate outright.

Furthermore, the fixed-versus-fixed test—which isolates secret-dependent leakage by holding the public inputs identical across two distinct secret matrices—is even more emphatic, reaching a peak $\left|t\right|=195.7$ with $\mathrm{12,298}$ of $\mathrm{20,000}$ samples failing; an independent ${\chi }^2$ leakage-detection test [22] peaks at 975 (threshold $\approx 20$ at 8 degrees of freedom), corroborating the t-test. As few as $N=25$ traces per class already drive the peak statistic above $4.5$ (Figure 5), so the traces-to-detection is negligible. Figure 2(left) shows the t-trace: leakage saturates the entire ∼$\mathrm{15,600}$-cycle matrix–vector product and collapses to the noise floor only once the computation ends.

Figure 2. Fixed-versus-fixed TVLA t-traces (dashed lines: the $\pm 4.5$ decision band). Left: the unprotected $\mathbf{O}·\mathbf{x}$ map leaks across the whole computation, peaking at $\left|t\right|=195.7$. Right: the masked and shuffled countermeasure (Section 8), measured with a drift-free block-interleaved acquisition on the same device, stays within $\left|t\right|=3.62<4.5$ at every one of the $24,000$ sample points.

Figure 2. Fixed-versus-fixed TVLA t-traces (dashed lines: the $\pm 4.5$ decision band). Left: the unprotected $\mathbf{O}·\mathbf{x}$ map leaks across the whole computation, peaking at $\left|t\right|=195.7$. Right: the masked and shuffled countermeasure (Section 8), measured with a drift-free block-interleaved acquisition on the same device, stays within $\left|t\right|=3.62<4.5$ at every one of the $24,000$ sample points.

7.2. Correlation Power Analysis

We attack the first row of $\mathbf{O}$ using 1000 random-input traces. Table 4 reports, per nibble j, the sample index of the point of interest, the recovered value, the ground-truth value, whether the recovery is exactly top-1, and the rank of the true nibble in the correlation ordering. The partial-correlation, points-of-interest distinguisher recovers 5 of the 8 nibbles exactly, with per-nibble true-key ranks $[2,1,1,1,4,1,3,1]$. The mean true-key rank is $1.75/16$, far below the random-guessing expectation of $8.5$. Taking the product of the per-nibble ranks, the first key-row search space collapses from ${16}^8\approx 4.29\times {10}^9$ to just 24 candidates—an exploitable break under straightforward enumeration (Figure 3).

Figure 3. CPA of the first row of $\mathbf{O}$. Left: rank of the true key nibble in the sorted correlation list (green = exact top-1; dashed line = random-guess expectation $8.5$); the mean rank is $1.75/16$. Right: partial-correlation spectrum over the 16 hypotheses for nibble $j=0$ at its point of interest; the true value (gold) is the second-ranked candidate.

Figure 3. CPA of the first row of $\mathbf{O}$. Left: rank of the true key nibble in the sorted correlation list (green = exact top-1; dashed line = random-guess expectation $8.5$); the mean rank is $1.75/16$. Right: partial-correlation spectrum over the 16 hypotheses for nibble $j=0$ at its point of interest; the true value (gold) is the second-ranked candidate.

Table 4. Partial-correlation CPA of the first row of $\mathbf{O}$ (1000 random-input traces, the released trace set). “Rank” is the position of the true nibble in the sorted correlation list (1 = exact recovery; random $=8.5$).

Nibble j	POI (sample)	Recovered	True	Rank
0	130	0x6	0x3	2
1	230	0xA	0xA	1
2	330	0x1	0x1	1
3	430	0x8	0x8	1
4	530	0xE	0xF	4
5	630	0x6	0x6	1
6	730	0x6	0xD	3
7	830	0x4	0x4	1
Recovered row		$6\mathrm{A}18\mathrm{E}664$
Ground truth		$3\mathrm{A}18\mathrm{F}6\mathrm{D}4$

Table 4. Partial-correlation CPA of the first row of $\mathbf{O}$ (1000 random-input traces, the released trace set). “Rank” is the position of the true nibble in the sorted correlation list (1 = exact recovery; random $=8.5$).

Nibble j	POI (sample)	Recovered	True	Rank
0	130	0x6	0x3	2
1	230	0xA	0xA	1
2	330	0x1	0x1	1
3	430	0x8	0x8	1
4	530	0xE	0xF	4
5	630	0x6	0x6	1
6	730	0x6	0xD	3
7	830	0x4	0x4	1
Recovered row		$6\mathrm{A}18\mathrm{E}664$
Ground truth		$3\mathrm{A}18\mathrm{F}6\mathrm{D}4$

Table 5. Summary CPA metrics for the first row of $\mathbf{O}$.

Metric	Value
Exact top-1 nibbles	$5/8$
Per-nibble true-key ranks	$[2,1,1,1,4,1,3,1]$
Mean true-key rank	$1.75/16$ (random $=8.5$)
Row-0 key-space reduction	${16}^8\approx 4.29\times {10}^9\to 24$

Table 5. Summary CPA metrics for the first row of $\mathbf{O}$.

Metric	Value
Exact top-1 nibbles	$5/8$
Per-nibble true-key ranks	$[2,1,1,1,4,1,3,1]$
Mean true-key rank	$1.75/16$ (random $=8.5$)
Row-0 key-space reduction	${16}^8\approx 4.29\times {10}^9\to 24$

Additionally, as a control, the naive global-maximum CPA (without partial correlation) recovers only $1/8$ nibbles—exactly the multiplicative-identity alias predicted in Section 6.4, where every nibble is reported as 1 and is “correct” only where the true value is 1. This confirms that the confound handling, not raw signal, is what makes the attack work.

7.3. Beyond the First Row: Full-Key Argument

The same distinguisher applies in principle to every row of $\mathbf{O}$, while a careful separation is maintained between what was measured and what is extrapolated. Within a single fixed-trigger capture, only the rows that fall inside the aligned, high signal-to-noise portion of the window are recoverable. Row 0 collapses to 24 candidates as reported above; row 1, which lies outside that window in the 5000-sample row-0 capture, yields a mean per-nibble rank of $9.62/16$— statistically indistinguishable from the random-guessing expectation of $8.5$—and no useful reduction ($1.86\times {10}^7$ candidates). This is an alignment effect, not a difference in leakage: each row executes the same $\mathrm{GF}\left(16\right)$ multiply sequence.

Two measurements bound the full-key cost. Attacking all 78 rows directly from a single wide ($\mathrm{20,000}$-sample) fixed-versus-fixed capture gives a mean per-nibble rank of $12.10$ and a residual enumeration cost of $2^{2089}$ against the nominal ${16}^{624}=2^{2496}$. Re-attacking six rows with per-row calibrated windows on a dedicated 2500-trace capture reduces the mean per-row residual to $20.74$ bits, which extrapolates to $\approx 2^{1617}$ for the full matrix. The measured reduction is therefore substantial—of the order of 880 bits below the nominal key space—but it is a reduction, not a complete break: reaching the row-0 figure on every row would require a per-row retriggered campaign that places each row in the same high-SNR position, which has not been performed. This bound is reported, together with the per-row detail, as released data, and the retriggered full-key campaign is identified as the natural next step (Section 9).

Two caveats bear on any per-row generalisation from this dataset. First, the firmware test key is generated as ${\mathbf{O}}_{\mathrm{flat}}\left[i\right]=(7i+3)mod16$, so with $o=8$ columns the row content repeats with period two ($56\equiv 8(mod16)$); rows 0 and 2 are identical by construction and cannot be treated as independent evidence. Second, the per-row extrapolation above assumes the row-0 leakage model transfers unchanged to rows acquired under separate triggers, which the present data can neither confirm nor refute.

8. A First-Order Countermeasure and Its Evaluation

The strong leakage of the unprotected map constitutes a defensive call to action. The proposed countermeasure is designed to provide an efficient, portable and verifiable first-order protection of the MAYO secret linear map, integrating fresh Boolean sharing, temporal share separation and independent per-pass row shuffling. It is structured into three mechanisms, in order to ensure that both the algorithmic and the micro-architectural leakage components are addressed. Furthermore, it is evaluated on the same STM32F303, closing the loop from leakage assessment to measured protection.

8.1. Design: Masking and Shuffling

Because $\mathrm{GF}\left(16\right)$ multiplication is ${\mathbb{F}}_2$-linear in its first argument, additive Boolean masking of the secret matrix distributes over the map: writing $\mathbf{O}={\mathbf{O}}_0\oplus {\mathbf{O}}_1$ with ${\mathbf{O}}_0$ a fresh uniform random matrix drawn per invocation,

$$\mathbf{O}·\mathbf{x}=({\mathbf{O}}_0\oplus {\mathbf{O}}_1)·\mathbf{x}=({\mathbf{O}}_0·\mathbf{x})\oplus ({\mathbf{O}}_1·\mathbf{x}),$$

(4)

so no gadget beyond share-wise matrix–vector products is required. We adopt this construction as the software analogue of the oil-space blinding used in hardware accelerators [19] and reuses the sharing philosophy of the multivariate masking gadgets [16,17,18]. Three implementation choices were made, in order to render the masking effective on a Cortex-M4, where naive sharing is known to leak through micro-architectural recombination. These are:

1.

Temporal share separation. The two share products ${\mathbf{O}}_0·\mathbf{x}$ and ${\mathbf{O}}_1·\mathbf{x}$ are computed in two separate passes, and the shares are recombined only after the measured (trigger-bracketed) region, so no sample manipulates ${\mathbf{O}}_0\left[r\right]\left[j\right]$ and ${\mathbf{O}}_1\left[r\right]\left[j\right]$ back-to-back (which would leak their Hamming distance $\mathrm{HW}\left(\mathbf{O}\right[r\left]\right[j\left]\right)$).

2.

Row shuffling. Each share pass evaluates the $v=78$ output rows in an independent uniformly random order (two Fisher–Yates permutations from an on-device xorshift32 generator), so any residual per-row leakage is diluted across 78 time slots and no fixed sample corresponds to a fixed secret row.

3.

Fresh randomness. Masks and permutations are regenerated every invocation, outside the trigger, so leakage of the mask itself does not enter the measured window.

Overall, masking removes the first-order dependence on $\mathbf{O}$, while shuffling removes the residual, micro-architectural component that pure masking leaves on this core. The necessity of the second step is measured, not assumed: the naive two-share implementation without row shuffling (firmware/mayo_lm_masked.c), assessed under the identical fixed-versus-fixed protocol at 1000 traces per class, still fails the gate decisively at $max\left|t\right|=17.94$ with $\mathrm{10,799}$ of $\mathrm{24,000}$ points exceeding $4.5$ (and ${\chi }^2=371$). Boolean sharing alone therefore buys roughly an order of magnitude, i.e., $195.7\to 17.94$. However, it leaves a first-order component an order of magnitude above the decision threshold, and only the addition of independent per-pass row shuffling brings the statistic below it.

8.2. Measured Overhead

We measured the protected and unprotected execution costs directly from the capture board’s cycle counter (trigger-high duration at one sample per clock), which is deterministic across runs (Table 6). The masked, shuffled map costs $\mathrm{36,130}$ cycles against $\mathrm{16,242}$ for the unprotected map—an overhead of $\mathbf{2}.\mathbf{22}\times$. Masking alone (two share passes, no shuffle) costs $2.19\times$, so shuffling adds only ∼$1.5\%$. This is at the low end of reported multivariate first-order costs, i.e., mUOV signing at $3.5\times$ [16] and masked Gaussian elimination at ∼$15\times$ on Cortex-M4 [17]. The result is consistent with the fact that blinding a single linear map is cheaper than masking a full solver, and it is comparable to the $<30\%$ hardware overhead of oil-space blinding [19].

8.3. Leakage Evaluation

The fixed-versus-fixed TVLA (two distinct secret matrices ${\mathbf{O}}_A,{\mathbf{O}}_B$, identical public-input sequence) is repeated on the protected firmware. A methodological point proved essential: because the protected map’s residual leakage, if any, is small, the assessment is sensitive to slow acquisition drift. Capturing the two classes in sequential blocks yields a peak of $\left|t\right|=9.72$, which a same-secret control—splitting one class against itself, where no secret-dependent leakage can exist—shows to be dominated by slow acquisition drift rather than by leakage. Therefore, we acquire the two classes in short interleaved blocks of 25 traces, so that both classes traverse the same drift trajectory. Under this drift-free acquisition the same-secret control falls to $\left|t\right|=4.12$ and $\left|t\right|=4.52$ for the two classes, establishing the measurement floor of the setup, and the protected map yields

$$max\left|t\right|=3.62<4.5,0/\mathrm{24,000}\mathrm{points}\mathrm{failing},$$

(5)

a $\mathbf{54}\times$ reduction from the unprotected peak of $195.7$, with the ${\chi }^2$ leakage test likewise falling from 975 to 27. The residual sits below the same-secret drift floor ($\left|t\right|\approx 4.1$–$4.5$), i.e. no secret-dependent leakage is detectable above the measurement noise. Figure 2 (right) shows the flat protected t-trace, and Figure 4 overlays the two implementations.

Furthermore, the protected map’s statistic does not grow with trace count, in that: across $N=50$ to 800 traces per class it stays in the $3.6$–$4.6$ band, whereas the unprotected statistic crosses $4.5$ by $N=25$ and climbs past 190 (Figure 5). A leaking implementation’s $\left|t\right|$ grows as $\sqrt{N}$; the flat curve is the signature of leakage that has been removed rather than merely attenuated. Each acquisition was repeated and the two secret matrices and the public-input sequence are fixed by seed, so the assessment is fully reproducible.

Figure 5. Peak $\left|t\right|$ versus traces per class (log scale). The unprotected map is detected almost immediately and grows as $\sqrt{N}$; the protected map remains below $4.5$ and shows no growth, the expected behaviour when first-order leakage is absent.

Figure 5. Peak $\left|t\right|$ versus traces per class (log scale). The unprotected map is detected almost immediately and grows as $\sqrt{N}$; the protected map remains below $4.5$ and shows no growth, the expected behaviour when first-order leakage is absent.

Masked MAYO subroutines for the Cortex-M4 assessed by TVLA have been reported before [15]. To the authors’ knowledge, this is the first MAYO $\mathrm{GF}\left(16\right)$ secret map protected by masking and shuffling and assessed under a secret-dependent fixed-versus-fixed test. The result is reported against the $4.5$ gate with an explicit count of failing sample points ($0/\mathrm{24,000}$), a measured cycle-count overhead, and evidence that masking alone is insufficient on this core. Overall, the experiments highlight the practical trade-off between protection and cost that a constrained device must absorb. The $2.22\times$ cycle penalty is modest against the reported multivariate first-order costs, yet it is not free, in that it roughly doubles the latency of the signing hot path and consumes fresh randomness on every invocation, which is a scarce resource on parts without a hardware entropy source. Furthermore, the row shuffling that proved necessary to cross the $4.5$ gate is precisely the component that resists formal probing-model argument, so the countermeasure trades a measured guarantee for a provable one. A second-order adversary that combines the two share passes is therefore out of scope for a first-order countermeasure, and extending the sharing order and adding temporal jitter constitute the natural next steps (Section 9).

9. Discussion

9.1. Why the First-Order Model Saturates

The three nibbles that are not recovered top-1 fail in a characteristic way that identifies the leakage model, rather than measurement noise, as the limiting factor. A fine scan of nibble 0 shows that the true value $0\mathrm{x}3$ does peak at the correct point of interest (sample 130, partial correlation $0.544$), but a $\mathrm{GF}\left(16\right)$-related competitor $0\mathrm{x}6$ edges it ($0.562$), a margin of under $0.02$. Repeating the acquisition and increasing the trace count leaves the ranking of these near-ties unchanged, which is the signature of a systematic model mismatch: additional traces reduce the variance of an estimator that is converging on the wrong maximum. This is the expected behaviour of a Hamming-weight model applied to a single $\mathrm{GF}\left(16\right)$ multiply inside a linear map: the model is an imperfect fit for the exact bit-level leakage, and products from neighbouring rows create spurious peaks. Critically, the true key remains a top-1-to-4 candidate throughout, so the attack still collapses the key-space to an enumerable 24 candidates for the row. Whether the same reduction can be realised on all 78 rows is an alignment question rather than a leakage question (Section 7.3), in that it requires per-row retriggering, which has not been performed.

The saturation is therefore not a failure of the platform’s leakage—TVLA already established that leakage is overwhelming—but a property of the distinguisher. Three well-understood upgrades would sharpen recovery to a clean top-1 per nibble: a profiled/template attack that builds per-value or per-Hamming-weight templates; a stochastic/linear-regression model that fits per-bit leakage weights instead of assuming uniform Hamming weight; and a chained-accumulator model that recovers $\mathbf{O}\left[0\right]\left[0\right]$ first and conditions each subsequent nibble on the already-recovered ones, matching the accumulation order of lincomb. These are the same mechanisms that let the published single-trace profiled attacks reach near-certain recovery; the presented contribution here is to make explicit, on a reproducible non-profiled baseline, exactly where the simple model breaks and why.

9.2. From Assessment to Countermeasure: What Was Measured and What Remains

Overall, the countermeasure of Section 8 realises, on hardware, the two steps that a defensive study in this space is expected to deliver: a first-order masked (blinded) $\mathrm{GF}\left(16\right)$ map with a measured overhead ($2.22\times$) and an on-device fixed-versus-fixed TVLA below the $4.5$ gate ($\left|t\right|=3.62$), rather than a gadget-level probing proof alone. Two design lessons generalise. First, on a Cortex-M4, naive Boolean sharing is not sufficient: it was observed that masking alone leaves a residual, micro-architectural first-order component, and that independent per-pass row shuffling is what suppresses it below the gate—the classic pitfall that has broken nominally first-order-secure masked software, made concrete here. Second, evaluating a near-threshold countermeasure demands drift-free acquisition; a sequential capture would have reported a spurious $\left|t\right|=9.72$ that a same-secret control unmasks as drift.

Finally, three extensions remain, which map directly onto PQ-NEXT’s side-channel/fault mitigation, crypto-agility and benchmarking activities:

1.

Higher-order security. A second-order adversary can combine the two share passes; extending to $d\ge 2$ shares (with refreshed masks) and adding temporal jitter would target higher-order resistance, at a cost that the multivariate masking literature quantifies [16,17,18].

2.

Integration into full signing. Here the map is isolated for measurement; folding the shared output into the vinegar addition ${\mathbf{s}}_i={\mathbf{v}}_i+\mathbf{O}{\mathbf{x}}_i$ (so the vinegar acts as a further share) and re-assessing within full mayo_sign is the deployment step.

3.

Cross-parameter and cross-scheme coverage. Repeat on MAYO-2 ($o=17$, $k=4$ change the map geometry) and extend the same reduced-target methodology to the other embedded multivariate candidates, for which hardware-evaluated masking is likewise absent.

Delivering a masked MAYO $\mathrm{GF}\left(16\right)$ map with measured overhead and on-device leakage evaluation fills the single clearest gap in MAYO implementation security and is directly responsive to the emphasis on physical-attack resistance in the ongoing NIST additional-signatures evaluation.

9.3. Limitations

The detailed recovery figures are reported for the first row of $\mathbf{O}$ within a single capture window. Section 7.3 bounds the full-key enumeration cost by direct measurement ($2^{2089}$ across all 78 rows) and by per-row extrapolation ($\approx 2^{1617}$). However, a uniform per-row recovery matching the row-0 figure needs per-row retriggering or a wider and slower capture, which has not been performed and is left to full-signing integration. The full-key cost should therefore be read as a measured bound, rather than as a proven break. The fixed test key also repeats with period two across rows, so this dataset cannot establish row-to-row independence. The reduced target faithfully reproduces the $\mathrm{GF}\left(16\right)$ multiply but not the surrounding key-expansion memory traffic of full signing; this is deliberate, as it isolates the primitive, but it means absolute leakage magnitudes in a full implementation may differ. The countermeasure is evaluated at first order on the isolated map, while second-order security and integration into full mayo_sign (where the vinegar addition supplies a further share) remain future work (Section 9). Finally, the ground-truth matrix is a fixed known value used only for scoring; the attack code operates without it, but a profiled attack would still need a controllable profiling device, as is standard.

10. Conclusions

This work presented a complete and reproducible power side-channel attack-and-defence case study of the MAYO secret linear map on a commodity Cortex-M4 evaluation platform. TVLA established that the unprotected $\mathbf{O}·\mathbf{x}$ operation leaks overwhelmingly, at $\left|t\right|=53.7$ fixed-versus-random and $\left|t\right|=195.7$ fixed-versus-fixed on the secret, corroborated by a ${\chi }^2$ peak of 975. Additionally, a non-profiled partial-correlation CPA that explicitly handles the two confounds of a linear $\mathrm{GF}\left(16\right)$ map recovered $5/8$ first-row nibbles exactly, thus driving the mean true-key rank to $1.75/16$ and collapsing the row search space from ${16}^8$ to 24 candidates, against a measured full-matrix enumeration bound of $2^{2089}$ and a nominal $2^{2496}$. Building on this baseline, the proposed first-order countermeasure—a masked and row-shuffled $\mathrm{GF}\left(16\right)$ map—was implemented and evaluated on the same device, realizing a leakage reduction approaching $54\times$, to $\left|t\right|=3.62<4.5$ with no failing sample point and a statistic flat in trace count, at a measured overhead of roughly $2.22\times$ cycles under a drift-free block-interleaved acquisition. In contrast to the masked MAYO Cortex-M4 subroutines already reported in the literature [15], the proposed approach combines masking with per-pass row shuffling—shown to be necessary, since masking alone still leaks at $\left|t\right|=17.94$—together with a secret-dependent fixed-versus-fixed assessment reported against the $4.5$ gate with an explicit count of failing sample points.

Conducted within the PQ-NEXT project, the presented study supplies concrete, on-hardware implementation-security evidence for a NIST additional-signatures multivariate candidate on a constrained device, thus contributing to the project’s goals of post-quantum algorithm maturity, side-channel and fault hardening, and good-practice demonstrators, while remaining directly relevant to the physical security criteria of the ongoing NIST evaluation. Beyond the immediate cryptographic result, the release of the firmware, capture and analysis code, and raw traces lowers the barrier for independent evaluators and device vendors to reproduce a leakage assessment on their own silicon, which is an important aspect for the certification pathways that post-quantum migration in regulated sectors will require. Future work will focus on three directions. These are: (i) extending the sharing order beyond first order and adding temporal jitter, in order to address a second-order adversary that combines the two share passes; (ii) integrating the protected map into full mayo_sign, where the vinegar addition supplies a further share; and (iii) a per-row retriggered acquisition campaign, in order to establish the full-key recovery cost by measurement rather than by extrapolation.