Leakage Assessment and Correlation Power Analysis of the MAYO Secret Linear Map on a Cortex-M4: A Reproducible Case Study and a Validated First-Order Countermeasure

Abstract

This work presents a complete power side-channel evaluation of the MAYO secret linear map on a constrained embedded target, together with a first-order countermeasure evaluated on the same hardware. While MAYO ranks among the most embedded-friendly candidates in the National Institute of Standards and Technology (NIST) additional-signatures call, few countermeasures for it are quantified against an explicit leakage threshold. The unprotected map $\mathbf{O}·{\mathbf{x}}_i$ over $\mathrm{GF}\left(16\right)$ is evaluated against a masked and row-shuffled variant under an identical acquisition procedure. Test Vector Leakage Assessment (TVLA) of the unprotected map peaks at $\left|t\right|=52.88$ fixed-versus-random and at $\left|t\right|=195.7$ under a secret-dependent fixed-versus-fixed test, while a non-profiled Correlation Power Analysis (CPA) resolving the multiplicative-identity alias and temporal row-mixing collapses the first key row from 16⁸ to 24 candidates, with a median of 287 measured across 20 independent random keys. The proposed countermeasure pairs masking with per-pass row shuffling, in order to suppress the micro-architectural residue masking alone leaves; it realizes a leakage reduction approaching 54×, to $\left|t\right|=3.62$ with no failing point out of 24,000, at roughly 2.22× cycles. The evaluation is a laboratory assessment of the isolated map on an STM32F303 (ARM Cortex-M4) measured with a ChipWhisperer-Lite, and does not exercise complete MAYO signing.

1. Introduction

The convergence of post-quantum cryptographic standardization with the deployment of security primitives on resource-constrained embedded devices has created the need for new requirements in the design and evaluation of signature schemes, in terms of resistance to physical attacks [1]. In this respect, the migration to post-quantum cryptography has entered a phase in which implementation security—and not only asymptotic hardness—is treated as a first-order selection criterion. Following the standardization of lattice-based signatures, the National Institute of Standards and Technology (NIST) issued an additional call for general-purpose digital signatures, in order to diversify the mathematical assumptions underpinning deployed schemes [1]. Among the advancing candidates, the multivariate family—classical Unbalanced Oil and Vinegar (UOV) and its variants—is attractive for constrained devices thanks to short signatures and simple field arithmetic. The family remains well represented in the process: of the nine schemes advanced to the third round in May 2026, four (UOV, MAYO, QR-UOV and SNOVA) are UOV-based [1]. MAYO [2,3], which “whips up” a small UOV map into a larger one in order to shrink public keys, is the most embedded-friendly member of this family and has attracted dedicated hardware and micro-controller implementations [4,5].

Precisely because these schemes are candidates for deployment on smart cards, secure elements and micro-controllers, their resistance to physical attacks must be established empirically, on real silicon, rather than argued in the abstract. The signing operation of a UOV-type scheme necessarily manipulates the secret linear map that separates the Oil-and-Vinegar subspaces; any measurable dependence of power consumption on that secret constitutes a potential key-recovery vector. The community has responded with a rapidly growing body of physical attacks on MAYO, including fault injections [6,7] and single-trace side-channel analyses [8,9,10]. However, what is comparatively underdeveloped for MAYO is the defensive counterpart, i.e., countermeasures whose leakage reduction is quantified against an explicit decision threshold. The systematization of UOV-family physical security [11] does supply first-order masked UOV and MAYO implementations for the Cortex-M4, with overhead benchmarked and a TVLA comparing protected against unprotected subroutines; masking of the Gaussian-elimination and $\mathrm{GF}\left(16\right)$ building blocks shared across UOV, MAYO, SNOVA and QR-UOV has otherwise been analyzed at the level of probing-model cost rather than measured on-device leakage [12]. What is still missing is a MAYO countermeasure evaluated under a secret-dependent (fixed-versus-fixed) test and reported against the $\left|t\right|<4.5$ gate with a stated number of failing sample points.

Contributions

This paper presents a careful, fully reproducible leakage-assessment case study of the MAYO secret linear map on a widely available evaluation platform, and uses it as the concrete foundation for an evaluated countermeasure. The presented contributions are the following:

• A non-profiled, first-order leakage baseline for the MAYO secret map. The MAYO secret operation $\mathbf{O}{\mathbf{x}}_i$ over $\mathrm{GF}\left(16\right)$ is isolated as a reference-faithful reduced target, reusing the MAYO-C $\mathrm{GF}\left(16\right)$ arithmetic verbatim so that the measured leakage is faithful to the reference while fitting the ∼48 KB SRAM on which full MAYO-1 signing does not run. On this target, non-specific TVLA yields $\left|t\right|=52.88$ and a secret-dependent fixed-versus-fixed test $\left|t\right|=195.7$ with 12,298/20,000 points failing (Section 5 and Section 7).
• A distinguisher that resolves the confounds of a linear $\mathbf{GF}\left(\mathbf{16}\right)$ map, with its assumptions made explicit. The multiplicative-identity input-load alias and temporal row-mixing are identified and removed by partial correlation with points-of-interest windowing, recovering $5/8$ first-row nibbles and collapsing the row from 16⁸ to 24 candidates, with the key dependence of that figure measured over 20 independent random keys (median 287 candidates, mean rank 3.21 against chance 8.50). The accompanying identity-disambiguation rule, its threshold-invariance interval, the significance of the reduction against a null model, and its dependence on the particular test key are all quantified, and the full-matrix cost is reported as a measured residual of 2³⁷⁴ over the 39 rows carrying exploitable leakage (per-row 9.60 bits, 40.4% of nibbles recovered outright) and an extrapolated full-matrix cost of ≈2⁷⁴⁹ (Section 6.4, Section 7 and Section 7.3).
• A first-order countermeasure evaluated on the same bench, with a methodology for near-threshold assessment. A masked and row-shuffled $\mathrm{GF}\left(16\right)$ map reduces the peak fixed-versus-fixed statistic to $\left|t\right|=3.62$ with 0/24,000 failing points at a measured 2.22× cycle cost, while masking alone still leaks at $\left|t\right|=17.94$. Reaching a defensible verdict at this effect size required drift-free block-interleaved acquisition and explicit null behavior for both the t and ${\chi }^2$ criteria, which is reported as a transferable methodology. Firmware, capture and analysis code and all raw traces are released as a public artifact [13] (Section 6.6 and Section 8).

The attack is deliberately framed as a non-profiled, first-order leakage-assessment and methodology contribution, rather than as a novelty-driven attack. Single-trace profiled key recovery on MAYO has already been reported [8,9,10]. By contrast, the presented study adopts the weaker and more portable non-profiled adversary, following the same methodological stance as recent non-profiled evaluations of lattice PQC [14]. Furthermore, it makes explicit the linear-map pitfalls that a profiled attack bypasses but that a first-order evaluator must confront, on top of which the countermeasure evaluation is built.

This paper is organized as follows. Section 2 provides the necessary background on MAYO and on the leakage-assessment and correlation techniques employed. Section 3 places this study within the PQ-NEXT project framework, while Section 4 reviews the closest prior attacks and countermeasures and identifies the remaining research gap. Section 5 analyzes the target primitive and states the threat model, and Section 6 details the measurement setup and the distinguisher. Section 7 reports the leakage-assessment and key-recovery results for the unprotected map, whereas Section 8 presents and evaluates the proposed masked and shuffled countermeasure. Section 9 discusses the implications and limitations of the presented approach. Finally, Section 10 concludes this paper.

2. Background

2.1. MAYO and the Secret Linear Map

MAYO [2,3] is a multivariate signature scheme derived from the Oil-and-Vinegar (OV) trapdoor. In OV, the secret is a linear subspace O (the “oil” space) of dimension o inside an n-dimensional space over a finite field; a public multivariate quadratic map $\mathcal{P}$ vanishes on O, and signing amounts to sampling vinegar values and then solving a linear system over the oil space so that $\mathcal{P}\left(\mathbf{s}\right)=\mathbf{t}$ for a message digest $\mathbf{t}$. MAYO reduces the OV public-key size by choosing an intentionally small oil space and then “whipping” the map k times into a larger emulated instance, recovering security while keeping keys compact.

For the NIST security level I parameter set, MAYO-1, the relevant parameters are $n=86$, $m=78$, $o=8$, $k=10$, $v=n-o=78$, and field order $q=16$, giving a public key of 1420 bytes and a signature of 454 bytes from a 24-byte seed secret key. During signing, each of the k signature blocks is formed by applying the secret oil matrix $\mathbf{O}\in \mathrm{GF}{\left(16\right)}^{v\times o}$ to a public vector ${\mathbf{x}}_i\in \mathrm{GF}{\left(16\right)}^o$:

$$\mathbf{O}{\mathbf{x}}_i=\mathbf{O}·{\mathbf{x}}_i,{\mathbf{s}}_i={\mathbf{v}}_i+\mathbf{O}{\mathbf{x}}_i,$$

(1)

after which ${\mathbf{x}}_i$ itself is copied into the signature block in the clear. The matrix $\mathbf{O}$ is the UOV secret; recovering it breaks the scheme. Crucially, ${\mathbf{x}}_i$ is public (it appears verbatim in the signature), so the elementary secret computation

$$\mathrm{prod}={\mathrm{mul}}_f\left(\mathbf{O}\left[r\right]\left[j\right],{\mathbf{x}}_i\left[j\right]\right)$$

(2)

multiplies one secret nibble by one known nibble in $\mathrm{GF}\left(16\right)\cong \mathrm{GF}\left(2\right)\left[x\right]/(x^4+x+1)$. Since a nibble takes only 16 values, a secret-key hypothesis for a single position has only 16 candidates. This is the textbook setting for a divide-and-conquer power-analysis attack, and it is the target of this study.

2.2. Leakage Assessment (TVLA)

Test Vector Leakage Assessment (TVLA) [15,16] is the de facto standard for detecting the presence of exploitable leakage without committing to a specific attack. In the non-specific fixed-versus-random variant, the device repeatedly processes either a single fixed input or freshly random inputs, and Welch’s two-sample t-test is applied point-wise to the two trace populations:

$$t={\displaystyle \frac{{\mu }_{\mathrm{fixed}}-{\mu }_{\mathrm{rand}}}{\sqrt{{\sigma }_{\mathrm{fixed}}^2/N_{\mathrm{fixed}}+{\sigma }_{\mathrm{rand}}^2/N_{\mathrm{rand}}}}}.$$

(3)

A commonly adopted decision threshold is $\left|t\right|>4.5$, corresponding to a very small false-positive probability for the null hypothesis of equal means at practical trace counts. Interleaving the fixed and random classes trace-by-trace (rather than in blocks) guards against slow environmental drift being misread as leakage. TVLA reports whether an implementation leaks, but—by design—not how much key a concrete adversary would recover; the two questions are complementary, and both are addressed.

2.3. Correlation Power Analysis (CPA)

Correlation Power Analysis [17] recovers a secret by correlating measured power against a leakage model of a key-dependent intermediate. For each key hypothesis g and each trace with known input x, one predicts an intermediate $z_g=f(g,x)$ and models its leakage—classically the Hamming weight $\mathrm{HW}\left(z_g\right)$. Pearson’s correlation between the predicted leakage and the measured samples is computed over many traces; the hypothesis whose correlation peaks is taken as the key. Applied to Equation (2), the CPA intermediate is $\mathrm{HW}\left({\mathrm{mul}}_f({\mathbf{O}}_{\mathrm{guess}},x)\right)$ with 16 hypotheses per secret nibble. As shown below, the linearity of the map introduces confounds that a straightforward global-maximum CPA does not survive, and which motivate the partial-correlation treatment in Section 6.

3. The PQ-NEXT Framework and the Placement of This Study

This study is carried out within PQ-NEXT (Post-Quantum Networks for Energy-Efficient Transitions), a Horizon Europe research and innovation action that develops a framework and toolbox for migrating large-scale infrastructures from classical to post-quantum cryptography, continuing the earlier PQ-REACT project’s comparative evaluation of post-quantum signatures [18,19]. Figure 1 summarizes the PQ-NEXT approach as a layered platform. The constituent layers are: (i) a PQC Algorithm Catalog, which curates quantum-resistant primitives across the lattice, code, hash, isogeny, MPC-in-the-Head and multivariate families, together with hybridization mechanisms; (ii) a Maintenance Tools layer, which provides energy monitoring, key management, system updates, compliance auditing and a crypto-agility module; (iii) a Network Security and Quantum-Resistant Communication layer, which secures next-generation networks; (iv) a Post-Quantum Programming Suite and Quantum Cryptanalysis foundation, built on Eclipse Qrisp and LLVM, which assesses candidate algorithms; and (v) a Migration Toolbox, which drives planning, implementation, compatibility, compliance, risk and cost analysis. The whole is exercised in large-scale pilot demonstrators spanning finance, telecommunications, critical infrastructure and municipal services.

Implementation security is an explicit concern of PQ-NEXT. Its network-security layer commits to mitigating side-channel and fault attacks through masking/blinding, randomness injection and control-flow integrity, “beyond the cryptographic algorithm level”; its benchmarking work package assesses the resilience and quality of post-quantum candidates on real and simulated platforms; one of its cross-cutting needs is adaptation to resource-constrained devices. The algorithm catalog explicitly spans the multivariate and MPC-in-the-Head families to which MAYO belongs. Both contributing institutions—NCSR “Demokritos” (project coordinator) and AGH University of Krakow—are PQ-NEXT partners.

Against this backdrop, the present study is the implementation-security control experiment for a multivariate candidate on a constrained target. It provides an on-hardware, reproducible leakage-assessment baseline (TVLA) and a first-order CPA key-recovery analysis of the MAYO secret linear map on a Cortex-M4, and it derives the masking-and-evaluation roadmap (Section 9) against which the project’s countermeasures are to be measured.

Table 1. Mapping of this study’s elements onto the PQ-NEXT framework.

Element of This Study	PQ-NEXT Layer/WP/Task	Serves
TVLA leakage assessment of $\mathbf{O}·\mathbf{x}$	Network Security layer, side-channel/fault mitigation (T2.3)	Hardened, leakage-evaluated implementations
CPA key-recovery baseline	Benchmarking of PQC resilience & quality (WP3)	Algorithm maturity/standardization input (EO1)
Masking-and-evaluation roadmap	Crypto-agility module, Maintenance Tools (T2.2)	Concrete countermeasure target
Reference-faithful reduced target	PQC Algorithm Catalog, multivariate family (T2.1)	Cross-parameter/cross-scheme coverage
Constrained Cortex-M4 focus	Adaptation to resource-constrained devices (SN#8)	Good-practice hardware demonstrator (EO5)

maps each element of this study onto the PQ-NEXT layer, work package and expected outcome it serves.

4. Related Work

4.1. Attacks on MAYO

MAYO has accumulated a dense body of physical attacks. On the fault side, Aulbach et al. (“MAYo or MAY-not”, FDTC 2024) [6] mount loop-abort and zeroing faults on the official Cortex-M4 implementation with full-key recovery from a single fault, Jendral and Dubrova [7] recover the key by fixing vinegar seeds, and Abdelmonem et al. [20] mount a component-wise fault injection attack against randomized MAYO, showing that re-randomization alone does not neutralize the fault surface. On the passive side, Jendral and Dubrova [8] present a deep learning single-trace attack exploiting leaky modular multiplication, with very high reported success. This line of work was later extended in the QRSEC’25 workshop [9] to full-key recovery from a single power trace, with success probabilities of 99.4% and 93.1% at two parameter sets. Most closely related to the presented platform, the SCA-MQDSA study [10] analyzes a nibble-sliced MAYO on precisely the hardware class used here (a ChipWhisperer-Lite with an STM32F3 target on a CW308 UFO board) and frames a common side-channel methodology across UOV, MAYO, QR-UOV and SNOVA. Related single-trace work on classical UOV, “Separating Oil and Vinegar with a Single Trace” [21], established the template for attacking the secret linear structure of OV schemes on the same STM32F3 platform.

4.2. Countermeasures

By contrast, defensive results for MAYO remain thin, though not absent. The physical security of UOV-based schemes has recently been systematized, mapping which attacks and protections transfer across the family [11]. That work is also the closest defensive antecedent to the presented study, in that it contributes first-order masked implementations of both UOV and MAYO for the Cortex-M4, and benchmarks their overhead on a NUCLEO-L4R5ZI board. Furthermore, it evaluates them by a TVLA of protected against unprotected subroutines, reporting substantially reduced t-values. The proposed countermeasure differs in three respects: (i) it targets the isolated $\mathbf{O}·\mathbf{x}$ map, rather than full-signing subroutines; (ii) it combines masking with per-pass row shuffling, which is shown in Section 8.1 to be necessary, in that masking alone still yields $\left|t\right|=17.94$ on this core; and (iii) it is assessed with a fixed-versus-fixed test across two distinct secret matrices, thus isolating secret-dependent leakage. Additionally, the result is reported against the 4.5 gate with an explicit count of failing sample points. The mUOV first- and higher-order masking [22] likewise targets classical UOV. The masking of Gaussian elimination at arbitrary order [12] provides a cost model for UOV, MAYO, SNOVA and QR-UOV but implements and benchmarks only UOV on Cortex-M4, explicitly leaving micro-architectural leakage evaluation out of scope. Two very recent works occupy adjacent ground: Coron, Gérard and Zhang mask the linear-equation solve in UOV signing at arbitrary order [23], and Krieger, Czuprynko and Sinha Roy blind the oil (secret) space of a UOV hardware accelerator against DPA [24]. Both are recent, both target UOV rather than MAYO, and neither reports an on-device micro-architectural TVLA of a MAYO $\mathrm{GF}\left(16\right)$ map. To the authors’ knowledge, no masked MAYO $\mathrm{GF}\left(16\right)$ secret map with a measured software overhead and an on-device fixed-versus-fixed TVLA below the 4.5 gate has been published; the countermeasure implemented and evaluated here (Section 8) fills exactly this gap.

4.3. Differentiation from Prior Work

Table 2. Differentiation of this work from the closest prior UOV/MAYO side-channel attacks and countermeasures. “Prof.” = profiled (a training/template phase or deep learning model); “non-prof.” = non-profiled. TtD = traces-to-disclosure; SR = success rate; GE = guessing entropy/key rank. Overhead is the reported first-order software cost factor where applicable.

Work	Target (Operation)	Platform	Prof.?	# Traces	Metric	Attack/Defense
Jendral–Dubrova [8,9]	MAYO (modular mult.)	Cortex-M4	Prof. (DL)	single trace	SR 99.9%/91.6%	Attack
SCA-MQDSA [10]	UOV/MAYO/QR-UOV/ SNOVA	ChipWhisperer, STM32F3	Non-prof.	single exec.	key recovery	Attack
Separating Oil and Vinegar [21]	UOV (central-map inversion)	ChipWhisperer, STM32F3	Non-prof.	single trace	key recovery	Attack
SoK UOV physical sec. [11]	UOV and MAYO (signing subroutines)	Cortex-M4 (NUCLEO-L4R5ZI)	—	—	TVLA (prot. vs. unprot.)	Defense (masking + fault)
Masking GE [12]	UOV/MAYO/SNOVA/QR-UOV (Gaussian elim.)	Cortex-M4	—	—	probing-model proof	Defense (∼$15\times$ M4)
mUOV [22]	UOV (dot-product, mat.–vec.)	Cortex-M4	—	—	probing-model proof	Defense ($3.5\times$ sign)
Coron et al. [23]	UOV (linear-system solve)	C (probing)	—	—	probing-model proof	Defense (≥$2.2\times$ vs. GE)
Krieger et al. [24]	UOV (oil-space blinding)	FPGA	—	—	runtime/area	Defense (<30% runtime)
This work	MAYO ($\mathbf{O}·\mathbf{x}$ over $\mathbf{GF}\left(\mathbf{16}\right)$)	ChipWhisperer, STM32F3	Non-prof.	${\mathbf{10}}^{\mathbf{3}}$ (CPA), $\mathbf{8}\mathbf{\times }{\mathbf{10}}^{\mathbf{2}}$/class (TVLA)	GE/$\left|\mathbf{t}\right|$/${\mathbf{\chi }}^{\mathbf{2}}$	Attack and defense (2.22×)

# denotes the number of traces; “—” marks entries that are not applicable; bold marks the present work.

places this study against the closest prior UOV/MAYO side-channel attacks and countermeasures. Relative to the attacks, the presented study is the only non-profiled, first-order evaluation of the isolated $\mathbf{O}·\mathbf{x}$ linear map, in that: the published MAYO key recoveries are profiled, deep learning single-trace attacks [8,9] or nibble-sliced analyses framed across the multivariate family [10], all of which bypass—rather than confront—the multiplicative-identity and row-mixing confounds that dominate a first-order attack on a linear map. Additionally, relative to the countermeasures, the proposed approach is the only one accompanied by an on-device TVLA of a MAYO $\mathrm{GF}\left(16\right)$ map with a measured software overhead, in that: the masked-GE and mUOV gadgets are proven in the probing model and benchmarked on UOV [12,22,23], and the oil-space blinding of [24] is a hardware accelerator. The new contribution is therefore twofold: a reproducible non-profiled first-order baseline on the isolated linear map, and an evaluated first-order countermeasure measured on the same bench.

This positioning aligns this study with the PQ-NEXT objective of hardening post-quantum implementations against side-channel and fault attacks through masking, blinding and randomness injection. Additionally, by supplying both the baseline and the evaluated defense on a single bench, the presented study becomes directly reusable as the control experiment for future MAYO countermeasures.

5. Target Analysis and Threat Model

5.1. Isolating the Sensitive Primitive

In the MAYO-C reference, signing forms each signature block via a matrix–vector product implemented as an accumulation of $\mathrm{GF}\left(16\right)$ products, $\mathbf{O}{\mathbf{x}}_i\left[r\right]={\sum }_j{\mathrm{mul}}_f(\mathbf{O}\left[r\right]\left[j\right],{\mathbf{x}}_i\left[j\right])$, where ${\mathrm{mul}}_f$ is the $\mathrm{GF}\left(16\right)$ multiplication modulo $x^4+x+1$. The secret matrix $\mathbf{O}$ is stored one $\mathrm{GF}\left(16\right)$ nibble per byte, occupying 624 bytes for MAYO-1 ($v\times o=78\times 8$). The public multiplicand ${\mathbf{x}}_i$ is the last o bytes of every signature block. Equation (2) is therefore the elementary secret operation, and it is exactly what is bracketed for measurement.

5.2. Feasibility Constraint and the Reduced Target

A key engineering decision follows from the target’s memory. The reference key expansion inflates the 24-byte seed into roughly 144 KB of RAM-resident key material (a $P_1$ table of 120,159 bytes and a $P_2$ table of 24,336 bytes), whereas the STM32F303 provides only about 48 KB of SRAM. Full reference mayo_sign therefore cannot run on this device—it is roughly threefold over budget—and the Cortex-M4 pqm4 MAYO variants likewise target larger-SRAM parts. Accordingly, a reduced target is built that isolates exactly the secret linear map, which at 624 bytes fits trivially, while reusing the MAYO-C $\mathrm{GF}\left(16\right)$ arithmetic sources verbatim so that the instruction-level leakage of ${\mathrm{mul}}_f$ is identical to the reference. This is standard practice: bracketing the sensitive primitive is precisely what both TVLA and CPA are meant to interrogate, and it removes confounds from unrelated key expansion so that any measured leakage is attributable to the map itself.

5.3. Threat Model

The standard non-invasive power side-channel adversary is assumed. The attacker can trigger signing (or, here, the isolated map) on chosen or known public inputs ${\mathbf{x}}_i$, observe the device’s power consumption at the sampling rate of a commodity oscilloscope-class capture board, and knows the algorithm and its implementation. The attacker does not know the secret matrix $\mathbf{O}$ and cannot read internal memory. This is exactly the capability of a laboratory evaluator performing a leakage assessment on a candidate implementation, which is the role adopted here. In order to provide the ground truth for the CPA distinguisher, the reduced target holds a fixed and known matrix ${\mathbf{O}}_{\mathrm{flat}}\left[i\right]=(7i+3)\mathrm{mod}16$, giving a first row $\mathbf{O}\left[0\right]=[3,\mathrm{A},1,8,\mathrm{F},6,\mathrm{D},4]$. The attack code is never given this value, which is used only to score recovery after the fact.

6. Materials and Methods

6.1. Device Under Test and Instrumentation

The target is an STM32F303 (ARM Cortex-M4, ∼48 KB SRAM, 256 KB flash; STMicroelectronics, Geneva, Switzerland) on a CW308 UFO board, measured with a ChipWhisperer-Lite CW1173 (NewAE Technology, Halifax, NS, Canada). The device runs a SimpleSerial (v1.1) firmware compiled with arm-none-eabi-gcc for the CW308_STM32F3 platform. The built image is compact—RAM occupancy 2392 bytes of 40 KB usable (5.84%) and ROM 5216 bytes of 256 KB (1.99%)—confirming that the isolated map leaves ample headroom.

For reproducibility the exact toolchain is as follows. The firmware is built with arm-none-eabi-gcc 10.3.1 (20210621) using the ChipWhisperer SimpleSerial build system, invoked as make PLATFORM=CW308_STM32F3 CRYPTO_TARGET=NONE SS_VER=SS_VER_1_1, which applies the framework’s default -O2 optimization level; the compiler memory barriers described below are required precisely because of that setting. The capture host runs Ubuntu 22.04.5 LTS (kernel 6.8.0-124) with Python 3.10.12, ChipWhisperer 6.0.0, NumPy 1.26.4, SciPy 1.15.3 and Matplotlib 3.10.8. The capture hardware is a ChipWhisperer-Lite CW1173 (USB ID 2b3e:ace2) driving a CW308 UFO baseboard with an STM32F303RCT6 target module. These versions are pinned in the released artifact.

We expose a single firmware command that accepts an 8-nibble public input ${\mathbf{x}}_i$, raises the capture trigger, computes $\mathbf{O}{\mathbf{x}}_i=\mathbf{O}·{\mathbf{x}}_i$, lowers the trigger, and returns the 16 output nibbles. Compiler memory barriers are placed immediately inside the trigger to prevent the -O2 scheduler from moving instructions across the trigger boundary:

trigger_high();

__asm__ volatile("" ::: "memory");

mat_mul(O, x, Ox, o, v, 1);

__asm__ volatile("" ::: "memory");

trigger_low();

We confirmed by inspection of the disassembly that ${\mathrm{mul}}_f$ is inlined between the trigger writes: the bit-mask partial products, the XOR accumulation and the mod $x^4+x+1$ reduction all appear inside the bracketed region, so the measured window faithfully spans the $\mathrm{GF}\left(16\right)$ multiply.

6.2. Capture Configuration

We capture at a 7.37 MHz target clock with the ADC in ×4 synchronous mode (29.54 MS/s), 25 dB gain, and a window of 5000 samples per trace; the trigger is on tio4 and serial on tio1/tio2. For the leakage assessment, the two TVLA classes are interleaved by a per-trace coin flip so that slow drift affects both classes equally. We persist the raw traces and the known inputs on every capture, so that the same data drive both the t-test and the subsequent CPA.

6.3. Leakage-Assessment Procedure

A non-specific fixed-versus-random TVLA is performed. The fixed class uses a constant ${\mathbf{x}}_i$; the random class draws a fresh uniform ${\mathbf{x}}_i$ per trace. Welch’s t-statistic (Equation (3)) is computed point-wise across the 5000-sample window and compared to the $\left|t\right|>4.5$ threshold. We report both a low-trace “smoke” run and a full run, so as to expose the expected growth of the statistic with trace count.

6.4. CPA Distinguisher and Confound Handling

The naive attack correlates $\mathrm{HW}\left({\mathrm{mul}}_f(g,x_j)\right)$ over all 16 hypotheses g at every sample. Two confounds, both intrinsic to a linear $\mathrm{GF}\left(16\right)$ map, defeat it:

• Multiplicative-identity input-load alias. Because ${\mathrm{mul}}_f(1,x)=x$ in $\mathrm{GF}\left(16\right)$, the hypothesis $g=1$ predicts exactly $\mathrm{HW}\left(x\right)$, which coincides with the strong, pervasive leakage of the public input being (re)loaded from memory on every row. A global-maximum CPA therefore returns $g=1$ for every nibble—correct only where the true nibble happens to be 1. This alias is removed by partial correlation, i.e., by linearly regressing $\mathrm{HW}\left(x_j\right)$ out of the traces before correlating, annihilating the $g=1$ predictor.
• Temporal row-mixing. Each public $x_j$ multiplies $\mathbf{O}\left[r\right]\left[j\right]$ for all 78 rows, so a full-trace search mixes contributions from many rows. Within the 5000-sample window the first row’s eight products are separated in time at a fixed cadence, empirically $\mathrm{POI}\left(j\right)=130+100j$ samples. Therefore, each nibble is correlated only within a tight window around its point of interest.

Partial correlation has one benign side effect that must be handled explicitly, as it is load-bearing for the reported key-space figures. Regressing out $\mathrm{HW}\left(x_j\right)$ annihilates the $g=1$ predictor, so a nibble whose true value is 1 becomes invisible to the partial-correlation spectrum—precisely the case the alias removal was designed to suppress. Such a nibble is nonetheless identifiable without knowledge of the key, by the conjunction of two attacker-observable conditions: the plain spectrum peaks at $g=1$, and the partial spectrum is flat. The adopted decision rule is “report 1 when the plain maximum is $g=1$, and the partial peak falls below 0.30”, and score that nibble under the plain spectrum. On the acquired data the rule fires on exactly one nibble ($j=2$, whose true value is indeed 1) and does so with a wide margin: its partial peak is 0.151, whereas every other nibble’s exceeds 0.476. No ground-truth information enters the rule, so the reported ranks are attacker-computable throughout.

The value 0.30 is not tuned: it is the midpoint of an empty interval in the observed statistic, and the result is invariant to it over a wide range. Across the eight nibbles the partial peaks are 0.562, 0.576, 0.151, 0.631, 0.601, 0.610, 0.678 and 0.476, so the rule-eligible nibble is separated from all others by the gap $(0.151,0.476)$. Any threshold chosen inside that interval produces byte-for-byte identical output; the adopted value sits 0.149 above the lower edge and 0.176 below the upper one. The rule therefore has no free parameter in practice on this dataset, and the sensitivity is reported so that a reader can confirm the margin rather than take the constant on trust. For completeness, the effect of disabling the rule entirely is also quantified in Section 7.

The final distinguisher combines points-of-interest windowing, partial-correlation removal of the input-load alias, and the identity disambiguation rule above. Recovery is scored by the rank of the true nibble in the sorted correlation list, where rank 1 denotes exact top-1 recovery and random guessing gives an expected rank of 8.5 over 16 candidates. Additionally, recovery is scored by the product of per-nibble ranks, which bounds the residual key-space of the row under an enumerate-by-rank strategy.

6.5. Statistical Rigor of the Assessment

Beyond the point-wise Welch t-test, three additional rigor measures are reported. (i) A traces-to-detection curve—the peak $\left|t\right|$ as a function of the number of traces per class—which both quantifies how quickly the unprotected leak is detected and, for the protected map, distinguishes removed leakage (flat curve) from merely attenuated leakage (growing as $\sqrt{N}$). (ii) An independent ${\chi }^2$-based leakage-detection test [25], which bins each sample’s two class populations into a contingency table and is sensitive to higher-moment differences the mean-based t-test can miss; its peak is reported alongside the t peak. (iii) A same-secret control (one class split against itself), which has no secret-dependent leakage by construction and therefore measures the drift/noise floor of the acquisition—indispensable for a near-threshold protected implementation. All acquisitions fix the two secret matrices and the public-input sequence by seed and are repeated across independent runs; the protected-map assessment additionally interleaves the two classes in short blocks so that slow drift affects both equally.

The trace budgets and the repetition structure behind each reported figure are as follows, so that the basis of every number is explicit. The unprotected fixed-versus-random assessment uses 1000 traces per class and is reported at two budgets (60 and 1000) in

Table 3. TVLA of the unprotected MAYO-1 secret linear map on the STM32F303. The non-specific fixed-versus-random test (rows 1–2) detects input-dependent leakage; the fixed-versus-fixed test (row 3) uses two distinct secret matrices ${\mathbf{O}}_A,{\mathbf{O}}_B$ with an identical public-input sequence, so any $\left|t\right|>4.5$ is unambiguously secret-dependent. The customary decision threshold is $\left|t\right|>4.5$; the last column of row 3 also reports the ${\chi }^2$ leakage-detection peak.

Test	Run	Traces/Class	Peak $\left|\mathit{t}\right|$	Points > 4.5
Fixed-vs-random	Smoke	60	14.20	847/5000
Fixed-vs-random	Full	1000	52.88	2747/5000
Fixed-vs-fixed	Full	500	195.7	12,298/20,000

. The unprotected fixed-versus-fixed assessment uses 500 traces per class, and its stability is checked by the same-secret split reported in Section 7. The CPA uses the 1000-trace released set, with the trace-count dependence of the distinguisher reported at $N=250$, 500, 750 and 1000 in Section 9. The protected assessment uses 800 traces per class, is reported at seven budgets from $N=50$ to $N=800$, and is additionally split into four disjoint sub-acquisitions whose spread is given in Section 8.3. Where a single pooled figure is quoted it is always the full-budget estimate, and the sub-budget behavior is reported alongside it rather than summarized.

6.6. Decision Criteria and Their Null Behavior

Because the protected implementation is assessed close to the decision boundary, the criteria are stated explicitly, together with their behavior under the null hypothesis of no leakage.

The t-test. A single sample exceeds $\left|t\right|>4.5$ with probability $6.8\times {10}^{-6}$ under the null, i.e., about one in $1.5\times {10}^5$. A leakage assessment, however, sweeps a whole window, so the relevant quantity is the distribution of the maximum over that window. Simulation of the null over 24,000 samples gives $\mathbb{E}\left[\max \right|t\left|\right]=4.22$ with standard deviation 0.28, a 95th percentile of 4.75, and $P\left(\max \right|t|>4.5)\approx 0.15$; for the 5000-sample window, the corresponding figures are 3.86 and 0.03. Two consequences follow, and both are applied throughout this paper. First, a peak anywhere in the range 3.6–4.8 over a 24,000-sample window is not evidence of leakage, since it is the ordinary behavior of the maximum of a noisy statistic; the same-secret control values of $\left|t\right|=4.12$ and $\left|t\right|=4.52$ reported in Section 8.3 are of exactly this kind and are consistent with the null despite the latter marginally exceeding 4.5. Second, a sub-threshold verdict is therefore never rested on the peak alone: the reported criterion is the number of failing sample points together with the absence of growth in N, which is the discriminating evidence.

The ${\chi }^2$ test. The customary figure of ${\chi }^2\approx 20$ at eight degrees of freedom is an uncorrected, single-sample critical value ($p\approx 0.010$) and is the wrong criterion for a 24,000-point sweep. Applying a Bonferroni correction at family-wise $\alpha =0.05$ over 24,000 samples gives a critical value of ${\chi }_8^2=41.0$, and the expected maximum over that many independent samples is 35.2. Against this corrected criterion the protected peak of 36.7 passes, while the unprotected peak of 932 fails by more than two hundred orders of magnitude in p-value. All ${\chi }^2$ statements in this paper are made against the corrected value of 41.0 (and 40.6 for the 20,000-sample unprotected sweep).

7. Results

7.1. Leakage Assessment

The unprotected secret linear map leaks strongly and pervasively. Table 3 summarizes the two runs: a 60-trace-per-class smoke test already exceeds the threshold with a peak $\left|t\right|=14.20$ (847/5000 points failing), and the full 1000-trace-per-class run reaches a peak $\left|t\right|=52.88$ with 2747 of 5000 points exceeding 4.5. A peak t-statistic of 52.9 against a 4.5 bar is enormous: over half of the observation window carries first-order, input-dependent leakage. This is the headline defensive finding—an unprotected $\mathbf{O}·\mathbf{x}$ implementation would fail any leakage-assessment gate outright.

Furthermore, the fixed-versus-fixed test—which isolates secret-dependent leakage by holding the public inputs identical across two distinct secret matrices—is even more emphatic, reaching a peak $\left|t\right|=195.7$ with 12,298 of 20,000 samples failing; an independent ${\chi }^2$ leakage-detection test [25] peaks at 932 (against the multiple-comparison-corrected critical value ${\chi }_8^2=41.0$ for a 24,000-point sweep, Section 6.6; the often-quoted $\approx 20$ is the uncorrected single-sample value), corroborating the t-test. As few as $N=25$ traces per class already drive the peak statistic above 4.5 (Section 8.3), so the traces-to-detection is negligible. The same drift control applied to the protected implementation was also run on the unprotected capture, in order to confirm that the headline figure is not itself inflated by acquisition drift: splitting each unprotected class against itself gives same-secret peaks of $\left|t\right|=9.93$ and $\left|t\right|=12.27$. Drift is therefore present in this capture as well, at a level comparable to the protected implementation’s sequential-capture artifact, but it is smaller than the secret-dependent signal by a factor of about 16, so it does not affect the unprotected verdict. The distinction matters only when the effect size approaches the decision threshold, which is exactly the protected case treated in Section 8.3. Figure 2(left) shows the t-trace: leakage saturates the entire ∼16,242-cycle matrix–vector product and collapses to the noise floor only once the computation ends.

7.2. Correlation Power Analysis

We attack the first row of $\mathbf{O}$ using 1000 random-input traces.

Table 4. Partial-correlation CPA of the first row of $\mathbf{O}$ (1000 random-input traces, the released trace set). “Rank” is the position of the true nibble in the sorted correlation list (1 = exact recovery; random = 8.5).

Nibble j	POI (Sample)	Recovered	True	Rank
0	130	0 × 6	0 × 3	2
1	230	0 × A	0 × A	1
2	330	0 × 1	0 × 1	1
3	430	0 × 8	0 × 8	1
4	530	0 × E	0 × F	4
5	630	0 × 6	0 × 6	1
6	730	0 × 6	0 × D	3
7	830	0 × 4	0 × 4	1
Recovered row		$6\mathrm{A}18\mathrm{E}664$
Ground truth		$3\mathrm{A}18\mathrm{F}6\mathrm{D}4$

reports, per nibble j, the sample index of the point of interest, the recovered value, the ground-truth value, whether the recovery is exactly top-one, and the rank of the true nibble in the correlation ordering. The partial-correlation, points-of-interest distinguisher recovers 5 of the 8 nibbles exactly, with per-nibble true-key ranks $[2,1,1,1,4,1,3,1]$. The mean true-key rank is 1.75/16, far below the random-guessing expectation of 8.5. Taking the product of the per-nibble ranks, the first key-row search space collapses from ${16}^8\approx 4.29\times {10}^9$ to just 24 candidates—an exploitable break under straightforward enumeration (

Table 5. Summary CPA metrics for the first row of $\mathbf{O}$.

Metric	Value
Exact top-1 nibbles	5/8
Per-nibble true-key ranks	$[2,1,1,1,4,1,3,1]$
Mean true-key rank	1.75/16 (random = 8.5)
Row-0 key-space reduction	${16}^8\approx 4.29\times {10}^9\to 24$

and Figure 3).

Additionally, as a control, the naive global-maximum CPA (without partial correlation) recovers only 1/8 nibbles—exactly the multiplicative-identity alias predicted in Section 6.4, where every nibble is reported as one and is “correct” only where the true value is one. This confirms that the confound handling, not raw signal, is what makes the attack work.

Statistical Significance and Dependence on the Particular Test Key

Two questions bear on how far the row-0 figure should be read, and both are answered here from the released data. First, is the reduction beyond chance? Under the null hypothesis of no exploitable leakage the eight per-nibble ranks are independent and uniform on $\{1,\dots ,16\}$, giving an expected mean rank of 8.50 and an expected ${\log }_2$ candidate count of 22.12 bits. The observed mean rank of 1.75 occurs with probability $5\times {10}^{-7}$ under that null, and the observed product of 24 was reached exactly once in $2\times {10}^6$ null draws (an empirical $p\approx 5\times {10}^{-7}$, consistent with the analytic value). The reduction is therefore not a chance artifact of a single favorable key.

Second, how much does the result depend on this particular key? The identity-disambiguation rule of Section 6.4 is by construction key-dependent: it applies precisely to nibbles whose secret value is one, of which this key row contains one, against an expectation of $8/16=0.5$ for a uniformly random row. Disabling the rule entirely changes the ranks to $[2,1,15,1,4,1,3,1]$, i.e., 360 candidates instead of 24 and a mean rank of 3.50 instead of 1.75; this remains far beyond chance ($p\approx 7\times {10}^{-5}$), so the qualitative conclusion is unchanged, but the factor of 15 between the two figures shows that the precise candidate count is sensitive to the key’s value distribution. A single eight-nibble row is moreover one realization of a quantity whose null standard deviation is 3.12 bits, so candidate counts of this kind should be read as order-of-magnitude indicators rather than as constants.

Measured key dependence. Rather than leave this as an estimate, the experiment was performed. Twenty independent, uniformly random secret matrices were captured under an acquisition configuration identical to that of the row-0 set (1000 traces each, 5000-sample window, same clock, gain and trigger), and the same distinguisher—including the identity rule—was applied to each.

Table 6. Key dependence of the row-0 recovery, measured over 20 independent uniformly random secret matrices at 1000 traces each, under the acquisition configuration of Section 6.

Metric	Random Keys (n = 20)	Structured Test Key
Exact top-1 nibbles	3.90/8 (range 1–6)	5/8
Mean true-key rank	$3.21\pm 1.20$ (chance 8.50)	1.75
Residual candidates	median 287 (min 24, max $3.4\times {10}^5$)	24
${\log }_2$ candidates	$8.65\pm 3.48$	4.58

summarizes the outcome.

The attack is confirmed to work on random keys: the mean true-key rank is $3.21\pm 1.20$ against a chance expectation of 8.50, and the median residual search space is 287 candidates from ${16}^8\approx 4.29\times {10}^9$. The effect is therefore a property of the leakage and not of the structured test key.

The structured key is, however, favorable. Its mean rank of 1.75 lies 5.47 standard errors below the random-key mean, and only 3 of the 20 random keys reach the 24-candidate figure, with the median an order of magnitude higher at 287. Two mechanisms contribute. The identity rule applies only to nibbles whose value is one: nine of the twenty random rows contained at least one such nibble, and those rows averaged 887 candidates against 31,838 for rows without one. Beyond that, the per-key spread is intrinsically wide ($\sigma =3.48$ bits), so any single row is a high-variance draw. Accordingly the random-key distribution is reported here as the representative figure, and the 24-candidate row-0 result is presented as a favorable case rather than a typical one.

7.3. Beyond the First Row: Full-Key Argument

The same distinguisher applies in principle to every row of $\mathbf{O}$, while a careful separation is maintained between what was measured and what is extrapolated. Within a single fixed-trigger capture, only the rows that fall inside the aligned, high signal-to-noise portion of the window are recoverable. Row 0 collapses to 24 candidates as reported above; row 1, which lies outside that window in the 5000-sample row-0 capture, yields a mean per-nibble rank of 9.38/16—statistically indistinguishable from the random-guessing expectation of 8.5—and no useful reduction ($9.32\times {10}^6$ candidates). This is an alignment effect, not a difference in leakage: each row executes the same $\mathrm{GF}\left(16\right)$ multiply sequence.

Two distinct quantities bound the full-key cost, and they must not be conflated. They are defined here and used with these meanings throughout.

(a) The measured residual enumeration cost, $2^{374}$. This is a direct measurement over the rows that carry exploitable secret leakage. Of the 78 rows, 39 (the even-indexed rows) were exercised with a non-zero secret in the released fixed-versus-fixed acquisition: that capture used a matrix loader which did not wait for the per-row SimpleSerial acknowledgment, so the odd-indexed rows were computed as zero on the device. The effect is conservative for the leakage-assessment statistics of Section 7 (fewer differing rows can only lower a fixed-versus-fixed statistic), but it leaves the odd rows without exploitable key material in this dataset. Across the 39 valid rows the attack attains a mean per-nibble rank of 3.43/16, recovers 40.4% of nibbles outright (78.8% within the top four) and 126 of 312 nibbles exactly; the product of the measured per-nibble ranks over these rows is $2^{374}$, against $2^{863}$ for the same nibbles under random ranking, and the observed exact-recovery count has probability $1.5\times {10}^{-67}$ under the no-leakage null. (The figure of $2^{2089}$ quoted in the submitted version was an artifact of a points-of-interest cadence fit that converged on a degenerate stride and left 38 rows unscored; it is withdrawn.)

(b) The extrapolated full-matrix cost, ≈$2^{749}$. Extending the measured per-row residual of $9.60\pm 2.97$ bits across all 78 rows gives ≈$2^{749}$, against the nominal ${16}^{624}=2^{2496}$. This is not a measurement of the full matrix: it assumes the 39 valid rows are representative of the whole, and it presupposes a re-acquisition with an acknowledgment-synchronized loader so that every row carries a non-zero secret. That acknowledgment-synchronized campaign has not been performed, and no claim of a recovered MAYO key is made anywhere in this paper. The reduction is substantial—of the order of 1700 bits below the nominal key space on the extrapolated figure—but it is a reduction, not a break. Both quantities, and the per-row detail behind them, are released as data.

Two caveats attach to the full-key figures. First, the firmware test key is generated as ${\mathbf{O}}_{\mathrm{flat}}\left[i\right]=(7i+3)\mathrm{mod}16$, so with $o=8$ columns, the row content repeats with period two ($56\equiv 8\left(\mathrm{mod}16\right)$); rows 0 and 2 are identical by construction and cannot be treated as independent evidence. Second, as noted under (a), only the 39 even-indexed rows carry a non-zero secret in the released capture, so the measured $2^{374}$ is a genuine measurement over those rows while the full-matrix ≈$2^{749}$ is an extrapolation pending a re-acquisition with an acknowledgment-synchronized loader. That the row-0 model transfers to other rows is nonetheless evidenced directly: the 39 valid rows recover at $9.60\pm 2.97$ bits each, far below the random-ranking expectation, so the reduction is not confined to row 0.

8. A First-Order Countermeasure and Its Evaluation

The strong leakage of the unprotected map constitutes a defensive call to action. The proposed countermeasure is designed to provide an efficient, portable and verifiable first-order protection of the MAYO secret linear map, integrating fresh Boolean sharing, temporal share separation and independent per-pass row shuffling. It is structured into three mechanisms, in order to ensure that both the algorithmic and the micro-architectural leakage components are addressed. Furthermore, it is evaluated on the same STM32F303, closing the loop from leakage assessment to measured protection.

8.1. Design: Masking and Shuffling

Because $\mathrm{GF}\left(16\right)$ multiplication is ${\mathbb{F}}_2$-linear in its first argument, additive Boolean masking of the secret matrix distributes over the map: writing $\mathbf{O}={\mathbf{O}}_0\oplus {\mathbf{O}}_1$ with ${\mathbf{O}}_0$ a fresh uniform random matrix drawn per invocation,

$$\mathbf{O}·\mathbf{x}=({\mathbf{O}}_0\oplus {\mathbf{O}}_1)·\mathbf{x}=({\mathbf{O}}_0·\mathbf{x})\oplus ({\mathbf{O}}_1·\mathbf{x}),$$

(4)

so no gadget beyond share-wise matrix–vector products is required. We adopt this construction as the software analogue of the oil-space blinding used in hardware accelerators [24] and reuses the sharing philosophy of the multivariate masking gadgets [12,22,23]. Three implementation choices were made in order to render the masking effective on a Cortex-M4, where naive sharing is known to leak through micro-architectural recombination. These are:

• Temporal share separation. The two share products ${\mathbf{O}}_0·\mathbf{x}$ and ${\mathbf{O}}_1·\mathbf{x}$ are computed in two separate passes, and the shares are recombined only after the measured (trigger-bracketed) region, so no sample manipulates ${\mathbf{O}}_0\left[r\right]\left[j\right]$ and ${\mathbf{O}}_1\left[r\right]\left[j\right]$ back-to-back (which would leak their Hamming distance $\mathrm{HW}\left(\mathbf{O}\right[r\left]\right[j\left]\right)$).
• Row shuffling. Each share pass evaluates the $v=78$ output rows in an independent uniformly random order (two Fisher–Yates permutations from an on-device xorshift32 generator), so any residual per-row leakage is diluted across 78 time slots, and no fixed sample corresponds to a fixed secret row.
• Fresh randomness. Masks and permutations are regenerated every invocation, outside the trigger, so leakage of the mask itself does not enter the measured window.

Overall, masking removes the first-order dependence on $\mathbf{O}$, while shuffling removes the residual, micro-architectural component that pure masking leaves on this core. The necessity of the second step is measured, not assumed: the naive two-share implementation without row shuffling (firmware/mayo_lm_masked.c), assessed under the identical fixed-versus-fixed protocol at 1000 traces per class, still fails the gate decisively at $\max \left|t\right|=17.94$ with 10,799 of 24,000 points exceeding 4.5 (and ${\chi }^2=371$). Boolean sharing alone therefore buys roughly an order of magnitude, i.e., $195.7\to 17.94$. However, it leaves a first-order component an order of magnitude above the decision threshold, and only the addition of independent per-pass row shuffling brings the statistic below it.

8.2. Measured Overhead

We measured the protected and unprotected execution costs directly from the capture board’s cycle counter (trigger-high duration at one sample per clock), which is deterministic across runs (

Table 7. Measured execution cost (cycles under trigger, STM32F303 at 7.37 MHz) and first-order overhead factor.

Implementation	Cycles	Overhead
Unprotected $\mathbf{O}·\mathbf{x}$	16,242	1.00×
Masked (two shares)	35,565	2.19×
Masked + shuffled	36,130	2.22×

). The masked, shuffled map costs 36,130 cycles against 16,242 for the unprotected map—an overhead of 2.22×. Masking alone (two share passes, no shuffle) costs 2.19×, so shuffling adds only ∼1.5%. This is at the low end of reported multivariate first-order costs, i.e., mUOV signing at 3.5× [22] and masked Gaussian elimination at ∼15× on Cortex-M4 [12]. The result is consistent with the fact that blinding a single linear map is cheaper than masking a full solver, and it is comparable to the <30% hardware overhead of oil-space blinding [24].

8.3. Leakage Evaluation

The fixed-versus-fixed TVLA (two distinct secret matrices ${\mathbf{O}}_A,{\mathbf{O}}_B$, identical public-input sequence) is repeated on the protected firmware. A methodological point proved essential: because the protected map’s residual leakage, if any, is small, the assessment is sensitive to slow acquisition drift. Capturing the two classes in sequential blocks yields a peak of $\left|t\right|=9.72$, which a same-secret control—splitting one class against itself, where no secret-dependent leakage can exist—shows to be dominated by slow acquisition drift rather than by leakage. Therefore, we acquire the two classes in short interleaved blocks of 25 traces, so that both classes traverse the same drift trajectory. Under this drift-free acquisition the same-secret control falls to $\left|t\right|=4.12$ and $\left|t\right|=4.52$ for the two classes, establishing the measurement floor of the setup, and the protected map yields

$$\max \left|t\right|=3.62<4.5,0/\mathrm{24,000}\mathrm{points}\mathrm{failing},$$

(5)

a 54× reduction from the unprotected peak of 195.7, with the ${\chi }^2$ leakage test likewise falling from 932 to 36.7, which is below the multiple-comparison-corrected critical value ${\chi }_8^2=41.0$ for this 24,000-point sweep and therefore a pass, whereas the unprotected 932 fails it by more than two hundred orders of magnitude in p-value (Section 6.6). The residual sits below the same-secret drift floor ($\left|t\right|\approx 4.1$–$4.5$), itself consistent with the null band of a windowed maximum, i.e., no secret-dependent leakage is detectable above the measurement noise. Figure 2(right) shows the flat protected t-trace, and Figure 4 overlays the two implementations.

Furthermore, the protected map’s statistic does not grow with trace count, in that: across $N=50$ to 800 traces per class, it stays in the 3.6–4.6 band, which coincides with the null band of the windowed maximum rather than indicating residual leakage (Section 6.6), whereas the unprotected statistic crosses 4.5 by $N=25$ and climbs past 190 (Figure 5). A leaking implementation’s $\left|t\right|$ grows as $\sqrt{N}$; the flat curve is the signature of leakage that has been removed rather than merely attenuated. Each acquisition was repeated, and the two secret matrices and the public-input sequence are fixed by seed, so the assessment is fully reproducible. To quantify run-to-run variability rather than assert it, the block-interleaved capture was partitioned into four disjoint sub-acquisitions of 200 traces per class and each was assessed independently. The resulting peaks are 3.95, 4.18, 4.38 and 5.49 (mean 4.50, standard deviation 0.68), against 3.62 for the pooled 800 traces per class. The spread is what the null behavior of a windowed maximum predicts at reduced trace counts (Section 6.6), and one sub-acquisition exceeds 4.5 for that reason; the pooled estimate is the one to be compared against the gate, and the sub-acquisition spread is reported so that the stability of the verdict can be judged directly.

Masked MAYO subroutines for the Cortex-M4 assessed by TVLA have been reported before [11]. To the authors’ knowledge, this is the first MAYO $\mathrm{GF}\left(16\right)$ secret map protected by masking and shuffling and assessed under a secret-dependent fixed-versus-fixed test. The result is reported against the 4.5 gate with an explicit count of failing sample points (0/24,000), a measured cycle-count overhead, and evidence that masking alone is insufficient on this core. Overall, the experiments highlight the practical trade-off between protection and cost that a constrained device must absorb. The 2.22× cycle penalty is modest against the reported multivariate first-order costs, yet it is not free, in that it roughly doubles the latency of the signing hot path and consumes fresh randomness on every invocation, which is a scarce resource on parts without a hardware entropy source. Furthermore, the row shuffling that proved necessary to cross the 4.5 gate is precisely the component that resists the formal probing-model argument, so the countermeasure trades a measured guarantee for a provable one. A second-order adversary that combines the two share passes is therefore out of scope for a first-order countermeasure, and extending the sharing order and adding temporal jitter constitute the natural next steps (Section 9).

9. Discussion

9.1. Why the First-Order Model Saturates

The three nibbles that are not recovered top-one fail in a characteristic way that identifies the leakage model, rather than measurement noise, as the limiting factor. A fine scan of nibble zero shows that the true value $0\mathrm{x}3$ does peak at the correct point of interest (sample 130, partial correlation 0.544), but a $\mathrm{GF}\left(16\right)$-related competitor $0\mathrm{x}6$ edges it (0.562), a margin of under 0.02. Repeating the acquisition and increasing the trace count leaves the ranking of these near-ties unchanged, which is the signature of a systematic model mismatch: additional traces reduce the variance of an estimator that is converging on the wrong maximum.

This distinction between a model bias and measurement noise can be made quantitative. For each nibble define the competitor gap as the difference between the top-ranked partial correlation and that of the true value, so that a positive gap marks a nibble that is not recovered. Measured at $N=250$, 500, 750 and 1000 traces, the three non-recovered nibbles give gaps of $0.023\to 0.018$ ($j=0$), $0.127\to 0.097$ ($j=4$) and $0.178\to 0.156$ ($j=6$), i.e., reductions of only 12–24% as the trace count quadruples. Nibble $j=2$ carries a larger partial gap ($0.196\to 0.151$) but is nonetheless recovered, because its true value is one and the identity-disambiguation rule fires; it is therefore not a model-limited failure. A noise-limited gap would fall as $N^{-1/2}$ and therefore halve over the same range (nibble $j=1$ is exactly such a case, its gap falling $0.025\to 0.000$ by $N=500$); the recovered nibbles, by contrast, reach a gap of exactly zero and stay there. The observed persistence separates the two failure sources: measurement noise is already subdominant at $N=250$, and what remains is a systematic mismatch between the Hamming-weight model and the true bit-level leakage of a single $\mathrm{GF}\left(16\right)$ multiply. Increasing the trace budget cannot remove it, which is why the upgrades listed below change the model rather than the sample size. This is the expected behavior of a Hamming-weight model applied to a single $\mathrm{GF}\left(16\right)$ multiply inside a linear map: the model is an imperfect fit for the exact bit-level leakage, and products from neighboring rows create spurious peaks. Critically, the true key remains a top-1-to-4 candidate throughout, so the attack still collapses the key-space to an enumerable 24 candidates for the row. Whether the same reduction can be realized on all 78 rows is an alignment question rather than a leakage question (Section 7.3), borne out by the 39 valid rows recovering at $9.60\pm 2.97$ bits each, well below the random-ranking expectation.

The saturation is therefore not a failure of the platform’s leakage—TVLA already established that leakage is overwhelming—but a property of the distinguisher. Three well-understood upgrades would sharpen recovery to a clean top-one per nibble: a profiled/template attack that builds per-value or per-Hamming-weight templates; a stochastic/linear-regression model that fits per-bit leakage weights instead of assuming uniform Hamming weight; and a chained-accumulator model that recovers $\mathbf{O}\left[0\right]\left[0\right]$ first and conditions each subsequent nibble on the already-recovered ones, matching the accumulation order of lincomb. These are the same mechanisms that let the published single-trace profiled attacks reach near-certain recovery; the presented contribution here is to make explicit, on a reproducible non-profiled baseline, exactly where the simple model breaks and why.

9.2. From Assessment to Countermeasure: What Was Measured and What Remains

Overall, the countermeasure of Section 8 realizes, on hardware, the two steps that a defensive study in this space is expected to deliver: a first-order masked (blinded) $\mathrm{GF}\left(16\right)$ map with a measured overhead (2.22×) and an on-device fixed-versus-fixed TVLA below the 4.5 gate ($\left|t\right|=3.62$), rather than a gadget-level probing proof alone. Two design lessons generalize. First, on a Cortex-M4, naive Boolean sharing is not sufficient: it was observed that masking alone leaves a residual, micro-architectural first-order component, and that independent per-pass row shuffling is what suppresses it below the gate—the classic pitfall that has broken nominally first-order-secure masked software, made concrete here. Second, evaluating a near-threshold countermeasure demands drift-free acquisition; a sequential capture would have reported a spurious $\left|t\right|=9.72$ that a same-secret control unmasks as drift.

Finally, three extensions remain, which map directly onto PQ-NEXT’s side-channel/fault mitigation, crypto-agility and benchmarking activities:

• Higher-order security. A second-order adversary can combine the two share passes; extending to $d\ge 2$ shares (with refreshed masks) and adding temporal jitter would target higher-order resistance, at a cost that the multivariate masking literature quantifies [12,22,23].
• Integration into full signing. Here the map is isolated for measurement; folding the shared output into the vinegar addition ${\mathbf{s}}_i={\mathbf{v}}_i+\mathbf{O}{\mathbf{x}}_i$ (so the vinegar acts as a further share) and re-assessing within full mayo_sign is the deployment step.
• Cross-parameter and cross-scheme coverage. Repeat on MAYO-2 ($o=17$, $k=4$ change the map geometry) and extend the same reduced-target methodology to the other embedded multivariate candidates, for which hardware-evaluated masking is likewise absent.

Delivering a masked MAYO $\mathrm{GF}\left(16\right)$ map with measured overhead and on-device leakage evaluation fills the single clearest gap in MAYO implementation security and is directly responsive to the emphasis on physical-attack resistance in the ongoing NIST additional-signatures evaluation.

9.3. Limitations

The detailed recovery figures are reported for the first row of $\mathbf{O}$ within a single capture window. Section 7.3 bounds the full-key enumeration cost by direct measurement over the 39 rows carrying exploitable leakage ($2^{374}$, per-row $9.60\pm 2.97$ bits, 40.4% of nibbles recovered outright) and by extrapolation to the full matrix (≈$2^{749}$). The remaining odd rows were computed as zero on the device by a loader that did not wait for the per-row acknowledgment; a re-acquisition with the acknowledgment-synchronized loader, and a full end-to-end key recovery, have not been performed and are left to full-signing integration. The full-key cost should therefore be read as a measured bound, rather than as a proven break. The fixed test key also repeats with period two across rows, so this dataset cannot establish row-to-row independence. The dependence of the row-0 figure on the choice of key has now been measured directly over 20 random keys (Section 7, Table 6): the attack works on random keys (mean rank 3.21 against chance 8.50), but the structured test key is favorable by 5.47 standard errors, so 24 candidates should be read as a best case and 287 as typical. The reduced target faithfully reproduces the $\mathrm{GF}\left(16\right)$ multiply but not the surrounding key-expansion memory traffic of full signing; this is deliberate, as it isolates the primitive, but it means absolute leakage magnitudes in a full implementation may differ. The countermeasure is evaluated at first order on the isolated map, while second-order security and integration into full mayo_sign (where the vinegar addition supplies a further share) remain future work (Section 9). Finally, the ground-truth matrix is a fixed known value used only for scoring; the attack code operates without it, but a profiled attack would still need a controllable profiling device, as is standard.

10. Conclusions

This work presented a complete and reproducible power side-channel attack-and-defense case study of the MAYO secret linear map on a commodity Cortex-M4 evaluation platform. TVLA established that the unprotected $\mathbf{O}·\mathbf{x}$ operation leaks overwhelmingly, at $\left|t\right|=52.88$ fixed-versus-random and $\left|t\right|=195.7$ fixed-versus-fixed on the secret, corroborated by a ${\chi }^2$ peak of 932. Additionally, a non-profiled partial-correlation CPA that explicitly handles the two confounds of a linear $\mathrm{GF}\left(16\right)$ map recovered $5/8$ first-row nibbles exactly, thus driving the mean true-key rank to $1.75/16$ and collapsing the row search space from ${16}^8$ to 24 candidates, against a measured residual of $2^{374}$ over the 39 rows with exploitable leakage (extrapolating to $\approx 2^{749}$ for the full matrix)—and a nominal $2^{2496}$. Building on this baseline, the proposed first-order countermeasure—a masked and row-shuffled $\mathrm{GF}\left(16\right)$ map—was implemented and evaluated on the same device, realizing a leakage reduction approaching 54×, to $\left|t\right|=3.62<4.5$ with no failing sample point and a statistic flat in trace count, at a measured overhead of roughly 2.22× cycles under a drift-free block-interleaved acquisition. In contrast to the masked MAYO Cortex-M4 subroutines already reported in the literature [11], the proposed approach combines masking with per-pass row shuffling—shown to be necessary, since masking alone still leaks at $\left|t\right|=17.94$—together with a secret-dependent fixed-versus-fixed assessment reported against the 4.5 gate with an explicit count of failing sample points.

The scope of these conclusions should be stated precisely. Every result reported here concerns the isolated secret linear map $\mathbf{O}·\mathbf{x}$, executed as a reduced target because full MAYO signing does not fit the STM32F303’s ∼48 KB SRAM (Section 5). The reduced target reproduces the reference $\mathrm{GF}\left(16\right)$ arithmetic verbatim, so the leakage of that operation is faithful, but it does not reproduce the key-expansion memory traffic, the vinegar sampling, or the surrounding control flow of a complete signing call. A full implementation may therefore leak differently in three respects: additional operations may leak on their own account; the surrounding traffic may raise the algorithmic noise floor and reduce the signal-to-noise ratio of the map itself; and the vinegar addition supplies a further share that may interact with the masking. Accordingly, the quantitative figures reported here—$\left|t\right|=195.7$ unprotected, $\left|t\right|=3.62$ protected, and 2.22× overhead—characterize the isolated primitive and should be read as a lower bound on the attack surface and as an upper bound on the achievable protection of that primitive in isolation, not as measurements of full MAYO signing. Establishing the corresponding figures for full signing requires a larger-SRAM target and is left to future work.

Conducted within the PQ-NEXT project, the presented study supplies concrete, on-hardware implementation-security evidence for a NIST additional-signatures multivariate candidate on a constrained device, thus contributing to the project’s goals of post-quantum algorithm maturity, side-channel and fault hardening, and good-practice demonstrators, while remaining directly relevant to the physical security criteria of the ongoing NIST evaluation. Beyond the immediate cryptographic result, the release of the firmware, capture and analysis code, and raw traces lowers the barrier for independent evaluators and device vendors to reproduce a leakage assessment on their own silicon, which is an important aspect for the certification pathways that post-quantum migration in regulated sectors will require. Future work will focus on three directions, each with a distinct principal obstacle. These are: (i) extending the sharing order beyond first order and adding temporal jitter, in order to address a second-order adversary that combines the two share passes—the difficulty here is not the sharing itself but the randomness budget and the refresh schedule, since a d-share $\mathrm{GF}\left(16\right)$ map needs fresh masks per invocation on a part with no hardware entropy source, and naïve refreshing reintroduces the recombination that the temporal separation was designed to prevent; (ii) integrating the protected map into full mayo_sign, where the vinegar addition supplies a further share—blocked here by memory rather than by cryptography, since full signing needs roughly 144 KB of expanded key against the ∼48 KB available, so the step requires either a larger-SRAM target or a streaming key expansion whose own leakage must then be assessed; and (iii) a per-row acquisition over all 78 rows using an acknowledgment-synchronized matrix loader, so that every row carries a non-zero secret, and the full-matrix cost is measured rather than extrapolated from the 39 valid rows of the present capture—the obstacle is acquisition cost and alignment, as each row needs its own trigger placement and drift-controlled trace budget before the per-row residuals can be multiplied.