Masked Gaussian sampling gets expensive fast; this paper trims FrodoKEM CDT costs with bitslicing for arbitrary orders.

Rejection sampling, the old side-channel workhorse, beats CDT here with fewer masked ANDs for lattice Gaussians (incl. HAWK).

First-order masked ML-DSA keygen/signing for Pavona ACC, reusing masked KMAC and aiming at DPA resistance?

HPCC gives single-cycle masked 3-input multiplies and 2-cycle AES S-boxes in the PINI glitch model.

First-order masking still folds to second-order CPA on masked Kyber768 on Cortex-M4, with leakage models and SNR plots.

First-order masked ML-KEM for Pavona's ACC fits under 22 KB DMEM and costs 2.6x to 3.4x, because side channels insist.

PR adds fully masked ML-KEM decaps/keygen plus masking gadgets for Pavona's crypto coprocessor, with the usual register fuss.

Paper finds a flaw in Changing of the Guards masking, patches it, and gets first-order AES with 20-cycle latency and no fresh randomness.