This work presents a complete power side-channel evaluation of the MAYO secret linear map on a constrained embedded target, together with a first-order countermeasure evaluated on the same hardware. While MAYO ranks among the most embedded-friendly candidates in the National Institute of Standards and Technology (NIST) additional-signatures call, few countermeasures for it are quantified against an explicit leakage threshold. The unprotected map $\mathbf{O}·{\mathbf{x}}_i$ over $\mathrm{GF}\left(16\right)$ is evaluated against a masked and row-shuffled variant under an identical acquisition procedure. Test Vector Leakage Assessment (TVLA) of the unprotected map peaks at $\left|t\right|=52.88$ fixed-versus-random and at $\left|t\right|=195.7$ under a secret-dependent fixed-versus-fixed test, while a non-profiled Correlation Power Analysis (CPA) resolving the multiplicative-identity alias and temporal row-mixing collapses the first key row from 16⁸ to 24 candidates, with a median of 287 measured across 20 independent random keys. The proposed countermeasure pairs masking with per-pass row shuffling, in order to suppress the micro-architectural residue masking alone leaves; it realizes a leakage reduction approaching 54×, to $\left|t\right|=3.62$ with no failing point out of 24,000, at roughly 2.22× cycles. The evaluation is a laboratory assessment of the isolated map on an STM32F303 (ARM Cortex-M4) measured with a ChipWhisperer-Lite, and does not exercise complete MAYO signing.

This work presents a complete power side-channel evaluation of the MAYO secret linear map on a constrained embedded target, together with a first-order countermeasure evaluated on the same hardware. While MAYO ranks among the most embedded-friendly candidates in the National Institute of Standards and Technology (NIST) additional signatures call, its defensive counterpart remains underdeveloped, as few countermeasures are quantified against an explicit leakage threshold. A two-fold study is realized, where the unprotected map O·xi over GF(16) is evaluated against a masked and row-shuffled variant under an identical acquisition procedure. Test Vector Leakage Assessment (TVLA) of the unprotected map peaks at |t|=53.7 fixed-versus-random and at |t|=195.7 under a secret-dependent fixed-versus-fixed test, while a non-profiled Correlation Power Analysis (CPA) resolving the multiplicative-identity alias and temporal row-mixing recovers 5 of 8 first-row nibbles, thus collapsing the row search space from 168 to 24 candidates. The proposed countermeasure combines masking with per-pass row shuffling, in order to suppress the micro-architectural residue that masking alone leaves. The proposed countermeasure realizes a leakage reduction approaching 54×, to |t|=3.62 with no failing point out of 24,000, at roughly 2.22× cycles. The experimental evaluations were performed in a real-world deployment on an STM32F303 (ARM Cortex-M4) measured with a ChipWhisperer-Lite.

Post-quantum migration moves the security of digital signatures onto their embedded implementations. This work presents a profiled deep-learning side-channel analysis of the secret linear map of MAYO, a multivariate Unbalanced Oil and Vinegar signature in the third round of the NIST additional-signatures process, and a hardware-validated first-order masking countermeasure. A reduced target isolating the secret product Ox on an STM32F303 (Cortex-M4) is assessed under a single budget of 50,000 profiling and 10,000 attack traces. Attacker effort is reported as the exact key rank of one oil vector over the 2312 key space; the usual product-of-ranks proxy understates it by 37 to 80 bits. The best oil vector of a genuine MAYO-1 key is recovered to an exact rank near 261, with 58 of 78 nibbles exact, and the residual uncertainty collapses into a two-dimensional GF(2) coset that a per-bit leakage map explains. Over its whole operation, the proposed masked build keeps profiled and bivariate second-order attacks at random guessing. Leakage assessment nonetheless localises Hamming-weight leaks of eleven nibbles to a memory-bus adjacency and to unmasked key handling, both confirmed with firmware variants. A corrected build shows no detectable first-order leakage of any key nibble, at 2.14× cycles and 1.32× memory.