the same length but different values. Using means and variances of power consumption for our fixed and random sequences, we compute a figure of merit $t$. If $|t| > 4.5$, we reason that we can distinguish between the two populations and that our design is leaking information. The protected AES-GCM design has a 5-stage pipeline and encrypts one 128-bit input block in 205 cycles. This requires 40 bits of randomness per cycle. In ACORN-1, there are ten 1-bit TI-protected AND-gate modules, which consume a total of 20 random re-share, and 10 random refresh bits per state update. In a two-cycle architecture, 15 random bits are required per clock cycle.

**Random Number Generator (RNG)** {#RNG}
---------------------------------

A RNG unit is required on both sides to generate random bits for side-channel protection of AEAD units, a random public message number (NPUB) for AEAD, and TRNs for CSTN-RCSTN. We adopted the ERO TRNG core described in [@petura2016survey], which is capable of generating only 1-bit of random data per over 20,000 clock cycles. In our TI implementations, AES-GCM needs 40 and ACORN 15 bits of random data per cycle. So, we employed a hybrid RNG unit combining the ERO TRNG with a Pseudo Random 