A safety protection method

Abstract

This application provides a security protection method, relating to the field of cryptography. The security protection method provided in this application decomposes input data w into a first variable w' and a second variable w'', and adds random masks to the lower-order portions of the first variable w' and the second variable w'', specifically the first lower-order data w0' and the second lower-order data w0''. This ensures that the first lower-order data w0' and the second lower-order data w0'' remain masked throughout the Decompose operation. This means that even if an attacker obtains side-channel information (such as processing time, power consumption mode, etc.), it is still difficult to directly deduce the input data w due to the mask protection, thus significantly reducing the risk of side-channel attacks and effectively improving the security of the Dilithium algorithm.

Description

Technical Field

[0001] This application relates to the field of cryptography, and in particular to a security protection method. Background Technology

[0002] With the widespread adoption of quantum computing technology, traditional public-key cryptography algorithms are facing unprecedented challenges. This is because the security of public-key cryptography is typically based on complex mathematical problems such as large integer factorization and discrete logarithms, which quantum computers can solve exponentially, rendering public-key cryptography unreliable. To address the proliferation of quantum computing, post-quantum cryptography (PQC) has emerged, aiming to develop new encryption algorithms to ensure information security.

[0003] In related technologies, the Dilithium algorithm is commonly used as one of the standards for PQC. This algorithm is a digital signature scheme based on lattice theory and is considered an effective means of resisting quantum attacks.

[0004] However, the decompose operation in the current Dilithium algorithm may expose side-channel information. Side-channel information refers to information leaked during the physical implementation, such as execution time, power consumption, or electromagnetic radiation. The risk of side-channel information leakage during the decompose operation could provide attackers with clues, thereby weakening the security of the Dilithium algorithm. Summary of the Invention

[0005] To address the aforementioned issues, this application provides a security protection method that can protect against side-channel attacks, thereby improving the security of the Dilithium algorithm.

[0006] The embodiments of this application disclose the following technical solutions:

[0007] In a first aspect, this application discloses a security protection method, the method comprising:

[0008] Obtain the first variable w' and the second variable w” of the input data w;

[0009] Based on the first high-order data w1' of the first variable and the second high-order data w1", the first low-order data w0' of the first variable and the second low-order data w0" of the second variable are determined;

[0010] Based on the first high-order data w1' and the second high-order data w1", the final high-order data w1 is determined;

[0011] Add a first mask and a second mask to the first low-order data w0' and the second low-order data w0” respectively to obtain the masked first low-order data w 0m 'and the second least significant bit after the mask w 0m ”;

[0012] According to the first low-order data w after the mask 0m 'and the second least significant bit data w after the mask 0m "Obtain the low-order data w after obtaining the final mask" 0m ;

[0013] Output the final high-order data w1 and the final masked low-order data w 0m The first mask and the second mask.

[0014] Optionally, the method for determining the first high-order data w1' of the first variable and the second high-order data w1" of the second variable includes:

[0015] Determine the high 12 bits of the first variable and the high 12 bits of the second variable;

[0016] By using a lookup table, the first high-order data w1' of the first variable and the second high-order data w1 of the second variable are determined, respectively, corresponding to the high 12 bits of the first variable and the high 12 bits of the second variable.

[0017] Optionally, determining the first low-order data w0' of the first variable and the second low-order data w0' of the second variable based on the first high-order data w1' of the first variable and the second high-order data w1' of the second variable includes:

[0018] The first variable w' is decomposed such that w' = w1' × 2γ2 + w0', where w1' is the first high-order data, w0' is the first low-order data, and γ2 is the target parameter; and the second variable w” is decomposed such that w” = w1” × 2γ2 + w0”, where w1” is the second high-order data, and w0” is the second low-order data.

[0019] Optionally, the first low-order data w after the mask is used... 0m 'and the second least significant bit data w after the mask 0m "Obtain the low-order data w after obtaining the final mask" 0m ,include:

[0020] By passing the first low-order data w behind the mask 0m 'and the second least significant bit data w after the mask 0m "Add them together to obtain the low-order data w of the final mask." 0m.

[0021] Optionally, determining the final high-order data w1 based on the first high-order data w1' and the second high-order data w1' includes:

[0022] The final high-order data w1 is obtained by adding the first high-order data w1' and the second high-order data w1”.

[0023] Optionally, the method further includes:

[0024] According to the low-order data w after the final mask 0m The first mask and the second mask are used to determine the low-order data of the input data.

[0025] Optionally, the first low-order data w after the mask is used... 0m 'and the second least significant bit data w after the mask 0m "Obtain the low-order data w after obtaining the final mask" 0m ,include:

[0026] According to the first low-order data w after the mask 0m 'and the second least significant bit data w after the mask 0m "Determine the low-order data w after correcting the mask" 0m* ;

[0027] When the low-order data w after the correction mask 0m* When the sum of 3γ2, the first mask mask1, and the second mask mask2 is greater than or equal to 3γ2, the low-order data w after the final mask is determined. 0m The low-order data w after the correction mask 0m* The difference between and 4γ2;

[0028] When the low-order data w after the correction mask 0m* When the sum of the first mask mask (mask1) and the second mask mask (mask2) is less than 3γ2 and greater than or equal to the sum of the first mask mask (mask1) and the second mask mask (mask2), the low-order data w after the final mask is determined. 0m The low-order data w after the correction mask 0m* The difference between 2γ2 and 2γ2;

[0029] When the low-order data w after the correction mask 0m* When the sum of γ2, the first mask mask1, and the second mask mask2 is less than γ2, the low-order data w after the final mask is determined. 0m The low-order data w after the correction mask 0m* .

[0030] Optionally, determining the final high-order data w1 based on the first high-order data w1' and the second high-order data w1' includes:

[0031] Based on the first high-order data w1' and the second high-order data w1", determine the corrected high-order data w. 1* ,

[0032] When the low-order data w after the correction mask 0m* When the sum of 3γ2, the first mask mask1, and the second mask mask2 is greater than or equal to 3γ2, the final high-order data w1 is determined to be the corrected high-order data w. 1* and the sum of 2;

[0033] When the low-order data w after the correction mask 0m* When the sum of γ2 and the sum of the first mask mask1 and the second mask mask2 is greater than or equal to γ2 and the sum of the first mask mask1 and the second mask mask2, the final high-order data w1 is determined to be the corrected high-order data w. 1* and the sum of 1;

[0034] When the low-order data w after the correction mask 0m* When the sum of γ2, the first mask mask1, and the second mask mask2 is less than γ2, the final high-order data w1 is determined to be the corrected high-order data w1. * .

[0035] Optionally, the method further includes:

[0036] When the final high-order data w1 is the first target value, the final high-order data w1 is determined to be 0, and the final masked low-order data w 0m The low-order data w after the correction mask 0m* The difference between 1 and 2.

[0037] Compared with the prior art, this application has the following beneficial effects:

[0038] This application provides a security protection method. The method decomposes input data w into a first variable w' and a second variable w'', and adds random masks to the lower-order portions of the first variable w' and the second variable w'', specifically the first low-order data w0' and the second low-order data w0''. This ensures that the first low-order data w0' and the second low-order data w0'' remain masked throughout the Decompose operation. This means that even if an attacker obtains side-channel information (such as processing time, power consumption mode, etc.), it is still difficult to directly deduce the input data w due to the mask protection, thus significantly reducing the risk of side-channel attacks and effectively improving the security of the Dilithium algorithm. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a flowchart of a security protection method provided in an embodiment of this application. Detailed Implementation

[0041] As described above, the Dilithium algorithm is currently commonly used as one of the standards for PQC. This algorithm is a digital signature scheme based on lattice theory and is considered an effective means of resisting quantum attacks.

[0042] However, the decompose operation in the current Dilithium algorithm may expose side-channel information. Side-channel information refers to information leaked during the physical implementation, such as execution time, power consumption, or electromagnetic radiation. The risk of side-channel information leakage during the decompose operation could provide attackers with clues, thereby weakening the security of the Dilithium algorithm.

[0043] The inventors, through research, proposed a security protection method. The security protection method provided in this application decomposes the input data w into a first variable w' and a second variable w”, and adds random masks to the low-order parts of the first variable w' and the second variable w”, namely the first low-order data w0' and the second low-order data w0”. This ensures that the first low-order data w0' and the second low-order data w0” are always in a masked state during the Decompose operation. This means that even if an attacker can obtain side-channel information (such as processing time, power consumption mode, etc.), it is still difficult to directly deduce the input data w because of the mask protection, thereby significantly reducing the risk of side-channel attacks and effectively improving the security of the Dilithium algorithm.

[0044] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0045] See Figure 1 The figure is a flowchart of a security protection method provided in an embodiment of this application. The method includes:

[0046] S101: Obtain the first variable w' and the second variable w of the input data w.

[0047] In the security protection method provided in this application embodiment, the input data w is decomposed into two variables by a pre-operation (i.e., an operation before entering the disassembly operation), namely the first variable w' and the second variable w”, and the input data w = the first variable w' + the second variable w”.

[0048] Understandably, through the decompose operation, even if an attacker obtains one of the variables (the first variable w' or the second variable w”), they cannot directly obtain the complete input data w.

[0049] S102: Determine the first low-order data w0' of the first variable and the second low-order data w0 of the second variable based on the first high-order data w1' of the first variable and the second high-order data w1' of the second variable.

[0050] High-order data refers to the high-order bits (most significant bits) of the input data w, typically representing the larger numerical value. Low-order data refers to the low-order bits (least significant bits) of the input data w, typically representing the smaller numerical value. For example, if the input data w = 11010110 (binary form), it can be split into high-order data: 1101 and low-order data: 0110.

[0051] In some specific implementations, the method for determining the first high-order data w1' of the first variable and the second high-order data w1" of the second variable may include: First, determining the high 12 bits of the first variable and the high 12 bits of the second variable. Second, using a lookup table, determining the first high-order data w1' of the first variable and the second high-order data w1" of the second variable, which correspond to the high 12 bits of the first variable and the high 12 bits of the second variable, respectively. Refer to Table 1, which is a code constant table provided in an embodiment of this application. For example, if the high 12 bits of the first variable w' are 000001011101, then according to Table 1, the first high-order data w1' can be determined to be 1.

[0052] Table 1

[0053] High-level data High 12 bits 0 000000000000 1 000001011101 2 000010111010 3 000100010111 4 000101110100 5 000111010001 6 001000101110 7 001010001011 ... ... 43 111110011111 44 111111111100

[0054] Subsequently, the first variable w' is decomposed such that w' = w1' × 2γ2 + w0', where w1' is the first high-order data, w0' is the first low-order data, and γ2 is the target parameter of the Dilithium algorithm (usually a non-negative integer representing the number of displacements); and the second variable w” is decomposed such that w” = w1” × 2γ2 + w0”, where w1” is the second high-order data, and w0” is the second low-order data.

[0055] Understandably, using a lookup table instead of direct division avoids the risk of information leakage caused by different execution times or power consumption patterns due to different inputs. Furthermore, the lookup table method reduces complex division operations, improving computational efficiency (especially in embedded systems or resource-constrained environments), and it ensures consistent results for each lookup, thus improving computational accuracy.

[0056] S103: Determine the final high-order data w1 based on the first high-order data w1' and the second high-order data w1".

[0057] In some specific implementations, the final high-order data w1 can be determined by adding the first high-order data w1' and the second high-order data w1”. 1＝ w1'+w1".

[0058] It should be noted that high-order data is generally considered relatively secure, with a low risk of leakage during the computation process, and therefore does not require excessive masking protection. Since the first high-order data w1' and the second high-order data w1" are two components obtained by decomposing the high-order part of the original input data w, they can be directly added together to determine the final high-order data w1. This ensures the integrity of the final high-order data w1, and because the first high-order data w1' and the second high-order data w1" themselves are not masked, no additional decoding steps are required.

[0059] S104: Add masks to the first low-order data w0' and the second low-order data w0” respectively to obtain the masked first low-order data w 0m 'and the second least significant bit after the mask w 0m ".

[0060] In some specific implementations, a first mask mask1 can be added to the first least significant bit data w0' to obtain the masked first least significant bit data w. 0m =w0'+mask1, and add a second mask mask2 to the second least significant data w0" to obtain the masked second least significant data w 0m = w0" + mask2. It should be noted that this application does not limit the specific first mask mask1 and second mask mask2.

[0061] It is understandable that by adding randomly generated mask values ​​to the first low-order data w0' and the second low-order data w0”, it can be ensured that the original first low-order data w0' and the second low-order data w0” will not be directly exposed during the entire calculation process, thereby effectively resisting side-channel attacks.

[0062] S105: Based on the first low-order data w after the mask... 0m 'and the second least significant bit data w after the mask 0m "Obtain the low-order data w after obtaining the final mask" 0m .

[0063] In some specific implementations, the first least significant bit of data after the mask can be used as a reference. 0m 'and the second least significant bit after the mask w 0m "Add them together to determine the low-order data w of the final mask." 0m , i.e. w 0m＝ w 0m '+w 0m ".

[0064] It should be noted that, due to the first least significant bit data w after the mask... 0m 'and the second least significant bit after the mask w0m "Each mask (mask1 and mask2) has been added separately, so the low-order data w after the final masking..." 0m It actually contains the sum of these two masks.

[0065] It should also be noted that in practical applications, addition operations may cause the values ​​to exceed the expected range (e.g., exceeding the maximum value specified by the algorithm parameters), therefore, correction rules need to be set. These correction rules are to ensure that even with a mask, the calculation results remain accurate and correctly reflect the characteristics of the original input data w.

[0066] First, based on the first high-order data w1' and the second high-order data w1", determine the corrected high-order data w. 1* And, based on the first low-order data w after the mask 0m 'and the second least significant bit after the mask w 0m "Determine the low-order data w after correcting the mask" 0m* Subsequently, the high-order data w was adjusted and corrected according to different conditions. 1* and the low-order data w after masking 0m* This yields the final high-order data w1 and the final masked low-order data w. 0m .

[0067] In some specific implementations, when the low-order data w after masking is corrected 0m* When the sum of 3γ2, the first mask mask1, and the second mask mask2 is greater than or equal to 3γ2, it means that the low-order data is too large. Therefore, it is necessary to increase the high-order data w to correct it. 1* The final high-order data w1 and the low-order data w after reducing the correction mask are obtained. 0m* The low-order data w after obtaining the final mask 0m For example, the final high-order data w1 can be determined to be the corrected high-order data w. 1* The sum of 2 and 3 determines the low-order data w of the final mask. 0m To correct the low-order data w after masking 0m* The difference between 4γ2 and 4γ2.

[0068] In some other specific implementations, when the low-order data w after masking is corrected... 0m* When the sum of γ2, the first mask mask1, and the second mask mask2 is less than 3γ2 and greater than or equal to the sum of γ2, the first mask mask1, and the second mask mask2, it means that the low-order data is still large but has not reached the maximum threshold. Therefore, it is necessary to moderately increase the correction of the high-order data w. 1* The final high-order data w1 and the low-order data w after appropriately reducing the correction mask are obtained.0m* The low-order data w after obtaining the final mask 0m For example, the final high-order data w1 can be determined to be the corrected high-order data w. 1* The sum of 1 and 1 determines the low-order data w of the final mask. 0m To correct the low-order data w after masking 0m* The difference between 2γ2 and 2γ2.

[0069] In some other specific implementations, when the low-order data w after masking is corrected... 0m* When the sum of γ2, the first mask mask1, and the second mask mask2 is less than γ2, it means that the low-order data is within the normal range, and no additional addition is needed to the high-order data. Therefore, the corrected high-order data w can be used directly. 1* and the low-order data w after masking 0m* As a final result, the final high-order data w1 is determined to be the corrected high-order data w. 1* The final low-order data w after masking 0m To correct the low-order data w after masking 0m * .

[0070] It should be noted that when the final high-order data w1 reaches the preset maximum value, further increases may lead to numerical overflow, affecting the correctness of subsequent calculations. To ensure that the numerical representation remains accurate even after the final high-order data w1 reaches its upper limit, further adjustments are needed to avoid numerical overflow. For example, when the final high-order data w1 reaches the first target value (e.g., 44), an adjustment mechanism can be triggered, such as determining that the final high-order data w1 is 0 (i.e., resetting the final high-order data w1 to 0), and adjusting the final masked low-order data w... 0m Make minor adjustments to compensate for the reset of the higher-order data, such as determining the lower-order data w after the final mask is determined. 0m To correct the low-order data w after masking 0m* The difference between 1 and 0. Understandably, reducing by 1 is to compensate for the impact of resetting the higher-order data from 44 to 0, thus ensuring the continuity and accuracy of the overall value. This method not only protects the security and integrity of the data but also ensures normal operation when the higher-order data approaches or reaches its limit. It is particularly suitable for data processing environments requiring high precision and security, such as encryption algorithms and digital signature verification.

[0071] S106: Output the final high-order data w1 and the final masked low-order data w1. 0m First mask and second mask.

[0072] It should be noted that the low-order data w after the final mask 0mIt is the sum of the final low-order data w0, the first mask mask1, and the second mask mask2, i.e., w 0m = w0 + mask1 + mask2.

[0073] In summary, this application provides a security protection method that decomposes the input data w into a first variable w' and a second variable w'”, and adds random masks to the low-order parts of the first variable w' and the second variable w'”, namely the first low-order data w0' and the second low-order data w0”. This ensures that the first low-order data w0' and the second low-order data w0” are always in a masked state during the Decompose operation. This means that even if an attacker can obtain side-channel information (such as processing time, power consumption mode, etc.), it is still difficult to directly deduce the input data w due to the mask protection, thereby significantly reducing the risk of side-channel attacks and effectively improving the security of the Dilithium algorithm.

[0074] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments. The device and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components indicated as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0075] The above description is merely one specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A security protection method, characterized in that, The method includes: Obtain the first variable w' and the second variable w” of the input data w; Based on the first high-order data w1' of the first variable and the second high-order data w1", the first low-order data w0' of the first variable and the second low-order data w0" of the second variable are determined; Based on the first high-order data w1' and the second high-order data w1", the final high-order data w1 is determined; Add a first mask and a second mask to the first low-order data w0' and the second low-order data w0” respectively to obtain the masked first low-order data w 0m 'and the second least significant bit after the mask w 0m ”; According to the first low-order data w after the mask 0m 'and the second least significant bit data w after the mask 0m "Obtain the low-order data w after obtaining the final mask" 0m ; Output the final high-order data w1 and the final masked low-order data w 0m The first mask and the second mask.

2. The method according to claim 1, characterized in that, The method for determining the first high-order data w1' of the first variable and the second high-order data w1" of the second variable includes: Determine the high 12 bits of the first variable and the high 12 bits of the second variable; By using a lookup table, the first high-order data w1' of the first variable and the second high-order data w1 of the second variable are determined, respectively, corresponding to the high 12 bits of the first variable and the high 12 bits of the second variable.

3. The method according to claim 2, characterized in that, The step of determining the first low-order data w0' of the first variable and the second low-order data w0' of the second variable based on the first high-order data w1' of the first variable and the second high-order data w1' of the second variable includes: The first variable w' is decomposed such that w' = w1' × 2γ2 + w0', where w1' is the first high-order data, w0' is the first low-order data, and γ2 is the target parameter; and the second variable w” is decomposed such that w” = w1” × 2γ2 + w0”, where w1” is the second high-order data, and w0” is the second low-order data.

4. The method according to claim 1, characterized in that, The first low-order data w after the mask 0m 'and the second least significant bit data w after the mask 0m "Obtain the low-order data w after obtaining the final mask" 0m ,include: By passing the first low-order data w behind the mask 0m 'and the second least significant bit data w after the mask 0m "Add them together to obtain the low-order data w of the final mask." 0m .

5. The method according to claim 1, characterized in that, The step of determining the final high-order data w1 based on the first high-order data w1' and the second high-order data w1' includes: The final high-order data w1 is obtained by adding the first high-order data w1' and the second high-order data w1”.

6. The method according to claim 1, characterized in that, The method further includes: According to the low-order data w after the final mask 0m The first mask and the second mask are used to determine the low-order data of the input data.

7. The method according to claim 1, characterized in that, The first low-order data w after the mask 0m 'and the second least significant bit data w after the mask 0m "Obtain the low-order data w after obtaining the final mask" 0m ,include: According to the first low-order data w after the mask 0m 'and the second least significant bit data w after the mask 0m "Determine the low-order data w after correcting the mask" 0m* ; When the low-order data w after the correction mask 0m* When the sum of 3γ2, the first mask mask1, and the second mask mask2 is greater than or equal to 3γ2, the low-order data w after the final mask is determined. 0m The low-order data w after the correction mask 0m* The difference between and 4γ2; When the low-order data w after the correction mask 0m* When the sum of the first mask mask (mask1) and the second mask mask (mask2) is less than 3γ2 and greater than or equal to the sum of the first mask mask (mask1) and the second mask mask (mask2), the low-order data w after the final mask is determined. 0m The low-order data w after the correction mask 0m* The difference between 2γ2 and 2γ2; When the low-order data w after the correction mask 0m* When the sum of γ2, the first mask mask1, and the second mask mask2 is less than γ2, the low-order data w after the final mask is determined. 0m The low-order data w after the correction mask 0m* .

8. The method according to claim 7, characterized in that, The step of determining the final high-order data w1 based on the first high-order data w1' and the second high-order data w1' includes: Based on the first high-order data w1' and the second high-order data w1", determine the corrected high-order data w. 1* , When the low-order data w after the correction mask 0m* When the sum of 3γ2, the first mask mask1, and the second mask mask2 is greater than or equal to 3γ2, the final high-order data w1 is determined to be the corrected high-order data w. 1* and the sum of 2; When the low-order data w after the correction mask 0m* When the sum of γ2 and the sum of the first mask mask1 and the second mask mask2 is greater than or equal to γ2 and the sum of the first mask mask1 and the second mask mask2, the final high-order data w1 is determined to be the corrected high-order data w. 1* and the sum of 1; When the low-order data w after the correction mask 0m* When the sum of γ2, the first mask mask1, and the second mask mask2 is less than γ2, the final high-order data w1 is determined to be the corrected high-order data w1. * .

9. The method according to claim 8, characterized in that, The method further includes: When the final high-order data w1 is the first target value, the final high-order data w1 is determined to be 0, and the final masked low-order data w 0m The low-order data w after the correction mask 0m* The difference between 1 and 2.

Images