An iterative based arithmetic mask to boolean mask conversion method and system

Abstract

The application provides an iteration-based arithmetic mask and Boolean mask conversion method and system, relates to the technical field of side channel security protection, and comprises the following steps: obtaining a target arithmetic mask sequence corresponding to an original secret value, wherein the sum of all arithmetic masks in the sequence is equal to the original secret value; taking each arithmetic mask in the target arithmetic mask sequence as a leaf node to construct a complete binary tree; starting from the leftmost leaf node of the complete binary tree, recursively calculating the Boolean mask sequence of each parent node until the calculation of the Boolean mask sequence of the root node is completed; and taking the Boolean mask sequence of the root node as the Boolean mask sequence of the original secret value, wherein the XOR sum of all Boolean masks in the sequence is equal to the original secret value; the application significantly improves the conversion efficiency between the arithmetic mask and the Boolean mask under the premise of ensuring the security of the mask, so that a better balance between performance and security is achieved in the side channel security protection.

Description

Technical Field

[0001] This invention relates to the field of side-channel security protection technology, specifically to an iterative arithmetic mask and Boolean mask conversion method and system. Background Technology

[0002] Lattice-based cryptographic algorithms are vulnerable to side-channel attacks during implementation, and masking techniques are currently recognized as one of the most effective protection methods. By introducing random masks during computation, the correlation between real data and physical information such as power consumption can be hidden, thereby improving the security of the cryptographic implementation. In the masked implementation of lattice cryptography, different operators often require different types of masks, among which the conversion between arithmetic masks and Boolean masks is a common and crucial operation.

[0003] Converting from an arithmetic mask to a Boolean mask typically involves Boolean mask addition, which incurs the largest computational overhead. Existing solutions often employ Ripple-Carry or Kogge-Stone adders to perform this addition. These methods require calculating carry values ​​bit by bit, resulting in numerous additional computational operations and impacting overall conversion efficiency.

[0004] Therefore, existing technologies suffer from high overhead in carry value calculation and low conversion efficiency, which limits the performance of mask protection in practical cryptographic systems. Summary of the Invention

[0005] To address the aforementioned problems, this invention proposes an iterative method and system for converting arithmetic and Boolean masks. This method significantly improves the conversion efficiency between arithmetic and Boolean masks while ensuring mask security, thereby achieving a better balance between performance and security in side-channel security protection.

[0006] According to some embodiments, the present invention adopts the following technical solution: An iterative method for converting arithmetic masks to Boolean masks, comprising: Obtain the target arithmetic mask sequence corresponding to the original secret value, where the modulo sum of all arithmetic masks in the sequence equals the original secret value; A complete binary tree is constructed using each arithmetic mask in the target arithmetic mask sequence as a leaf node. Starting from the leftmost leaf node of the complete binary tree, recursively calculate the Boolean mask sequence of each parent node until the Boolean mask sequence of the root node is calculated; use the Boolean mask sequence of the root node as the Boolean mask sequence of the original secret value, and the XOR sum of all Boolean masks in this sequence is equal to the original secret value. The Boolean mask sequence of the parent node is obtained by performing Boolean-safe addition on the expanded Boolean mask sequences of the two child nodes based on an iterative adder.

[0007] According to some embodiments, the present invention adopts the following technical solution: An iterative arithmetic mask to Boolean mask conversion system, comprising: The acquisition module is configured to: acquire the target arithmetic mask sequence corresponding to the original secret value, wherein the modulo sum of all arithmetic masks in the sequence is equal to the original secret value; The construction module is configured to construct a complete binary tree using each arithmetic mask in the target arithmetic mask sequence as a leaf node. The recursive module is configured to: start from the leftmost leaf node of the complete binary tree, recursively calculate the Boolean mask sequence of each parent node until the calculation of the Boolean mask sequence of the root node is completed; use the Boolean mask sequence of the root node as the Boolean mask sequence of the original secret value, and the XOR sum of all Boolean masks in the sequence is equal to the original secret value. The Boolean mask sequence of the parent node is obtained by performing Boolean-safe addition on the expanded Boolean mask sequences of the two child nodes based on an iterative adder.

[0008] According to some embodiments, the present invention adopts the following technical solution: A computer program product includes a computer program that, when executed by a processor, implements the aforementioned iterative arithmetic mask to Boolean mask conversion method.

[0009] According to some embodiments, the present invention adopts the following technical solution: A non-transitory computer-readable storage medium is provided for storing computer instructions, which, when executed by a processor, implement the aforementioned iterative arithmetic mask to Boolean mask conversion method.

[0010] According to some embodiments, the present invention adopts the following technical solution: An electronic device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to perform an iterative arithmetic mask to Boolean mask conversion method.

[0011] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention organizes the target arithmetic mask sequence corresponding to the original secret value into a complete binary tree structure and recursively calculates the Boolean mask sequence of each parent node from bottom to top. This decomposes the conversion problem from multi-component arithmetic mask to Boolean mask into multiple binary Boolean secure addition operations, effectively reducing the complexity of a single conversion. On this basis, by using an iterative adder to perform Boolean secure addition on the Boolean mask sequences of the two extended child nodes, the high computational overhead caused by bit-by-bit carry-through in traditional schemes is eliminated. This significantly improves the conversion efficiency between arithmetic mask and Boolean mask while ensuring mask security, thus achieving a better balance between performance and security in side-channel security protection. Attached Figure Description

[0012] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0013] Figure 1 This is the complete flowchart of SecA2B in Example 1.

[0014] Figure 2 This is a basic process diagram of iterating SecAdd in Example 1. Detailed Implementation

[0015] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0016] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0017] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0018] Example 1 One embodiment of the present invention provides an iterative arithmetic mask to Boolean mask conversion method, comprising: Step S1: Obtain the target arithmetic mask sequence corresponding to the original secret value, where the modulo sum of all arithmetic masks in the sequence equals the original secret value; Step S2: Construct a complete binary tree using each arithmetic mask in the target arithmetic mask sequence as a leaf node; Furthermore, the construction of the complete binary tree is specifically as follows: The target arithmetic mask sequence is recursively divided into subsequences. Each time, the current sequence is divided into two subsequences until all subsequences contain only one arithmetic mask, thus obtaining a complete binary tree.

[0019] Step S3: Starting from the leftmost leaf node of the complete binary tree, recursively calculate the Boolean mask sequence of each parent node until the Boolean mask sequence of the root node is calculated; use the Boolean mask sequence of the root node as the Boolean mask sequence of the original secret value, and the XOR sum of all Boolean masks in this sequence is equal to the original secret value. The Boolean mask sequence of the parent node is obtained by performing Boolean-safe addition on the expanded Boolean mask sequences of the two child nodes based on an iterative adder.

[0020] Furthermore, the recursive calculation of the Boolean mask sequence of each parent node is performed in post-order traversal order, so that when any parent node is calculated, the Boolean mask sequences of its left and right child nodes have already been calculated.

[0021] Furthermore, the Boolean mask sequence of the leaf node is formed by using the value of its own arithmetic mask as the Boolean mask, resulting in a Boolean mask sequence with only one Boolean mask.

[0022] Furthermore, the expansion is achieved by randomly splitting the Boolean mask sequence of the child nodes back into n Boolean masks.

[0023] Furthermore, the iterative adder is based on the formula The carry operation is eliminated by iteratively performing the following calculations until the termination condition is met. ,Will As a Boolean mask sequence after Boolean secure addition:

[0024]

[0025] Where x and y are the Boolean mask sequences of the two expanded child nodes, respectively. Indicates the number of iterations.

[0026] As an example, the present invention provides an iterative arithmetic mask to Boolean mask conversion method, which significantly improves the conversion efficiency between arithmetic masks and Boolean masks while ensuring mask security, thereby achieving a better balance between performance and security in side-channel security protection. The specific implementation process is described below.

[0027] 1. Technical problem to be solved in this embodiment The conversion from arithmetic mask to Boolean mask usually involves Boolean mask addition, which is the most expensive part of the conversion.

[0028] To calculate two Boolean mask of bits and The existing scheme introduces carry-in values ​​for the addition result. Make ,in

[0029] According to the above formula, for two Adding the bit-Boolean masks requires calculation. Carry value This will result in a huge additional computational overhead.

[0030] To eliminate the extra overhead caused by carry value calculation, this embodiment proposes to optimize the Boolean mask addition process using an iterative adder, and experimental results show that the proposed method improves the algorithm efficiency.

[0031] 2. Technical solution of this embodiment To resist side-channel attacks, in the masked implementation of lattice ciphers, the arithmetic value (i.e., the original secret value) is split into... an arithmetic mask ,Right now ,in The original arithmetic value. All are random numbers; Boolean values ​​will be split into... Boolean mask ,Right now ,in For the original Boolean value, All are random numbers.

[0032] At this point, the arithmetic to Boolean (A2B) conversion, ensuring that the arithmetic value and the Boolean value are equal, can be represented as:

[0033]

[0034] This embodiment uses a recursive approach to solve the A2B problem, including recursively partitioning subsequences to construct a complete binary tree and recursively calculating the Boolean mask sequence for each parent node.

[0035] Specifically, assuming that a solution has now been found to... an arithmetic mask Convert to Boolean mask Algorithm That is, applying this algorithm It can be obtained A Boolean mask that satisfies this The XOR sum of these Boolean masks equals this. The modulo sum of the arithmetic masks is expressed by the formula:

[0036]

[0037] Therefore, now using the original secret value arithmetic mask sequence As input, the arithmetic mask in the sequence can be divided into two equal parts, and the above algorithm can be applied to each part separately. get

[0038] To ensure the security of the intermediate calculation process, an extension step is also required to divide the process into... Boolean mask and Re-expanded to A Boolean submask can be created by dividing each Boolean submask into submasks. Randomly split into and similarly Split into To complete, and thus obtain

[0039] at this time, Includes the former Information of an arithmetic mask Includes the latter Information from an arithmetic mask.

[0040] Now repeat the above process until the original secret value is obtained. Divided into Each part is divided into independent sections, and each section is expanded to contain information about an arithmetic mask. Since each section contains only one arithmetic mask, there is no distinction between arithmetic masks and Boolean masks; they can be directly treated as Boolean masks.

[0041] After completing the above steps, you will obtain... Each independent Boolean submask yields a complete binary tree containing n leaf nodes. To convert this... The individual Boolean masks need to be reassembled by recursively adding them pairwise, i.e., recursively calculating the Boolean mask sequence of each parent node. Since the addends are now Boolean values, arithmetic addition cannot be performed, and Boolean safe addition SecAdd is required.

[0042] Table 1 shows the execution process of the SecA2B algorithm (an arithmetic mask to Boolean mask conversion based on recursion). Figure 1 As shown, the specific steps of SecA2B are as follows: Table 1 SecA2B Algorithm

[0043] Step 1: Put The arithmetic mask is recursively decomposed into Each independent part is a complete binary tree containing n leaf nodes constructed by recursively partitioning subsequences. Step 2: Treat each part as a Boolean mask and perform an Expand step on each part to ensure the safety of the algorithm; Step 3: Recursively check Each Boolean mask is subjected to Boolean secure addition (SecAdd), which is calculated by backtracking and merging the Boolean mask sequence of each parent node.

[0044] Furthermore, some lattice cryptography algorithms employ modulo... The standard format, such as the Kyber and Dilithium algorithms, requires a modulo operation after each step of the algorithm. With the variables constrained, the mask transformation (A2B) algorithm then becomes:

[0045] At this point, the SecA2B algorithm process also needs to be changed accordingly. Specifically, assuming and It is a sensitive variable Given two arithmetic masks, then the modulo... A2B in the following case is That is, it is necessary to judge and The size relationship. If ,but ;if ,but Therefore, A2B conversion usually produces two results, and then it is determined which result is correct.

[0046] Table 2 shows the model The A2B algorithm flow in this case is shown in Table 3, where BitCopyMask is a small tool for analog-to-digital conversion. Table 2 Recursive A2BModq Algorithm

[0047] Table 3 BitCopyMask Algorithm

[0048] To reduce the overhead of Boolean safe addition SecAdd, this embodiment proposes an iterative SecAdd method to eliminate carry operations. Specifically, the method in this embodiment requires iteratively performing a left shift operation on one of the addends. After each left shift operation, zeros are filled into the low bits of the addend to maintain the correct bit length of the number until the addend gradually decreases to zero. At this point, the value of the other addend is the result of the addition.

[0049] Specifically, the iterative adder in this embodiment is based on the formula The equation uses additional logical operations. Converting the original variables from arithmetic types to Boolean types implies an arithmetic relationship between Boolean masks. The above equation is then executed iteratively. Representing the addition formula, Indicates the first The first addend of the next iteration. Indicates the first The second addend in the next iteration, when initialized, has: , Then we have:

[0050] in, , , This represents the number of iterations, when the termination condition is met. At that time, the final result will be obtained. .

[0051] In the above description, To represent the logical AND operation, in order to resist side-channel attacks, this embodiment uses the secure AND (SecAnd) operation in the iterative SecAdd to implement the logical AND operation; Figure 2 The basic process of iterative SecAdd is illustrated. In each iteration of the algorithm, a zero bit is introduced into the operand through a left shift operation. After all iterations are completed, the second addend becomes a binary number with all zeros, while the first addend retains the sum. This iterative method ensures the safety of the addition operation while maintaining the integrity of the Boolean mask. More detailed steps are shown in Table 4. Table 4 Iterative SecAdd Algorithm

[0052] During the iterative process of SecAdd, due to the left shift operation, each iteration involves replacing a valid bit with a zero bit. The presence of these zero bits does not jeopardize the security of sensitive information; therefore, they do not require additional random numbers for protection. In other words, the... The next iteration only requires A random number.

[0053] Based on this idea, this embodiment allocates the random numbers generated by the random number generator to different iteration rounds to make full use of the random numbers generated by the random number generator, thereby reducing the number of times it is called.

[0054] Based on this characteristic, the iterative SecAdd algorithm is further optimized, as shown in Table 5. In this algorithm, the iterative calculation phase only uses the valid bits to complete the conversion between the two mask types, while ignoring the invalid zero bits. During the algorithm initialization process, the ratio of the value bit width to the valueless bit width increases with the increase of the mask bit width. This ratio is also affected by the number of iterations in the optimized version.

[0055] Table 5 Optimized Iterative SecAdd Algorithm

[0056] This embodiment analyzes the number of operations required by the iterative A2B conversion algorithm and compares it with existing A2B conversion algorithms. The comparison methods include: (1) Coron et al.’s recursive A2B conversion algorithm based on Goubin’s theorem; (2) Schneider et al.'s A2B conversion algorithm based on the Kogge-Stone adder; (3) Bronchain et al. introduced a bit-slicing technique to optimize the A2B conversion algorithm.

[0057] First, assume that generating random numbers takes one unit of time, and based on this, estimate the time complexity of the A2B algorithm, let... Indicates having n indivual k The number of operations in the A2B conversion algorithm for bitmasks, then This embodiment presents the number of operations required for different high-order A2B conversion algorithms, as shown in Table 6. The results show that the A2B conversion algorithm based on the iterative SecAdd algorithm in this embodiment has better performance than the previous A2B algorithm, while the A2B conversion algorithm based on the optimized iterative SecAdd algorithm further improves the performance.

[0058] Table 6 Operation counts for different high-order A2B algorithms

[0059] Example 2 One embodiment of the present invention provides an iterative arithmetic mask to Boolean mask conversion system, comprising: The acquisition module is configured to: acquire the target arithmetic mask sequence corresponding to the original secret value, wherein the modulo sum of all arithmetic masks in the sequence is equal to the original secret value; The construction module is configured to construct a complete binary tree using each arithmetic mask in the target arithmetic mask sequence as a leaf node. The recursive module is configured to: start from the leftmost leaf node of the complete binary tree, recursively calculate the Boolean mask sequence of each parent node until the calculation of the Boolean mask sequence of the root node is completed; use the Boolean mask sequence of the root node as the Boolean mask sequence of the original secret value, and the XOR sum of all Boolean masks in the sequence is equal to the original secret value. The Boolean mask sequence of the parent node is obtained by performing Boolean-safe addition on the expanded Boolean mask sequences of the two child nodes based on an iterative adder.

[0060] Example 3 One embodiment of the present invention provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned iterative arithmetic mask to Boolean mask conversion method.

[0061] Example 4 In one embodiment of the present invention, a non-transitory computer-readable storage medium is provided for storing computer instructions, which, when executed by a processor, implement the aforementioned iterative arithmetic mask to Boolean mask conversion method.

[0062] Example 5 One embodiment of the present invention provides an electronic device, including: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the iterative arithmetic mask and Boolean mask conversion method described above.

[0063] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0064] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0065] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A method for converting between arithmetic masks and Boolean masks based on iteration, characterized in that, include: Obtain the target arithmetic mask sequence corresponding to the original secret value, where the modulo sum of all arithmetic masks in the sequence equals the original secret value; A complete binary tree is constructed using each arithmetic mask in the target arithmetic mask sequence as a leaf node. Starting from the leftmost leaf node of the complete binary tree, recursively calculate the Boolean mask sequence of each parent node until the Boolean mask sequence of the root node is calculated; use the Boolean mask sequence of the root node as the Boolean mask sequence of the original secret value, and the XOR sum of all Boolean masks in this sequence is equal to the original secret value. The Boolean mask sequence of the parent node is obtained by performing Boolean-safe addition on the expanded Boolean mask sequences of the two child nodes based on an iterative adder.

2. The method for iterative arithmetic mask to Boolean mask conversion as described in claim 1, characterized in that, The construction of the complete binary tree is as follows: The target arithmetic mask sequence is recursively divided into subsequences. Each time, the current sequence is divided into two subsequences until all subsequences contain only one arithmetic mask, thus obtaining a complete binary tree.

3. The method for iterative arithmetic mask to Boolean mask conversion as described in claim 1, characterized in that, The recursive calculation of the Boolean mask sequence for each parent node is performed in post-order traversal, ensuring that the Boolean mask sequences of both the left and right child nodes have been calculated when any parent node is being calculated.

4. The method for iterative arithmetic mask to Boolean mask conversion as described in claim 1, characterized in that, The Boolean mask sequence of the leaf node is formed by using the value of its own arithmetic mask as the Boolean mask, resulting in a Boolean mask sequence with only one Boolean mask.

5. The method for iterative arithmetic mask to Boolean mask conversion as described in claim 1, characterized in that, The expansion is achieved by randomly splitting the Boolean mask sequence of the child nodes back into n Boolean masks.

6. The method for iterative arithmetic mask to Boolean mask conversion as described in claim 1, characterized in that, The iterative adder is based on the formula The carry operation is eliminated by iteratively performing the following calculations until the termination condition is met. ,Will As a Boolean mask sequence after Boolean secure addition: Where x and y are the Boolean mask sequences of the two expanded child nodes, respectively. Indicates the number of iterations.

7. An iterative arithmetic mask to Boolean mask conversion system, characterized in that, include: The acquisition module is configured to: acquire the target arithmetic mask sequence corresponding to the original secret value, wherein the modulo sum of all arithmetic masks in the sequence is equal to the original secret value; The construction module is configured to construct a complete binary tree using each arithmetic mask in the target arithmetic mask sequence as a leaf node. The recursive module is configured to: start from the leftmost leaf node of the complete binary tree, recursively calculate the Boolean mask sequence of each parent node until the calculation of the Boolean mask sequence of the root node is completed; use the Boolean mask sequence of the root node as the Boolean mask sequence of the original secret value, and the XOR sum of all Boolean masks in the sequence is equal to the original secret value. The Boolean mask sequence of the parent node is obtained by performing Boolean-safe addition on the expanded Boolean mask sequences of the two child nodes based on an iterative adder.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the iterative arithmetic mask and Boolean mask conversion method according to any one of claims 1-6.

9. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium is used to store computer instructions, which, when executed by a processor, implement an iterative arithmetic mask to Boolean mask conversion method as described in any one of claims 1-6.

10. An electronic device, characterized in that, include: The electronic device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to perform an iterative arithmetic mask and Boolean mask conversion method as described in any one of claims 1-6.

Images