APPARATUS AND METHOD FOR PREVENTING SIDE CHANNEL ATTACK FOR NTRU LPRime ALGORITHM

Abstract

An apparatus and method for preventing side-channel attacks on the NTRU (Nth degree Truncated polynomial Ring Units) LPRime algorithm are provided. A method for preventing side-channel attacks according to one embodiment includes: a step of creating a sequence table containing position index values ​​for each bit value of a bit string, which is secret information to be generated through a decoding algorithm of the NTRU LPRime algorithm; a step of shuffling the sorting order of the position index values ​​for each bit value within the sequence table based on a random number; a step of determining the generation order of each bit value according to the sorting order of the position index values ​​for each bit value within the sequence table; and a step of generating the secret information through the decoding algorithm, wherein the secret information is generated by generating each bit value according to the determined generation order.

Description

Technology Field

[0001] The disclosed embodiments relate to a technology for preventing side-channel attacks. Background Technology

[0002] NIST (National Institute of Standards and Technology) has been conducting a standardization competition for Post-Quantum Cryptography (PQC) technology since 2016, and on January 30, 2019, a total of 26 algorithms, including the NTRU LPRime algorithm, were announced as candidates for Round 2.

[0003] With the inclusion of security against side-channel analysis in the second round selection criteria, a result implemented to be secure against simple power analysis (SPA), the most well-known side-channel analysis, was submitted to NIST. However, even if it is secure against simple power analysis, it still has vulnerabilities to single trace attacks, a powerful side-channel analysis technique that derives secret information using only a single waveform; therefore, it is necessary to design a countermeasure for this. Prior art literature

[0004] Daniel J. Bernstein, et al. "NTRU Prime: round 2 20190330" The problem to be solved

[0005] The disclosed embodiments are intended to provide an apparatus and method for preventing side-channel attacks on the NTRU LPRime algorithm. means of solving the problem

[0006] A side-channel attack prevention method according to one embodiment comprises: a step of generating a sequence table including position index values ​​for each bit value of a bit string, which is secret information to be generated through a decoding algorithm of the NTRU (Nth degree Truncated polynomial Ring Units) LPrime algorithm; a step of shuffling the sorting order of the position index values ​​for each bit value within the sequence table based on a random number; a step of determining the generation order of each bit value according to the sorting order of the position index values ​​for each bit value within the sequence table; and a step of generating the secret information through the decoding algorithm, wherein the secret information is generated by generating each bit value according to the determined generation order.

[0007] The shuffling step comprises an arbitrary number R for the i-th position index value (wherein is an integer such that 1 ≤ i ≤ L-1 as the sorting order, and L is the length of the bit sequence) included in the order table. i (At this time, R i is 0≤R i A step of generating an integer (i); the arbitrary number R i Based on the above, the method may include the step of selecting a j-th position index value (where j is an integer such that 0 ≤ j ≤ i) within the above order table; and the step of swapping the sort order within the above order table of the i-th position index value and the j-th position index value.

[0008] The step of generating the above sequence table may generate a sequence table in which the position index values ​​for each bit value are sorted according to the order of corresponding positions within the bit sequence.

[0009] The above selection step is the following mathematical formula 1

[0010] [Mathematical Formula 1]

[0011] j=R i mod (i+1)

[0012] Based on this, the j-th position index value can be selected.

[0013] A side-channel attack prevention device according to one embodiment includes a memory for storing one or more instructions; and one or more processors for executing the one or more instructions, wherein the one or more processors may perform the steps of: generating a sequence table including position index values ​​for each bit value of a bit string, which is secret information to be generated through a decoding algorithm of the NTRU (Nth degree Truncated polynomial Ring Units) LPrime algorithm; shuffling the sorting order of the position index values ​​for each bit value within the sequence table based on a random number; determining the generation order of each bit value according to the sorting order of the position index values ​​for each bit value within the sequence table; and generating the secret information through the decoding algorithm, wherein the secret information is generated by generating each bit value according to the determined generation order.

[0014] The shuffling step comprises an arbitrary number R for the i-th position index value (wherein is an integer such that 1 ≤ i ≤ L-1 as the sorting order, and L is the length of the bit sequence) included in the order table. i (At this time, R i is 0≤R i A step of generating an integer (i); the arbitrary number R iBased on the above, the method may include the step of selecting a j-th position index value (where j is an integer such that 0 ≤ j ≤ i) within the above order table; and the step of swapping the sort order within the above order table of the i-th position index value and the j-th position index value.

[0015] The step of generating the above sequence table may generate a sequence table in which the position index values ​​for each bit value are sorted according to the order of corresponding positions within the bit sequence.

[0016] The above selection step is the following mathematical formula 1

[0017] [Mathematical Formula 1]

[0018] j=R i mod (i+1)

[0019] Based on this, the j-th position index value can be selected. Effects of the invention

[0020] According to the disclosed embodiments, by increasing the attack complexity of a single waveform attack for obtaining secret information generated through the decoding process of the NTRU LPRime algorithm, it is possible to prevent the acquisition of secret information by a single waveform attack. Brief explanation of the drawing

[0021] FIG. 1 is a block diagram illustrating a computing environment including a computing device according to one embodiment. FIG. 2 is a flowchart of a side-channel attack defense method according to one embodiment. FIG. 3 is a drawing showing a shuffling process according to one embodiment. Figure 4 is a diagram showing the pseudocode of the decapsulation algorithm of the NTRU LPRime algorithm. FIG. 5 is a drawing showing source code implemented for the execution of the decoding algorithm illustrated in FIG. 4. FIG. 6 is a drawing illustrating source code implemented for executing the mask algorithm included in FIG. 5. FIG. 7 is a drawing illustrating the source code of a decoding algorithm modified to apply a side-channel attack defense method according to one embodiment. Specific details for implementing the invention

[0022] Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to facilitate a comprehensive understanding of the methods, apparatus, and / or systems described herein. However, this is merely illustrative and the present invention is not limited thereto.

[0023] In describing the embodiments of the present invention, detailed descriptions of known technologies related to the present invention are omitted if it is determined that such detailed descriptions may unnecessarily obscure the essence of the present invention. Furthermore, the terms described below are defined in consideration of their functions within the present invention, and these may vary depending on the intentions or practices of the user or operator. Therefore, such definitions should be based on the content throughout this specification. Terms used in the detailed description are intended merely to describe the embodiments of the present invention and should not be limiting in any way. Unless explicitly stated otherwise, expressions in the singular form include the meaning of the plural form. In this description, expressions such as "include" or "comprise" are intended to refer to certain characteristics, numbers, steps, actions, elements, parts thereof, or combinations thereof, and should not be interpreted to exclude the existence or possibility of one or more other characteristics, numbers, steps, actions, elements, parts thereof, or combinations thereof other than those described.

[0024] FIG. 1 is a block diagram illustrating a computing environment including a computing device according to one embodiment. In the illustrated embodiment, each component may have different functions and capabilities in addition to those described below, and may include additional components in addition to those described below.

[0025] The illustrated computing environment (110) includes a computing device (12). The computing device (12) may be one or more components included in a device for performing a side-channel attack prevention method according to one embodiment.

[0026] The computing device (12) includes at least one processor (14), a computer-readable storage medium (16), and a communication bus (18). The processor (14) can cause the computing device (12) to operate according to the exemplary embodiment described above. For example, the processor (14) can execute one or more programs stored in the computer-readable storage medium (16). The one or more programs may include one or more computer-executable instructions, and the computer-executable instructions may be configured to cause the computing device (12) to perform operations according to the exemplary embodiment when executed by the processor (14).

[0027] A computer-readable storage medium (16) is configured to store computer-executable instructions or program code, program data and / or other suitable forms of information. A program (20) stored in the computer-readable storage medium (16) includes a set of instructions executable by a processor (14). In one embodiment, the computer-readable storage medium (16) may be memory (volatile memory such as random access memory, non-volatile memory, or a suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash memory devices, or other forms of storage media that are accessed by a computing device (12) and capable of storing desired information, or a suitable combination thereof.

[0028] The communication bus (18) interconnects various other components of the computing device (12), including the processor (14) and the computer-readable storage medium (16).

[0029] The computing device (12) may also include one or more input / output interfaces (22) and one or more network communication interfaces (26) that provide interfaces for one or more input / output devices (24). The input / output interfaces (22) and network communication interfaces (26) are connected to a communication bus (18). The input / output devices (24) may be connected to other components of the computing device (12) through the input / output interfaces (22). An exemplary input / output device (24) may include an input device such as a pointing device (such as a mouse or trackpad), a keyboard, a touch input device (such as a touchpad or touchscreen), a voice or sound input device, various types of sensor devices and / or imaging devices, and / or an output device such as a display device, a printer, a speaker and / or a network card. An exemplary input / output device (24) may be included inside the computing device (12) as a component constituting the computing device (12), or it may be connected to the computing device (12) as a separate device distinct from the computing device (12).

[0030] FIG. 2 is a flowchart of a side-channel attack defense method according to one embodiment.

[0031] The method illustrated in FIG. 2 can be performed, for example, by the computing device (12) illustrated in FIG. 1.

[0032] Referring to FIG. 2, first, the computing device (12) generates a sequence table (210) containing position index values ​​for each bit value of a bit string, which is secret information to be generated through the decoding algorithm (hereinafter, decoding algorithm) of the NTRU (Nth degree Truncated polynomial Ring Units) LPrime algorithm.

[0033] According to one embodiment, when secret information to be generated through a decoding algorithm is a bit sequence of L bits (where L is an integer greater than 1), the position index value of each of the L bit values ​​constituting the bit sequence may mean information indicating the position of each bit value within the bit sequence.

[0034] For example, assuming that secret information is a 4-bit bit sequence r=(r0,r1,r3,r4)∈{0,1}, the position index value of the first bit value of the bit sequence r, 'r0', the position index value of the second bit value, 'r1', the position index value of the third bit value, 'r2', the position index value of the fourth bit value, 'r3', the position index value of the fourth bit value, 'r3', may be '3'. However, the position index values ​​are not necessarily limited to the examples described above, and various values ​​that can be used to identify a specific location within the bit sequence may be used as position index values ​​in addition to the examples described above.

[0035] Meanwhile, according to one embodiment, each position index value included in the order table can be sorted in the order of corresponding positions within the bit sequence. Specifically, assuming that the secret information is a bit sequence r=(r0,r1,r3,r4) as described above, the computing device (12) can generate an order table such as, for example, Table 1 below.

[0036] Order 0 1 2 3 4 Index 0 1 2 3 4

[0037] Specifically, in the order table shown in Table 1, the value in the 'Index' row represents the position index value of each bit value included in the bit sequence r, and the value in the 'Order' row represents the order index value representing the sort order within the order table of each position index value.

[0038] Afterward, the computing device (12) shuffles the sorting order within the order table of each position index value included in the order table based on a random number (220).

[0039] Afterward, the computing device (12) determines the generation order for each bit value of the secret information to be generated through the decoding algorithm according to the sorting order of each position index value in the order table determined through shuffling (230).

[0040] Afterwards, the computing device (12) generates secret information using a decoding algorithm, and generates each bit value of the secret information according to the generation order determined in step 230 (240).

[0041] For example, if the position index values ​​included in the sequence table of Table 1 described above are shuffled through shuffling as in the sequence table shown in Table 2 below, the computing device (12) is r4, r1, r3, r2, The bit values ​​of the secret information can be generated in the order of r0.

[0042] Order 0 1 2 3 4 Index 4 1 3 2 0

[0043] FIG. 3 is a diagram showing a shuffling process according to one embodiment.

[0044] The shuffling process illustrated in Fig. 3 can be performed, for example, in step 220 illustrated in Fig. 2.

[0045] First, the computing device (12) initializes the order index value i, which represents the sort order of each position index value included in the order table, to i=L-1 (310).

[0046] Afterwards, the computing device (12) can randomly determine the number R i (At this time, R i is 0≤R i Generates an integer (320).

[0047] Subsequently, the computing device (12) has a sequence index value i and an arbitrary number Ri Based on this, a position index value is selected where the order index value in the order table is j (where j is an integer such that 0≤j≤i) (330).

[0048] At this time, according to one embodiment, the computing device (12) can determine the order index value j using the following mathematical formula 1.

[0049] [Mathematical Formula 1]

[0050] j=R i mod (i + 1)

[0051] Afterwards, the computing device (12) swaps the sort order within the order table of the i-th position index value and the j-th position index value (340).

[0052] For example, assuming that the order table is identical to Table 1 and i=4 and j=1, the computing device (12) can change the sorting order of the 4th position index value '4' and the 1st position index value '1' within the order table, and accordingly, the order table shown in Table 1 can be changed as shown in Table 3 below.

[0053] Order 0 1 2 3 4 Index 0 4 2 3 1

[0054] Afterwards, the computing device (12) decreases the order index value i by 1 (350) and determines whether i=0 (360).

[0055] At this time, if i > 0, the computing device (12) repeats steps 310 to 360 until i = 0 is satisfied, and if i = 0, shuffling is terminated.

[0056] Figure 4 is a diagram showing the pseudo code of the decapsulation algorithm of the NTRU LPRime algorithm.

[0057] Referring to the pseudocode illustrated in Fig. 4, the process described in lines 5 and 6 of the pseudocode is the process in which the decoding algorithm is executed, and the Right function is by the positive integer τ (Here, q represents a predefined function as a prime number.)

[0058] Meanwhile, FIG. 5 is a diagram showing source code implemented for the execution of the decoding algorithm shown in FIG. 4, and FIG. 6 is a diagram showing source code implemented for the execution of the mask algorithm included in FIG. 5.

[0059] Referring to FIGS. 5 and 6, r=(r0,r1,…,r L-1 Each bit r included in )∈{0,1} i Let -u be the output value generated by using (=r[i]) as the input to the mask algorithm 'int16_negative_mask', and let r' be the L-bit secret information r'= r=(r'0,r'1,…,r' L-1 Each bit value included in )∈{0,1} is r' i =-(-u) is

[0060] Meanwhile, in the example illustrated in FIGS. 5 and 6, the attack location by a single waveform attack is each bit value r' of the secret information r' using a mask algorithm i It is the location that returns, and assuming the power consumption model depends on Hamming weight (HW) information, the amount of power consumed when the median value is x is P = ε·HW(x) + P noise (Here, ε is a constant, P noise is noise. In other words, the intermediate HW value and power consumption exhibit linearity.

[0061] That is, if int16_negative_mask(r[i])=0xffff, then r' i If =1 and int16_negative_mask(r[i])=0x0000, then r' i =0. Therefore, r'i When =1, power consumption proportional to 16, which is the HW value of the median 0xffff, occurs, and r' i Since power consumption proportional to 0, which is the HW value of the median value 0x0000 when =0 occurs, secret information r' can be exposed by a single waveform attack.

[0062] Meanwhile, FIG. 7 is a diagram illustrating the source code of a decoding algorithm modified to apply a side-channel attack defense method according to one embodiment.

[0063] Specifically, the source code illustrated in FIG. 7 is source code modified from the source code illustrated in FIG. 5 so that the creation and shuffling process (710) of the order table is performed.

[0064] According to the source code illustrated in FIG. 7, an int_negative_mask operation process (720) is performed so that bit values ​​of secret information r' corresponding to each position index value are generated according to the sorting order of each position index value in the order table generated through the order table generation and shuffling process (710).

[0065] That is, according to the source code illustrated in FIG. 7, in the int_negative_mask operation process (620), each bit value of the secret information r' is generated independently of each other, so it is possible to determine whether the currently generated bit value is 0 or 1 through a single waveform attack, but it is not possible to determine which position within the bit sequence of r' the currently generated bit value is. Therefore, to determine which position within the bit sequence of r' the currently generated bit value is, an additional attack is required to determine the generation order of each bit value within the bit sequence of r', thus increasing the complexity of the attack.

[0066] Although the present invention has been described in detail above through representative embodiments, those skilled in the art will understand that various modifications can be made to the aforementioned embodiments without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined by the claims set forth below as well as equivalents thereof. Explanation of the symbols

[0067] 10: Computing Environment 12: Computing device 14: Processor 16: Computer-readable storage media 18: Communication bus 20: Program 22: Input / Output Interface 24: Input / Output Devices 26: Network communication interface

Claims

Claim 1 A method for preventing side-channel attacks comprising: a step of generating a sequence table including position index values ​​for each bit value of a bit string, which is secret information to be generated through a decoding algorithm of an NTRU (Nth degree Truncated polynomial Ring Units) LPrime algorithm, wherein the position index values ​​for each bit value indicate the position of each bit value in the bit string; a step of shuffling the sorting order of the position index values ​​for each bit value within the sequence table based on a random number; a step of determining the generation order of each bit value according to the sorting order of the position index values ​​for each bit value within the sequence table; and a step of generating the bit string through the decoding algorithm, wherein the bit string is generated by generating each bit value according to the determined generation order. Claim 2 In claim 1, the shuffling step comprises an arbitrary number R for the i-th position index value (wherein i is an integer such that 1 ≤ i ≤ L-1 as the sorting order, and L is the length of the bit sequence) included in the order table. i (At this time, R i is 0≤R i A step of generating an integer (i); the arbitrary number R i A method for preventing side-channel attacks, comprising: a step of selecting a j-th position index value (wherein j is an integer such that 0 ≤ j ≤ i) within a sequence table based on; and a step of swapping the sort order within the sequence table of the i-th position index value and the j-th position index value. Claim 3 A side-channel attack prevention method according to claim 2, wherein the step of generating the order table comprises generating an order table in which position index values ​​for each bit value are sorted according to the order of corresponding positions within the bit sequence. Claim 4 In claim 2, the selecting step is the following mathematical formula 1 [Mathematical Formula 1] j=R i A side-channel attack prevention method for selecting the j-th position index value based on mod (i+1). Claim 5 A side-channel attack prevention device comprising: a memory storing one or more instructions; and one or more processors executing said one or more instructions, wherein the one or more processors perform the steps of: generating a sequence table including position index values ​​for each bit value of a bit string, which is secret information to be generated through a decoding algorithm of the NTRU (Nth degree Truncated polynomial Ring Units) LPrime algorithm, wherein the position index values ​​for each bit value indicate the position of each bit value in said bit string; shuffling the sorting order of said position index values ​​for each bit value within said sequence table based on a random number; determining the generation order of said bit value according to the sorting order of said position index values ​​for each bit value within said sequence table; and generating said bit string through said decoding algorithm, wherein said bit string is generated by generating said bit value according to said determined generation order. Claim 6 In claim 5, the shuffling step comprises an arbitrary number R for the i-th position index value (wherein i is an integer such that 1 ≤ i ≤ L-1 as the sorting order, and L is the length of the bit sequence) included in the order table. i (At this time, R i is 0≤R i A step of generating an integer (i); the arbitrary number R i A side-channel attack prevention device comprising: a step of selecting a j-th position index value (wherein j is an integer such that 0 ≤ j ≤ i) within a sequence table based on; and a step of swapping the sort order within the sequence table of the i-th position index value and the j-th position index value. Claim 7 In claim 6, the step of generating the order table is a side-channel attack prevention device that generates an order table in which position index values ​​for each bit value are sorted according to the order of corresponding positions within the bit sequence. Claim 8 In claim 6, the selecting step is the following mathematical formula 1 [Mathematical Formula 1] j=R i Side-channel attack prevention device that selects the j-th position index value based on mod (i+1).

Images