Sampling method and apparatus for responding to side-channel attacks

Abstract

The present invention relates to a sampling apparatus and method robust against side-channel attacks, the method comprising the steps of: (a) receiving a random bit; (b) setting an iteration loop index i to 0 and determining whether the random bit is greater than or equal to NRCDT[i]; (c) if the random bit is greater than or equal to NRCDT[i], an adjustment value in an i-th iteration loop is set to 1, and if the random bit is smaller than NRCDT[i], the adjustment value in the iteration loop is set to 0; (d) updating a random integer by subtracting the adjustment value from 18; and (e) repeating steps (b) to (d) while increasing i by 1 until i reaches 17, thereby obtaining a finally updated random integer, wherein NRCDT[i] has a value obtained by bit-inverting RCDT[i] of a base sampler.

Description

Sampling method and device for responding to side-channel attacks

[0001] The present invention relates to a sampling method and apparatus, and more specifically, to a sampling method and apparatus for responding to side-channel attacks.

[0002]

[0003] As a sampling method and device for neutralizing side-channel attacks on cryptographic protocols, there is the base sampling method and device of FALCON, which was selected as a NIST Post-Quantum Cryptography (PQC) standardization technology. FALCON uses a base sampling method as a signature technique designed based on the GPV framework, and the base sampling method of FALCON is implemented such that the random integers generated by sampling have a Half Discrete Gaussian Distribution.

[0004] However, FALCON's base sampling method had a vulnerability to side-channel attacks to the extent that it could estimate random integer values ​​output from Simple Power Analysis (SPA) attacks.

[0005]

[0006] The present invention proposes a sampling device and method that are robust against side-channel attacks while providing the same output as the sampling device of FALCON.

[0007]

[0008] According to one aspect of the present invention, a step of receiving a random bit (a); a step of setting a loop index i=0 and determining whether the random bit is greater than or equal to NRCDT[i] (b); and if the random bit is greater than or equal to NRCDT[i], a control value z in the i-th loop. i Set to 1, and if the random bit is smaller than NRCDT[i], z is the adjustment value in the i-th iteration loop. iA sampling method robust to side-channel attacks is provided, comprising the steps of: setting zi to 0 (c); updating a random integer by subtracting zi from 18 (d); and repeating steps (b) through (d) while increasing i by 1 until i reaches 17 to obtain a final updated random integer (e), wherein NRCDT[i] is a bit-inverted value of the RCDT[i] of the base sampler.

[0009] The above NRCDT[i] is obtained as shown in the following mathematical formula.

[0010] NRCTD[i] L =2 N+23 - RCTD[i] L -1

[0011] NRCTD[i] M =2 N+23 -RCTD[i] M -1

[0012] NRCTD[i] R =2 N+23 -RCTD[i] R -1

[0013] In the mathematical formula above, RCTD[i] L is the left bit of the bits of RCTD[i] divided into 3 parts, and RCTD[i] M is mid-beat, and RCTD[i] R is a light beat, and NRCTD[i] L is the left bit of the bits of NRCTD[i] divided into 3 parts, and NRCTD[i] M = is the mid beat, and NRCTD[i] R is a light bit, and N is a preset integer.

[0014]

[0015] N bit flips occur during the operation of step (b) above.

[0016] The above step (b) includes: a step of dividing the random bit into three parts; a step of calculating a first cc bit using the value obtained by adding the left bit of the divided random bit and the left bit of NRCDT[i] and then performing a 24-bit shift operation; a step of calculating a second cc bit using the value obtained by adding the mid bit of the divided random bit, the mid bit of NRCDT[i] and the first cc bit and then performing a 24-bit shift operation; and a step of calculating a third cc bit using the value obtained by adding the right bit of the divided random bit, the right bit of NRCDT[i] and the second cc bit and then performing a 24-bit shift operation.

[0017] The above step (c) is the value of the third cc bit z i Set to.

[0018] The above first cc bit is calculated as follows:

[0019] cc1= (v0+w0) >>24

[0020] In the above mathematical formula, cc1 is the first cc bit, v0 is the left bit of the divided random bit, and w0 is the left bit of NRCDT[i].

[0021] The above second cc bit is calculated as follows:

[0022] cc2= (v1+w1+ cc1) >>24

[0023] In the above mathematical formula, cc2 is the second cc bit, v1 is the mid bit of the divided random bit, and w1 is the mid bit of NRCDT[i].

[0024] The above third cc bit is calculated as follows:

[0025] cc3= (v2+w2+ cc2) >>24

[0026] In the above mathematical formula, cc3 is the 3rd cc bit, v2 is the write bit of the divided random bit, and w2 is the write bit of NRCDT[i].

[0027] According to another aspect of the present invention, the processor comprises: a memory connected to the processor, wherein the processor receives a random bit (a); sets a loop index i=0 and determines whether the random bit is greater than or equal to NRCDT[i] (b);

[0028] If the random bit is greater than or equal to NRCDT[i], the adjustment value z in the i-th iteration loop i Set to 1, and if the random bit is smaller than NRCDT[i], z is the adjustment value in the i-th iteration loop. i A step (c) of setting zi to 0; a step (d) of updating a random integer by subtracting zi from 18; and a step (e) of obtaining a final updated random integer by repeating steps (b) through (d) while increasing i by 1 until i reaches 17, wherein a sampling device robust against side-channel attacks is provided in which NRCDT[i] has a bit-inverted value of the RCDT[i] of the base sampler.

[0029]

[0030] According to the sampling device and method of the present invention, there is an advantage of being robust against side-channel attacks while providing the same output as the sampling device of FALCON.

[0031]

[0032] Figure 1 is pseudocode showing the operation algorithm of a conventional FALCON base sampler.

[0033] Figure 2 is a diagram showing an example of an RCDT used in a Falcon base sampler.

[0034] FIG. 3 is a diagram showing an example of the NRCDT proposed in the present invention.

[0035] FIG. 4 is a flowchart showing the overall flow of a sampling method according to an embodiment of the present invention.

[0036] Figure 5 is a diagram showing the pseudocode of the flowchart illustrated in Figure 4.

[0037] FIG. 6 is a flowchart showing a specific process of setting an adjustment value by comparing the size of a random bit and NRCDT[i].

[0038] Figure 7 is a diagram showing the pseudocode of the flowchart illustrated in Figure 6.

[0039]

[0040] In order to fully understand the present invention, the operational advantages of the present invention, and the objectives achieved by the implementation of the present invention, reference must be made to the accompanying drawings illustrating preferred embodiments of the present invention and the contents described in the accompanying drawings.

[0041] The present invention will be described in detail below by explaining preferred embodiments with reference to the attached drawings. However, the present invention may be implemented in various different forms and is not limited to the embodiments described. Furthermore, to clearly explain the present invention, parts unrelated to the description are omitted, and the same reference numerals in the drawings indicate the same components.

[0042] Throughout the specification, when a part is described as “comprising” a certain component, this means that, unless specifically stated otherwise, it does not exclude other components but may include additional components. Furthermore, terms such as “...part,” “...unit,” “module,” and “block” as used in the specification refer to a unit that processes at least one function or operation, and this may be implemented in hardware, software, or a combination of hardware and software.

[0043] The sampling method and device of the present invention basically provide the same output as the Base Sampler of FALCON, have a Harv discrete Gaussian distribution, and are designed to be robust against side-channel attacks.

[0044] In cryptographic protocols, sampling refers to receiving input bits and outputting a random integer value. Sampling is performed to apply a random integer value to the ciphertext, and the random integer value output by sampling must be unpredictable. Before explaining the contents of the present invention, the sampling method of the conventional FALCON base sampler is described.

[0045] Figure 1 is pseudocode showing the operation algorithm of a conventional FALCON base sampler.

[0046] The FALCON base sampler takes 72 bits of random input and outputs a random integer. The FALCON base sampler is configured to output an integer between 0 and 18. The base sampler runs a total of 18 for loops, and a modulation value is calculated in each loop.

[0047] The adjustment value is determined by whether the input bit is smaller than the value of RCDT[i]. If the input bit is larger than the value of RCDT[i], it is determined to be true and the adjustment value is set to 1; if the input bit is smaller than the value of RCDT[i], it is determined to be false and the adjustment value is set to 0. Here, i is an index representing the number of iterations of the for loop, and bits are stored in the RCDT (Random Cumulative Distribution Table) for each i. Since the for loop is repeated 18 times, 18 bit values ​​are stored in the RCDT, and for each loop, the bit value of the corresponding RCDT is compared with the input bit to set the adjustment value.

[0048] The final output of FALCON is determined by accumulating the adjustment values ​​output from each loop starting from 0.

[0049] If the modulation value is 1 in all loops, the bass sampler outputs 18. If the modulation value is 0 in all loops, the bass sampler outputs 0.

[0050] Figure 2 is a diagram showing an example of an RCDT used in Falcon's base sampler.

[0051] Referring to FIG. 2, the RCDT used in the base sampler consists of a total of 18 numbers, and in the example shown in FIG. 2, each line is a number of RCDTs. In the base sampler, the number of RCDTs is predetermined based on the variance of a half-discrete Gaussian distribution, and the predetermined number of RCDTs and the input bit are compared during the sampling process to determine whether it is true or false.

[0052] However, the Falcon base sampler described above had a vulnerability to side-channel SPA attacks. The base sampler's RCDT[i] has a size of 72 bits, and the input bits also have a size of 72 bits.

[0053] Since the current CPU registers are 32-bit, the comparison between the input bit and RCDT[i] is performed by dividing the input bit and RCDT[i] into 24-bit units. That is, the 72-bit input bit and RCDT[i] are each divided into three 24-bit units, and then the size comparison is performed.

[0054] In this state, when a subtraction operation is performed to compare RCDT[i] with the input bit, the upper bits set to 0 in the 32-bit register are switched to 1, resulting in at least 8 bit flips.

[0055] In Falcon's base sampler, such large-scale bit flips cause significant power fluctuations, making it inevitably vulnerable to SPA attacks that detect these large changes. Through SPA attacks, adjustment values ​​can be estimated in each iteration loop, which in turn makes it possible to predict the base sampler's final output value.

[0056] The present invention proposes a sampling device and a sampling method robust against SPA attacks on such side channels.

[0057] The sampling method of the present invention may be performed in a computing device including a processor and memory, and the sampling device of the present invention may be a computing device including a processor and memory.

[0058] The present invention uses NRCDT[i], which is a modified version of RCDT[i] of a base sampler, and NRCDT[i] has a bit-inverted value of RCTD[i].

[0059] Specifically, NRCDT[i] is obtained by modifying RCDT[i] as shown in the following mathematical formula 1.

[0060] [Mathematical Formula 1]

[0061] NRCTD[i] L =2 N+23 - RCTD[i] L -1

[0062] NRCTD[i] M =2 N+23 -RCTD[i] M -1

[0063] NRCTD[i] R =2 N+23 -RCTD[i] R -1

[0064] In the mathematical formula above, RCTD[i] L is the left bit of the bits of RCTD[i] divided into 3 parts, and RCTD[i] M is mid-beat, and RCTD[i] R is a light beat, and NRCTD[i] L is the left bit of the bits of NRCTD[i] divided into 3 parts, and NRCTD[i] M = is the mid beat, and NRCTD[i] R is a light bit, and N is a preset integer.

[0065] N is the number of bits flipped during the sampling process of the sampling method and device of the present invention. For example, if a user wants to set the number of bits flipped during the sampling process to 1, N=1 is set to obtain NRCDT[i] from RCDT[i].

[0066] The structure that uses NRCDT[i] by modifying RCDT[i] as in Equation 1 is the core structure of the present invention, and enables the number of flip bits generated during the sampling process to be minimized through NRCDT and the sampling algorithm of the present invention described below.

[0067] Figure 3 is a diagram showing an example of the NRCDT proposed in the present invention.

[0068] Referring to Fig. 3, there are a total of 18 NRCDTs, and each NRCDT[i] has 72 bits. Accordingly, for computation, NRCDT[i] is also divided into 3 parts (NRCDT[i] L , NRCDT[i] M , NRCDT[i] R It is distinguished by ). In this embodiment, NRCDT[i] L Define as the left bit, and NRCDT[i] M Defined as the mid-beat, NRCDT[i] R Defines as a light bit.

[0069] FIG. 4 is a flowchart showing the overall flow of a sampling method according to one embodiment of the present invention.

[0070] First, a random bit is input (step 400). The random bit (u) is a bit with a size of 72 bits.

[0071] When a random bit is input, index i for the iteration operation is set to 0 (step 410).

[0072] Determine whether random bit u is greater than or equal to NRCDT[i] (step 420). If random bit u is greater than NRCDT[i], it is determined to be true, and if it is less than NRCDT[i], it is determined to be false.

[0073] Adjustment value z based on the judgment result in Step 420 i Set the value (430). If true, adjust value z i is set to 1, and if false, the adjustment value z i is set to 0.

[0074] When the adjustment value is set, the random integer m, which is the sampler's output, is 18-z i Update to (step 440). The random integer is initially set to 18, but is set to be less than 18 depending on the adjustment value in each loop. In the first iteration loop where i=0, if the adjustment value in step 430 is 1, the random integer m is updated to 17.

[0075] It is determined whether i=17 (step 450).

[0076] If I is not 17, increment the iteration index i by 1 (step 460). With i incremented by 1, steps 420 through 440 are repeated to update the random integer m.

[0077] When i=17, terminate the iteration and output the updated random integer at i=17 as the final random integer (step 470).

[0078] Unlike the conventional Falcon sampler, the present invention constructs NRCDT[i] by modifying RCDT[i] and updates random bits through an operation that determines whether the input random bit u is greater than NRCDT[i]. Through this method, the number of bits flipped is limited to a value pre-set by the user, thereby preventing the prediction of random integers caused by SPA.

[0079] Figure 5 is a diagram showing the pseudocode of the flowchart illustrated in Figure 4.

[0080] Figure 6 is a flowchart showing a specific process of setting an adjustment value by comparing the size of a random bit and NRCDT[i].

[0081] The flowchart illustrated in FIG. 6 is a flowchart showing a specific method for setting adjustment values ​​by comparing the sizes of u and NRCDT[i] in steps 420 and 430 of the flowchart in FIG. 4.

[0082] Referring to FIG. 6, the input random bit u is divided into three sub-bits (step 600). The input random bit is divided into a left bit, a mid bit, and a right bit, and the 72-bit random bit is divided into 24 bits each. In the divided random bit, the left bit is defined as v0, the mid bit as v1, and the right bit as v2. Additionally, the bits of NRCDT[i] are already divided and stored, and the left bit of NRCDT[i] is defined as w0, the mid bit of NRCDT[i] as w1, and the right bit of NRCDT[i] as w2.

[0083] When the input random bit is divided, the first cc (carry chain) bit, cc1, is operated on (step 610). The first cc bit is the value obtained by adding the left bit of the divided random bit and the left bit of NRCDT[i] and then performing a 24-bit shift operation. At this time, the left bit of the random bit and the left bit of NRCDT[i] are binary numbers.

[0084] The method of performing an operation on the first cc bit (cc1) can be expressed mathematically as shown in the following mathematical formula 2. The first cc bit has a value of 0 or 1.

[0085] [Mathematical Formula 2]

[0086] cc1= (v0+w0) >>24

[0087] When the first cc bit is calculated, the second cc bit (cc2) is calculated. The second cc bit is the value obtained by summing the mid bit of the divided random bit, the mid bit of NRCDT[i], and the first cc bit, followed by a 24-bit shift operation. The second cc bit also has a value of 0 or 1. The method of calculating the second cc bit can be expressed mathematically as Equation 3 below.

[0088] [Mathematical Formula 3]

[0089] cc2= (v1+w1+ cc1) >>24

[0090] When the second cc bit is calculated, the third cc bit (cc3) is calculated. The third cc bit is the value obtained by summing the write bit of the divided random bit, the write bit of NRCDT[i], and the second cc bit, followed by a 24-bit shift operation. The third cc bit also has a value of 0 or 1. The method of calculating the third cc bit can be expressed mathematically as Equation 4 below.

[0091] [Mathematical Formula 4]

[0092] cc3= (v2+w2+ cc2) >>24

[0093] When the third cc bit is calculated through mathematical formulas 2 to 4, the third cc bit is the adjustment value calculated in each iteration loop of FIG. 4. That is, cc3=z i It is.

[0094] The third cc bit, calculated through the above mathematical formulas 1 to 3, is the value that determines whether the random bit u is greater than or equal to NRCDT[i] in each iteration loop i. If the third cc bit is 1, the random bit u is greater than or equal to NRCDT[i], and if the third cc bit is 0, the random bit u is smaller than NRCDT[i].

[0095] FIG. 7 is a diagram showing the pseudocode of the flowchart illustrated in FIG. 6. FIG. 7 presents the process of operating the first to third cc bits in C language code.

[0096] The sampling method and apparatus of the present invention described above do not perform subtraction operations during the comparison process between random bits and NRCDT[i], so the number of flipped bits is significantly smaller than that of the base sampler of Falcon, and since it is possible to set the number of flipped bits to 1, it is possible to provide the same output as the base sampler while being robust against SPA attacks on the subchannel.

[0097] The present invention has been described with reference to the embodiments illustrated in the drawings, but this is merely illustrative, and those skilled in the art will understand that various modifications and equivalent alternative embodiments are possible therefrom.

[0098] Therefore, the true scope of technical protection of the present invention should be determined by the technical concept of the appended claims.

Claims

1. Step of receiving a random bit (a); Step (b) of setting the loop index i=0 and determining whether the random bit is greater than or equal to NRCDT[i]; If the random bit is greater than or equal to NRCDT[i], the adjustment value z in the i-th iteration loop i Set to 1, and if the random bit is smaller than NRCDT[i], z is the adjustment value in the i-th iteration loop. i Step of setting to 0 (c); Step (d) of updating a random integer by subtracting the above zi from 18; and The method includes a step (e) of obtaining a final updated random integer by repeating steps (b) through (d) while increasing i by 1 until i reaches 17, wherein The above NRCDT[i] is a sampling method robust to side-channel attacks, having a bit-inverted value of the base sampler's RCDT[i].

2. In Paragraph 1, The above NRCDT[i] is a sampling method robust to side-channel attacks obtained as shown in the following mathematical formula. NRCTD[i] L =2 N+23 - RCTD[i] L -1 NRCTD[i] M =2 N+23 -RCTD[i] M -1 NRCTD[i] R =2 N+23 -RCTD[i] R -1 In the mathematical formula above, RCTD[i] L is the left bit of the bits of RCTD[i] divided into 3 parts, and RCTD[i] M is mid-beat, and RCTD[i] R is a light beat, and NRCTD[i] L is the left bit of the bits of NRCTD[i] divided into 3 parts, and NRCTD[i] M = is the mid beat, and NRCTD[i] R is a light bit, and N is a preset integer.

3. In Paragraph 2, A sampling method robust to side-channel attacks in which N bit flips occur during the operation of step (b) above.

4. In Paragraph 2, The above step (b) is, A step of dividing the above random bit into three parts; A step of calculating the first cc bit using the value obtained by adding the left bit of the divided random and the left bit of NRCDT[i] and then performing a 24-bit shift operation; A step of calculating a second cc bit using the value obtained by adding the mid bit of the divided random bit, the mid bit of NRCDT[i], and the first cc bit, followed by a 24-bit shift operation; A sampling method robust to side-channel attacks comprising the step of calculating a third cc bit using the value obtained by adding the write bit of a divided random bit, the write bit of NRCDT[i], and the second cc bit, and then performing a 24-bit shift operation.

5. In Paragraph 4, The above step (c) is the value of the third cc bit z i A sampling method robust to side-channel attacks configured as.

6. In Paragraph 4, The above first cc bit is a sampling method robust to side-channel attacks, calculated as follows mathematical formula. cc1= (v0+w0) >>24 In the above mathematical formula, cc1 is the first cc bit, v0 is the left bit of the divided random bit, and w0 is the left bit of NRCDT[i].

7. In Paragraph 6, The above second cc bit is a sampling method robust to side-channel attacks, calculated as follows mathematical formula. cc2= (v1+w1+ cc1) >>24 In the above mathematical formula, cc2 is the second cc bit, v1 is the mid bit of the divided random bit, and w1 is the mid bit of NRCDT[i].

8. In Paragraph 7, The above third cc bit is a sampling method robust to side-channel attacks, calculated as follows mathematical formula. cc3= (v2+w2+ cc2) >>24 In the above mathematical formula, cc3 is the 3rd cc bit, v2 is the write bit of the divided random bit, and w2 is the write bit of NRCDT[i].

9. Processor; It includes memory connected to the above processor, The above processor Step (a) of receiving random bits; Step (b) of setting the loop index i=0 and determining whether the random bit is greater than or equal to NRCDT[i]; If the random bit is greater than or equal to NRCDT[i], the adjustment value z in the i-th iteration loop i Set to 1, and if the random bit is smaller than NRCDT[i], z is the adjustment value in the i-th iteration loop. i Step of setting to 0 (c); Step (d) of updating a random integer by subtracting the above zi from 18; and Execute step (e) of obtaining a final updated random integer by repeating steps (b) through (d) while increasing i by 1 until i reaches 17, wherein The above NRCDT[i] is a sampling device robust against side-channel attacks, having a bit-inverted value of the base sampler's RCDT[i].

10. In Paragraph 9, The above NRCDT[i] is a sampling device robust to side-channel attacks obtained as shown in the following mathematical formula. NRCTD[i] L =2 N+23 - RCTD[i] L -1 NRCTD[i] M =2 N+23 -RCTD[i] M -1 NRCTD[i] R =2 N+23 -RCTD[i] R -1 In the mathematical formula above, RCTD[i] L is the left bit of the bits of RCTD[i] divided into 3 parts, and RCTD[i] M is mid-beat, and RCTD[i] R is a light beat, and NRCTD[i] L is the left bit of the bits of NRCTD[i] divided into 3 parts, and NRCTD[i] M = is the mid beat, and NRCTD[i] R is a light bit, and N is a preset integer.

11. In Paragraph 9, A sampling device that is robust against side-channel attacks in which N bit flips occur during the operation of step (b) above.

12. In Paragraph 9, The above step (b) is, A step of dividing the above random bit into three parts; A step of calculating the first cc bit using the value obtained by adding the left bit of the divided random and the left bit of NRCDT[i] and then performing a 24-bit shift operation; A step of calculating a second cc bit using the value obtained by adding the mid bit of the divided random bit, the mid bit of NRCDT[i], and the first cc bit, followed by a 24-bit shift operation; A sampling device robust to side-channel attacks comprising the step of calculating a third cc bit using the value obtained by adding the write bit of a divided random bit, the write bit of NRCDT[i], and the second cc bit, and then performing a 24-bit shift operation.

13. In Paragraph 12, The above step (c) is the value of the third cc bit z i A sampling device robust against side-channel attacks configured as.

14. In Paragraph 12, The above-mentioned first cc bit is a sampling device robust against side-channel attacks, calculated as follows mathematical formula. cc1= (v0+w0) >>24 In the above mathematical formula, cc1 is the first cc bit, v0 is the left bit of the divided random bit, and w0 is the left bit of NRCDT[i].

15. In Paragraph 14, The above second cc bit is a sampling device robust against side-channel attacks, calculated as follows mathematical formula. cc2= (v1+w1+ cc1) >>24 In the above mathematical formula, cc2 is the second cc bit, v1 is the mid bit of the divided random bit, and w1 is the mid bit of NRCDT[i].

16. In Paragraph 15, The above third cc bit is a sampling device robust against side-channel attacks, calculated as follows mathematical formula. cc3= (v2+w2+ cc2) >>24 In the above mathematical formula, cc3 is the 3rd cc bit, v2 is the write bit of the divided random bit, and w2 is the write bit of NRCDT[i].

Images