Adaptive Bit Masking for Lattice-Based Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Lattice-based cryptography schemes, such as DILITHIUM, are vulnerable to algebraic side-channel attacks where an attacker can recover the secret key by exploiting leakage of a single bit of the secret masking vector, with varying levels of difficulty based on the bit index, leading to inefficient protection mechanisms that waste computing resources.
Innovation Solution
An adaptive bit masking technique that dynamically adjusts the level of protection for different bits of the secret masking vector by generating specific adaptive shares for vulnerable bit indexes, reducing the number of randomness bits required and optimizing security without unnecessary computing overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If uniform bit masking protection is applied to all bits of the secret masking vector, then security against side-channel attacks is improved, but computational overhead and randomness requirements increase significantly
Solution Approach 1:
The patent applies different levels of masking protection to different bits of the secret masking vector based on their individual vulnerability characteristics. Specifically, bits at certain positions (e.g., bits 0-6 and bits 25-31) receive stronger protection with more shares, while intermediate bits receive lighter protection. This local differentiation resolves the contradiction by providing necessary security where vulnerable without wasting computational resources on already-secure bits.
Solution Approach 2:
The patent changes the parameter of protection level (number of shares) from a uniform value to a variable value that depends on the bit position. By analyzing the vulnerability of each bit position and assigning different numbers of shares accordingly, the system achieves adequate security with reduced overall computational overhead and randomness requirements compared to uniform protection.
2Object-affected harmful factors
If stronger masking protection is applied to vulnerable bit positions, then resistance to algebraic side-channel attacks is improved, but the number of randomness bits required increases
Solution Approach 1:
The patent identifies specific bit positions in the secret masking vector that are more vulnerable to algebraic side-channel attacks and applies stronger masking (more shares) only to those positions. This localized approach ensures resistance to attacks where needed while minimizing the total number of randomness bits required, as intermediate bits that are less vulnerable receive lighter protection.
Solution Approach 2:
The patent applies masking protection selectively rather than uniformly. By providing excessive protection (more shares) only to the most vulnerable bits and adequate but not excessive protection to other bits, the system achieves sufficient security against algebraic side-channel attacks while optimizing the quantity of randomness bits used.
Data Source
AI summary
A device may include a computer-readable memory and an integrated circuit including a processor configured to implement a cryptographic operation, wherein the cryptographic operation enables computation of a cryptographic result using a bit masking value y. The processor may be configured to access the computer-readable memory to determine a set of bit indexes, wherein each bit index in the set of bit indexes is associated with a bit value in the bit masking value y, for each bit index in the set of bit indexes, calculate an adaptive share value in which the bit value associated with the bit index is masked, and execute a cryptographic operation using the adaptive share value.