Look-Up Table Initialization for AES Side-Channel Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption methods, particularly those using look-up tables in AES encryption, face challenges in effectively protecting against high-order side-channel attacks due to high latency and complexity, which complicates circuit design and performance.
Innovation Solution
The method involves initializing look-up tables using multiple masks in a tower-of-fields architecture with flip-flops, allowing for fast execution of initialization steps in a single clock cycle, and iteratively re-initializing the tables to vary the number of iterations and masks, thereby enhancing protection against side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple masks are used for initializing look-up tables to protect against high-order side-channel attacks, then security is improved, but latency and circuit area increase
Solution Approach 1:
The patent divides the look-up table into multiple segments or parts, each initialized with different mask values. This segmentation allows the system to achieve high-order masking protection by distributing the masking operations across multiple table segments, thereby reducing the latency and computational overhead associated with initializing a single large table with multiple masks.
Solution Approach 2:
The patent performs preliminary initialization of look-up table segments with mask values before the actual encryption operation. By pre-initializing the table segments with appropriate masking, the system prepares the security structure in advance, avoiding the need for complex real-time masking operations during encryption, thus reducing latency.
2Reliability
If multiple masks are used for initializing look-up tables to protect against high-order side-channel attacks, then security is improved, but circuit area increases
Solution Approach 1:
The patent segments the look-up table into multiple smaller tables, each requiring fewer mask values for initialization. This segmentation reduces the total circuit area needed for storing mask values and table entries, while still achieving high-order masking protection through the combined use of multiple segmented tables with different masks.
Solution Approach 2:
The patent applies different mask values to different segments or regions of the look-up table, rather than using a single uniform masking scheme. This local quality approach allows each table segment to be optimized with specific mask values, improving security against high-order attacks while minimizing the overall circuit area by avoiding redundant masking infrastructure.
3Reliability
If look-up tables are initialized with mask values for side-channel attack protection, then security is improved, but device complexity increases
Solution Approach 1:
The patent divides the look-up table initialization process into multiple simpler steps, where each step initializes a separate table segment with a specific mask. This segmentation transforms a single complex initialization operation into multiple simpler operations, reducing the overall device complexity while maintaining high-order masking protection.
Solution Approach 2:
The patent performs preliminary initialization of table segments with mask values before the main encryption operation. By preparing the masked table structure in advance through systematic preliminary actions, the system simplifies the main encryption process and reduces the complexity of real-time masking operations during active use.
Data Source
Figure 1a~1b
Figure 2a~2b
Figure 3
AI summary
An encryption method that envisages execution of a encryption algorithm (200) including operations (210) that comprise accessing a look-up table (50), the operation of accessing a look-up table (50) comprising an operation of initialization (100) of the look-up table (50) that comprises writing initialization values in the aforesaid look-up table (50) applying (110; 110, 120) an input mask (R1) to input data (din, dinref) that identify a location of said look-up table (50) and an output mask (R2) to data (dout, doutref) at output from a location of the aforesaid look-up table (50). According to the invention, the above method comprises carrying out at least one second step of initialization (120) of the aforesaid look-up table (50) that comprises: providing at least one second input mask R1ʹ and one second output mask R2ʹ; and computing corresponding initialization values as a function of a logic combination (Δ1) of the aforesaid first input mask (R1) and second input mask R1ʹ and of a logic combination (Δ2) of the aforesaid first output mask R2ʹ and second output mask R2ʺ, in such a way that in the resulting table the input data (dinmask') are masked only by the second input mask R1ʹ and the output data (doutmask') are masked only by the second output mask R2ʹ.