AES S-Box Domain-Oriented Masking With Shared Registers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches to prevent unauthorized access of integrated circuits (ICs) are often expensive and spatially challenging, and attackers can exploit side-channel analysis to compromise IC security.
Innovation Solution
Implement domain-oriented masking techniques that share circuit resources, such as flip flops and registers, between different portions of an IC, and use outputs from previous stages as randomness for subsequent stages to reduce the need for entropy generation circuitry, thereby decreasing circuit cost and area without compromising security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Area of stationary object
If domain-oriented masking is implemented to share circuit resources, then circuit area and cost are reduced, but security against side-channel attacks must be maintained
Solution Approach 1:
The circuit is divided into multiple domains (e.g., different stages of the AES S-Box) that can be independently masked. Each domain processes data with its own masking variables, allowing resource sharing while maintaining security boundaries. This segmentation enables flip-flops and registers to be shared between domains without compromising the security of individual domains.
Solution Approach 2:
Different masking strategies are applied to different parts of the circuit based on their security requirements. Critical paths and sensitive operations receive stronger masking protection, while less sensitive operations can use simpler masking or share resources more aggressively. This local differentiation optimizes the balance between security and resource utilization.
2Device complexity
If entropy generation circuitry is reduced by using outputs from previous stages as randomness, then circuit cost and area are decreased, but cryptographic security guarantees must be maintained
Solution Approach 1:
The circuit uses its own internal outputs from previous stages as randomness sources for subsequent stages, eliminating the need for external entropy generation circuitry. The AES S-Box outputs are fed back into the masking mechanism of subsequent operations, allowing the system to generate its own masking variables without additional hardware. This self-service approach reduces circuit complexity while maintaining security through the inherent unpredictability of cryptographic transformations.
3Area of stationary object
If flip flops and registers are shared between different portions of the IC, then circuit area is reduced, but access control and security management become more complex
Solution Approach 1:
Flip-flops and registers are designed to serve multiple domains and functions simultaneously. The same physical register can hold masked data for one domain while another domain uses the same register for different cryptographic operations at different times. This multi-functionality is enabled by careful timing control and domain-specific masking that prevents cross-contamination of sensitive data.
Solution Approach 2:
The shared registers are accessed in periodic cycles with strict timing control. Each domain is granted access to shared resources during specific time windows, ensuring that sensitive data from one domain does not interfere with another domain's security requirements. This temporal separation allows resource sharing while maintaining security through controlled access patterns.
Data Source
AI summary
This document discloses techniques, apparatuses, and systems for efficient and secure data handling using domain-oriented masking. In aspects, efficient and secure data handling using domain-oriented masking enables circuit resources (e.g., flip flops, data) to be shared between portions of an integrated circuit (IC). Specifically, an input register of a Galois-Field (GF) multiplier and a pipeline register within a stage of an Advanced Encryption Standard Substitution-Box (S-Box) may be implemented as sharing a single flip flop. Some ICs may utilize multiple S-Boxes, including multiple GF multipliers that are provided randomness each time the input is updated. In this case, an output from a previous stage of a first S-box may be provided as randomness to a subsequent stage of a second S-Box to limit the need for entropy generation circuitry. In this way, efficient and secure data handling using domain-oriented masking may decrease circuit cost and circuit area without impacting security.