AES SubBytes Masking with Dirac Handling for High-Order Side-Channel Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing AES block cipher algorithms against high-order side-channel attacks, such as those proposed by Genelle et al., are inefficient in terms of computational cost and memory usage, particularly in systems with limited RAM, and may expose sensitive information during the SubBytes step.
Innovation Solution
A method involving a Dirac function to handle multiplicative masking in the SubBytes step of AES, utilizing precomputed tables in non-volatile memory to efficiently compute a Dirac output value, ensuring that no share becomes zero, and converting between additive and multiplicative sharing to secure the algorithm.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Genelle et al.'s method for secure multiplicative masking is used, then security against high-order side-channel attacks is improved, but computational cost and memory usage increase
Solution Approach 1:
The patent precomputes and stores the Dirac function output values in a lookup table during an initialization phase. This preliminary action eliminates the need for complex runtime computations of the Dirac function, reducing computational overhead during actual encryption operations while maintaining security guarantees.
Solution Approach 2:
The patent creates a precomputed copy of the Dirac function results in a lookup table. Instead of computing the Dirac function repeatedly during encryption, the system uses this precomputed copy, significantly reducing computational cost while preserving the security properties of the original function.
2Reliability
If Genelle et al.'s method is used, then security against high-order side-channel attacks is improved, but memory requirements increase
Solution Approach 1:
The patent extracts only the essential Dirac function output values needed for the masking operation and stores them in a compact lookup table. By taking out only the necessary precomputed values rather than storing entire function implementations or large intermediate structures, memory usage is minimized while maintaining security.
3Quantity of substance
If the Dirac function is computed without precomputed tables, then memory usage is reduced, but computational overhead increases
Solution Approach 1:
The patent performs preliminary computation of the Dirac function results and stores them in a compact lookup table. This shifts the computational burden to an initialization phase, making the actual encryption operations much faster with minimal runtime memory access, thus balancing memory usage and computational efficiency.
4Device complexity
If x=0 is not specially handled during inversion, then computational complexity is reduced, but security is compromised due to information leakage
Solution Approach 1:
The patent introduces the Dirac function as an intermediary mechanism that detects when x=0 and applies appropriate masking. This intermediary function allows the system to handle the special case securely without exposing information about the secret key, while maintaining computational efficiency through precomputed lookup tables.
Solution Approach 2:
The patent changes the parameter representation by using multiplicative masking with precomputed Dirac values. When x=0, the Dirac output is 1, which when multiplied with the masked value maintains the masking property. This parameter transformation allows secure handling of the zero case without increasing computational complexity.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The present invention relates to a method for securing against high-order side-channel attacks an execution of a SubBytes step of a block cipher algorithm based on Advanced Encryption Standard and operating on an internal state x split into a first set of (n+1) shares (x0, x1, x2.. xn) by a (n+1)-additive sharing, with n a non-zero integer, said SubBytes step comprising: a substep of affine transformation in GF(28) on the state x and a substep of a field inversion in GF(256)*, wherein said substep of field inversion is performed by a cryptographic device and comprises : - computing (S1) a Dirac output value by executing at least one Dirac function on a plurality of shares xi of the internal state x, with i an integer in [O,n], said Dirac function being a function defined in GF(256) such that said Dirac output value is equal to 1 when x equals 0 and is equal to 0 otherwise, - adding (S2) said Dirac output value to one of said shares of the first set of shares to obtain a second set of shares, - performing a conversion of the second set of shares (S3) from said (n+1) additive sharing to a (n+1)-multiplicative sharing, - performing an inversion of each share of the (n+1)-multiplicative sharing (S4), - performing a conversion of the inverted shares (S5) from said multiplicative sharing to a (n+1)-additive sharing to obtain a third set of shares, - adding (S6) said Dirac output value to one of said shares of the third set of shares.