Affine Masking for Cryptographic Intermediate Variable Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting secret data in cryptographic devices are inadequate against advanced auxiliary channel attacks, particularly those using multiple measurement points, as they are either ineffective or excessively costly to implement.
Innovation Solution
The use of affine masking operations, specifically the function m(x) = Rx + r, where R is a binary invertible matrix and r is a random vector, to protect intermediate variables within cryptographic algorithms, making it difficult for attackers to infer secret data from measurement points.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If masking with function m_r(x) = x + r is used, then ease of implementation is improved, but resistance to higher-order auxiliary channel attacks deteriorates
Solution Approach 1:
The patent changes the masking parameter from simple random value r to an affine transformation involving a random invertible matrix R and random vector r, transforming m_r(x) = x + r into m(x) = R.x + r. This parameter change maintains implementation feasibility while significantly improving resistance to higher-order auxiliary channel attacks by breaking the linear correlation between masked values and secret data.
2Reliability
If masking with k random variables r1, r2, ..., rk is used to resist order k attacks, then resistance to attacks is improved, but device complexity increases unacceptably
Solution Approach 1:
Instead of using k separate random variables which would increase complexity linearly with k, the patent uses a single affine transformation with a random invertible matrix R and random vector r. This parameter change achieves resistance to attacks of any order k ≥ 2 while maintaining constant implementation complexity, as the affine masking can be applied uniformly across all operations without requiring separate masking variables for each attack order.
3Reliability
If affine masking m(x) = R.x + r is used, then resistance to higher-order attacks is improved, but implementation complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-generating the random invertible matrix R and random vector r, and pre-computing the affine transformation parameters. This allows the masking to be applied efficiently during cryptographic operations without requiring complex real-time computation, thereby reducing the actual implementation cost while maintaining high resistance to higher-order attacks.
Data Source
Figure 1a
Figure 1b
Figure 2
AI summary
The method involves protecting an electronic device by affine masking, where the electronic device performs operations based on secret variables, which are binary vectors of non-zero data. The variables are replaced using affine masking operations based on specific affine function containing parameters of invertible random binary matrix and random binary vectors, where the electronic device utilizes a cryptography algorithm.