Asymmetrically Masked Multiplication for SPA Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cryptographic systems face vulnerabilities due to differences in power consumption profiles between modular squaring and multiplication operations, which can be exploited by attackers using Simple Power Analysis (SPA) and Differential Power Analysis (DPA) attacks, leading to potential key leakage.
Innovation Solution
The implementation of Asymmetrically Masked Multiplication (AMM) techniques, which convert squaring operations into multiplication operations by using additional multiplications and masking strategies to obscure the power consumption patterns, making them indistinguishable from regular multiplications and thus harder to attack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If separate circuits are used for squaring and multiplication operations, then operational speed is improved, but power consumption differences become more pronounced making the system vulnerable to SPA attacks
Solution Approach 1:
The patent merges the separate squaring and multiplication circuits into a unified multiplication circuit that can perform both operations. This eliminates the distinct power consumption profiles that made separate circuits vulnerable to SPA attacks, while maintaining operational speed through optimized multiplication algorithms.
Solution Approach 2:
The patent applies different masking strategies to different parts of the multiplication operation based on whether it is a squaring or multiplication operation. By locally adapting the masking approach to each operation type, the system maintains security against SPA attacks while preserving the performance benefits of optimized operations.
2Device complexity
If the same circuit is used for both squaring and multiplication operations, then device complexity is reduced, but power consumption profiles remain distinguishable enabling SPA attacks
Solution Approach 1:
The patent changes the operational parameters of the unified circuit by applying different masking values and operation sequences for squaring versus multiplication. This transforms the power consumption characteristics of each operation type, making them indistinguishable to SPA attackers while using the same physical circuit.
Solution Approach 2:
The patent introduces masking operations as intermediaries between the actual squaring/multiplication operations and the external observation point. These masking operations obscure the true power consumption patterns, preventing attackers from distinguishing between operation types even when using the same circuit.
3Speed
If optimized squaring operations are implemented, then computational speed is improved, but the reduced transistor switching creates more distinguishable power profiles
Solution Approach 1:
The patent converts the harmful effect of reduced transistor switching (which creates distinguishable power profiles) into a benefit by applying masking operations. The masking adds computational overhead that increases power consumption variability, which paradoxically helps obscure the underlying operation patterns from attackers.
Solution Approach 2:
Instead of trying to make optimized operations consume more power naturally, the patent inverts the approach by adding masking operations that deliberately increase power consumption variability. This inversion transforms the power profile characteristics to prevent distinguishability while preserving the speed benefits of optimized operations.
Data Source
AI summary
Methods and systems for masking certain cryptographic operations in a manner designed to defeat side-channel attacks are disclosed herein. Squaring operations can be masked to make squaring operations indistinguishable or less distinguishable from multiplication operations. In general, squaring operations are converted into multiplication operations by masking them asymmetrically. Additional methods and systems are disclosed for defeating DPA, cross-correlation, and high-order DPA attacks against modular exponentiation.