Authentication Tag Computation Protection Against Side-Channel Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems, such as AES-GCM, are vulnerable to side-channel attacks that can reveal the secret authentication key, allowing attackers to alter data and authentication tags, compromising encryption security.
Innovation Solution
Implementing countermeasures like data randomization, multiplexing, and circuit optimization to prevent power and electromagnetic side-channel attacks during authentication tag computation, including the use of pseudo-random number generators and multiplexers to obscure intermediate results and reduce leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If AES-GCM encryption operation is implemented without additional protection, then encryption functionality is provided, but the authentication key is vulnerable to side-channel attacks
Solution Approach 1:
The authentication tag computation is divided into multiple shares, where each share is computed separately and then combined. This segmentation prevents side-channel attacks from directly observing the complete authentication key, as the key is split across multiple computational paths that are individually protected.
Solution Approach 2:
Multiplexers are introduced as intermediary components that control the flow of data between different computational paths. These multiplexers act as mediators that prevent direct observation of intermediate results containing authentication key information, while still allowing the computation to proceed correctly through controlled signal routing.
2Object-affected harmful factors
If data randomization and multiplexing are implemented, then side-channel attack resistance is improved, but circuit complexity increases
Solution Approach 1:
The circuit employs dynamic multiplexing where the selection of computational paths changes based on control signals. This dynamic behavior ensures that the same authentication key material is processed through different paths in different clock cycles, preventing attackers from correlating power consumption patterns with specific key values across multiple observations.
Solution Approach 2:
The implementation changes the temporal parameters of computation by distributing the authentication tag calculation across multiple clock cycles rather than completing it in a single operation. This temporal distribution, combined with multiplexing, alters the power consumption profile over time, making it difficult for attackers to extract key information through traditional DPA methods.
3Reliability
If authentication tag computation is protected against side-channel attacks, then security is enhanced, but computation time increases
Solution Approach 1:
The protected authentication tag computation maintains continuous useful action by overlapping the protected computation with other operations. The multiplexed structure allows different shares of the authentication tag to be computed in parallel during different time slots, ensuring that the overall computation completes efficiently while maintaining continuous protected operation throughout the process.
Data Source
Figure 1A~1B
Figure 2A
Figure 2B
AI summary
Protection of authentication tag computation against power and electromagnetic side-channel attacks is described. An example of one or more storage mediums includes instructions for performing a process for calculation of an authentication tag for a data encryption operation, including generating one or more random values; receiving multiple data blocks for calculation, and performing calculation utilizing the received data blocks and the one or more random values to generate intermediate values; performing a data accumulation operation to accumulate random values in calculation of the data blocks; and calculating the authentication tag based at least in part on the generated intermediate values and the accumulated random values.