Binomial Sampling Randomization for Side-Channel-Resistant Lattice Crypto
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Binomial sampling in lattice-based cryptography is vulnerable to implementation attacks such as side-channel and fault attacks, and higher-order masking methods are computationally expensive and require significant hardware resources.
Innovation Solution
Implement randomized expansion and shuffling of operands during binomial sampling, utilizing bit-slicing transformations and random rotations to obfuscate computations, reducing computational overhead and hardware requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If higher-order masking is used to protect binomial sampling against side-channel attacks, then security against attacks is improved, but computational cost increases significantly
Solution Approach 1:
The patent changes the parameter of masking order from higher-order (2nd order or above) to first-order masking. By using first-order masking with randomized expansion, the patent achieves adequate security protection while reducing computational overhead. The execution time overhead is reduced from 3.5×-131× with higher-order masking to a much lower level with first-order masking combined with randomized expansion.
Solution Approach 2:
The patent introduces dynamic randomized expansion where the expansion factor θ is randomly selected from a range. This dynamic approach adds variability to the binomial sampling operation, making it more resistant to side-channel attacks while maintaining efficiency. The randomization parameter θ changes during execution, providing security without the heavy computational burden of higher-order masking.
2Reliability
If higher-order masking is used to protect binomial sampling, then security against attacks is improved, but hardware resources increase
Solution Approach 1:
The patent reduces the masking order parameter from higher-order to first-order, which directly decreases hardware resource requirements. First-order masking requires fewer random shares and less complex hardware circuits compared to higher-order masking, while still providing adequate protection when combined with randomized expansion techniques.
Solution Approach 2:
The patent introduces randomized expansion as an intermediary mechanism that works together with first-order masking. The randomized expansion with parameter θ acts as an additional layer of protection that compensates for using only first-order masking, achieving security comparable to higher-order masking but with reduced hardware complexity.
3Productivity
If binomial sampling is implemented without protection, then computational efficiency is maintained, but vulnerability to side-channel attacks increases
Solution Approach 1:
The patent applies randomized expansion with a dynamically selected parameter θ to the binomial sampling operation. This dynamic randomization changes the computational path and intermediate values, obscuring the relationship between power consumption and secret data, thereby protecting against side-channel attacks while maintaining computational efficiency.
Solution Approach 2:
The patent modifies the binomial sampling operation by introducing a random expansion parameter θ that varies the number of terms in the expansion. This parameter change creates variability in the computation that prevents attackers from correlating power consumption patterns with secret keys, while the overall computational complexity remains manageable.
Data Source
AI summary
Solutions described herein refer to a lattice-based cryptographic operation, comprising a binomial sampling of coefficients, wherein a randomized expansion of binomial sampling operands utilize a value e.