Block Cipher Masking for Side-Channel Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic data processing systems are vulnerable to external monitoring attacks, particularly side-channel attacks that exploit power consumption and other physical parameters, which can lead to unauthorized access to encryption keys and other sensitive information.
Innovation Solution
The implementation of pre-computed mask values for the linear part of the block cipher data path, combined with register pre-charging and mask swapping schedules, to minimize round leakage and correlations, thereby enhancing resistance to external monitoring attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional block cipher computation is used, then processing speed and simplicity are maintained, but the system becomes vulnerable to external monitoring attacks through power consumption analysis and other side-channel attacks
Solution Approach 1:
The patent applies preliminary action by pre-computing mask values before the actual cryptographic operation. Mask values are generated and stored in advance in lookup tables, and register pre-charging is performed before data processing. This prepares the system in advance to resist side-channel attacks without adding complexity during the critical computation phase, thereby improving security while managing device complexity.
Solution Approach 2:
The patent introduces mask values as intermediary elements between the plaintext/ciphertext and the cryptographic computation. These masks act as mediators that obscure the actual data being processed, preventing direct correlation between power consumption and secret keys. The masks are computed in advance and applied during encryption/decryption, serving as a protective layer without requiring fundamental changes to the cryptographic algorithm structure.
2Reliability
If mask values are computed dynamically during encryption/decryption, then security is improved, but processing time increases due to real-time computation overhead
Solution Approach 1:
The patent resolves the time overhead issue by computing mask values in advance and storing them in lookup tables. Instead of calculating masks during encryption or decryption operations, the system prepares all necessary mask values beforehand. This shifts the computational burden to a pre-processing phase, making the actual cryptographic operations faster while maintaining security through the use of pre-computed masks.
Solution Approach 2:
The patent implements periodic action by organizing mask computation into discrete, periodic batches. Rather than continuous real-time computation, masks are generated in periodic batches and stored for reuse. This periodic batch processing approach optimizes the balance between security and performance by concentrating computational effort in periodic intervals rather than during every cryptographic operation.
3Reliability
If comprehensive masking is applied to all data paths, then resistance to external monitoring attacks is enhanced, but device complexity and computational overhead increase
Solution Approach 1:
The patent applies local quality by selectively applying masking to specific critical data paths rather than uniformly to all data paths. The mask swapping mechanism is applied locally at strategic points in the cryptographic computation where side-channel information leakage is most likely to occur. This targeted approach provides effective security against external monitoring attacks while avoiding the unnecessary complexity of comprehensive masking across the entire system.
Solution Approach 2:
The patent reduces data path complexity through preliminary action by pre-computing and pre-organizing mask values in lookup tables before they are needed. This advance preparation allows the system to apply masking efficiently at specific points without requiring complex real-time computation or restructuring of the entire data path. The preliminary organization of mask values simplifies the actual implementation during cryptographic operations.
Data Source
AI summary
Systems and methods for protecting block cipher computation operations, from external monitoring attacks. An example apparatus for implementing a block cipher may comprise: a first register configured to store a first pre-computed mask value represented by a combination of a first random value and a second random value; a second register configured to store an output mask value, wherein the output mask value is an inverse permutation function of the first random value; a third register configured to store a second pre-computed mask value represented by a combination the first pre-computed mask value and a permutation function of the output mask value; a fourth register configured to store an input mask value, wherein the input mask value is a combination of an expansion function of the first random value and a key mask value; a non-linear transformation circuit configured to apply the expansion function to a masked round state, perform a non-linear transformation of a combination of a masked key with an output of the expansion function, and apply the permutation function to the output of the non-linear transformation, wherein the non-linear transformation is defined using the input mask value stored in the fourth register and the output mask value stored in the second register; and two round feedback circuits configured to swap the masked round state produced by the non-linear transformation and combine the masked round state with the first pre-computed mask value stored in the first register and the second pre-computed mask value stored in the third register.