CCFB Block Cipher Mode for DPA-Resistant Authenticated Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Authenticated Encryption (AE) and Authenticated Encryption with Associated Data (AEAD) schemes are prone to first-order Differential Power Analysis (DPA) attacks, which compromise cryptographic key security by analyzing power consumption patterns.
Innovation Solution
The proposed solution involves an improved mode of operation based on the Counter Cipher FeedBack (CCFB) scheme, utilizing round repetition and a combination of counter mode and cipher feedback mode to generate ciphertext and authentication tags, where each plaintext block is processed in an orderly manner, and a global tag is computed using local tags to enhance resistance to DPA attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authenticated encryption schemes (AE) and authenticated encryption with associated data (AEAD) are used to protect message privacy and integrity, then security against eavesdropping and tampering is improved, but vulnerability to first-order Differential Power Analysis (DPA) attacks increases
Solution Approach 1:
The patent divides the message into multiple blocks and processes them in separate rounds, where each round independently computes ciphertext blocks and authentication tags. This segmentation isolates the cryptographic operations across multiple discrete steps, making it difficult for DPA attackers to correlate power consumption patterns across the entire encryption process, while still maintaining end-to-end security for the complete message
Solution Approach 2:
The patent implements periodic computation of authentication tags at the end of each round, rather than a single final tag computation. This periodic authentication mechanism distributes the cryptographic operations over multiple time periods, obscuring the temporal patterns of power consumption and preventing attackers from identifying the exact moment when secret key material is processed
2Reliability
If traditional AE modes are used for encryption, then data confidentiality is achieved, but power consumption patterns become predictable and susceptible to DPA attacks
Solution Approach 1:
The patent introduces dynamic computation patterns where the order and timing of cryptographic operations vary between rounds. Each round dynamically computes ciphertext blocks and authentication tags in a non-fixed sequence, causing the power consumption profile to change with each encryption round. This dynamic behavior prevents attackers from predicting power consumption patterns, while the system maintains consistent security properties across all rounds
3Productivity
If a single pass over the data is used for authenticated encryption, then processing speed is improved, but security against DPA attacks deteriorates
Solution Approach 1:
The patent segments the encryption process into multiple rounds, where each round processes a portion of the data independently. This segmentation allows the system to maintain high processing speed by parallelizing operations across different rounds while simultaneously providing security through the distributed computation pattern that obscures power consumption characteristics
Solution Approach 2:
The patent performs preliminary computations of authentication tags during each round rather than waiting until the final step. This preliminary authentication action distributes the cryptographic workload across multiple time steps, reducing the concentration of power consumption at any single moment and thereby resisting DPA attacks while maintaining efficient processing
Data Source
AI summary
A block cipher method and apparatus using round repetition for providing, from a plaintext message (10), a ciphertext message (50) and a global tag (52) is disclosed. The plaintext message is converted into a plurality of ordered plaintext blocks (11) which are successively processed during a round for computing:—a cryptogram (30) by encrypting input data (20) using a single cryptographic key, said cryptogram comprising a first segment (31) and a second segment (32)—a ciphertext block (51) by performing a first operation (41) using, as operands: said first segment (31) said current plaintext block (11) and said second segment (32). At each next round said input data is newly determined based on the current ciphertext block and an updated reproducible data. The ciphertext message is determined by concatenating the ciphertext blocks and the global tag by a second operation (42) using computed authentication local tags as operands.