Cipher Algorithm Protection via Masked Key and Data Shares
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electronic circuits executing symmetric encryption algorithms are vulnerable to side-channel attacks, which exploit information such as power consumption and electromagnetic radiation to access sensitive information.
Innovation Solution
The method involves masking at least one of the data and the key with a mask and applying a round function to both the masked key and data in each round of the cipher algorithm, with the number of applications to the data shares being smaller than or equal to the applications to the key shares, and using multiple hardware entities to perform these operations randomly and independently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If masking is applied to data and key with unequal numbers of round function applications, then security against side-channel attacks is improved, but execution time increases
Solution Approach 1:
The patent applies dynamic balancing by adjusting the number of round function applications on data shares to match the number of applications on key shares, creating a balanced execution profile that prevents timing attacks while maintaining security. This dynamic adjustment ensures that no single execution path is distinguishable from others, thereby preventing side-channel leakage without excessive time overhead.
Solution Approach 2:
The patent changes the execution parameter by applying the round function an equal number of times to both data shares and key shares, rather than using the traditional unequal approach. This parameter change transforms the execution pattern to be uniform across different data types, making it impossible for attackers to distinguish between key and data operations through timing analysis.
2Reliability
If multiple hardware entities are used to apply the round function randomly, then security against side-channel attacks is improved, but device complexity increases
Solution Approach 1:
The patent segments the cryptographic processing into multiple independent hardware entities, each capable of applying the round function to different shares. This segmentation allows the system to distribute the computational workload and introduces randomness in entity selection, making it difficult for attackers to correlate physical measurements with specific cryptographic operations. The modular architecture manages complexity through clear separation of functions.
Solution Approach 2:
The patent introduces a new dimension of security by using multiple hardware entities operating in parallel with random selection, rather than relying solely on sequential processing. This dimensional approach adds spatial diversity to the cryptographic execution, where attackers would need to simultaneously monitor multiple hardware entities to gather useful side-channel information, significantly increasing the difficulty of successful attacks.
3Reliability
If the round function is applied alternately to key shares and data shares, then security against side-channel attacks is improved, but productivity decreases
Solution Approach 1:
The patent implements periodic action by applying the round function alternately to key shares and data shares in a regular, predictable pattern. This periodic execution ensures that both types of shares receive equal processing attention, preventing timing attacks that rely on irregular execution patterns. The regular alternation creates a consistent timing profile that is resistant to side-channel analysis while maintaining acceptable processing throughput.
Data Source
AI summary
Systems and methods for protecting secret or secure information involved in generation of ciphered data by circuitry. The circuitry includes data paths and key paths that operate to perform cipher operations to generate a plurality of key shares and a plurality of data shares using a key and data as input. The data and the key may be masked by at least one mask. The plurality of key shares may be generated using the key and a first mask. The plurality of data shares are generated using key shares, the data, and a second mask.