Circuit Side-Channel Analysis Protection via Hamming Weight Masking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Circuits implementing cryptographic algorithms are vulnerable to side channel analysis attacks, which aim to discover secret data such as encryption keys by observing variations in current consumption or electromagnetic radiation, posing a challenge in protecting these secrets effectively.
Innovation Solution
A method involving generating pairs of input words with one's complements for each bit, applying specific operations to these pairs, and using a derived operation to transform and combine them, thereby masking the Hamming weight and making it independent of the data's actual value, thus preventing leakage of secret information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic algorithms are implemented in circuits, then encryption operations can be performed, but the circuits become vulnerable to side channel analysis attacks
Solution Approach 1:
The input data is divided into multiple input words, each containing a part of the first input data, a part of the second input data, and their respective binary one's complements. This segmentation allows the cryptographic operation to be performed on segmented data, masking the actual data values and preventing side channel analysis attacks from directly observing the Hamming weight of the original data.
Solution Approach 2:
The patent transforms the data representation by incorporating binary one's complements of data parts into the input words. This parameter change in data representation ensures that the Hamming weight of the processed data does not directly reflect the Hamming weight of the original secret data, thereby changing the observable parameters and preventing leakage through side channel analysis.
2Productivity
If data is processed directly without masking, then processing speed is maintained, but Hamming weight information leaks secret data
Solution Approach 1:
The patent introduces intermediate input words that contain data parts and their binary one's complements as mediators between the original secret data and the cryptographic operation. These intermediary structures allow the processing to proceed without directly exposing the Hamming weight of the original data, thus preventing information leakage while maintaining processing efficiency.
3Reliability
If Hamming weight is made independent of data value, then side channel analysis is prevented, but additional processing steps are required
Solution Approach 1:
The patent merges the data parts and their binary one's complements into unified input words, and similarly merges the output data parts and their complements into output words. This merging approach allows the Hamming weight masking to be achieved through structured data representation rather than requiring separate masking operations, thereby reducing processing complexity while maintaining security.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The present invention relates to a method for executing by a circuit a target operation (OPR) combining two input data (SD, M) and providing an output data (RD), the method comprising steps of: generating at least two pairs of input words (SDMj, MMj) each comprising a first and a second input word, each of the first and second input words comprising a respective part (SObj) of the first or second input data and a binary one's complement (SDbj) of the first or second input data part, the parts of the first and second input data being in same positions in the first and second input data words of each word data pair, and the binary one's complements of the parts of the first and second input data being in same positions in the first and second input data words of each word data pair, and applying to each input word pair a same derived operation (OPR1) and providing an output word (RDMj) comprising a part (RDbj) of the output data, resulting from the application of the target operation to the first and second input data parts present in the pair of input words, and a binary one's complement (RDbj) of the output data part.