CMAC Generation via Selective State Array Row Retention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cipher-based message authentication codes (CMACs) are vulnerable to Differential Power Analysis (DPA) attacks, where attackers can recover parts of the round keys, particularly the 2nd-last round key, due to the retention of only the 8 most significant bytes during the MAC computation, making it easier for them to perform brute force attacks.
Innovation Solution
The method generates a cipher-based message authentication code by retaining bytes from at least one row of the state array, specifically discarding the bytes of the remaining rows or subjecting message bytes to an exclusive-OR operation, thereby increasing the difficulty for DPA attackers by requiring them to construct and test hypotheses about two key bytes at a time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If the standard method retains only the 8 most significant bytes during MAC computation, then the MAC length is reduced and processing is simplified, but the system becomes vulnerable to Differential Power Analysis attacks
Solution Approach 1:
The patent segments the state array into different row groups (first group containing rows 0-1, second group containing rows 2-3) and selectively retains bytes from specific rows based on the attack resistance requirement. This segmentation allows the system to maintain shorter MAC length while selecting specific row segments that provide better cryptographic security against DPA attacks.
Solution Approach 2:
The patent applies local quality by treating different rows of the state array differently - some rows are retained for MAC computation while others are discarded. Specifically, it retains bytes from rows that provide optimal balance between MAC length and attack resistance, rather than uniformly retaining all or none of the state array bytes.
2Object-affected harmful factors
If bytes from multiple rows are retained for MAC computation, then resistance against DPA attacks increases, but the MAC length increases and processing complexity increases
Solution Approach 1:
The patent divides the state array into distinct row groups and defines specific retention patterns (e.g., retaining rows 0-1 or rows 2-3) that limit the number of bytes processed in the MAC. This segmentation approach increases DPA resistance by involving more rows while controlling processing complexity through systematic selection rules.
Solution Approach 2:
The patent implements partial action by retaining only specific rows (e.g., 2 out of 4 rows) rather than all rows, providing sufficient DPA resistance without the full overhead of processing the entire state array. This partial retention achieves adequate security margins while maintaining efficient processing.
3Object-affected harmful factors
If the attacker can recover the 2nd-last round key through DPA, then brute force attacks become feasible, but increasing key protection measures会增加 computational overhead
Solution Approach 1:
The patent segments the key protection mechanism by distributing key material across multiple row groups in the state array. By retaining bytes from specific rows that are distributed throughout the encryption process, the system protects the round key without requiring additional computational steps beyond the standard AES operations.
Solution Approach 2:
The patent uses the state array row selection as an intermediary mechanism to protect the round key. Instead of directly protecting the key material, it controls which intermediate state bytes are exposed in the MAC, thereby indirectly protecting the round key from recovery without adding direct key protection overhead.
Data Source
Figure 1~6
Figure 2
Figure 3
AI summary
In a method for generating a cipher-based message authentication code, a state array (25) comprised of rows (31-34) of bytes (S'0-S'15) and columns (41-44) of bytes (S'0-S'15) based on a message to be transmitted is generated. The cipher-based message authentication code is generated by retaining the bytes (29, 30) of at least one row (32, 34) of the state array (25).