Computation Device Multiplicative Additive Shares Side-Channel
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cryptographic devices are vulnerable to various attacks, including black box, side-channel, and white-box attacks, particularly due to the difficulty in protecting arithmetic-based algorithms like RSA and Diffie-Hellman, which rely on large numbers, and existing additive masking techniques restrict randomness and are limited in multiplications.
Innovation Solution
A computation device that performs arithmetic operations using variables represented as multiple additive shares, allowing for secure exponentiation by encoding numbers as both multiplicative and additive shares, making it harder for attackers to correlate side-channel information with the actual computation, and enabling secure operations without the need for re-encoding or correcting calculations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If additive masking is used to protect cryptographic operations, then resistance against side-channel attacks is improved, but randomness is restricted and multiplications become limited
Solution Approach 1:
The invention segments the masking approach by introducing two distinct types of shares: additive shares (a0, a1) where x = a0 + a1, and multiplicative shares (m0, m1) where x = m0 × m1. This segmentation allows different operations to use appropriate share types independently, resolving the contradiction between additive masking security and multiplication versatility. The device can perform additive operations on additive shares and multiplicative operations on multiplicative shares without cross-contamination constraints.
Solution Approach 2:
The invention introduces a conversion mechanism that acts as an intermediary between additive and multiplicative share representations. When multiplication is needed, the system can convert additive shares to multiplicative shares (or vice versa) through controlled operations, enabling flexible computation while maintaining security. This intermediary conversion resolves the limitation where additive masking restricted multiplicative operations.
2Reliability
If multiplicative masking is used to protect algorithms, then multiplications can be performed securely, but it does not work well when variables have the value 0
Solution Approach 1:
The invention makes the masking strategy dynamic by selecting between additive and multiplicative share representations based on operational needs. For multiplications, multiplicative shares provide security; for operations involving zero or additive computations, additive shares are used. This dynamic selection eliminates the static limitation of multiplicative masking failing with zero values, as the system adapts to use additive shares when appropriate.
3Manufacturing precision
If re-encoding or correcting calculations are performed to account for masking errors, then operational correctness is maintained, but device complexity increases
Solution Approach 1:
The invention enables self-service operation by designing the dual-share system such that each share type is self-sufficient for its designated operations. Additive shares naturally support additive operations without correction, and multiplicative shares support multiplicative operations without correction. The system serves itself by selecting the appropriate share type for each operation, eliminating the need for external re-encoding or correcting mechanisms that would increase complexity.
Data Source
AI summary
Some embodiments are directed to an electronic computation device (100) arranged for obfuscated execution of a multiplication. The device comprises a storage (120) arranged for storing multiple variables used in the execution of an arithmetic operation, a variable (x: y; 2) of the multiple variables being represented as multiple multiplicative shares (X=(x0, x1, . . . , xm−1); Y=(y0, y1, . . . , ym−1); 20), said multiplicative shares being represented in the storage as multiple additive shares (xi=(xi,0,xi,1, . . . , xi,n−1); Yi=(yi,0,yi,1, . . . , yi,n−1); 210, 220).