Conditional Calculator for Post-Quantum Cryptography Side-Channel Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The FALCON algorithm, a standard in post-quantum cryptography, is vulnerable to side-channel attacks due to its reliance on conditional operations that can be exploited through power analysis, leading to potential exposure of cryptographic keys.
Innovation Solution
A conditional calculator and method that perform conditional operations based on control values using left-shifting or multiplication operations, reducing the Hamming weight difference of intermediate values to secure against side-channel attacks, specifically by implementing equations such as 2x-y+(y-x)≪cv and x+(y-x)*cv, which ensure consistent operation timing and reduced Hamming weight differences regardless of the control value.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conditional operations using control bits are employed in the FALCON algorithm, then the cryptographic functionality is achieved, but the system becomes vulnerable to side-channel attacks based on power analysis
Solution Approach 1:
The patent changes the operational parameters by introducing mask values and modifying the control bit representation. Instead of directly using control bits to conditionally execute operations, the system transforms the control values and operands through masking operations, changing the physical characteristics (power consumption patterns) while preserving the logical functionality of the cryptographic algorithm
Solution Approach 2:
The patent introduces mask values as intermediary elements between the control bits and the actual cryptographic operations. These mask values act as mediators that hide the true control signals from power analysis attacks, allowing the system to maintain conditional operation functionality while preventing attackers from directly observing the control bit states through power consumption measurements
2Reliability
If conditional operations are implemented to perform predetermined operations based on control values, then the cryptographic algorithm executes correctly, but timing information becomes exposed to attackers
Solution Approach 1:
The patent changes the timing parameters by ensuring that masked operations are always executed regardless of the control bit value. By transforming the conditional operation into a form where masked computations are performed uniformly, the system eliminates timing variations that would otherwise expose control bit information to timing attacks
3Device complexity
If standard conditional operations are used, then the implementation is simple and efficient, but the Hamming weight difference of intermediate values creates security vulnerabilities
Solution Approach 1:
The patent changes the parameter representation by introducing mask values that transform the Hamming weight characteristics of intermediate values. Instead of operating directly on values with varying Hamming weights, the system applies masking that equalizes the Hamming weight distribution, thereby eliminating the vulnerability while maintaining operational efficiency
Data Source
AI summary
A conditional calculator includes an input unit configured to receive a first operand, a second operand, and a control value and a calculation unit configured to perform a conditional operation in which a determination is made as to whether a predetermined operation is performed on the first and second operands, depending on the control value. The calculation unit may perform the conditional operation based on an operation of left-shifting an intermediate value of the conditional operation according to the control value or an operation of multiplying the intermediate value of the conditional operation by the control value.