Cryptographic Arithmetic Masking via Boolean XOR Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cryptographic algorithms that mix Boolean and arithmetic operations face challenges in performing arithmetic operations on values masked by Boolean masks, as existing methods require a large number of operations, making them vulnerable to side-channel attacks.
Innovation Solution
A method that performs arithmetic operations on values masked by Boolean masks using a series of computing steps involving Boolean exclusive OR operations, ensuring a constant number of elementary operations regardless of operand size, while keeping all intermediate values masked, and optionally blinding intermediate values for increased protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conversion between Arithmetic and Boolean masking is performed, then intermediate values can be masked using the kind of masking compatible with the next operation, but the computation time strongly depends on the size of the values and masks to be handled
Solution Approach 1:
The patent performs preliminary actions by pre-defining the arithmetic operation to work directly with Boolean-masked values. The operator is designed in advance to accept Boolean masks and produce Boolean-masked results without requiring runtime conversion, thereby eliminating the time-consuming conversion step while maintaining masking compatibility.
Solution Approach 2:
The patent extracts the conversion step from the computation process. By removing the Arithmetic-to-Boolean masking conversion that previously occurred during runtime, the method eliminates the source of computation time dependency on value and mask sizes, while preserving the essential masking compatibility through direct Boolean-masked arithmetic operations.
2Reliability
If operands are redefined to accept Boolean masks and output Boolean-masked results, then arithmetic operations can be performed on masked values, but the number of operations linearly depends on the size of the input values and masks
Solution Approach 1:
The patent changes the parameters of the arithmetic operator to work with fixed-size Boolean masks regardless of the actual data size. By parameterizing the operator to use a constant number of Boolean mask words (e.g., 4x32-bit masks) independent of operand size, the method achieves size-independent operation counts while maintaining masked operation capability.
Solution Approach 2:
The patent transitions from thinking in terms of data-size-proportional operations to fixed-dimension Boolean mask operations. By representing masked values in a fixed-dimensional Boolean mask structure (constant number of mask words), the method achieves constant-time operations independent of the actual operand size, effectively changing the dimensional approach from scalable to fixed.
3Productivity
If a constant number of elementary operations is performed regardless of bit-size, then computational efficiency is improved, but maintaining masking compatibility becomes more difficult
Solution Approach 1:
The patent creates a universal arithmetic operator that handles both the arithmetic computation and Boolean masking functions simultaneously. This multi-functional operator works with fixed-size Boolean masks to produce constant-time results while inherently maintaining masking compatibility, as the Boolean mask structure is designed to preserve cryptographic security properties across different operand sizes.
Data Source
AI summary
The present invention relates to a method secured against side channel attacks performing an arithmetic operation of a cryptographic algorithm mixing Boolean and arithmetic operations, wherein said method is performed by a cryptographic device comprising a processing system having at least one hardware processor, and said operation has a first value (x) and a second value (y) as operands, comprising: —obtaining (S1) a first masked value (x′), a second masked value (y′), a first Boolean mask (rx), a second Boolean mask (ry), said first masked value (x′) resulting from masking said first value (x) by said first Boolean mask (rx) by performing a Boolean exclusive OR (XOR) operation between said first value (x) and said first Boolean mask (rx), and said second masked value (y′) resulting from masking said second value (y) by said second Boolean mask (ry) by performing a Boolean exclusive OR (XOR) operation between said second value (y) and said second Boolean mask (ry), —performing (S2) in any order a plurality of computing steps combining values among said first masked value (x′), said second masked value (y′), said first Boolean mask (rx) and said second Boolean mask (ry) to obtain a boolean masked result equal to the result of the arithmetic operation having said first value (x) and said second value (y) as operands, masked by a third boolean mask (rx xor ry) resulting from performing said Boolean exclusive OR (XOR) operation between said first Boolean mask (rx) and said second Boolean mask (ry) ((x+y) xor (rx xor ry)), wherein said computing steps perform Boolean exclusive OR (XOR) operations or arithmetic operations between said values without disclosing any information relative to the first and second values and, wherein said computing steps are executed by the hardware processor by performing a constant number of elementary operations whatever the bit-size of said first and second values, —outputting (S3) said boolean masked result of the arithmetic operation between said first value (x) and said second value (y).