Cryptographic Blinding for Montgomery Multiplication Efficiency

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

In public-key cryptography systems, the conversion of input messages into Montgomery form for Montgomery multiplication is computationally resource-intensive and vulnerable to side-channel attacks, leading to potential secret key leakage during cryptographic operations.

Innovation Solution

The technique avoids explicit conversion to Montgomery form by using a random value to blind the input message, performing modular reduction in side-channel-attack-resistant cryptographic computation, thereby reducing functional calls and preventing message value leakage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If explicit conversion to Montgomery form is performed, then Montgomery multiplication can be executed, but computational resources are consumed and side-channel attack vulnerability increases

Engineering Contradiction:
Improvecryptographic operation efficiencyVSAvoidside-channel attack vulnerability
Core Design Contradiction:
ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary action by performing blinding with a random value r before the Montgomery multiplication operation. The input message m is transformed into a blinded form m' = m * r^e mod n, where the random factor r is introduced in advance. This preliminary blinding action ensures that subsequent Montgomery operations operate on randomized data, preventing side-channel attacks while maintaining computational efficiency through the properties of modular arithmetic.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent uses a random value r as an intermediary element that mediates between the plaintext message m and the cryptographic operation. This intermediary r acts as a protective layer that obscures the actual message value during computation. The random intermediary is introduced, processed through Montgomery multiplication, and then removed through unblinding, allowing the operation to proceed efficiently without exposing sensitive data to side-channel analysis.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If Montgomery multiplication is performed repeatedly, then decryption can be completed, but secret key leakage risk increases due to side-channel attacks

Engineering Contradiction:
Improvedecryption correctnessVSAvoidsecret key leakage
Core Design Contradiction:
ReliabilityVSLoss of information

Solution Approach 1:

The patent applies preliminary anti-action by introducing blinding factors before the repeated Montgomery multiplications that could potentially leak secret key information through side channels. The random value r is incorporated into the message before decryption operations, creating a countermeasure that prevents information leakage. This anti-action is performed in advance of any potential attack vector, ensuring that even if multiple operations are performed, the secret key remains protected.

Inventive Principle:
Principle #9Preliminary anti-action

Solution Approach 2:

The patent converts the potential harm of repeated Montgomery operations (which could leak key information) into a benefit by using the same repeated operations to process blinded data. The harmful side-channel leakage is transformed into a beneficial cryptographic primitive where the repeated multiplications efficiently compute the decryption while operating on randomized intermediate values that prevent information leakage about the secret key.

Inventive Principle:
Principle #22Blessing in disguise (Convert harm into benefit)

3Object-affected harmful factors

If input message is blinded with random value, then security against side-channel attacks is improved, but additional computational steps are required

Engineering Contradiction:
Improveside-channel attack resistanceVSAvoidcryptographic operation complexity
Core Design Contradiction:
Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The patent merges the blinding operation with the Montgomery multiplication operation itself. Rather than treating blinding as a separate preliminary step followed by a separate decryption step, the method combines these operations into a unified Montgomery multiplication process. The blinded message m' = m * r^e mod n is processed through the same Montgomery multiplication hardware/software that would normally process unblinded messages, eliminating the need for separate operational sequences and reducing overall system complexity.

Inventive Principle:
Principle #5Merging (Combining)

Solution Approach 2:

The patent makes the Montgomery multiplication operation universal by designing it to handle both blinded and unblinded inputs through the same computational pathway. The Montgomery multiplication algorithm is made multi-functional so that it can process messages whether or not they have been blinded, with the unblinding factor naturally working through the modular arithmetic operations. This universality eliminates the need for separate processing paths, reducing device complexity while maintaining security.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP3776305B1Using cryptographic blinding for efficient use of montgomery multiplication
Publication Date: 2024.09.18 CRYPTOGRAPHY RESEARCH INC
  • EP3776305B1 patent drawingFigure 1
  • EP3776305B1 patent drawingFigure 2
  • EP3776305B1 patent drawingFigure 3

AI summary

Aspects of the present disclosure involves receiving an input message, generating a first random value that is used to blind the input message to prevent a side-channel analysis (SCA) attack, computing a second random value using the first random value and a factor used to compute the Montgomery form of a blinded input message without performing an explicit Montgomery conversion of the input message, and computing a signature using Montgomery multiplication, of the first random value and the second random value, wherein the signature is resistant to the SCA attack.