Cryptographic Blinding for Montgomery Multiplication Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In public-key cryptography systems, the conversion of input messages into Montgomery form for Montgomery multiplication is computationally resource-intensive and vulnerable to side-channel attacks, leading to potential secret key leakage during cryptographic operations.
Innovation Solution
The technique avoids explicit conversion to Montgomery form by using a random value to blind the input message, performing modular reduction in side-channel-attack-resistant cryptographic computation, thereby reducing functional calls and preventing message value leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If explicit conversion to Montgomery form is performed, then Montgomery multiplication can be executed, but computational resources are consumed and side-channel attack vulnerability increases
Solution Approach 1:
The patent applies preliminary action by performing blinding with a random value r before the Montgomery multiplication operation. The input message m is transformed into a blinded form m' = m * r^e mod n, where the random factor r is introduced in advance. This preliminary blinding action ensures that subsequent Montgomery operations operate on randomized data, preventing side-channel attacks while maintaining computational efficiency through the properties of modular arithmetic.
Solution Approach 2:
The patent uses a random value r as an intermediary element that mediates between the plaintext message m and the cryptographic operation. This intermediary r acts as a protective layer that obscures the actual message value during computation. The random intermediary is introduced, processed through Montgomery multiplication, and then removed through unblinding, allowing the operation to proceed efficiently without exposing sensitive data to side-channel analysis.
2Reliability
If Montgomery multiplication is performed repeatedly, then decryption can be completed, but secret key leakage risk increases due to side-channel attacks
Solution Approach 1:
The patent applies preliminary anti-action by introducing blinding factors before the repeated Montgomery multiplications that could potentially leak secret key information through side channels. The random value r is incorporated into the message before decryption operations, creating a countermeasure that prevents information leakage. This anti-action is performed in advance of any potential attack vector, ensuring that even if multiple operations are performed, the secret key remains protected.
Solution Approach 2:
The patent converts the potential harm of repeated Montgomery operations (which could leak key information) into a benefit by using the same repeated operations to process blinded data. The harmful side-channel leakage is transformed into a beneficial cryptographic primitive where the repeated multiplications efficiently compute the decryption while operating on randomized intermediate values that prevent information leakage about the secret key.
3Object-affected harmful factors
If input message is blinded with random value, then security against side-channel attacks is improved, but additional computational steps are required
Solution Approach 1:
The patent merges the blinding operation with the Montgomery multiplication operation itself. Rather than treating blinding as a separate preliminary step followed by a separate decryption step, the method combines these operations into a unified Montgomery multiplication process. The blinded message m' = m * r^e mod n is processed through the same Montgomery multiplication hardware/software that would normally process unblinded messages, eliminating the need for separate operational sequences and reducing overall system complexity.
Solution Approach 2:
The patent makes the Montgomery multiplication operation universal by designing it to handle both blinded and unblinded inputs through the same computational pathway. The Montgomery multiplication algorithm is made multi-functional so that it can process messages whether or not they have been blinded, with the unblinding factor naturally working through the modular arithmetic operations. This universality eliminates the need for separate processing paths, reducing device complexity while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Aspects of the present disclosure involves receiving an input message, generating a first random value that is used to blind the input message to prevent a side-channel analysis (SCA) attack, computing a second random value using the first random value and a factor used to compute the Montgomery form of a blinded input message without performing an explicit Montgomery conversion of the input message, and computing a signature using Montgomery multiplication, of the first random value and the second random value, wherein the signature is resistant to the SCA attack.