Cryptographic Device Tamper-Resistant Shift Function

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

White-box implementations of block ciphers, such as DES, are vulnerable to differential fault attacks, where attackers can modify variables to emulate physical faults and recover secret keys, even if direct key extraction is prevented.

Innovation Solution

Incorporating tamper-resistance shift functions before the round function and output units to restrict modifications and errors, thereby handicapping differential fault attacks by ensuring that only authorized changes to encoded values are allowed.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a white-box implementation of block cipher is used, then direct key extraction is prevented, but the implementation becomes vulnerable to differential fault attacks

Engineering Contradiction:
Improvekey protectionVSAvoiddifferential fault attack vulnerability
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary encoding transformations to the block cipher implementation before it is exposed to potential attacks. The cipher is transformed into an equivalent form with encoded variables and table look-up operations, which prevents direct key extraction while maintaining cryptographic functionality. This preliminary transformation is the foundation that enables subsequent fault attack resistance mechanisms.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent introduces intermediate encoding layers and verification mechanisms as mediators between the cryptographic operations and the external environment. These intermediaries include encoded variable representations, verification variables, and controlled modification mechanisms that prevent direct access to sensitive internal states while allowing controlled interactions. The mediators ensure that even if an attacker can observe or modify variables, they cannot directly extract keys or easily mount differential fault attacks.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Difficulty of detecting and measuring

If variables are made accessible for observation, then implementation transparency is achieved, but secret key information may be exposed through fault attacks

Engineering Contradiction:
Improveimplementation transparencyVSAvoidsecret key exposure
Core Design Contradiction:
Difficulty of detecting and measuringVSLoss of information

Solution Approach 1:

The patent creates encoded copies of the cryptographic variables and operations rather than exposing the original plaintext representations. The block cipher is implemented using encoded variables that are mathematical equivalents but visually and structurally different from the original form. Table look-up operations work on these encoded copies, providing implementation transparency through observable operations while the encoded nature prevents direct inference of secret keys even when variables are observed.

Inventive Principle:
Principle #26Copying

Data Source

PatentEP3289579B1Cryptographic device for calculating a block cipher
Publication Date: 2021.03.10 KONINKLIJKE PHILIPS NV
  • EP3289579B1 patent drawingFigure 1
  • EP3289579B1 patent drawingFigure 2.1~2.5
  • EP3289579B1 patent drawingFigure 2.6

AI summary

A cryptographic device (100) for calculating a block cipher (500) on a block cipher input (105) and producing a block cipher output (106), the block cipher calculation operating on encoded values (210), the cryptographic device comprising a round function unit (140; 300)for applying the final round (118) of the multiple rounds of cryptographic processing implementing the block cipher, a first output unit (160) and second output unit (180) for decoding encoded output data (132, 152).