Cryptographic Group-Order Padding Against Low-Value Key Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic methods are vulnerable to attacks, particularly profiled side-channel attacks, when attackers choose a low-value secret key, leading to identical cryptographic algorithm implementations and compromising the security of the system.
Innovation Solution
A cryptographic processing method that involves adding the order or a multiple of the order to a first number, determining a random number, and performing Euclidean division to generate a second element through a series of group operations, ensuring the quotient by the random number is non-zero, thereby enhancing security even with low-value secret keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the secret key is chosen to be of low value, then the cryptographic algorithm implementation becomes identical across different implementations, but the security against profiled side-channel attacks is compromised
Solution Approach 1:
The patent applies preliminary action by adding the order or a multiple of the order to the first number before performing the Euclidean division. This pre-modification ensures that the second number has a sufficiently large value, which guarantees a non-zero quotient when divided by the random number. This preliminary step prevents the security vulnerability that would otherwise arise from using low-value secret keys, as it ensures the cryptographic implementation maintains variability across different executions while preserving the intended computational efficiency.
2Productivity
If the quotient obtained during cryptographic algorithm execution is zero, then the implementation becomes identical across different runs, but this enables profiled side-channel attacks
Solution Approach 1:
The patent applies parameter changes by modifying the first number through addition of the group order or its multiple before proceeding with the Euclidean division. This transformation changes the parameter value (the second number) to ensure it falls within a range that produces a non-zero quotient. By adjusting this parameter, the patent maintains computational efficiency while eliminating the harmful effect of identical implementations that would otherwise occur with low-value secret keys.
3Reliability
If a random number is used in the Euclidean division, then the cryptographic implementation varies across executions, but the quotient may become zero with low-value secret keys
Solution Approach 1:
The patent applies preliminary action by pre-modifying the first number with the group order or its multiple before the Euclidean division with the random number. This ensures that the second number is sufficiently large to produce a non-zero quotient, thereby maintaining the security benefits of randomization without falling into the trap of zero quotients that would compromise security. The preliminary action resolves the contradiction by ensuring the randomization process remains effective.
Solution Approach 2:
The patent applies parameter changes by transforming the first number through addition of the group order before performing the division. This parameter transformation ensures that the resulting second number produces a non-zero quotient when divided by the random number. The parameter change maintains the variability introduced by randomization while preventing the harmful outcome of zero quotients, thus balancing security and computational correctness.
Data Source
Figure 1~4
AI summary
A cryptographic processing method includes the following steps: - obtaining (E32) a second number (d") determined by adding to a first number the order of a finite group or a multiple of this order; - determining (E34) a quotient (q) and a remainder (r) by dividing the second number (d") by a random number (a); - obtaining (E36) a third element (l) equal to the combination of elements equal to a first element of the finite group and in number equal to the product of the quotient (q) and the random number (a); - obtaining (E38) a fourth element (J) equal to the combination of elements equal to the first element and in number equal to the remainder (r); - determining (E40) a second element (P) by combining the third element (l) and the fourth element (J).