Cryptographic Module Key-Input Mode Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic modules are vulnerable to attacks where secret key data can be discovered by manipulating input data during cryptographic operations, as they may output partial results before all key data has been processed, allowing attackers to deduce the key.
Innovation Solution
A cryptographic module that switches between key-input and data-input modes, ensuring all key data is included in the combining operation and processed fully before outputting any results, with a separate data-input mode allowing shorter data lengths to be processed securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the cryptographic module outputs partial results before all key data has been processed, then the processing speed is improved, but the security is worsened as attackers can discover key data
Solution Approach 1:
The patent introduces a control mechanism that performs preliminary verification to ensure all key data has been fully processed before allowing any output. The control logic monitors the completion status of key data processing and only enables output after confirmation that the entire key has been consumed in the cryptographic operation, preventing attackers from obtaining partial results that could reveal key information.
2Reliability
If the cryptographic module requires all key data to be processed before outputting results, then the security is improved, but the processing speed is worsened
Solution Approach 1:
The patent introduces a control logic intermediary that mediates between the cryptographic processing unit and the output interface. This control logic monitors the processing state and manages the output timing, allowing the system to maintain high processing speed while ensuring security by only enabling output after all key data has been processed. The intermediary decouples the processing speed from the output timing constraint.
3Device complexity
If the cryptographic module uses a single mode for both key-input and data-input operations, then the device complexity is reduced, but the security is worsened due to potential key exposure
Solution Approach 1:
The patent implements dynamic mode switching within the cryptographic module, allowing it to operate in different modes (key-input mode and data-input mode) based on the operational requirements. The control logic dynamically adjusts the processing and output behavior according to the current mode, ensuring that in key-input mode, output is restricted until all key data is processed, while in data-input mode, normal processing continues. This dynamic adaptation maintains security without requiring completely separate hardware paths.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A cryptographic module (14) is switchable between a key-input mode and a data-input mode. In the key-input mode, the cryptographic module (14) receives key data, key length information and first input data, combines an amount of the key data corresponding to the key length information with the first input data to produce combined data, wherein a key-influenced length of the combined data is the shortest length of the combined data that contains every data bit of the combined data whose value depends on the key data. It performs a cryptographic operation on the combined data to generate first output data and does not output any of the first output data until after the cryptographic operation has been applied to all of the key-influenced length of the combined data. In the data-input mode of operation, the cryptographic module (14) receives a quantity of second input data whose length can be less than said key- influenced length, performs the cryptographic operation on the second input data to generate second output data and outputs the second output data.