Domain Embedding for Side-Channel Resistant Cryptographic Masking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems, particularly lattice-based post-quantum cryptographic applications, are vulnerable to side-channel attacks due to exposure of private keys during decryption processes, which involves repeated multiplication of secret polynomials with ciphertexts.
Innovation Solution
The implementation of domain embedding techniques, specifically using Number Theoretic Transforms (NTTs) and auxiliary domains, allows for efficient masking and unmasking of polynomial operations without requiring separate computations on masked data, thereby protecting secret data from side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional masking techniques are used to protect secret data during polynomial multiplication, then security against side-channel attacks is improved, but additional unmasking computations are required which increase processing time and reduce computational throughput
Solution Approach 1:
The patent extracts the masking operations from the main computational flow by performing them in a separate auxiliary domain ( NTT domain). The secret polynomial s(x) and ciphertext polynomial c(x) are transformed to the auxiliary domain, where masking is applied independently. This separation allows masking to be applied without interfering with the main decryption throughput, as the masked values are processed in parallel or pre-computed in the auxiliary domain before being transformed back to the working domain.
Solution Approach 2:
The patent introduces an auxiliary domain (NTT domain) as an intermediary between the working domain and the masking operations. By transforming polynomials to this intermediate domain, applying masking, and then transforming back, the system achieves secure computation without requiring additional unmasking steps in the main computational path. The auxiliary domain acts as a mediator that enables masking while preserving computational efficiency.
2Reliability
If separate unmasking computations are performed on masked data, then security is maintained, but latency increases due to additional processing steps
Solution Approach 1:
The patent applies masking in advance during the NTT transformation phase, before the main polynomial multiplication operations. By pre-computing the masked values in the auxiliary domain and preparing the masking polynomials beforehand, the system eliminates the need for time-consuming unmasking operations after decryption. The masking is performed as a preliminary action that integrates seamlessly into the existing computational flow without adding post-processing latency.
3Ease of operation
If repeated multiplication of secret polynomials with ciphertexts is performed during decryption, then decryption functionality is achieved, but secret data becomes exposed to side-channel attacks
Solution Approach 1:
The patent moves the vulnerable polynomial multiplication operations to another dimension by transforming them to the NTT domain. In this transformed domain, the multiplication operations are performed on masked values rather than direct secret polynomials, and the results are then transformed back. This dimensional change (from time-domain to frequency-domain via NTT) allows the same decryption functionality to be achieved while operating on masked representations that are resistant to side-channel analysis.
Data Source
AI summary
Disclosed aspects and implementations are directed to systems and techniques for protecting cryptographic operations against side-channel attacks. In one example, polynomials associated with secret data and public data defined on a working domain having a first dimension are mapped to an auxiliary domain having a larger second dimension. The mapped polynomials are masked using masking polynomials associated with a kernel of a homomorphism transformation from the auxiliary domain to the working domain. One or more computations are then performed on the masked polynomials in the auxiliary domain and an output is transformed from the auxiliary domain to the working domain.