Dynamic Masking for DES Round Keys Against Side-Channel Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Devices implementing DES encryption methods with 'on demand' round key generation are vulnerable to side-channel attacks, as the Hamming distance between successive round keys remains observable, and existing masking techniques do not effectively protect against such attacks.
Innovation Solution
A method involving the use of alternating binary masks (all ones and all zeros) for each round key, where each round key is masked with a unique mask, making it difficult for attackers to distinguish between key differences and mask differences, thereby obscuring the secret key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If round keys are generated on demand and masked with a predetermined mask, then memory consumption is reduced, but the device remains vulnerable to side-channel attacks because the Hamming distance between masked keys remains observable
Solution Approach 1:
The patent applies dynamics by making the mask variable rather than fixed. The mask changes according to the round index and is computed dynamically using a non-linear function of the round index, ensuring that each round key is masked with a different pattern. This dynamic masking prevents attackers from observing consistent Hamming distance patterns between successive masked round keys, thereby securing the system while maintaining on-demand key generation.
Solution Approach 2:
The patent changes the parameter of the mask from a static predetermined value to a dynamic value that varies with the round index. Specifically, the mask for round r is computed as a non-linear function of r, causing the mask parameters to change with each encryption round. This parameter change ensures that the Hamming distance between consecutive masked round keys does not reveal information about the secret key, resolving the security vulnerability.
2Device complexity
If a fixed mask is applied to all round keys, then the masking operation is simple, but it fails to protect against side-channel attacks as the Hamming distance remains unchanged
Solution Approach 1:
The patent transforms the static masking operation into a dynamic one by computing the mask based on the round index. Instead of using a fixed mask for all rounds, the system computes a unique mask for each round using a non-linear function of the round index. This increases the complexity slightly but provides effective security by ensuring that the Hamming distance between masked round keys does not leak secret key information.
Solution Approach 2:
The patent applies preliminary action by pre-computing or pre-determining the mask values based on round indices before the actual encryption rounds begin. The masks are prepared in advance according to the non-linear function of round indices, so that when encryption rounds execute, the appropriate masks are already available. This approach balances complexity by avoiding runtime mask computation while still providing dynamic masking protection.
Data Source
AI summary
The present invention relates to a method for encryption or decryption of a data block from a secret key, wherein the method comprises: generating a first round key kr dependent on the secret key, selecting each of a first mask (−br) and a second mask (−br+1) in a set consisting of a mask of bits all at one and a mask of all zero bits, calculating a first masked key kr′ from the first round key kr and the first mask (−br) as follows:kr′=kr⊕(−br)wherein ⊕ is an exclusive disjunction, executing a first encryption round applied to two first data dependent on the data block, by means of the first masked round key kr′ so as to produce two second data, after producing the first masked key kr′, generating a second round key kr+1 dependent on the secret key, calculating a second masked key kr+1′ from the second round key kr+1 and the second mask (−br+1) as follows: kr+1′=kr+1⊕(−br+1), calculating two third data Lrb<sub2>r+1</sub2>, Rrb<sub2>r+1 </sub2>as follows:Rrb<sub2>r+1</sub2>=Rrb<sub2>r</sub2>⊕(−br−1)⊕(−br)Lrb<sub2>r+1</sub2>=Lrb<sub2>r</sub2>⊕(−br−1)⊕(−br)and executing a second encryption round following the first encryption round, wherein the second encryption round is applied to the two third data Lrb<sub2>r+1</sub2>, Rrb<sub2>r+1 </sub2>by means of the second masked round key kr+1′.