Masked Scalar Blinding Circuits for ECC Side-Channel Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing elliptic curve cryptography (ECC) implementations are vulnerable to side-channel attacks (SCA) due to observable information leakage during cryptographic operations, particularly through timing, power analysis, and electromagnetic measurements, which can reveal the secret key.
Innovation Solution
Implement a masked scalar blinding technique using additional random values and logical operations to obscure the secret key, splitting it into shares and masking the vulnerability of scalar blinding operations, thereby reducing the correlation between the secret key and side-channel measurements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If scalar blinding countermeasure is implemented to protect ECC against side-channel attacks, then security against SCA is improved, but the countermeasure itself becomes vulnerable to specialized DPA attacks
Solution Approach 1:
The patent applies segmentation by dividing the private key into multiple shares (first private key value and second private key value) that sum to the original private key. This segmentation prevents direct observation of the secret key during scalar blinding operations, as each share alone reveals no information about the original key. The countermeasure is protected by ensuring that even if one share is exposed through DPA, the complete private key remains secure.
Solution Approach 2:
The patent introduces random values as intermediaries in the scalar blinding process. These random values are used to mask the private key shares during multiplication operations with the group order. The intermediaries prevent direct correlation between the private key and side-channel measurements, thereby protecting the countermeasure from DPA attacks while maintaining security.
2Reliability
If additional random values and logical operations are used to mask the secret key, then side-channel attack resistance is improved, but computational overhead and latency increase
Solution Approach 1:
The patent applies preliminary action by pre-computing certain values during the scalar blinding process. Random values are generated and prepared in advance, and their products with the group order are computed before the actual key operation. This preliminary preparation reduces the computational burden during the critical signing or verification operation, thereby minimizing latency while maintaining security.
3Object-affected harmful factors
If the private key is split into multiple shares, then vulnerability to DPA is reduced, but device complexity increases
Solution Approach 1:
The patent implements segmentation by splitting the private key into two shares using simple logical operations. The first share is obtained by ANDing the private key with a random value, and the second share is derived through logical operations on the first share and the random value. This segmentation approach protects against DPA while maintaining relatively simple circuit implementation compared to more complex secret sharing schemes.
Solution Approach 2:
The patent changes the parameters of the private key representation by transforming it into shares through logical operations with random values. This parameter transformation allows the system to work with modified key representations that are more resistant to DPA attacks. The logical operations (AND, NOT, XOR) provide a computationally efficient way to achieve this transformation without requiring complex hardware modifications.
Data Source
AI summary
Masked scalar blinding circuits for a side channel analysis (SCA) attack countermeasure are provided. A circuit can include logic gates configured to receive a private key and generate a first private key value and a second private key value that sum to the private key, a first multiplier configured to generate a first product based on a first random number and a multiplicative group order, a second multiplier configured to generate a second product based on a second random number and the multiplicative order group, and circuitry configured to generate a result and a carry out, based on the first private key value, second private key value, the first product, and the second product.