Elliptic Curve Diffie-Hellman Key Protection Against White-Box Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cryptographic implementations are insecure against white-box attacks, as they expose cryptographic keys to attackers who can analyze all aspects of the implementation, particularly in key agreement schemes like Diffie-Hellman, where the shared secret can be compromised if an attacker observes computations on a party's device.
Innovation Solution
The proposed methods generate and manipulate transformed random numbers to create obfuscated public keys and shared secrets in Elliptic Curve Diffie-Hellman (ECDH) schemes, using pre-computed auxiliary elliptic curve points and transformations like linear and pseudo-Hadamard transformations to protect keys from white-box attackers, ensuring the same public and shared secrets are generated without exposing the original random numbers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional cryptographic implementations are used, then ease of operation is maintained, but security against white-box attacks deteriorates
Solution Approach 1:
The patent segments the random number into multiple components (r1, r2, ..., rk) that are combined with pre-computed auxiliary points (G1, G2, ..., Gk) to generate the public key. This segmentation allows the secret random number to be protected while still producing the correct cryptographic output, as the attacker would need to compromise all segments simultaneously to reconstruct the original random number.
Solution Approach 2:
The patent performs preliminary computation of auxiliary elliptic curve points (G1, G2, ..., Gk) offline before the actual key agreement protocol execution. These pre-computed points are stored and reused during the protocol, allowing the random number to be processed in a protected manner without exposing the secret values during critical operations.
2Reliability
If the random number is processed directly, then computational efficiency is maintained, but the random number becomes exposed to white-box attackers
Solution Approach 1:
The patent introduces auxiliary elliptic curve points (G1, G2, ..., Gk) as intermediaries between the secret random number components and the public key generation process. These intermediary points enable the computation to proceed without directly exposing the random number, as they act as protective layers that mask the secret values during computation.
Solution Approach 2:
The patent transforms the single random number parameter into multiple random number components (r1, r2, ..., rk) that are combined with auxiliary points. This parameter transformation changes the computational structure from a direct single-value operation to a multi-component operation that inherently protects the secret through distribution and masking.
3Reliability
If transformed random numbers are used to protect keys, then security against white-box attacks is improved, but device complexity increases
Solution Approach 1:
The patent segments both the random number and the auxiliary points into corresponding components that are combined through scalar multiplication. This segmentation strategy protects the shared secret by ensuring that even if some components are compromised, the attacker cannot reconstruct the full shared secret without all segments, thereby improving reliability while managing complexity through structured computation.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
In the present disclosure, implementations of Diffie-Hellman key agreement are provided that, when embodied in software, resist extraction of cryptographically sensitive parameters during software execution by white-box attackers. Four embodiments are taught that make extraction of sensitive parameters difficult during the generation of the public key and the computation of the shared secret. The embodiments utilize transformed random numbers in the derivation of the public key and shared secret. The traditional attack model for Diffie-Hellman implementations considers only black-box attacks, where attackers analyze only the inputs and outputs of the implementation. In contrast, white-box attacks describe a much more powerful type of attacker who has total visibility into the software implementation as it is being executed.