Elliptic Curve Point Multiplication via Fixed MSB Position
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional elliptic curve point multiplication procedures are vulnerable to side-channel attacks due to variations in resource consumption, particularly when operations involving zero consume less resources than others, potentially leaking information about the secret multiplier k.
Innovation Solution
A method is introduced where a scalar multiplier k is modified by adding a randomly generated integer multiplier r times the order n, with r constrained within a specific range to ensure that the bit position of the most significant bit of k+r*n remains even and fixed, thus making resource consumption independent of k, thereby reducing side-channel leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional EC point multiplication procedures are used, then the computation is efficient and straightforward, but resource consumption varies depending on the value of k, leading to side-channel information leakage
Solution Approach 1:
The patent applies preliminary action by pre-determining a fixed sequence of operations and pre-calculating the range for integer multiplier r before the actual point multiplication. The most significant bit position is fixed in advance, and the operation sequence is predetermined regardless of k's value, preventing side-channel leakage while maintaining procedural efficiency
Solution Approach 2:
The patent changes parameters by introducing a random integer multiplier r within a specifically determined range, and adding it to the scalar multiplier k. This parameter transformation (k + r*n) ensures the most significant bit position remains fixed and even, making resource consumption independent of the original k value while preserving cryptographic security
2Reliability
If a random multiple of n is added to k to address leakage, then some information leakage is reduced, but operations still do not consume uniform resources, allowing information leakage to occur
Solution Approach 1:
The patent transforms the parameter k by adding a random integer multiplier r (within a determined range) times n, where the range is specifically calculated to ensure the most significant bit position of (k + r*n) is fixed and even. This parameter change ensures uniform resource consumption across all operations, completely preventing timing and power analysis attacks that rely on detecting variations in resource usage patterns
3Productivity
If operations involving zero consume less resources than other operations, then computational efficiency is improved, but side-channel attacks can exploit these variations to extract information about k
Solution Approach 1:
The patent changes the parameter k to (k + r*n) where r is a random integer within a specifically determined range. This transformation ensures the most significant bit position is fixed and even, guaranteeing that the same sequence of operations is always performed regardless of the original k value. This eliminates resource consumption variations that would otherwise reveal information about k, while maintaining computational efficiency through the fixed operation sequence
Solution Approach 2:
The patent applies preliminary action by determining the range for r and fixing the most significant bit position before executing the point multiplication. This pre-determination ensures that the operation sequence is independent of k's value, preventing attackers from exploiting timing or power consumption variations to infer information about the secret multiplier
Data Source
AI summary
One feature pertains to elliptic curve (EC) point multiplication for use in generating digital signatures. In one aspect, a scalar multiplier (k) of a base point (P) of order (n) is selected on an elliptic curve for use with EC point multiplication. An integer value (r) is then randomly generated from within a range of values constrained so that, regardless of the particular value of (r) obtained within the range, EC point multiplication procedures performed using the scalar multiplier (k) summed with a product of the integer multiplier (r) and the order (n) consume device resources independent of the value of the scalar multiplier (k) to thereby reduce or eliminate side-channel leakage. This may be achieved by determining the range of values for r so that the bit position of the most significant bit of k+(r*n) will be even and fixed for a particular elliptic curve.