Elliptic Curve Scalar Multiplication via Secure-Unsecure Processor Split
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems face challenges in securely computing elliptic curve scalar multiplication in unsecured environments, where attackers can reverse-engineer code to access secure information, and existing secure processors are limited by computational power, leading to longer execution times and vulnerability to side-channel attacks.
Innovation Solution
A system utilizing both secure and unsecure processors, where the secure processor splits a scalar into random values, computes residues, and masks elliptic curve points, while the unsecure processor performs computational intensive tasks on obfuscated data, with the secure processor reconstructing the result to maintain security and leverage the unsecure processor's greater computational capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure processors are used to perform elliptic curve scalar multiplication, then security is improved, but computational power is limited leading to longer execution times
Solution Approach 1:
The patent divides the elliptic curve scalar multiplication computation into multiple segments by splitting the scalar K into m1 residues (c1, c2, ..., cm1) where each residue corresponds to a separate elliptic curve point computation. This allows the computationally intensive operations to be distributed across multiple parallel computations, improving execution time while maintaining security through the secure processor's control over the scalar decomposition and final result aggregation.
2Reliability
If secure processors are used to perform elliptic curve scalar multiplication, then security is improved, but vulnerability to side-channel attacks increases due to limited computational resources
Solution Approach 1:
The patent introduces an intermediary mechanism where the secure processor acts as a mediator that decomposes the secret scalar into multiple residues and controls the distribution of computational tasks. The unsecure processor performs the actual elliptic curve point multiplications on masked data, while the secure processor aggregates the results. This intermediary approach allows the use of more powerful unsecure hardware while maintaining security through controlled information flow and masking techniques.
Solution Approach 2:
The patent transforms the computation by changing parameters - specifically, it converts a single scalar multiplication operation into multiple point multiplications with different scalars (residues). By representing the original scalar K as a sum of residues (K = c1 + c2*2^w1 + c3*2^w2 + ... + cm1*2^w(m1-2)), the system can perform parallel computations with modified parameters that prevent side-channel leakage of the original secret scalar.
3Productivity
If unsecure processors are used to perform computational tasks, then execution speed is improved, but security is compromised due to potential reverse engineering
Solution Approach 1:
The patent extracts the secret scalar decomposition logic and result aggregation functions into the secure processor, leaving only the computationally intensive elliptic curve point multiplications for the unsecure processor. The secure processor extracts and distributes only the necessary residues and masking values, while the unsecure processor works with obfuscated data that reveals no information about the original secret scalar through reverse engineering analysis.
Solution Approach 2:
The patent performs preliminary actions in the secure processor by pre-computing the scalar decomposition into residues and preparing the masking values before transferring any data to the unsecure processor. This preliminary preparation ensures that the unsecure processor receives only processed, masked data that cannot be reverse-engineered to reveal the original secret, while the secure processor has already performed the sensitive cryptographic operations.
Data Source
AI summary
A system includes a secure processor and an unsecure processor. The secure processor is configured to: split a secure scalar K into m2 random values ki, where i is an integer index; randomly select m1-m2 values ki for the indices m2<i≤m1; select m1 mask values δi; compute m1 residues ci based upon random residues ai, δπ(i)−1, and kπ(i), wherein π(i) is a random permutation; compute m1 elliptic curve points Gi based upon random residues ai and an elliptic point to be multiplied; receive m1 elliptic curve points; and compute the elliptic curve scalar multiplication by combining a portion of the received elliptic curve points and removing the mask values δi from the portion of the received elliptic curve points. The unsecure processor is configured to: receive m1 residues ci and elliptic curve points Gi; compute m1 elliptic curve points Pi based upon the m1 residues ci and elliptic curve points Gi; and send the m1 elliptic curve points Pi to the secure processor.