Encryption Device Signature Generation Against Side-Channel Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption devices are vulnerable to side-channel attacks (SCAs), such as power analysis attacks and error injection attacks, which can compromise the security of digital signatures by revealing secret keys and random numbers.
Innovation Solution
The encryption device employs a method of generating electronic signatures using a combination of random numbers and secret keys through specific mathematical operations, including multiplication and modular operations, to create secure parameters that protect against SCAs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional electronic signature generation methods are used, then the signature generation process is simple and fast, but the device becomes vulnerable to side-channel attacks that can reveal secret keys and random numbers
Solution Approach 1:
The electronic signature generation process is divided into multiple independent stages: generating first and second random numbers, calculating first and second parameters through separate multiplication operations, and producing first and second electronic signatures through distinct computational paths. This segmentation prevents attackers from extracting complete secret information through single-point side-channel analysis.
Solution Approach 2:
The patent introduces multiple random parameters (first random number, second random number) and performs multiple multiplication operations to generate different parameters (first parameter, second parameter) that are used in subsequent signature generation. By changing and randomizing parameters throughout the computation, the patent ensures that side-channel measurements capture only randomized intermediate values rather than stable secret key patterns.
2Reliability
If multiple random numbers and multiplication operations are used to protect against attacks, then security against side-channel attacks is improved, but the power consumption and operation time increase
Solution Approach 1:
The patent converts the harmful effect of power consumption (which side-channel attackers exploit) into a beneficial randomizing factor. By designing the computation to inherently consume variable power through multiple random operations and parameter changes, the patent ensures that power measurements reveal only randomized computational patterns rather than deterministic secret key operations, thus converting the attacker's measurement target into a security feature.
3Reliability
If traditional signature generation is used, then the operation time is short, but the device is susceptible to error injection attacks that can compromise the secret key
Solution Approach 1:
The patent performs preliminary random number generation and parameter calculation operations before the actual signature generation. By pre-computing randomized parameters (first parameter, second parameter) using multiple random numbers and multiplication operations, the patent ensures that when the actual signing occurs, the secret key is already protected by layers of randomization. This preliminary preparation adds security against error injection while managing overall execution time through structured computation flow.
Data Source
AI summary
The present disclosure relates to methods, devices, and systems for generating a signature of a message by a first device based on a secret key and a public key. The method includes generating a first parameter based on a first multiplication operation on the secret key and a first random number. The method further includes generating a first electronic signature based on the first parameter and the public key. The method further includes generating a second parameter based on the first random number, a second random number, and the message. The method further includes generating a second electronic signature based on the first parameter, the second parameter, the second random number, and the first electronic signature. The method further includes outputting, to a second device, the message, the first electronic signature, and the second electronic signature.