Encryption Apparatus Using S-Box for Side-Channel Attack Resistance

Solution Overview

Problem

Conventional encryption processing apparatuses face challenges in reducing circuit scale and power consumption while effectively countering side-channel attacks, such as DPA, which estimate secret keys by measuring power consumption during encryption or decryption processes.

Innovation Solution

The encryption processing apparatus employs a side-channel countermeasure that reuses mask values to generate new intermediate masks through linear and non-linear transformations, eliminating the need for external random number generators, thereby reducing circuit scale and power consumption.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a physical random number generator circuit or pseudo random number generator circuit is incorporated independently of the encryption circuit to counter side-channel attacks, then the side-channel attack resistance is improved, but the circuit scale increases and power consumption increases

Engineering Contradiction:

Improveside-channel attack resistanceVSAvoidcircuit scale

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges the random number generation function with the encryption circuit by reusing the S-box (substitution box) component that already exists in the encryption algorithm. The S-box is used both for its cryptographic function and for generating random numbers through its non-linear transformation properties, eliminating the need for a separate random number generator circuit.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The S-box component is given multiple functions: it serves both as a cryptographic substitution element in the encryption process and as a random number generator. This multi-functionality allows the same hardware component to fulfill both security requirements and random number generation needs without increasing circuit scale.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Reliability

If a physical random number generator circuit or pseudo random number generator circuit is incorporated independently of the encryption circuit to counter side-channel attacks, then the side-channel attack resistance is improved, but the power consumption increases

Engineering Contradiction:

Improveside-channel attack resistanceVSAvoidpower consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent merges the random number generation function with the encryption circuit by reusing the S-box (substitution box) component that already exists in the encryption algorithm. The S-box is used both for its cryptographic function and for generating random numbers through its non-linear transformation properties, eliminating the need for a separate random number generator circuit.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The encryption circuit's existing S-box component serves itself by generating random numbers internally without requiring external random number generation resources. This self-service approach allows the circuit to generate its own masking values using already-present components, reducing overall power consumption.

Inventive Principle:

Principle #25Self-service

3Device complexity

If mask values are reused to generate new intermediate masks through linear and non-linear transformations, then the circuit scale is reduced and power consumption is reduced, but the ability to invalidate DPA attacks must be maintained

Engineering Contradiction:

Improvecircuit scaleVSAvoidDPA attack resistance

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The patent applies preliminary masking to intermediate values during the encryption process by combining them with random values before storage or further processing. This preliminary action prevents side-channel attacks by ensuring that even if power consumption is measured, the attacked values are already masked and do not directly reveal secret key information.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent changes the parameters of intermediate values by applying non-linear transformations (through the S-box) to the masking values. This transformation ensures that the relationship between the original masking value and the transformed value is non-linear, which is critical for maintaining security against differential power analysis attacks while using the same hardware components.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS8724804B2Encryption processing apparatus

Publication Date: 2014.05.13 KK TOSHIBA

AI summary

According to an embodiment, a first linear transformation unit performs a linear transformation from mask data to first mask data. A second linear transformation unit performs a linear transformation from mask data to second mask data. A first calculator calculates first data based upon data to be processed and the first mask data. A selecting unit selects the first data or the second mask data. A non-linear transformation unit performs a non-linear transformation on the selected first data or second mask data. A second calculator calculates second data based upon the first data after the non-linear transformation and the mask data. A third linear transformation unit performs a linear transformation on the second data. The second data after the linear transformation by the third linear transformation unit is retained as new data to be processed, and the second mask data after the non-linear transformation is retained as new mask data.