Exponent Splitting for DPA-Resistant Cryptographic Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Integrated circuits used in cryptographic operations are susceptible to side channel attacks, particularly Differential Power Analysis (DPA), where attackers can retrieve the exponent value by analyzing power consumption, compromising the security of encrypted information.
Innovation Solution
The exponent value is split into two shares, with each share being randomly represented and updated based on specific bits, using different equations to perform group exponentiation, making it difficult for attackers to obtain the original exponent value through power consumption analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the exponent value is used directly in cryptographic operations, then the operation is simple and efficient, but the integrated circuit becomes susceptible to Differential Power_analysis attacks
Solution Approach 1:
The exponent value is segmented into multiple shares (at least two shares) where each share represents a portion of the original exponent. These shares are processed separately through different computational paths, preventing an attacker from deriving the complete exponent value from any single share's power consumption profile.
Solution Approach 2:
The exponent value is transformed by changing its representation from a single value to multiple shares with random offsets. Each share is computed as original_exponent ± random_offset, fundamentally altering the parameter representation to obscure the true exponent value during cryptographic operations.
2Reliability
If the exponent value is split into multiple shares, then security against DPA attacks is improved, but the computational complexity increases
Solution Approach 1:
The exponent is divided into multiple shares that are processed in parallel through separate computational ladders. This segmentation allows the system to maintain security while managing computational load by distributing operations across multiple independent paths rather than sequentially processing a single complex exponent.
Solution Approach 2:
Random offsets are pre-computed and stored as shares before the actual cryptographic operation. This preliminary action prepares the exponent in a secure format that can be efficiently processed during the exponentiation operation, avoiding the need for complex real-time computations during the critical cryptographic step.
Data Source
AI summary
A first share value and a second share value may be received. A combination of the first share value and the second share value may correspond to an exponent value. The value of a first register is updated using a first equation that is based on the first and second share values and the value of a second register is updated using a second equation that is based on the second share value. One of the value of the first register or the value of the second register is selected based on a bit value of the second share value.