Hash Round Masking to Obscure Real and Dummy Iterations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing hash algorithm implementations are vulnerable to sophisticated side-channel attacks, with existing countermeasures failing to adequately protect against distinguishing real and dummy round iterations and being prone to security vulnerabilities.
Innovation Solution
Introduce dummy iterations in hash kernel rounds with dynamic round masks, using a sequence of control values to distinguish between real and dummy iterations, and process vectors with predefined algorithms while masking inputs and outputs to obscure the distinction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dummy round iterations are executed in hash compression functions with separate output buffers, then side-channel protection is improved, but the execution time increases
Solution Approach 1:
The patent merges the real output buffer and dummy output buffer into a single unified output buffer. This eliminates the need for separate buffers while maintaining the dummy round iteration protection mechanism, thereby reducing the execution time overhead without compromising side-channel protection.
Solution Approach 2:
The single output buffer serves dual purposes: it stores results from both real iterations and dummy iterations. This multi-functional use of the buffer eliminates the need for separate buffer management and reduces the overall execution time while maintaining security against side-channel attacks.
2Reliability
If additional hiding layers and random buffer swaps are implemented, then output buffer leakage is reduced, but circuit size increases
Solution Approach 1:
The patent combines multiple hiding mechanisms into a unified approach using a single output buffer with controlled write operations. Instead of implementing separate hiding layers and random buffer swaps that increase circuit complexity, the invention uses a streamlined method that achieves the same leakage protection with reduced hardware overhead.
3Ease of manufacture
If static data in shares is used for masking, then implementation simplicity is maintained, but protection against higher order attacks is insufficient
Solution Approach 1:
The patent introduces dynamic masking values that change during the execution of dummy round iterations, rather than using static data in shares. This dynamic approach provides protection against higher order attacks while maintaining implementation simplicity through the use of a unified output buffer and controlled write operations.
4Reliability
If real and dummy iterations use different output buffers, then side-channel information leakage is reduced, but the distinction between real and dummy rounds becomes detectable
Solution Approach 1:
The patent merges the output buffers for real and dummy iterations into a single buffer, which prevents side-channel information leakage while simultaneously making it difficult for attackers to distinguish between real and dummy rounds. The unified buffer structure ensures that both types of iterations write to the same location, obscuring the distinction.
Solution Approach 2:
The patent applies different write control strategies to different iterations within the same buffer. Real iterations write their results to specific locations based on their index, while dummy iterations write to different locations or overwrite previous values. This local differentiation within the unified buffer structure provides security without creating detectable patterns.
Data Source
AI summary
A data processing device comprises a round mask generator, a controller configured to control values and a processor configured to iteratively process a vector of values, where each iteration comprises receiving a respective input vector, generating a processing result vector by applying a predefined processing algorithm to the input vector, and, in reaction to that the control value associated with the iteration indicates that the iteration is a dummy iteration, outputting the input vector re-masked with the round mask associated with the next iteration of the sequence of iterations and, in reaction to that the control value associated with the iteration indicates that the iteration is a real iteration, generating a masked processing result vector by masking the processing result vector with the round mask associated with the next iteration and outputting the masked processing result vector.