Instruction Fetch Control for Timing Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption technologies face vulnerabilities in timing attacks due to differences in processing time and power consumption caused by conditional branching, which can lead to the leakage of secret information, especially when implemented in semiconductor devices.
Innovation Solution
The solution involves an information processor with an instruction fetch unit and decode unit that aligns the fetch timing of instructions regardless of branch conditions, ensuring equal processing time and power consumption by refetching instructions and using dummy operations to eliminate timing and power differences.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conditional branch instructions are used in encryption algorithms, then processing speed can be optimized by skipping unnecessary calculations, but processing time varies causing vulnerability to timing attacks
Solution Approach 1:
The patent applies preliminary action by pre-calculating and storing remainder values in a lookup table before the actual encryption operation. When processing encryption, the system retrieves pre-computed remainders based on the secret key bits, eliminating the need for conditional branching during the critical encryption path. This approach maintains high processing speed while ensuring constant execution time resistant to timing attacks.
Solution Approach 2:
The patent segments the encryption process into two distinct phases: a preprocessing phase where remainder tables are generated and stored, and an execution phase where encryption is performed using table lookups without conditional branches. This segmentation allows the time-consuming calculations to be performed once during table generation, while the actual encryption operates in constant time, resolving the contradiction between speed optimization and timing attack resistance.
2Measurement precision
If conditional branch instructions are used to handle different calculation cases, then correct results are obtained for different input values, but power consumption varies causing vulnerability to differential power analysis
Solution Approach 1:
The patent pre-computes remainder values for all possible key combinations and stores them in lookup tables during a preprocessing phase. During actual encryption operations, the system performs table lookups based on the secret key without executing conditional branches. This eliminates power consumption variations that would otherwise leak information through differential power analysis, while maintaining calculation accuracy through the pre-computed correct remainder values.
Solution Approach 2:
The patent creates copies of remainder values in lookup tables for different key scenarios. Instead of dynamically calculating remainders with conditional branches during encryption, the system copies and retrieves pre-computed remainder data from tables indexed by key bits. This copying approach ensures correct results for different inputs while maintaining uniform power consumption patterns.
3Reliability
If dummy operations are added to equalize processing time, then timing attack resistance is improved, but actual processing time increases
Solution Approach 1:
The patent moves the time-consuming remainder calculation operations to a preliminary table generation phase that occurs once before encryption operations. During actual encryption, the system performs fast table lookups without conditional branches, achieving both constant execution time and high speed. This eliminates the need for dummy operations while maintaining timing attack resistance, as the critical encryption path inherently executes in uniform time.
Data Source
AI summary
In implementing an encryption algorithm or the like in a computer, it is difficult to align timing at which an instruction is executed regardless of presence or absence of branch in a case of including a conditional branch instruction. In order to solve the problem, provided is an information processor (1), including: an instruction fetch unit (instruction fetch circuit 200) that fetches an instruction code to be executed to output the fetched instruction code; and an instruction decode unit (instruction decode circuit 300) that decodes the instruction code that is output from the instruction fetch unit, in which the instruction decode unit outputs, upon detection of the instruction code being a conditional branch instruction, a control signal to the instruction fetch unit so that fetch timing of the successive instruction code becomes identical with each other regardless of the presence or absence of the branch due to the branch condition.