Key-Dependent Exchange Circuit with Randomization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current key-dependent exchange methods in public key cryptosystems are vulnerable to side-channel attacks, as power traces can reveal the key during operations like Modular Exponentiation and Scalar Multiplication, allowing attackers to analyze Hamming weights and determine secret information.
Innovation Solution
A circuit for combined key value-dependent exchange and randomization is introduced, which splits a key value into shares and uses an exchange and randomizing circuit to conditionally exchange and randomize values, ensuring that the exchanged values do not retain the same Hamming weight characteristics, thereby masking the exchange process through multiplicative or additive randomization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If key-dependent exchange operation is performed to protect against side-channel attacks, then security against side-channel attacks is improved, but the exchange operation itself becomes vulnerable to power trace analysis and Hamming weight comparison attacks
Solution Approach 1:
The patent introduces a randomization value as an intermediary element that is combined with the exchanged values through arithmetic operations. This randomization value acts as a mediator that masks the relationship between the original values and the exchanged values, preventing direct analysis of power traces and Hamming weights from revealing key information.
Solution Approach 2:
The patent changes the parameters of the values by applying randomization through arithmetic operations (addition, subtraction, multiplication, or division) before the exchange operation. This parameter transformation ensures that even though the exchange depends on the key, the randomized values do not retain the Hamming weight characteristics that would otherwise leak information about the key or the exchanged data.
2Device complexity
If simple exchange operation is used, then device complexity is reduced, but security against side-channel attacks deteriorates
Solution Approach 1:
The patent merges the exchange operation with a randomization operation into a single combined operation. Instead of performing a simple exchange followed by separate randomization steps, the randomization is integrated into the exchange process itself, combining multiple security functions into one operation that maintains low device complexity while enhancing security.
Solution Approach 2:
The combined operation serves multiple functions simultaneously: it performs the key-dependent exchange, applies randomization to mask Hamming weights, and prevents power trace analysis. This multi-functionality allows the system to achieve high security without requiring separate dedicated circuits for each function, thus maintaining low device complexity.
3Reliability
If key value is split into shares to enhance security, then protection against power trace analysis is improved, but device complexity increases due to additional control input circuit
Solution Approach 1:
The patent segments the key value into multiple shares that are distributed to different control input circuits. This segmentation allows the key to be processed in parts, with each share controlling specific aspects of the exchange and randomization operations. The segmentation approach enhances security by ensuring that no single circuit has complete knowledge of the key, while the modular structure keeps the added complexity manageable.
Data Source
AI summary
According to various embodiments, a circuit for a combined key value-dependent exchange and randomization of two values is described comprising a control input circuit configured to supply two or more shares of a key to an exchange and randomizing circuit, wherein the exchange and randomizing circuit is configured to supply each of the two values to one of two inputs, wherein it depends on at least a first share of the shares which value of the two values is supplied to which input of the two inputs, arithmetically combine, for each of the two inputs, the value supplied to the input with a randomization value to generate a respective randomized value and to store the randomized values in two result locations, wherein it depends on at least a second share of the shares which randomized value is stored into which result location of the two result locations.