Kyber Compress Masking for Side-Channel-Resistant Decapsulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Lattice-based cryptographic schemes like Kyber are vulnerable to side-channel attacks due to the sensitivity of the Compress function in the decapsulation algorithm, which processes polynomial coefficients, making them susceptible to attacks through power consumption or electromagnetic analysis.
Innovation Solution
Implement an arithmetic masking technique to split input polynomial coefficients into arithmetic shares and generate output polynomial coefficients using Boolean masking without performing costly Arithmetic to Boolean conversions, by computing intermediate shares and additional shares to ensure proper Boolean masking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the Compress function processes polynomial coefficients sequentially to generate shared secret bits, then the cryptographic key exchange functionality is achieved, but the device becomes vulnerable to side-channel attacks through power consumption or electromagnetic analysis
Solution Approach 1:
The patent applies segmentation by dividing each polynomial coefficient into multiple arithmetic shares (e.g., 2 shares per coefficient). This segmentation ensures that no single share reveals information about the original coefficient, thereby protecting against side-channel attacks that monitor power consumption or electromagnetic emissions during coefficient processing. The segmented shares are processed independently through the Compress function, maintaining cryptographic security while eliminating side-channel vulnerabilities.
Solution Approach 2:
The patent introduces an intermediary mechanism by using random masking values and intermediate computation shares between the original coefficients and the final shared secret bits. These intermediaries (masking values, intermediate shares) act as buffers that decouple the physical characteristics of processing from the secret data, preventing attackers from correlating side-channel measurements with the actual polynomial coefficients or shared secret bits.
2Object-affected harmful factors
If arithmetic masking techniques are used to protect polynomial coefficients during Compress function execution, then resistance to side-channel attacks is enhanced, but computational complexity and resource consumption increase
Solution Approach 1:
The patent changes the parameter representation from single-value coefficients to multi-share arithmetic representations. By transforming coefficients into arithmetic shares and processing them through modified Compress function logic, the patent achieves side-channel resistance. The parameter change from direct coefficient processing to share-based processing fundamentally alters the computational landscape, adding security at the cost of increased complexity.
Solution Approach 2:
The patent segments the Compress function execution into multiple operations on individual arithmetic shares rather than processing whole coefficients. This segmentation allows each share to be processed with simpler, more uniform operations that are less susceptible to side-channel analysis, though the overall computational complexity increases due to the need to process multiple shares for each coefficient.
3Productivity
If arithmetic to Boolean conversion is performed on masked shares, then the shared secret can be generated, but costly conversions increase resource consumption and processing time
Solution Approach 1:
The patent extracts and eliminates the costly Arithmetic to Boolean conversion step from the traditional Compress function execution. By designing a new approach that works directly with arithmetic shares and produces Boolean shares through alternative mechanisms (avoiding traditional conversion), the patent removes this energy-intensive operation while still achieving the necessary shared secret generation functionality.
Solution Approach 2:
The patent changes the output parameter format from requiring Boolean conversion to directly producing Boolean shares through arithmetic operations. By modifying the Compress function to output Boolean shares directly from arithmetic share inputs without traditional Arithmetic to Boolean conversion, the patent significantly reduces computational energy consumption while maintaining productivity in shared secret generation.
Data Source
Figure 1~3
Figure 4~5
Figure 6
AI summary
The present invention relates to a method for securing against side channel attacks execution of a Compress function designed to be used in a decapsulation algorithm of a Kyber Lattice-based Post Quantum cryptographic key-encapsulation mechanism, wherein said Compress function converts an input polynomial P(X) into an output polynomial B(X) such that each coefficient bi of the output polynomial B(x) equals 1 if the corresponding coefficient Pi of the input polynomial P(X) is in ](q-1)/4, 3(q-1)/4[ and bi equals 0 otherwise, with i in {1,..,n}, n being an integer and q being a prime number, each coefficient Pi of said input polynomial P(x) being masked using an arithmetic splitting masking and represented by L arithmetic shares Ai1, Ai2, ...,AiL such that Ai1+ Ai2+ ... + AiL = Pi modulo q, with L an integer, and each coefficient bi of said output polynomial B(X) being masked with a Boolean splitting masking and represented by a plurality of Boolean shares, said method being performed by the key requesting device comprising a processor and a memory and comprising, instead of applying Compress function to said input polynomial P[X], for each coefficient Pi of said input polynomial P(X): - obtaining said L polynomial shares A1i, A2i, ..., ALi of said coefficient Pi, - for each polynomial share Aji with j in {1 ,... ,L}, computing an intermediate share vji equal to 0 when floor([2Aji+ Zj.(q-1)/2] / q ) is even and equal to 1 when it is odd with Zj such that Z1 + Z2 + ... + ZL = 1 and Zj.(q-1)/2 is an integer, - computing an additional intermediate share vL+1i equal to 0 when floor([ Σj(2 Aji + Zj.(q-1)/2) mod q)]/q) is even and equal to 1 when it is odd, - obtaining said plurality of Boolean shares (b1i, b2i ,...,bLi) from said L computed intermediate shares (v1i, ..., vLi) and said computed additional intermediate share (vL+1i).