Lattice-Based Cryptography Coefficient Randomization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Lattice-based cryptography systems are vulnerable to implementation attacks, particularly side-channel attacks, due to the lack of effective countermeasures when executed on secure chip card controllers or in adverse environments.
Innovation Solution
The approach involves performing computations in the ring Zq′, where q′=k·q, with redundant representations and randomization of coefficients, making it difficult for attackers to extract secret keys or intermediate values by adding randomness to coefficients and performing computations in Zq′ before reducing back to Zq, thereby enhancing security against invasive and non-invasive attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If lattice-based cryptography is executed on secure chip card controllers, then cryptographic functionality is provided, but vulnerability to side-channel attacks increases
Solution Approach 1:
The patent applies preliminary action by performing randomization of coefficients before the actual cryptographic computation. This preliminary randomization step ensures that even if side-channel attacks occur during execution, the attacker cannot extract meaningful information because the intermediate values are already obscured by random masks. The randomization is set up in advance and maintained throughout the computation.
Solution Approach 2:
The patent introduces random masks as intermediary elements between the secret cryptographic data and the physical implementation. These masks act as mediators that obscure the relationship between the secret key and the power consumption or electromagnetic emissions, making side-channel analysis ineffective. The random masks are added to coefficients during computation and removed only at the final reduction step.
2Productivity
If computations are performed in Zq with standard representations, then computational efficiency is maintained, but security against implementation attacks is reduced
Solution Approach 1:
The patent changes the parameter space by moving computations from the ring Zq to the ring Zq' where q' = k·q for some integer k > 1. This parameter transformation allows the use of redundant representations where each coefficient in Zq can be represented in multiple ways in Zq'. The computation is performed in this expanded space with randomization, and then reduced back to Zq at the end, maintaining correctness while improving security.
3Reliability
If randomization is applied to coefficients, then security against side-channel attacks is improved, but computational complexity increases
Solution Approach 1:
The patent segments the cryptographic computation into distinct phases: a setup phase where random masks are generated and applied to coefficients, a computation phase where operations are performed on the randomized values in Zq', and a reduction phase where results are mapped back to Zq. This segmentation allows the complexity of randomization to be managed systematically rather than being embedded throughout the entire computation.
Data Source
AI summary
A method for conducting an operation including (a) lifting coefficients of a data structure from a representation modulo q to a representation modulo q′, wherein the data structure comprises values which are reduced modulo q, wherein q and are integers; (b) randomizing the coefficients in modulo q′, wherein for each coefficient a random value is multiplied with the value of q and the result of this multiplication is added to the coefficient; (c) conducting an operation on the lifted and randomized coefficients; and (d) reducing the lifted and randomized coefficients by conducting an operation modulo q.