Lattice-Based Cryptographic Operation Blinding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Lattice-based cryptographic systems face challenges in achieving optimal performance, minimizing memory usage, and efficiently protecting against implementation attacks such as side-channel and fault attacks, particularly in hardware implementations like smart cards and Hardware Security Modules.
Innovation Solution
A method involving the use of a blinding polynomial to disguise noise, secret, and public polynomials, calculating their product, and determining the result of lattice-based cryptographic operations to enhance security against physical attacks, utilizing a processing device with a crypto module and hardware-random number generator to perform polynomial operations efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If lattice-based cryptographic operations are performed using standard algorithms, then cryptographic functionality is achieved, but the system becomes vulnerable to side-channel and fault attacks
Solution Approach 1:
The patent applies preliminary action by introducing blinding polynomials before the main cryptographic computation. The secret polynomial s(x) is transformed into a blinded version s'(x) = s(x) + b(x)·t(x) before multiplication with the public polynomial a(x). This preliminary blinding step ensures that during the computation of c(x) = a(x)·s'(x) + e(x), the intermediate values do not directly reveal information about the secret key, thereby preventing side-channel and fault attacks while maintaining the correctness of the cryptographic operation.
2Reliability
If polynomial blinding operations are performed to prevent attacks, then security against side-channel attacks is improved, but computational overhead increases
Solution Approach 1:
The patent employs parameter changes by working in the polynomial ring Rq = Zq[x]/(xn+1) with specific parameter choices that enable efficient computation. By selecting q and n such that the ring structure allows for optimized polynomial multiplication (e.g., using number theoretic transform or other fast multiplication algorithms), the computational overhead of blinding operations is reduced. The blinding polynomial b(x) and auxiliary polynomial t(x) are chosen from the same ring structure, allowing all operations to leverage the same efficient arithmetic framework rather than requiring separate computational paths for blinding and unblinding.
Data Source
AI summary
In various embodiments, a method for performing a lattice-based cryptographic operation is provided. The method includes obtaining a noise polynomial, a secret polynomial and a public polynomial, disguising at least one of the noise polynomial, the secret polynomial and the public polynomial by means of multiplying it with a random blinding polynomial, calculating the sum of the noise polynomial with the product of the public polynomial and the secret polynomial based on the disguised at least one polynomial, and determining a result of the lattice-based cryptographic operation based on the calculated sum of the noise polynomial with the product of the public polynomial and the secret polynomial.