Look-Up Table Masking for Side-Channel Attack Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption methods using look-up tables face challenges in effectively protecting against high-order side-channel attacks, which require complex countermeasures that increase latency and circuit area, and are difficult to implement due to the need for predefined protection levels during design.
Innovation Solution
The method involves initializing a look-up table by applying logical combinations of address-masks and data-masks to generate masked addresses and data, using a process that iteratively updates masks to separate the contribution of each mask, allowing for flexible protection against side-channel attacks without increasing hardware requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complex countermeasures are used to protect against high-order side-channel attacks, then security level is improved, but latency time and circuit area increase
Solution Approach 1:
The patent changes the parameter of mask application by applying the same mask multiple times to different data values during look-up table initialization. This creates higher-order mask combinations that protect against high-order attacks without requiring additional hardware resources or increasing latency, as it reuse the same mask values rather than introducing new computational steps
Solution Approach 2:
The patent performs preliminary masking during the look-up table initialization phase, where mask values are applied to the table contents before actual encryption operations begin. This preliminary action embeds the security protection into the existing initialization process, avoiding additional latency during the actual encryption operations
2Reliability
If complex countermeasures are used to protect against high-order side-channel attacks, then security level is improved, but circuit area increases
Solution Approach 1:
The patent makes the existing look-up table initialization circuit multi-functional by having it serve both the standard initialization purpose and the security protection purpose simultaneously. The same initialization circuitry applies masks to multiple different data values, creating high-order mask combinations without requiring dedicated security protection hardware, thus avoiding additional circuit area
Solution Approach 2:
The patent changes the operational parameters of the initialization circuit to apply masks repeatedly to different data values, transforming a simple initialization function into a security-hardening function. This parameter change enables high-order attack protection using the existing circuit infrastructure without expanding the circuit area
3Reliability
If mask values are applied to look-up table during initialization, then protection against side-channel attacks is improved, but the same mask values must be reused in different rounds which reduces effectiveness
Solution Approach 1:
The patent merges multiple applications of the same mask into a single comprehensive masking operation during look-up table initialization. By applying the mask to multiple different data values and combining the results, it creates high-order mask combinations that maintain protection effectiveness while reducing the number of distinct mask values needed, thus resolving the contradiction between protection effectiveness and mask flexibility
Data Source
AI summary
An encryption method includes accessing a look-up table (LUT) to implement countermeasures against side-channel attacks, such as embedding masks. The LUT is initialized by writing initialization values in the LUT by applying an address-mask to input data that identify a location of said LUT and a data-mask to data to be stored at a location of the LUT. The method includes carrying out an initialization of the LUT that includes providing at least one second address-mask and one second data-mask; and computing corresponding initialization values as a function of a logic combination of the aforesaid first address-mask and second address-mask and of a logic combination of the aforesaid first data-mask and second data-mask. In the resulting table the address data are masked only by the second address-mask and the data are masked only by the second data-mask. The structure of the LUT may allow convenient implementation by initializing all the values of the LUT in parallel in one cycle.