Cryptographic Masking Conversion for Side-Channel Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic processing methods are vulnerable to side-channel attacks like differential power analysis (DPA), particularly due to the resource-intensive nature of existing countermeasures and the susceptibility of non-linear transformations like the Multiplicative Inverse Transformation (MIT) in AES, which complicates secure implementation in embedded systems like smart cards.
Innovation Solution
The method involves combining secret data with an additive mask, converting it into a multiplicative mask, and applying a non-zero random replacement for zero values before non-linear transformations, allowing for secure unmasking and enhanced resistance to SCA attacks by avoiding zero-value vulnerabilities and using random values for increased resistance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If additive masking is applied to protect against SCA attacks, then security against side-channel attacks is improved, but the complexity of the cryptographic processing increases
Solution Approach 1:
The patent transforms the masking approach from additive to multiplicative parameter space. By converting the additive mask `m` into a multiplicative mask `β` where `β = 2^8 - 1 - m`, the system maintains security against SCA attacks while enabling more efficient processing. This parameter transformation allows the use of standard AES operations without requiring complex masking adjustments during non-linear transformations.
2Reliability
If the Multiplicative Inverse Transformation (MIT) is adapted for masked calculations, then security is improved, but memory space and processing time requirements increase
Solution Approach 1:
Instead of adapting the MIT transformation to work with additive masks (which increases complexity), the patent inverts the approach by converting the additive mask to a multiplicative mask before applying the standard MIT transformation. This allows the use of the original, unmodified AES MIT operation while maintaining security. The conversion is performed using the relationship `β = 2^8 - 1 - m`, which is computationally inexpensive.
3Productivity
If zero values are processed directly in non-linear transformations, then processing efficiency is maintained, but vulnerability to SCA attacks increases
Solution Approach 1:
The patent converts the potential vulnerability of zero values into a security feature. By applying multiplicative masking, zero values are transformed in a way that obscures their original nature during processing. The multiplicative mask `β` ensures that even when `X = 0`, the masked value `β × X` maintains the necessary security properties against SCA attacks while allowing efficient processing to continue.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The method involves combining secret data with additive mask for providing combined data by a combining unit, and providing transformed combined data by linear transformation of the combined data. The additive mask is converted into multiplicative mask by a converting unit. The transformed combined data is multiplied with the multiplicative mask for providing multiple data. The multiple data is non-linearly transformed by a non-linear transformation unit. An independent claim is also included for a device for cryptographically processing secret data, comprising a combining unit.