Cryptographic Masking Conversion for Side-Channel Attack Resistance

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current cryptographic processing methods are vulnerable to side-channel attacks like differential power analysis (DPA), particularly due to the resource-intensive nature of existing countermeasures and the susceptibility of non-linear transformations like the Multiplicative Inverse Transformation (MIT) in AES, which complicates secure implementation in embedded systems like smart cards.

Innovation Solution

The method involves combining secret data with an additive mask, converting it into a multiplicative mask, and applying a non-zero random replacement for zero values before non-linear transformations, allowing for secure unmasking and enhanced resistance to SCA attacks by avoiding zero-value vulnerabilities and using random values for increased resistance.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If additive masking is applied to protect against SCA attacks, then security against side-channel attacks is improved, but the complexity of the cryptographic processing increases

Engineering Contradiction:
Improvesecurity against SCA attacksVSAvoidcomplexity of cryptographic processing
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent transforms the masking approach from additive to multiplicative parameter space. By converting the additive mask `m` into a multiplicative mask `β` where `β = 2^8 - 1 - m`, the system maintains security against SCA attacks while enabling more efficient processing. This parameter transformation allows the use of standard AES operations without requiring complex masking adjustments during non-linear transformations.

Inventive Principle:
Principle #35Parameter changes

2Reliability

If the Multiplicative Inverse Transformation (MIT) is adapted for masked calculations, then security is improved, but memory space and processing time requirements increase

Engineering Contradiction:
Improvesecurity against DPA attacksVSAvoidmemory space and processing time
Core Design Contradiction:
ReliabilityVSQuantity of substance

Solution Approach 1:

Instead of adapting the MIT transformation to work with additive masks (which increases complexity), the patent inverts the approach by converting the additive mask to a multiplicative mask before applying the standard MIT transformation. This allows the use of the original, unmodified AES MIT operation while maintaining security. The conversion is performed using the relationship `β = 2^8 - 1 - m`, which is computationally inexpensive.

Inventive Principle:
Principle #13The other way round (Inversion)

3Productivity

If zero values are processed directly in non-linear transformations, then processing efficiency is maintained, but vulnerability to SCA attacks increases

Engineering Contradiction:
Improveprocessing efficiencyVSAvoidsecurity against SCA attacks
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The patent converts the potential vulnerability of zero values into a security feature. By applying multiplicative masking, zero values are transformed in a way that obscures their original nature during processing. The multiplicative mask `β` ensures that even when `X = 0`, the masked value `β × X` maintains the necessary security properties against SCA attacks while allowing efficient processing to continue.

Inventive Principle:
Principle #22Blessing in disguise (Convert harm into benefit)

Data Source

PatentEP2296307B1Cryptographic data processing method secured against side-channel attacks
Publication Date: 2018.11.07 IDEMIA FRANCE SAS
  • EP2296307B1 patent drawingFigure 1~2
  • EP2296307B1 patent drawingFigure 3
  • EP2296307B1 patent drawingFigure 4

AI summary

The method involves combining secret data with additive mask for providing combined data by a combining unit, and providing transformed combined data by linear transformation of the combined data. The additive mask is converted into multiplicative mask by a converting unit. The transformed combined data is multiplied with the multiplicative mask for providing multiple data. The multiple data is non-linearly transformed by a non-linear transformation unit. An independent claim is also included for a device for cryptographically processing secret data, comprising a combining unit.