Masked AES Field Inversion Against High-Order Side-Channel Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing AES block cipher algorithms against high-order side-channel attacks, such as Differential Power Analysis (DPA), are inefficient and resource-intensive, particularly in systems with limited RAM, due to the need for large tables and recomputation of masking functions during the SubBytes step.
Innovation Solution
A method involving (n+1)-additive sharing and (n+1)-multiplicative sharing of the internal state, combined with a Dirac function to handle field inversions, using precomputed tables and efficient Dirac function implementations to secure the SubBytes step against high-order side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If a RAM table is used to store precomputed values for the Dirac function, then the computational speed is improved, but the memory requirement increases significantly (from 32 bits to 256 bits)
Solution Approach 1:
The patent precomputes and stores the Dirac function values in a RAM table during system initialization, so that during actual cryptographic operations, the system only needs to perform table lookups rather than computing the Dirac function in real-time. This preliminary action significantly speeds up the SubBytes step execution.
Solution Approach 2:
The patent creates a copy of the Dirac function implementation in the form of a precomputed lookup table, separate from the main cryptographic computation. This allows the actual encryption operation to simply reference the precomputed values without performing complex calculations during the critical security operations.
2Quantity of substance
If the Dirac function is computed on the fly without precomputed tables, then the memory requirement is reduced, but the computational complexity and execution time increase
Solution Approach 1:
The patent performs the computationally intensive precomputation of the Dirac function values during system initialization or offline processing, before the actual cryptographic operations begin. This separates the heavy computation from the time-critical encryption/decryption operations, reducing execution time during security-sensitive operations.
Solution Approach 2:
The patent uses a small, fixed-size lookup table that is precomputed and stored in read-only memory or non-volatile memory. This disposable precomputed structure avoids the need for large RAM tables while providing fast access during operations, effectively trading off the one-time computation cost for repeated fast lookups.
3Reliability
If the internal state is masked using multiplicative sharing, then the security against side-channel attacks is improved, but the complexity of handling zero values increases
Solution Approach 1:
The patent introduces the Dirac function as an intermediary component that detects whether a masked value is zero and provides appropriate handling. This intermediary function allows the system to maintain multiplicative sharing for security while systematically addressing the zero-value problem through a well-defined mathematical approach.
Solution Approach 2:
The patent changes the parameter representation by using the Dirac function to transform the masked value into a form that is safe for inversion. When a value is zero, the Dirac function detects this and modifies the handling accordingly, allowing the system to work with multiplicative shares without encountering division-by-zero errors.
Data Source
AI summary
Provided is a method for securing against high-order side-channel attacks wherein a substep of field inversion is performed by a cryptographic device. The method includes computing (S1) a Dirac output value, adding (S2) said Dirac output value to one of said shares of the first set of shares to obtain a second set of shares, performing a conversion of the second set of shares (S3) from said (n+1) additive sharing to a (n+1)-multiplicative sharing, performing an inversion of each share of the (n+1)-multiplicative sharing (S4), performing a conversion of the inverted shares (S5) from said multiplicative sharing to a (n+1)-additive sharing to obtain a third set of shares, and adding (S6) said Dirac output value to one of said shares of the third set of shares. Other embodiments disclosed.