Multi-Domain Masked AND Gate for Low-Latency Power Analysis Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic implementations are vulnerable to power analysis attacks due to the correlation between secret values and their intermediate computational values, which can be exploited by adversaries.
Innovation Solution
Implementing a multi-domain masked AND gate that includes inner-domain calculations, re-sharing, register stages, and cross-domain calculations, using randomness to decouple secret values from intermediate results, ensuring security even in the presence of glitches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware masking is implemented to protect against power analysis attacks, then security is improved, but computational latency increases
Solution Approach 1:
The computational domain is segmented into multiple independent share domains (first share domain and second share domain). Each domain processes masked shares independently through inner-domain calculations, avoiding cross-domain dependencies that would increase latency. The segmentation allows parallel processing of different share combinations, reducing overall computational latency while maintaining security through domain independence.
Solution Approach 2:
Inner-domain calculations are performed preliminarily within each share domain before cross-domain operations. The first and second share results are computed in advance within their respective domains, and only then are they combined through cross-domain calculations. This preliminary action within domains reduces the critical path latency compared to performing all operations sequentially across domains.
2Reliability
If multi-domain masking with re-sharing is used to achieve robustness against probing models, then security is improved, but device complexity increases
Solution Approach 1:
The circuit is segmented into distinct share domains with dedicated inner-domain calculation units. Each domain handles specific share combinations independently, which modularizes the complexity and makes the overall system more manageable. The segmentation also enables reuse of similar circuit structures across domains, reducing total complexity despite the increased security requirements.
Solution Approach 2:
The cross-domain calculation unit performs multiple functions: it combines results from different share domains, implements re-sharing operations, and handles both inner-domain and cross-domain interactions. This multi-functional design reduces the need for separate dedicated circuits for each operation, thereby reducing overall device complexity while maintaining robust security properties.
3Object-affected harmful factors
If domain-oriented masking is implemented to decouple secret values from intermediate results, then resistance to power analysis attacks is improved, but computational overhead increases
Solution Approach 1:
Computations are segmented into inner-domain operations that process shares independently within each domain. This segmentation allows for more efficient resource utilization and reduces redundant computations across domains. The independent inner-domain calculations can be optimized separately, reducing overall computational overhead while maintaining the decoupling of secret values from intermediate results.
Solution Approach 2:
The multi-domain masking scheme enables continuous processing of masked values through pipelined inner-domain calculations. While one domain is performing cross-domain operations, other domains can simultaneously perform inner-domain calculations, maintaining continuous useful action and reducing total computational overhead compared to sequential processing.
Data Source
AI summary
A multi-domain masked AND gate includes inner-domain calculations, re-sharing, register stage, cross-domain calculations, and compression. The inner-domain multiplication and the re-sharing are calculated prior to storing the re-shared variables in the register stage. Thus, the inputs to the cross-domain multiplication and the compression are performed on variables that have been refreshed by additional randomness. This AND gate does not need statistically independent inputs, is secure in the probing model even in the presence of glitches, also known as the robust probing model. A two-domain input and two domain output AND gate can be implemented using six (6) registers, four (4) two input logical AND gates, and eight (8) exclusive-OR (XOR) gates. The AND gate may also be used to implement an AES S-box that has two (2) register stages and takes two (2) clock cycles per computation.