Masked Compression for Lattice-Based Polynomial Rejection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing post-quantum digital signature schemes, such as Dilithium, are vulnerable to side-channel attacks due to unprotected implementations of polynomial rejection checks, which can lead to the extraction of secret keys, and current masking solutions require costly Boolean-masked additions and conversions.
Innovation Solution
A masked compressed comparison method is introduced, using the MaskedCompress and MaskedComparison functions to efficiently check if polynomial coefficients are within boundary values by shifting, scaling, and XORing arithmetic shares, reducing the number of operations and random elements required, and enabling a more efficient masked polynomial rejection check.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current masking solutions are used for polynomial rejection checks, then side-channel security is improved, but computational cost and operation complexity increase significantly
Solution Approach 1:
The patent extracts the essential function of polynomial rejection checking from the complex masking framework. By identifying that rejection checks only need to determine whether coefficients fall within valid ranges, the invention removes unnecessary Boolean-masked additions and conversions, keeping only the critical range-checking operations while discarding redundant security layers that do not contribute to actual side-channel protection.
Solution Approach 2:
Instead of applying masking to protect the rejection check (conventional approach), the patent inverts the logic by designing the rejection check to inherently operate on unmasked or partially masked data in a way that naturally prevents side-channel leaks. The compression function and range checks are structured to work directly with the secret shares without requiring additional masking operations, thus achieving security through operational simplicity rather than added complexity.
2Reliability
If current masking solutions are used for polynomial rejection checks, then side-channel security is improved, but the number of random elements required increases
Solution Approach 1:
The patent extracts only the essential random elements needed for rejection checking - specifically, the random thresholds used in the compression function's range comparisons. By removing the need for random masking values and random conversion elements, the invention reduces the quantity of random elements from multiple sources to just the threshold generation, while maintaining security through the compressed representation that naturally hides secret information.
3Productivity
If polynomial rejection checks are implemented without masking, then computational efficiency is improved, but vulnerability to side-channel attacks increases
Solution Approach 1:
The patent applies preliminary compression to the polynomial coefficients before the rejection check, transforming them into a condensed format that preserves the necessary information for range validation while hiding the actual secret values. This preliminary transformation allows subsequent rejection operations to proceed efficiently on the compressed data without requiring complex masking, thus achieving both security and efficiency through advance preparation.
Solution Approach 2:
The patent changes the representation parameters of the polynomial coefficients by compressing them into a smaller range while maintaining their essential properties for rejection checking. By transforming the coefficients from their original large-range integer representation to a compressed format with fewer bits, the invention enables faster comparison operations and reduces the computational burden, while the compression process itself provides the necessary security by obscuring the relationship between compressed and original values.
Data Source
AI summary
Various embodiments relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a cryptographic operation using masked compressing of coefficients of a polynomial having ns arithmetic shares for lattice-based cryptography in a processor, the instructions, including: shifting a first arithmetic share of the ns arithmetic shares by an input mask λ1; scaling the shifted first arithmetic share by a value based on a first compression factor δ and a masking scaling factor φ1; shifting the scaled first arithmetic share by a value based on the masking scaling factor φ1; scaling a second to ns shares of the ns arithmetic shares by a value based on the first compression factor δ and the masking scaling factor φ1; converting the ns scaled arithmetic shares to ns Boolean shares; right shifting the ns Boolean shares based upon the masking scaling factor φ1 and a second compression factor φ2; XORing an output mask λ2 with the shifted first Boolean share to produce ns compressed Boolean shares; and carrying out a cryptographic operation using the ns arithmetic shares when the ns compressed Boolean shares indicates that the coefficients of the polynomial are within boundary values.