Cryptographic Calculation Method Using Masked Data Paths and Redundant Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic methods, such as DES and AES, are vulnerable to attacks like Differential Fault Analysis (DFA) and Differential Power Analysis (DPA), which can compromise the security of components like smart cards by allowing attackers to deduce the secret key used in encryption and decryption processes.
Innovation Solution
Implementing a secure cryptographic calculation method that involves redundant algorithmic instances with masked data paths using random quantities and nonlinear substitution operators, and verifying consistency between multiple executions to detect and prevent faults, thereby protecting against DFA and DPA attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard cryptographic methods (DES, AES) are used, then encryption and decryption operations can be performed efficiently, but the system becomes vulnerable to DFA and DPA attacks that can compromise the secret key
Solution Approach 1:
The cryptographic calculation is divided into multiple independent instances (first instance, second instance, third instance) that process the same input data with the same key but produce different intermediate results due to different masking values. This segmentation allows verification through comparison while maintaining security against DFA and DPA attacks.
Solution Approach 2:
Masking values (first masking value, second masking value, third masking value) are introduced as intermediaries between the secret key and the input data. These masking values prevent direct observation of key-dependent operations during power analysis attacks and fault injection attacks, as they randomize the intermediate computational states.
2Reliability
If redundant algorithmic instances with masking are implemented, then protection against DFA and DPA attacks is achieved, but the calculation time and processing overhead increase
Solution Approach 1:
Masking values are generated and applied before the cryptographic calculation begins. The first masking value is XORed with the input data, and the second masking value is XORed with the key before they enter the cryptographic function. This preliminary masking prepares the system for secure parallel processing without adding significant overhead during the actual computation phase.
Solution Approach 2:
Multiple cryptographic instances (first instance, second instance, third instance) are executed in parallel or sequentially with different masking values, and their results are merged through comparison. The verification step combines the outputs of these instances to detect faults, achieving security through consolidated verification rather than separate protective measures.
3Reliability
If verification steps are added to detect faults, then security against DFA attacks is improved, but the system becomes more susceptible to double fault injection attacks that can circumvent verification
Solution Approach 1:
Different masking values are applied at different stages of the cryptographic calculation (input masking, key masking, intermediate masking). This local variation in masking quality ensures that even if one instance is affected by a fault, other instances with different masking provide redundant verification, making double fault injection significantly more difficult to execute successfully.
Solution Approach 2:
The verification mechanism uses feedback by comparing the output of the first cryptographic instance with the output of the second cryptographic instance. If the results differ, a fault is detected and the operation is aborted. This feedback loop continuously monitors the cryptographic process for inconsistencies that would indicate fault injection attempts.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A secure cryptographic computing method, comprising the creation 20 of a first list of first random quantities, the creation 21 of a first nonlinear substitution operator masked using at least a part of said first list, the creation 22 of a second list deduced from said first list and comprising second random quantities respectively deduced from said first random quantities, the creation 23 of a second nonlinear substitution operator masked using at least a part of said second list, at least two successive implementations of a cryptographic computing algorithm comprising N successive computation rounds to obtain an output from an input and a secret key, the data path of the algorithm being masked,one of the two implementations 24 comprising a masking of the data path of the algorithm involving the first list of first random quantities and said first masked nonlinear substitution operator, the other implementation 25 comprising a masking of the data path of the algorithm involving the second list of second random quantities and said second masked nonlinear substitution operator, and after the two implementations of the algorithm, a verification 26 of the equality between two data taken from among the data involved in the two implementations.