Masked Infinity Norm Checks for Embedded Dilithium
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The implementation of quantum-safe cryptography standards like CRYSTALS-Dilithium in embedded systems faces challenges due to memory and computational resource limitations, and these systems are vulnerable to side-channel attacks, which existing countermeasures exacerbate these constraints.
Innovation Solution
A method for norm checking in lattice-based cryptography that uses Boolean masking to optimize operations, reducing memory consumption and execution time by selecting a smaller modulus and employing bitsliced representations, while leveraging secure subtraction and addition functions to protect against side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If quantum-safe cryptography standards like CRYSTALS-Dilithium are implemented in embedded systems, then security against quantum computers is improved, but memory and computational resource consumption increases
Solution Approach 1:
The patent segments cryptographic operations into arithmetic shares and Boolean shares, processing them separately through distinct computational paths. This segmentation allows optimized resource usage for each share type while maintaining overall security requirements.
Solution Approach 2:
The patent changes the modulus parameter from a large prime number to a power of two, which enables more efficient arithmetic operations and reduces memory requirements. This parameter change maintains cryptographic security while optimizing for embedded system constraints.
2Reliability
If quantum-safe cryptography standards like CRYSTALS-Dilithium are implemented in embedded systems, then security against quantum computers is improved, but computational resource consumption increases
Solution Approach 1:
The patent substitutes traditional arithmetic operations with Boolean operations in certain computational paths. This substitution leverages the efficiency of Boolean logic in hardware implementations, reducing overall computational resource consumption while maintaining cryptographic functionality.
Solution Approach 2:
By changing the modulus to a power of two, the patent enables the use of efficient bitwise operations instead of traditional modular arithmetic, significantly reducing computational overhead in embedded system implementations.
3Reliability
If countermeasures against side-channel attacks are implemented, then security against physical attacks is improved, but memory and computational resource consumption increases
Solution Approach 1:
The patent uses segmentation by dividing secret values into multiple arithmetic shares that are processed independently. This segmentation provides inherent side-channel resistance as each share appears random individually, while the collective computation maintains security. The segmented approach reduces memory overhead compared to traditional masking countermeasures.
4Reliability
If countermeasures against side-channel attacks are implemented, then security against physical attacks is improved, but computational resource consumption increases
Solution Approach 1:
By segmenting computations into independent arithmetic share operations, the patent reduces the computational complexity of implementing side-channel countermeasures. Each share can be processed with simpler operations, reducing overall computational overhead compared to traditional countermeasures.
Solution Approach 2:
The parameter change to power-of-two modulus enables more efficient implementation of arithmetic operations in the presence of masking countermeasures, reducing the computational burden of side-channel protection.
Data Source
AI summary
A data processing system and method for norm checking a cryptographic operation for lattice-based cryptography in a processor, the instructions, including: multiplying a first polynomial by a second polynomial to produce a first output, wherein the d arithmetic shares have a modulus q′; securely converting the first output to d Boolean shares; securely subtracting a third polynomial from the first output to produce a second output, wherein the third polynomial is randomly generated and then offset by a first constant parameter; securely adding a first constant based upon a bound check and the first constant parameter to the second output to shift the values of the second output to positive values to produce a third output; and securely adding a second constant based upon the bound check to the third output to produce a carry bit.