Masked Modular Reduction Circuit for Side-Channel-Safe Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic systems like RSA and ECC are vulnerable to attacks by quantum computers, and key generation in lattice-based public key encryption schemes like Dilithium requires protection against side-channel attacks, which is challenging due to the complexity of masking operations and parallelization.
Innovation Solution
A security device with modular reducer and detector circuits performs modulo reduction and rejection sampling in a masked manner using Boolean arithmetic and SIMD operations, allowing parallel operations on multiple nibbles, to protect against side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rejection sampling and modular reduction are performed with masking countermeasures to protect against side-channel attacks, then security against side-channel attacks is improved, but device complexity and computational overhead increase
Solution Approach 1:
The patent applies segmentation by dividing the modular reduction operation into multiple iterations, each handling a specific bit position or group of bit positions. The reduction process is broken down into sequential steps where intermediate results are processed individually, allowing masking to be applied at each stage rather than requiring complex simultaneous masking of the entire operation. This segmented approach reduces the overall complexity of masking while maintaining security.
Solution Approach 2:
The patent employs preliminary action by pre-computing certain values and preparing masked intermediate results before the main modular reduction operation. Constants and intermediate values are pre-masked and stored in a way that facilitates the subsequent reduction steps. This preliminary preparation reduces the computational burden during the actual reduction process and simplifies the masking requirements.
2Manufacturing precision
If rejection sampling is performed on random bitstrings with individual nibble testing and modular reduction, then uniform random integer generation is improved, but processing time and computational resources increase
Solution Approach 1:
The patent segments the random bitstring into individual nibbles (4-bit groups) and processes each nibble independently through the rejection sampling and modular reduction process. This segmentation allows parallel processing of multiple nibbles and avoids the need to process the entire bitstring sequentially, significantly reducing processing time while maintaining uniform distribution of the generated random integers.
Solution Approach 2:
The patent applies partial action by performing modular reduction on individual nibbles rather than on the entire random bitstring. This partial processing approach generates the required random integers with uniform distribution while avoiding the computational overhead of processing all bits simultaneously. The excessive action aspect is reflected in the iterative nature of the process, where multiple iterations may be performed on different nibbles to ensure sufficient random integers are generated.
Data Source
AI summary
According to various embodiments, a security device is provided comprising a modular reducer configured to perform a modulo reduction by a modulus of each binary number of a sequence of binary numbers forming a data word, wherein each binary number consists of n bits by one or more first iterations comprising, in reaction to a first detector of the security device detecting that the most significant bit (MSB) of the binary number is set, changing the binary number by deleting its MSB and adding the difference between 2n−1 and the modulus to the binary number, followed by one or more second iterations comprising, in reaction to a second detector of the security device detecting that the MSB of the sum of the binary number with the difference between 2n−1 and the modulus is set, setting the binary number to that sum, wherein the MSB of the sum is deleted.