Masked Polynomial Comparison for Post-Quantum Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for comparing polynomials in post-quantum cryptographic schemes are inefficient and suffer from significant performance overhead, limiting their applicability in thwarting side-channel attacks.
Innovation Solution
A method that selects subsets of polynomial coefficients, splits them into shares, combines and randomizes these subsets to efficiently compare polynomials, reducing the number of operations and random elements required, while ensuring adequate security against side-channel analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing masking methods are used for polynomial comparison, then security against side-channel analysis is improved, but performance overhead increases significantly
Solution Approach 1:
The patent segments the polynomial coefficients into subsets of size k, where each subset is processed independently through sharing and comparison operations. This segmentation allows parallel processing of multiple coefficient groups, reducing the overall computational overhead while maintaining security through the sharing mechanism applied to each segment.
Solution Approach 2:
The patent merges multiple comparison operations by processing subsets of coefficients in batches. Instead of comparing coefficients one by one, the method combines multiple comparison operations into unified sharing and randomization steps, reducing the total number of operations required while maintaining the security properties of masking.
2Reliability
If masking is applied to polynomial comparison, then security is improved, but the number of operations and random elements increases
Solution Approach 1:
The patent applies partial masking by selecting subsets of k coefficients from the total m coefficients, rather than applying full masking to all coefficients individually. This partial action reduces the number of random elements and operations required while maintaining adequate security through the sharing mechanism applied to each subset.
Solution Approach 2:
The patent changes the parameter of coefficient grouping by introducing subset size k and the number of shares n as controllable parameters. By adjusting these parameters, the system can optimize the balance between security and computational complexity, reducing the number of operations and random elements while maintaining security properties.
3Measurement precision
If all coefficients are processed individually, then comparison accuracy is improved, but computational efficiency deteriorates
Solution Approach 1:
The patent segments the coefficient processing into batches of size k, where each batch is processed through unified sharing and comparison operations. This segmentation maintains comparison accuracy by ensuring all coefficients are evaluated while improving computational efficiency through batch processing and parallel operations.
Solution Approach 2:
The patent maintains continuous useful action by processing multiple coefficient subsets through overlapping operations. The sharing and randomization operations are performed continuously across different coefficient groups, eliminating idle time and maximizing computational efficiency while ensuring all coefficients are processed accurately.
Data Source
Figure 1
AI summary
Various embodiments relate to a method and system for securely comparing a first and second polynomial, including: selecting a first subset of k coefficients of the first polynomial and a second subset of k corresponding coefficients of the second polynomial, wherein the coefficients of the first polynomial are split into n shares and the first and second polynomials have m coefficients; subtracting the second subset of coefficients from one of the shares of the first subset of coefficients; reducing the number of elements in the first subset of coefficients to / elements by combining groups of k/l elements together; generating a random number for each of the elements of the reduced subset of coefficients; summing the product of each of the elements of the reduced subset of coefficients with their respective random numbers; summing the n shares of the sum of the products; and generating an output indicating that the first polynomial does not equal the second polynomial when the sum does not equal zero.