Masked Polynomial Decoding via Bitsliced Binary Search
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing post-quantum cryptographic schemes are vulnerable to side-channel attacks due to the inefficiencies and limitations of current masked decoding methods, particularly in handling polynomial decoding operations, which introduce significant performance overhead and are often restricted to specific moduli or first-order security.
Innovation Solution
A method for masked decoding of polynomials using a single arithmetic-to-Boolean conversion per coefficient, combined with bitslicing and a binary search approach, which works for arbitrary moduli without pre-computed tables, reducing the number of operations and random elements required, and enabling higher-order security implementations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional masked decoding methods are used, then security protection is provided, but performance overhead increases and efficiency decreases
Solution Approach 1:
The patent segments the decoding process into distinct phases: arithmetic-to-Boolean conversion, bitslicing, and binary search. Each phase operates independently on specific data representations, allowing optimized processing for each stage while maintaining overall security. The arithmetic shares are converted to Boolean shares and then bitsliced, enabling parallel processing that improves efficiency without compromising security.
Solution Approach 2:
The patent replaces traditional mechanical table-lookup approaches with an algorithmic binary search method. Instead of using pre-computed tables that require memory access and are vulnerable to side-channel attacks, the invention uses a systematic binary search algorithm that operates purely through arithmetic and logical operations, eliminating the need for pre-computed tables and reducing memory access vulnerabilities.
2Productivity
If pre-computed tables are used for masked decoding, then decoding speed is improved, but memory requirements increase and side-channel vulnerabilities arise
Solution Approach 1:
The patent extracts and eliminates the pre-computed tables from the decoding system. Instead of storing large lookup tables in memory, the invention uses an on-the-fly binary search algorithm that computes decoding results through systematic arithmetic operations. This extraction removes the memory burden and eliminates the side-channel vulnerabilities associated with table access patterns.
Solution Approach 2:
The patent replaces expensive, static pre-computed tables with inexpensive, dynamic computations. The binary search algorithm generates decoding results through temporary arithmetic operations that are discarded after use, rather than relying on persistent memory structures. This approach uses computationally inexpensive operations that do not require long-term storage.
3Device complexity
If first-order security masking is applied, then implementation simplicity is maintained, but higher-order security protection is not achieved
Solution Approach 1:
The patent creates a universal masked decoding framework that can operate at any security order. The core algorithm structure remains the same regardless of the masking order, with the arithmetic-to-Boolean conversion and binary search processes working identically for first-order, second-order, or higher-order security requirements. This multi-functionality allows the same implementation to provide different security levels without fundamental redesign.
Solution Approach 2:
The patent enables security order adjustment through parameter changes rather than structural modifications. By changing the number of shares and the complexity of the arithmetic-to-Boolean conversion, the same binary search framework can provide different security orders. This allows flexible adaptation of security parameters without complicating the overall implementation.
4Measurement precision
If arithmetic-to-Boolean conversion is performed for each coefficient, then decoding accuracy is maintained, but the number of operations increases
Solution Approach 1:
The patent merges the arithmetic-to-Boolean conversion operations across all coefficients by using bitslicing. Instead of processing each coefficient independently through separate conversion sequences, the invention combines multiple coefficient conversions into parallel operations that share common computational steps. This merging reduces the total number of operations while maintaining the accuracy of individual coefficient decoding.
Data Source
AI summary
Various embodiments relate to a method for masked decoding of a polynomial a using an arithmetic sharing a to perform a cryptographic operation in a data processing system using a modulus q, the method for use in a processor of the data processing system, including: subtracting an offset δ from each coefficient of the polynomial a; applying an arithmetic to Boolean (A2B) function on the arithmetic shares of each coefficient ai of the polynomial a to produce Boolean shares âi that encode the same secret value ai; and performing in parallel for all coefficients a shared binary search to determine which of coefficients ai are greater than a threshold t to produce a Boolean sharing value {circumflex over (b)} of the bitstring b where each bit of b decodes a coefficient of the polynomial a.