Masked Polynomial Hash Function for Side-Channel Attack Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cryptographic data processing systems face vulnerabilities to external monitoring attacks, particularly side-channel attacks that exploit physical parameters of cryptographic data processing devices, such as power consumption and electromagnetic radiation, which can lead to unauthorized access to sensitive information.
Innovation Solution
Implementing masking schemes for universal polynomial hash functions, such as GHASH, where either the input data block or the hash key is masked, and the mask correction value is reused across iterations, reducing the number of non-linear operations and eliminating the need for new random masks in each iteration, thereby enhancing resistance to side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If masking schemes are implemented for each iteration with new random masks, then security against side-channel attacks is improved, but computational overhead and complexity increase
Solution Approach 1:
A single random mask is generated in advance before the iterative polynomial hash computation begins. This preliminary masking action eliminates the need to generate new random masks during each iteration, reducing computational overhead while maintaining security against side-channel attacks through consistent masking of sensitive intermediate values.
Solution Approach 2:
The same random mask generated in the preliminary stage is reused across all iterations of the polynomial hash function. This universal application of a single mask value protects multiple intermediate computations without requiring separate masking operations for each iteration, thereby reducing complexity while maintaining security.
2Productivity
If the number of non-linear operations is reduced by reusing mask correction values, then computational efficiency is improved, but security against monitoring attacks may be compromised
Solution Approach 1:
Mask correction values are introduced as intermediary elements that allow the reuse of the initial random mask across multiple iterations. These correction values enable efficient computation by avoiding redundant non-linear operations while maintaining the security properties of the masking scheme, thus resolving the contradiction between efficiency and security.
3Reliability
If masking is applied to protect cryptographic operations, then resistance to external monitoring attacks is improved, but processing speed may decrease
Solution Approach 1:
The masking operation is performed once in advance before the main computational loop, rather than repeatedly during each iteration. This preliminary action ensures protection against external monitoring attacks while minimizing the impact on processing speed by avoiding redundant masking operations throughout the computation.
Solution Approach 2:
The initially generated mask serves a universal protective function across all iterations of the polynomial hash computation. This single mask value protects all intermediate values from side-channel and external monitoring attacks, maintaining security without requiring multiple masking operations that would slow down processing.
Data Source
AI summary
Systems and methods for protecting from external monitoring attacks cryptographic data processing operations involving computation of a universal polynomial hash function, such as GHASH function. An example method may comprise: receiving an input data block, an iteration result value, and a mask value; performing a non-linear operation to produce a masked result value, wherein a first operand of the non-linear operation is represented by a combination of the iteration result value and the input data block, and the second operand of the non-linear operation is represented by a secret hash value, and wherein one of the first operand or the second operand is masked using a mask value; determining, based on the mask value, a mask correction value; and producing a new iteration result value by applying the mask correction value to the masked result value.