Masked S-Box Key Update for White Box Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current white box implementations of cryptographic algorithms, such as DES and AES, face memory and communication-intensive key updates, increased runtime due to additional 'key translation units, and vulnerability to statistical attacks, which complicate security assessments and compromise efficiency.
Innovation Solution
A processor device with a masked key-dependent computing step using key change data to update the masked table, allowing for memory-saving, communication-efficient, and secure key updates, where the original masked table can be overwritten with a new one, removing information about the old key and preventing statistical attacks, while maintaining execution efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If white box implementations use additional key translation units for key updates, then key update functionality is achieved, but runtime increases and execution efficiency decreases
Solution Approach 1:
The patent combines the key translation unit functionality directly into the masked table structure, merging the key update mechanism with the existing cryptographic computation path. This eliminates separate key translation operations and reduces runtime overhead while maintaining adaptability for key updates.
Solution Approach 2:
The masked table is designed to serve multiple functions: it performs both the cryptographic S-box substitution and the key update operation simultaneously. By making the masked table multi-functional, the patent eliminates the need for separate key translation units, thereby improving execution efficiency while preserving key update capability.
2Adaptability or versatility
If white box implementations store multiple masked tables for different rounds, then key-dependent computing for multiple rounds is supported, but memory requirements increase
Solution Approach 1:
The patent implements dynamic generation of round-specific masked tables from a single master masked table. Instead of storing all round tables statically in memory, the system generates required round tables on-demand during execution, reducing memory requirements while maintaining support for multiple rounds through dynamic adaptation.
Solution Approach 2:
The master masked table contains embedded information that enables it to generate all round-specific masked tables autonomously during execution. The table serves itself by containing the necessary key material and transformation rules to derive subsequent round tables, eliminating the need to pre-store all tables and reducing overall memory requirements.
3Adaptability or versatility
If key update methods transfer complete masked tables, then key updates are achieved, but communication requirements increase
Solution Approach 1:
The patent extracts only the essential key material and transformation parameters from the complete masked table structure for transmission during key updates. By separating the core key information from the full table representation, the system achieves key update capability while minimizing communication requirements, as only compact key data needs to be transferred rather than entire tables.
4Productivity
If white box implementations use standard masked tables, then cryptographic computation is performed, but vulnerability to statistical attacks increases
Solution Approach 1:
The patent introduces asymmetric masking where the masked table uses different masking strategies for different parts of the computation or different rounds. This asymmetric approach disrupts statistical patterns that attackers might exploit, enhancing security against statistical attacks while maintaining the necessary cryptographic computational functionality through the masked table structure.
Data Source
AI summary
A processor device has an executable implementation of a cryptographic algorithm implemented thereon, which algorithm is adapted to produce an output text from an input text employing a secret key K. The implementation of the algorithm comprises a key-dependent computing step S which comprises a key combination of input values x derived directly or indirectly from the input text with key values SubK derived directly or indirectly from the key; the key-dependent computing step S is represented by a table which is masked with input masking and/or output masking to form a masked table TabSSubK; and a new masked table TabSKneu is generated in the processor device.