Masking Technique for Side-Channel Protected Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic calculations are vulnerable to side-channel attacks, particularly Differential Power Analysis (DPA) attacks, which exploit the power consumption patterns of processors to infer secret keys, especially in higher-order attacks.
Innovation Solution
The method combines basic masking techniques like XOR or affine masking with secondary 00/FF masking, where the one's complement of masked intermediate values is used, randomizing the calculation to obscure power consumption patterns, and expands table accesses to use complementary tables, making it difficult to distinguish correct key usage from incorrect key usage in statistical analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If basic masking techniques (XOR or affine masking) are applied to intermediate values, then protection against first-order DPA attacks is improved, but vulnerability to higher-order DPA attacks remains
Solution Approach 1:
The patent applies nested masking by combining basic masking (XOR or affine) with secondary masking (00/FF masking) in layers. The basic masking is applied first to intermediate values, then the 00/FF masking is applied to the already-masked values. This nested structure provides protection against higher-order DPA attacks while maintaining the benefits of basic masking, effectively resolving the contradiction between first-order protection and higher-order vulnerability.
Solution Approach 2:
The patent performs preliminary masking actions by pre-computing and storing masked tables (both basic-masked and 00/FF-masked versions) before the actual cryptographic calculation. This preliminary preparation allows the system to use pre-masked data during computation, eliminating the need for real-time masking operations and providing robust protection against higher-order DPA attacks without performance penalty.
2Reliability
If tables are recalculated for each access to protect against side-channel attacks, then security is improved, but computational efficiency deteriorates
Solution Approach 1:
The patent applies preliminary action by pre-calculating and storing multiple versions of lookup tables (unmasked, basic-masked, and 00/FF-masked) in memory before the cryptographic operation. During the actual computation, the system simply selects and uses the appropriate pre-computed table based on the masking scheme, rather than recalculating tables for each access. This maintains security through multiple table versions while preserving computational efficiency through O(1) table lookup.
Solution Approach 2:
The patent creates multi-functional tables that serve multiple purposes: the same table structure supports both unmasked and masked operations, and the 00/FF-masked tables provide additional security layers. These universal table designs can be used across different cryptographic operations and masking schemes, eliminating the need for separate table calculations for each access scenario and maintaining high computational efficiency.
3Reliability
If 00/FF masking is applied to intermediate values, then protection against higher-order DPA attacks is improved, but device complexity increases
Solution Approach 1:
The patent reduces implementation complexity by performing the 00/FF masking operations during the table pre-computation phase rather than during each cryptographic operation. The masked tables are generated once in advance using standard programming techniques, and then simply loaded and used during execution. This preliminary approach transforms a complex runtime operation into a simple memory access, making the enhanced security feature practical to implement.
Solution Approach 2:
The patent uses copying by creating copies of the original lookup tables with applied masking transformations. Instead of modifying the original table structure dynamically, the system creates parallel copies (unmasked table, basic-masked table, 00/FF-masked table) that can be independently stored and selected. This copying approach simplifies the implementation by allowing standard memory operations and table loading mechanisms to handle the masked data without complex runtime manipulation.
Data Source
Figure 1a~3c
Figure 4~7
Figure 8~10
AI summary
The invention provides a method, in a processor, for performing a cryptographical calculation. The performance of the calculation involves the application of basic masking, which includes intermediate values in the calculation as masked intermediate values. The performance of the calculation additionally involves the application of secondary masking, wherein, for each intermediate value masked by means of the basic masking, the one's complement of the masked intermediate value is formed, the masked intermediate value and the one's complement of the masked intermediate value are provided and, under random control, the calculation is performed either with the masked intermediate value or with the one's complement of the masked intermediate value.