Modular Calculation Protection via Masking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting modular exponentiation and scalar multiplication operations in electronic circuits are ineffective against horizontal side-channel attacks and fault-injection attacks, as they do not adequately mask the secret data, allowing attackers to infer sensitive information from a single trace or execution.
Innovation Solution
A method that combines a second number with a third number to create a fourth number, performing modular calculations on the first and fourth numbers, and iteratively updates a memory location based on the bits of the third number, using the inverse of the first number or the first number itself depending on the state of the corresponding bit in the fourth number, to mask the exponent or scalar during calculations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional modular exponentiation or scalar multiplication operations are performed without additional masking, then the calculation is simple and fast, but the secret data (exponent or scalar) is vulnerable to horizontal side-channel attacks and fault-injection attacks
Solution Approach 1:
The patent introduces a third number (masking value) as an intermediary element that is combined with the second number (exponent or scalar) to create a fourth number. This masking value acts as a mediator that hides the secret data during calculation, preventing horizontal side-channel attacks while maintaining the mathematical correctness of the operation through modular arithmetic properties
Solution Approach 2:
The patent changes the parameter representation by adding a random multiple of the Euler totient function of the modulo to the exponent, or adding a random value to the scalar. This parameter transformation masks the original secret value while preserving the cryptographic functionality, making it impossible for attackers to infer the secret from intermediate values
2Reliability
If the exponent or scalar is masked by combining with a third number, then protection against horizontal attacks is achieved, but the calculation requires additional operations
Solution Approach 1:
The patent performs preliminary masking by combining the second number with a third number before the main modular calculation. This preliminary action prepares the data in a protected form, and the subsequent calculation proceeds with the masked value, requiring unmasking only at the end to retrieve the final result
3Loss of information
If conventional operations are performed, then the implementation is straightforward, but side-channel attacks can infer secret data from power consumption or radiation patterns
Solution Approach 1:
The third number serves as a masking intermediary that prevents direct correlation between the secret data and physical side-channel emissions. By performing operations on the masked value rather than the bare secret, the physical characteristics (power consumption, radiation) no longer directly reveal information about the exponent or scalar
Solution Approach 2:
The patent creates a composite value by combining the secret second number with a random third number. This composite masked value maintains the mathematical properties needed for correct calculation while hiding the individual components from side-channel analysis, similar to how composite materials combine properties to achieve desired characteristics
Data Source
AI summary
A method of protecting a modular calculation on a first number and a second number, executed by an electronic circuit, including the steps of: combining the second number with a third number to obtain a fourth number; executing the modular calculation on the first and fourth numbers, the result being contained in a first register or memory location; initializing a second register or memory location to the value of the first register or to one; and successively, for each bit at state 1 of the third number: if the corresponding bit of the fourth number is at state 1, multiplying the content of the second register or memory location by the inverse of the first number and placing the result in the first register or memory location, if the corresponding bit of the fourth number is at state 0, multiplying the content of the second register or memory location by the first number and placing the result in the first register or memory location.