Modular Exponentiation Error Detection via Complementary Variable Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modular exponentiation calculations in cryptographic algorithms are vulnerable to attacks such as Differential Fault Analysis (DFA), Statistical Power Analysis (SPA), and Differential Power Analysis (DPA), and existing protection methods either increase calculation time or fail to verify error-free operation at all points, especially during result recombination.
Innovation Solution
A method that updates two variables based on the bits of an exponent in a complementary manner, allowing for a relationship test between these variables to detect errors, thereby enhancing security against current analysis and error generation attacks, and can be applied to various cryptographic operations including modular exponentiation and elliptical curve operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If duplication of calculations is performed to verify error-free execution, then security against error generation attacks is improved, but calculation time is doubled
Solution Approach 1:
The patent creates a copy of the calculation process by maintaining two parallel variables (first variable and second variable) that are updated based on complementary conditions (bit value 0 or 1). Instead of duplicating the entire calculation, the method uses these two variables to track parallel execution paths, allowing verification through relationship testing between derived values from each variable.
Solution Approach 2:
The patent introduces an intermediary verification mechanism by deriving values from both the first and second variables and testing their relationship. This intermediary step (comparing derived values) serves as a lightweight check that confirms error-free execution without requiring full recalculation, thus reducing the time overhead compared to complete duplication.
2Reliability
If symmetrical operations are performed for each bit of the exponent, then protection against SPA attacks is improved, but operation complexity increases
Solution Approach 1:
The patent applies asymmetry by updating only one variable (either first or second) based on the bit value, rather than performing identical operations on both variables for each bit. The update rule is asymmetric: if the bit is 0, update the first variable; if the bit is 1, update the second variable. This asymmetric approach maintains protection against SPA attacks while reducing operational complexity compared to fully symmetrical operations.
3Reliability
If verification is performed at intermediate stages, then detection of error generation attacks is improved, but computational overhead increases
Solution Approach 1:
The patent performs partial verification by testing the relationship between derived values from the two variables at intermediate stages, rather than performing complete verification of all calculation steps. This partial action approach provides sufficient error detection capability while minimizing computational overhead, as it only requires comparing derived values rather than rechecking entire calculation chains.
Data Source
AI summary
A data processing method, whereby an element is subjected to a first operation with a given operand. The method includes a step of updating by a second operation a first variable (B; a0; S′p, S′q) or a second variable (A; a1; Sp, Sq), depending on whether a corresponding bit of the operand=0 or 1; and a step of testing a relationship between a first value (B; a0; S′) derived from the first variable and a second value (A; a1; S) derived from the second variable. A related device is also disclosed.