Modular Exponentiation Protection Against Horizontal Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electronic circuits implementing modular exponentiation and elliptic curve calculations are vulnerable to horizontal attacks, which exploit a single execution trace to extract secret information, compromising security.
Innovation Solution
The method involves decomposing the exponent or scalar into a sum of integer terms and processing these terms in a random or permuted order, making it difficult for attackers to extract the original secret data from a single execution trace.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the exponent is processed in standard sequential order, then the calculation is simple and fast, but the circuit is vulnerable to horizontal attacks that can extract secret information from execution traces
Solution Approach 1:
The exponent is segmented into multiple components (e.g., high-order bits and low-order bits) that are processed separately. The calculation is divided into multiple stages where different segments are handled in different orders, preventing attackers from correlating execution trace patterns with specific exponent bits.
Solution Approach 2:
The processing order of exponent segments is dynamically changed between different executions. Randomization techniques are applied to vary the sequence in which exponent segments are processed, making it difficult for attackers to establish consistent patterns in execution traces across multiple runs.
2Reliability
If randomization techniques are applied to protect against attacks, then security is improved, but the calculation time and complexity increase
Solution Approach 1:
By segmenting the exponent processing into independent components that can be handled in parallel or pre-computed, the overhead of randomization is reduced. Critical path operations remain efficient while non-critical operations are randomized.
Solution Approach 2:
Certain protective measures are performed in advance during key generation or setup phases, so that during actual cryptographic operations, the randomized protection is already in place without adding significant execution time. Pre-computed tables and structures are used to minimize runtime overhead.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The present description relates to a method of protecting a calculation on a first number (M) and a second number (e), performed by an electronic circuit, in which: the second number (e) is decomposed into a sum of at least two third numbers (X1, X2); and the calculation is performed bit by bit for each rank (i) of the third numbers (X1, X2).