Modular Exponentiation Protection via Random Quantity Initialization

Solution Overview

Problem

Existing solutions for protecting modular exponentiation calculations and operations on elliptic curves against side channel attacks, such as DPA-type attacks, are resource-intensive due to the high consumption of power and calculation time required for unmasking the random quantities used for masking.

Innovation Solution

A method is introduced that initializes variables with random quantities and iteratively updates them using multiplication and subtraction operations based on the bits of the exponent, reducing the number of multiplications needed for modular exponentiation, and involves squaring and division operations to minimize resource usage, particularly suited for RSA-type algorithms and elliptic curve cryptography.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If random quantities are used to mask the quantities manipulated by the algorithm to protect against side channel attacks, then security against side channel attacks is improved, but resource consumption (power and calculation time) increases due to the unmasking process

Engineering Contradiction:

Improvesecurity against side channel attacksVSAvoidpower consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent applies preliminary action by pre-initializing variables with random quantities before the modular exponentiation calculation. This allows the masking to be in place during the entire calculation process, and the unmasking is naturally integrated into the final result extraction, avoiding separate resource-intensive unmasking operations.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements self-service by designing the calculation method such that the random quantities used for masking are automatically eliminated through the mathematical structure of the modular exponentiation itself. The final result naturally contains only the intended computation outcome without the masking random quantities, making the unmasking process self-executing and resource-efficient.

Inventive Principle:

Principle #25Self-service

2Reliability

If random quantities are used to mask the quantities manipulated by the algorithm to protect against side channel attacks, then security against side channel attacks is improved, but calculation time increases due to the unmasking process

Engineering Contradiction:

Improvesecurity against side channel attacksVSAvoidcalculation time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies preliminary action by pre-initializing variables with random quantities before the modular exponentiation calculation. This allows the masking to be in place during the entire calculation process, and the unmasking is naturally integrated into the final result extraction, avoiding separate resource-intensive unmasking operations.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements self-service by designing the calculation method such that the random quantities used for masking are automatically eliminated through the mathematical structure of the modular exponentiation itself. The final result naturally contains only the intended computation outcome without the masking random quantities, making the unmasking process self-executing and resource-efficient.

Inventive Principle:

Principle #25Self-service

3Ease of operation

If traditional unmasking methods are used to remove the contribution of random quantities from the result, then the result can be correctly exploited, but resource consumption increases significantly

Engineering Contradiction:

Improveresult correctnessVSAvoidpower consumption

Core Design Contradiction:

Ease of operationVSUse of energy by moving object

Solution Approach 1:

The patent implements self-service by designing the calculation method such that the random quantities used for masking are automatically eliminated through the mathematical structure of the modular exponentiation itself. The final result naturally contains only the intended computation outcome without the masking random quantities, making the unmasking process self-executing and resource-efficient.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent applies parameter changes by modifying the initialization parameters of the modular exponentiation algorithm. Instead of initializing with plain values, the method initializes variables with random quantities added to them, and through the exponentiation process, this transforms the final result to automatically eliminate the random quantity contributions without requiring additional unmasking operations.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS9014368B2Protection of a modular exponentiation calculation by addition of a random quantity

Publication Date: 2015.04.21 STMICROELECTRONICS (ROUSSET) SAS

AI summary

A method for protecting a calculation, by an electronic circuit, of a modular exponentiation of a digital quantity, wherein: a first variable is initialized with a random quantity increased by once unit; a second variable is initialized with the product of the digital quantity by the random quantity; a third variable is initialized with the digital quantity; iteratively for all the bits at 1 of an exponent of the modular exponentiation, the first variable is updated by: a) multiplying its content by that of the third variable; and b) subtracting thereto the content of the second variable increased by the random quantity; and once all the bits of the exponent have been processed, the content of the first variable is decreased by the random quantity to provide the result of the modular exponentiation.