Modular Exponentiation via Randomized Addition Chains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the white-box cryptography model, existing technologies face challenges in securely implementing modular exponentiation without revealing the secret exponent, especially in scenarios where the attacker has full access to the software implementation and can pause or alter its execution.
Innovation Solution
A device and method are introduced that generate code for modular exponentiation using a randomized addition chain, where intermediate results are stored in a lookup table, allowing secure computation without directly embedding the secret exponent, and incorporating countermeasures to protect against white-box attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the secret exponent is directly embedded in the software implementation, then the modular exponentiation can be executed efficiently, but the attacker can extract the secret key by analyzing the software
Solution Approach 1:
The patent introduces random addition chains as an intermediary mechanism between the secret exponent and the modular exponentiation computation. Instead of directly embedding the secret exponent in the software, the system uses randomly generated addition chains that compute the same result but reveal no information about the original exponent. This intermediary layer allows efficient computation while preventing key extraction attacks.
Solution Approach 2:
The patent changes the computational parameters by replacing the fixed secret exponent with randomly generated addition chains. Each execution uses different random parameters (addition chain sequences) that produce the same cryptographic result but have different computational paths. This parameter transformation maintains computation efficiency while enhancing security against analysis.
2Reliability
If randomization techniques are applied to protect the secret exponent, then security against white-box attacks is improved, but the device complexity increases due to lookup tables and chain generation
Solution Approach 1:
The patent segments the modular exponentiation computation into multiple smaller steps defined by the addition chain. Instead of performing one large exponentiation operation, the computation is broken down into a sequence of smaller multiplications corresponding to the addition chain elements. This segmentation allows the use of lookup tables for intermediate values and simplifies the randomization process while maintaining security.
Solution Approach 2:
The patent performs preliminary generation of addition chains and precomputation of intermediate values before the actual cryptographic operation. The addition chains are generated in advance and stored, along with precomputed intermediate results in lookup tables. This preliminary action reduces the complexity during runtime execution while maintaining the security benefits of randomization.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Various embodiments relate to a device for generating code which implements modular exponentiation, the device including: a memory used to store a lookup table; and a processor in communication with the memory, the processor configured to: receive information for a generated randomized addition chain; output code for implementing the modular exponentiation which loads elements from the lookup table including intermediate results which utilize the information for a generated randomized addition chain; and output code for implementing the modular exponentiation which uses the loaded elements to compute the next element.