Constant-Time Modular Reduction for Cryptographic Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electronic circuits employing modular reduction calculations, such as those used in elliptic curve cryptography, are vulnerable to timing attacks due to non-constant run times, which can reveal secret data.
Innovation Solution
A method that performs modular reduction calculations by calculating intermediate results and adjusting them using specific integer multiples and logical operations, ensuring a constant number of steps independent of the input, thereby masking timing information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional modular reduction calculations are used in cryptographic operations, then processing speed and efficiency are improved, but security against timing attacks deteriorates
Solution Approach 1:
The patent changes the execution parameters of the modular reduction algorithm by introducing a conditional addition step that executes based on the most significant word value. This parameter change ensures that the total execution time remains constant regardless of input values, thereby preventing timing attacks while maintaining processing efficiency
Solution Approach 2:
The patent introduces an intermediary conditional check on the most significant word (MSW) that acts as a mediator between the input data and the final result. This intermediary step ensures that the execution path adapts to input variations without exposing timing information, resolving the contradiction between speed and security
2Reliability
If conditional operations are added to prevent timing attacks, then security is improved, but computational complexity increases
Solution Approach 1:
The patent segments the modular reduction operation into distinct phases: initial computation, MSW evaluation, conditional addition, and final result generation. This segmentation allows the conditional security measure to be isolated to a specific step rather than permeating the entire computation, thereby limiting the increase in overall complexity
Solution Approach 2:
The patent applies partial action by performing the conditional addition only when the MSW indicates it is necessary, rather than always executing the full sequence of operations. This partial execution approach maintains security while avoiding unnecessary computational overhead in cases where the conditional step is not required
3Reliability
If constant-time execution is enforced, then security against timing attacks is improved, but processing efficiency deteriorates
Solution Approach 1:
The patent introduces dynamic adaptation into the modular reduction algorithm by conditionally executing the addition step based on the MSW value. This dynamic approach allows the algorithm to optimize its execution path for each specific input while maintaining constant overall execution time, thereby preserving both security and efficiency
Data Source
AI summary
A modular reduction calculation on a first number and a second number is protected from side-channel attacks, such as timing attacks. A first intermediate modular reduction result is calculated. A value corresponding to four times the first number is added to the first intermediate modular reduction result, generating a second intermediate modular reduction result. A value corresponding to the first number multiplied by a most significant word of the second intermediate modular reduction result plus 1, is subtracted from the second intermediate modular reduction result, generating a third intermediate modular reduction result. A cryptographic operation is performed using a result of the modular reduction calculation.