Montgomery Ladder Scalar Multiplication Randomization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In asymmetric cryptography, particularly in Elliptic Curve Cryptography (ECC), existing methods are vulnerable to side-channel attacks due to high computational costs and inefficiencies in randomization processes, which allow attackers to exploit patterns in multiplication operations, compromising key security.
Innovation Solution
The implementation of a Montgomery ladder-based scalar multiplication procedure with iterative randomization of projective format coordinates by multiplying them with a random value generated within a specific range, reducing computational costs and enhancing security by making each key iteration unique.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional Montgomery multiplication is used for randomization in ECC scalar multiplication, then security against side-channel attacks is improved, but computational cost increases significantly due to quadratic terms in modular multiplication
Solution Approach 1:
The patent changes the parameters of the randomization process by generating random values within a controlled range (0 to 2^w-1 where w is word size) and using these to scale projective coordinates. This parameter constraint eliminates quadratic terms in the multiplication while maintaining security properties, directly resolving the contradiction between security and efficiency
Solution Approach 2:
The patent segments the randomization process into controlled steps: generating random values in specific ranges, scaling coordinates iteratively, and normalizing results. This segmentation allows the computation to avoid expensive quadratic operations while achieving the same security goal, improving computational efficiency without compromising security
2Reliability
If randomization is performed at each iteration of the Montgomery ladder, then resistance to side-channel attacks is enhanced, but computational latency increases
Solution Approach 1:
The patent applies partial randomization by scaling coordinates with random factors at selected iterations rather than performing full randomization operations at every step. This partial action maintains security against side-channel attacks while reducing the total computational latency compared to complete randomization at each iteration
3Device complexity
If the random value range is limited to powers of two of word size, then computational complexity is reduced, but the quality of randomization may be compromised
Solution Approach 1:
The patent carefully selects the random value range as (0 to 2^w-1) where w is the processor word size. This parameter choice enables efficient computation using native word operations while still providing sufficient entropy for security. The patent proves that this constrained range maintains security properties by ensuring the randomization is sufficient to mask side-channel information
Solution Approach 2:
The patent leverages the processor's native word size and arithmetic capabilities to generate and process random values. By aligning the random value range with the processor's natural word boundaries, the system uses its own architectural features to achieve both low computational complexity and high-quality randomization, eliminating the need for external complex randomization mechanisms
Data Source
AI summary
A scalar multiplication operation includes an iterative procedure performing a set of operations at each iteration on a bit or on a group of consecutive bits of a secret key. The multiplication operation includes multiplying values of projective format coordinates by a random value. The random value is a product of a random number generated over a range having as end value a first value, with a second value, which is larger than said first value. The first value is a power of two of a word size multiplied by a multiplier value, minus one. The second value is equal to a power of two of a number of bits of the coordinates divided by the first value. The multiplier value is an integer greater than or equal to one and smaller than a ratio of said number of bits to the word size.