Montgomery Multiplier Blinded Modulus for Side-Channel Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Montgomery multiplication methods require a complex final step of conditional reduction, increasing computational complexity and vulnerability to side-channel attacks.
Innovation Solution
The method involves computing a blinded modulus M' as a multiple of the original modulus M by a random factor R, ensuring the length of M' is less than the block size by at least two bits, which eliminates the need for conditional reduction and enhances security by simplifying the computation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional Montgomery multiplication is performed with exact modulus M, then computational accuracy is maintained, but conditional modular reduction is required which increases computational complexity and vulnerability to side-channel attacks
Solution Approach 1:
The patent applies preliminary action by pre-selecting a random blinding factor R and computing the blinded modulus M' = R*M before the Montgomery multiplication operation. This preliminary blinding transformation eliminates the need for conditional modular reduction during the computation, as the result will naturally fall within the valid range due to the properties of the blinded modulus. The blinding factor is chosen such that M' < 2^(n+1), ensuring that the final result requires no reduction.
Solution Approach 2:
The patent introduces an intermediary element - the random blinding factor R - which transforms the original modulus M into a blinded modulus M'. This intermediary allows the computation to proceed without conditional reduction by mediating the relationship between the operands and the modulus. The blinding factor acts as a temporary transformation that simplifies the computational process while maintaining the mathematical correctness of the operation.
2Measurement precision
If conditional modular reduction is performed to ensure exact Montgomery product, then computational precision is maintained, but resistance to side-channel attacks is reduced
Solution Approach 1:
The patent converts the potential harm of side-channel attacks into a benefit by using random blinding. The randomness introduced by the blinding factor R masks the actual computational operations from side-channel analysis, while the mathematical properties of the blinded modulus ensure that the computation remains precise and correct. The harm of added complexity is converted into the benefit of enhanced security.
Solution Approach 2:
The patent changes the parameter of the modulus from the fixed value M to a randomized value M' = R*M. This parameter change transforms the deterministic Montgomery multiplication into a randomized operation that is resistant to side-channel attacks. The randomness in the modulus parameter ensures that identical operations appear different to external observers, preventing timing and power analysis attacks.
3Device complexity
If blinded modulus M' is used with length less than n blocks by at least two bits, then conditional reduction is eliminated, but overflow risk increases
Solution Approach 1:
The patent applies partial action by reducing the blinded modulus M' to be slightly smaller than the maximum possible value (less than n blocks by at least two bits). This partial reduction is sufficient to eliminate conditional modular reduction while maintaining adequate headroom to prevent overflow. The two-bit margin provides just enough buffer to ensure reliability without requiring full-size reduction.
Data Source
Figure 1
Figure 2
AI summary
A method, a device and a non-transitory computer-readable medium for cryptographic computation are provided. The method for computation includes: receiving, in a Montgomery multiplier circuit having a predefined block size, a pair of operands A and B and a modulus M for computation of a Montgomery product of A and B mod M; specifying a number n of blocks of the predefined block size to be used in the computation; computing a blinded modulus M' as a multiple of the modulus M by a random factor R, M' = R*M, while selecting R so that the length of M' is less than n times the block size by at least two bits; and operating the Montgomery multiplier circuit to compute and output the Montgomery product of A and B mod M'.