Multiplicative-Additive Masking for Zero Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Simplified multiplicative masking in cryptographic algorithms is vulnerable to side channel attacks, particularly 'zero attacks,' as a multiplicative mask does not effectively mask input values of zero, allowing power analysis attacks even when masking is used.
Innovation Solution
The implementation of multiple lookup tables (LUTs) or sub-tables, where an additive mask is transformed into a multiplicative-additive mask, and selected bits are used to select one of the sub-tables for non-linear transformations, increasing the difficulty of zero attacks by ensuring non-zero outputs for zero inputs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If simplified multiplicative masking is used in cryptographic algorithms, then the security against side channel attacks is improved, but the vulnerability to zero attacks increases because multiplicative masks do not effectively mask input values of zero
Solution Approach 1:
The patent combines additive masking and multiplicative masking into a composite masking scheme. The input data is masked with both an additive mask (XOR operation) and a multiplicative mask, creating a composite masked value that leverages the strengths of both masking types while mitigating their individual weaknesses, particularly the zero-attack vulnerability of pure multiplicative masking
Solution Approach 2:
The patent transforms the masking parameters by converting between additive and multiplicative masks through field operations in GF(2^8). This parameter transformation allows the system to switch between different masking representations, enabling the composite scheme to maintain security properties across different operational states and preventing attackers from exploiting单一 masking approach
2Reliability
If multiple lookup tables are used with multiplicative-additive masking, then the security against zero attacks is improved by ensuring non-zero outputs, but the device complexity increases
Solution Approach 1:
The patent divides the single large substitution table into multiple smaller lookup tables (LUTs), each handling a specific portion of the masked input space. This segmentation reduces the memory access complexity and allows parallel processing of different mask combinations, offsetting the increased structural complexity with improved access efficiency and enhanced security
Solution Approach 2:
The patent introduces intermediate computation steps that transform the composite masked input into appropriate indices for selecting and accessing the correct lookup table. These intermediary transformations include field multiplications and XOR operations that mediate between the complex masking scheme and the simplified table lookup structure, managing the complexity transition
3Reliability
If composite masking transformations are applied to masked input data, then the security is enhanced, but the propagation delay increases
Solution Approach 1:
The patent performs preliminary computations of the multiplicative mask components and prepares the composite masked values before the actual substitution operation. By pre-computing mask transformations and preparing lookup table indices in advance, the system reduces the critical path delay during the main encryption operation, trading off some preprocessing time for faster core execution
Data Source
AI summary
Processing of masked data using multiple lookup tables (LUTs), or sub-tables, is described. For each input value, an appropriate sub-table provides an output value that is the result of a non-linear transformation (e.g., byte substitution) applied to the input value. An additive mask can be applied to the input data. A transformation can be applied to the masked input data to transform the additive mask into a multiplicative-additive mask. Selected bits of the masked input data and the bits in the additive component of the multiplicative-additive mask can be used in combination to select one of the sub-tables. An entry in the selected sub-table, corresponding to a transformed version of the input data, can then be identified.