Multiplicative Masked Encryption Engine for Zero-Value Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing AES hardware designs face challenges in achieving side-channel resistance while minimizing area and power overheads, particularly with multiplicative masking susceptible to zero-value attacks and additive masking leading to information leakage.
Innovation Solution
Implement a cryptographic engine with multiplicative masking for non-linear operations and additive masking for linear operations, incorporating zero-value detection and conversion mechanisms to prevent information leakage, using a balanced zero-value detector and dual-rail zero-value detection circuits.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Area of stationary object
If multiplicative masking is used for AES hardware, then area overhead is reduced compared to additive masking, but the design becomes susceptible to zero-value attacks and information leakage
Solution Approach 1:
The patent applies preliminary anti-action by detecting zero-values in masked operands before they are processed by the Sbox circuitry. When a zero-value is detected, the system proactively replaces it with a random non-zero value, preventing the zero-value attack from succeeding. This preemptive measure counteracts the vulnerability before it can exploit the multiplicative masking scheme.
Solution Approach 2:
The patent introduces an intermediary zero-value detection mechanism that sits between the multiplicative masking operation and the Sbox processing. This intermediary layer monitors the masked operands and intervenes when zero-values are detected, replacing them with random non-zero values. This intermediary prevents direct exploitation of the multiplicative masking vulnerability while maintaining the area efficiency benefits.
2Reliability
If additive masking is used for AES hardware, then side-channel resistance is improved, but area overhead increases by more than double compared to base AES hardware
Solution Approach 1:
The patent applies local quality by using different masking approaches in different parts of the AES implementation. Multiplicative masking is used for linear operations where it provides area efficiency, while zero-value detection and replacement is applied specifically at the Sbox input stage where security is critical. This localized application of security measures provides adequate protection without incurring the full area overhead of complete additive masking.
Solution Approach 2:
The patent changes the masking parameter from additive to multiplicative in specific contexts to reduce area overhead. By using multiplicative masking for linear operations and only applying zero-value detection where needed, the system achieves lower area overhead while maintaining side-channel resistance through parameter optimization rather than uniformly applying the more resource-intensive additive masking scheme.
3Reliability
If multiplicative masking is used with zero-value detection, then zero-value attacks are prevented, but Hamming distance information leakage occurs due to mask reuse
Solution Approach 1:
The patent applies preliminary action by generating fresh random masks for each Sbox operation input. This ensures that even if multiple Sbox operations process related data, each operation uses a unique mask, preventing attackers from comparing Hamming distances across operations to extract information. The random mask generation occurs before each critical operation, proactively eliminating the information leakage vulnerability.
Solution Approach 2:
The patent introduces dynamics by making the mask values change for each operation rather than reusing static masks. The system dynamically generates new random masks for each Sbox input, ensuring that mask values are different across operations. This dynamic mask renewal prevents Hamming distance analysis attacks while maintaining zero-value protection, as the masks adapt to each specific operation rather than remaining fixed.
Data Source
AI summary
In one embodiment, a method comprises: combining, in a first adder circuit of a cryptographic engine, a round key with masked plaintext to generate an additively masked input; converting, in a first converter of the cryptographic engine, the additively masked input to a multiplicatively masked input; and performing, in a substitution box circuit of the cryptographic engine, a non-linear inverse operation on the multiplicatively masked input when the multiplicatively masked input is non-zero, and performing the non-linear inverse operation on a random non-zero value when the multiplicatively masked input is zero. Other embodiments are described and claimed.