Polynomial Evaluation Fault Detection for Lattice Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Contemporary countermeasures for protecting lattice-based cryptography against fault injection attacks require high overhead in runtime or memory, and existing methods are expensive or ineffective against certain types of faults.
Innovation Solution
A fault detection mechanism using polynomial evaluation that reduces overhead by relying on evaluations rather than storing and recomputing polynomials, employing scalar operations and refresh schemes to protect polynomial operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If re-computation-based fault countermeasures are used, then fault protection is provided, but runtime and memory consumption increase significantly
Solution Approach 1:
The patent extracts only the essential evaluation points from full polynomial re-computation. Instead of re-computing entire polynomials, it extracts and evaluates only at specific points, significantly reducing runtime while maintaining fault detection capability
Solution Approach 2:
The patent uses evaluation points as simplified copies of the full polynomial state. Rather than storing and re-computing complete polynomials, it maintains copies at evaluation points which are sufficient for fault detection, reducing both time and memory overhead
2Reliability
If re-computation-based fault countermeasures are used, then fault protection is provided, but memory consumption increases
Solution Approach 1:
The patent extracts only the necessary evaluation points from full polynomial representations. By maintaining data only at these extracted points rather than full polynomials, memory consumption is significantly reduced while preserving fault detection capability
Solution Approach 2:
Instead of storing polynomials and evaluating them when needed (traditional approach), the patent inverts the approach by pre-selecting evaluation points and maintaining only the evaluated values, which requires less memory while providing equivalent or superior fault protection
3Reliability
If contemporary fault countermeasures are used, then some fault protection is provided, but overhead in area, runtime or memory is high
Solution Approach 1:
The patent introduces evaluation points as intermediary representations between full polynomials and fault detection. These intermediaries enable efficient comparison and fault detection with minimal overhead in area, runtime, and memory compared to direct polynomial manipulation
Data Source
Figure 1~2
Figure 3~4
AI summary
Various embodiments relate to a fault detection system and method for polynomial operations, including: selecting a plurality of evaluation points; evaluating a first polynomial at the plurality of evaluation points to produce first results; applying a first function to the first polynomial to produce a second polynomial; evaluating the second polynomial at the plurality of evaluation points second results; evaluating a second scalar function on the first results to produce third results; comparing the second results to the third results; and performing a polynomial operation using the second polynomial when the second results match the third results.