Lightweight Side-Channel Protection for Polynomial Multiplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing public-key digital signature algorithms like RSA and ECDSA are not secure against brute-force attacks from quantum computers, necessitating the development of new algorithms resistant to quantum computing threats, particularly in hash-based signature schemes such as XMSS and LMS, which are computationally expensive and vulnerable to side-channel attacks.
Innovation Solution
Implementing lightweight side-channel protection for polynomial multiplication using random reordering and shuffling countermeasures in polynomial multiplication circuitry, which reduces latency and hardware-area overhead while providing protection against side-channel attacks, and optimizing operations in hash-based signature schemes like XMSS and LMS to enhance security and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional public-key algorithms (RSA, ECDSA) are used, then current security standards are met, but they become vulnerable to quantum computer attacks
Solution Approach 1:
The patent transitions from classical cryptographic parameters (modular exponentiation, elliptic curve point multiplication) to post-quantum parameters (polynomial coefficients in ring structures, NTT transforms). This parameter change enables quantum resistance while maintaining computational feasibility through optimized polynomial arithmetic and number-theoretic transforms.
2Reliability
If hash-based signature schemes (XMSS, LMS) are implemented, then quantum security is achieved, but computational expense increases
Solution Approach 1:
The patent replaces traditional polynomial multiplication mechanisms with Number Theoretic Transform (NTT) based multiplication. This substitution leverages fast Fourier transform-like algorithms to reduce the computational complexity from O(n²) to O(n log n), dramatically improving signature generation and verification speed while maintaining quantum security.
3Productivity
If polynomial multiplication is performed without protection, then computational efficiency is maintained, but side-channel attacks become possible
Solution Approach 1:
The patent applies preliminary masking to polynomial coefficients before multiplication operations. Random masks are generated and combined with secret coefficients in advance, so that the actual sensitive values never appear in isolation during computation. This preliminary protection prevents attackers from extracting secret information through power analysis or timing attacks while maintaining efficient polynomial arithmetic.
4Object-affected harmful factors
If side-channel protection is added to polynomial multiplication, then security against attacks improves, but hardware overhead increases
Solution Approach 1:
The patent applies side-channel protection selectively to specific critical operations rather than uniformly across all computations. Masking is applied to polynomial coefficients during multiplication, while other operations remain unprotected. This localized approach provides necessary security against side-channel attacks while minimizing hardware overhead and maintaining overall system efficiency.
Data Source
AI summary
In one example an apparatus comprises a first input node to receive a first input, a second input node to receive a control signal, a polynomial multiplication circuitry to perform a polynomial multiplication function using the first input as an element of a digital signature protocol, the polynomial multiplication function comprising a plurality of polynomial multiplication operations, the polynomial multiplication function performed in a security mode determined by the control signal, the security mode comprising one of a first mode in which no side-channel protection is provided to the polynomial multiplication operation or a second mode in which a shuffling-based side-channel protection is provided to the polynomial multiplication operation. Other examples may be described.