Post-Quantum Cryptographic Math Unit With Masked Side-Channel Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems face challenges in efficiently performing post-quantum cryptographic operations, particularly in low-resource embedded systems, while ensuring resistance to attacks and maintaining high-speed data processing, especially with the threat of quantum computing and side-channel vulnerabilities.
Innovation Solution
A cryptographic system-on-chip (SoC) design that includes a cryptographic math unit with a matrix memory, address generator, and arithmetic unit, configured for discrete binary arithmetic and vector processing, which performs post-quantum cryptographic operations autonomously, with a control unit controlling operations without accessing sensitive data, and implements masking to protect against side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If post-quantum cryptographic functions are implemented with complex mathematical operations and long bit lengths, then security against quantum attacks is improved, but processor cycle consumption increases and performance decreases
Solution Approach 1:
The cryptographic system is divided into distinct functional units: a control unit that manages operations without accessing sensitive data, a cryptographic math unit that performs computations, and a memory unit that stores data. This segmentation allows each component to be optimized independently, with the math unit focused purely on computation and the control unit on operation management, thereby improving processing efficiency while maintaining security.
Solution Approach 2:
A dedicated cryptographic math unit acts as an intermediary between the control unit and memory, handling all cryptographic computations. This intermediary structure allows the control unit to remain isolated from sensitive cryptographic data while still managing operations, reducing the attack surface for side-channel attacks and improving overall system security without sacrificing performance.
2Reliability
If cryptographic operations are performed repeatedly at high speeds for end-to-end encryption, then data protection coverage is improved, but computational resource consumption increases
Solution Approach 1:
The system performs key establishment and other preparatory cryptographic operations in advance, storing results in memory for later use. This preliminary action reduces the need to perform computationally intensive operations repeatedly during actual data encryption, thereby lowering real-time computational resource consumption while maintaining comprehensive data protection.
3Ease of operation
If control units have access to sensitive cryptographic data for operation control, then operational flexibility is improved, but vulnerability to side-channel attacks increases
Solution Approach 1:
The cryptographic math unit serves as an intermediary that the control unit communicates with through a controlled interface. The control unit can initiate and manage cryptographic operations without directly accessing sensitive data stored in memory or processed by the math unit. This intermediary structure maintains operational flexibility while minimizing the control unit's exposure to side-channel attacks.
Solution Approach 2:
Different parts of the system have different access permissions to sensitive data. The control unit has operational control but limited data access, the math unit has processing access but restricted data visibility, and only specific protected memory regions store sensitive cryptographic data. This localized quality approach allows operational flexibility in each component while containing side-channel attack risks to specific areas.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Certain examples described herein relate to at least a cryptographic system and a method of operating a cryptographic system. The cryptographic system may be implemented as a co- processor for performing post-quantum cryptographic functions. The cryptographic system has a set of bus interfaces for coupling to an external computing system, a cryptographic math unit and a control unit. The cryptographic math unit in certain examples is adapted to provide one or more masked modes of operation that secure the cryptographic operations against side-channel and non- invasive attacks. The method of operating a cryptographic system involves annotating secret data and tracking those annotations through one or more arithmetic operations.