Processing Circuit Side-Channel Security via Blinding Value Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current processing circuits for multiplying operands in security-relevant applications are vulnerable to side-channel attacks, especially when operands are not independent, as information can be leaked through statistical analysis of product shares, even with blinding values.
Innovation Solution
A processing circuit design that splits operands and a blinding value into multiple shares, using different splits in separate branches to generate and combine product shares, ensuring higher-order security without additional register stages by re-sharing the blinding value with random values, thereby preventing information leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a blinding value is introduced to protect against side-channel attacks, then security is improved, but information may still leak through statistical analysis when operands are not independent
Solution Approach 1:
The blinding value is split into multiple shares (first shares and second shares) that are distributed across different computational branches. This segmentation ensures that no single branch contains the complete blinding value, preventing statistical analysis from recovering information about the operands even when they are not independent.
Solution Approach 2:
Multiple intermediate values are introduced in different branches (first intermediate value from first shares, second intermediate value from second shares) that act as mediators to mask the relationship between operands. These intermediaries prevent direct statistical correlation between input and output shares.
2Reliability
If multiple shares are used to increase security order, then security against side-channel attacks is improved, but circuit complexity increases
Solution Approach 1:
The circuit is divided into multiple independent branches, each processing a subset of shares. This segmentation allows the complex operation of handling multiple shares to be distributed across simpler parallel sub-circuits, managing complexity through modular organization.
Solution Approach 2:
Results from multiple parallel branches are merged to produce the final output. By combining the computational power of multiple simpler branches that each handle fewer shares, the circuit achieves high-order security without requiring a single overly complex processing unit.
3Loss of information
If different splits of the blinding value are used in separate branches, then information leakage is prevented, but the number of operations increases
Solution Approach 1:
The blinding value is segmented into different shares used in different branches, and multiple splits are performed to create the required number of intermediate values. This segmentation prevents information leakage by ensuring that each branch operates on incomplete information.
Solution Approach 2:
The circuit performs more operations than the minimal single-branch approach would require, creating multiple intermediate values and using multiple splits of the blinding value. This excessive action in terms of operations is necessary to achieve the security goal of preventing statistical information extraction.
Data Source
AI summary
A processing circuit comprises a first multiplier configured to determine three shares of the product of the first operand with a blinding value by multiplying each share of the first operand with each share of the blinding value according to a first split of the blinding value into three first shares. The processing circuit further comprises one or more first adders configured to determine, for each share of the second operand, the sum of the share of the second operand with a respective corresponding second share of the blinding value according to a second split of the blinding value into three second shares, wherein the first and second splits of the blinding value are different. The processing circuit is configured to determine shares of the product of the first operand with the second operand from the results of the first multiplier and the one or more first adders.