Randomized Modular Multiplier for Side-Channel Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Lattice-based cryptographic algorithms are vulnerable to side-channel attacks due to predictable power consumption patterns during modular multiplication operations, which can reveal secret information like private and public keys.
Innovation Solution
A modular multiplier system that includes a random number generator, lookup tables for pre-computed modular arithmetic, and a processor that randomly determines the order of addition and acquisition of modular arithmetic results, decomposing inputs into polynomials and using positive and negative number tables to obscure power consumption patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If modular multiplication operations are performed using conventional methods, then computation efficiency is maintained, but power consumption patterns become predictable and vulnerable to side-channel attacks
Solution Approach 1:
The modular multiplication operation is segmented into multiple partial product computations, where each partial product corresponds to a specific bit position or group of bit positions. These partial products are then accumulated to produce the final result. This segmentation allows the system to introduce randomization in the accumulation order without affecting the mathematical correctness of the computation, thereby masking power consumption patterns while maintaining computational efficiency.
Solution Approach 2:
The invention introduces dynamic randomization in the accumulation process by randomly selecting the order in which partial products are accumulated. This dynamic approach changes the execution pattern of the modular multiplication operation on each invocation, making power consumption patterns unpredictable to side-channel attackers while preserving the underlying mathematical logic and computational efficiency.
2Reliability
If the order of addition arithmetic is fixed, then processing speed is optimized, but power consumption patterns reveal information about secret inputs
Solution Approach 1:
Partial products are pre-computed and stored before the final accumulation step. This preliminary action separates the computation of partial products from their accumulation, allowing the accumulation order to be randomized without affecting the overall processing speed. The pre-computed partial products can be quickly retrieved and accumulated in any order, maintaining efficiency while enhancing security.
Solution Approach 2:
The accumulation order of partial products is dynamically randomized during each modular multiplication operation. This dynamic randomization prevents side-channel attackers from inferring secret inputs based on fixed power consumption patterns, while the underlying computational efficiency is preserved through optimized accumulation algorithms that can handle variable ordering.
3Productivity
If lookup tables are used for pre-computed modular arithmetic, then computation time is reduced, but memory requirements increase
Solution Approach 1:
The lookup table is segmented into multiple smaller tables, each storing results for specific ranges or types of modular arithmetic operations. This segmentation reduces the memory footprint of individual tables while maintaining comprehensive coverage of all required computations. The system can selectively access different segments based on the specific operation being performed, optimizing both memory usage and computation speed.
Solution Approach 2:
The lookup table structure is designed to be universal, supporting multiple types of modular arithmetic operations (multiplication, addition, subtraction) and different modulus values within the same cryptographic scheme. This multi-functionality allows a single lookup table infrastructure to serve various computational needs, reducing overall memory requirements compared to having separate tables for each operation type.
Data Source
AI summary
A modular multiplier includes a random number generator that generates a random number, a memory that stores at least one lookup table including results of pre-computed modular arithmetic, and a processor that obtains results of modular arithmetic on partial products defined by a product of a first polynomial corresponding to a first input and a second polynomial corresponding to a second input with reference to the at least one lookup table, and generates a result of modular arithmetic on a product of the first input and the second input based on addition arithmetic of the obtained results of the modular arithmetic. The processor randomly determines at least one of an order of the addition arithmetic or an acquisition order of modular arithmetic results on the partial products based on the random number generated by the random number generator.