Sbox Masking for Side-Channel Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The SNOW process, a popular cryptographic algorithm for wireless data protection, is vulnerable to side-channel attacks based on power analysis, particularly due to its S-Boxes which are susceptible to power consumption monitoring.
Innovation Solution
A data processing system is designed with a cipher block that includes a finite state machine with an Sbox capable of additively masking content and converting the mask into a multiplicative mask, simplifying subsequent unmasking operations, and using a Multiplicative Mask Generator to prevent all-zero multiplicative masks, thereby enhancing security against side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the SNOW process uses S-Boxes for cryptographic processing, then encryption functionality is provided, but the system becomes vulnerable to side-channel attacks based on power analysis
Solution Approach 1:
The patent applies preliminary masking actions to the S-Box inputs and intermediate values before they are processed. Additive masks are applied to inputs, and multiplicative masks are applied to intermediate values, so that when the S-Box processes these masked values, the power consumption patterns do not reveal information about the original unmasked data. This preliminary masking prevents the side-channel attack from succeeding.
Solution Approach 2:
The patent introduces mask values as intermediary elements between the original data and the S-Box processing. These masks act as mediators that hide the relationship between the input data and the power consumption patterns. The additive masks (a1, a2) and multiplicative masks (m1, m2) serve as intermediaries that decouple the power analysis from the actual secret data.
2Object-affected harmful factors
If additive masking is applied to S-Box inputs to protect against power analysis, then security against side-channel attacks is improved, but the complexity of mask reversal operations increases
Solution Approach 1:
The patent applies preliminary multiplicative masking to intermediate values in the S-Box computation path. By multiplying intermediate results by multiplicative masks (m1, m2), the patent creates a structured masking scheme where the masks can be systematically tracked and reversed. This preliminary action simplifies the overall unmasking process compared to using only additive masks.
Solution Approach 2:
The patent transforms the masking approach by changing from purely additive masks to a combination of additive and multiplicative masks. This parameter change in the masking strategy allows for more efficient unmasking operations, as multiplicative masks in finite fields can be reversed through modular inverse operations, which are computationally simpler than reversing multiple additive mask layers.
3Speed
If the system processes unmasked data through S-Boxes, then processing speed is maintained, but original data exposure creates security vulnerabilities
Solution Approach 1:
The patent applies preliminary masking to data before it enters the S-Box processing stage, so that the S-Box operates on masked values rather than unmasked secret data. This preliminary action maintains the processing speed because the masking operations are simple XOR and multiplication operations that can be performed in parallel with the S-Box computation, while simultaneously providing security by ensuring the original data is never exposed in unmasked form during processing.
Data Source
AI summary
An integrated circuit features technology for generating a keystream. The integrated circuit comprises a cipher block with a linear feedback shift register (LFSR) and a finite state machine (FSM). The LFSR and the FSM are configured to generate a stream of keys, based on an initialization value and an initialization key. The FSM comprises an Sbox that is configured to use a multiplicative mask to mask data that is processed by the Sbox when the LFSR and the FSM are generating the stream of keys. Other embodiments are described and claimed.