Scrambled Tweak Mode Encryption for DPA Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The aviation industry faces challenges in securing critical IT infrastructure due to side channel attacks, particularly differential power analysis (DPA), which exploits regularities in the computation of tweak values in standard XTS tweak mode encryption engines, leading to increased processing time and energy usage.
Innovation Solution
A scrambled tweak mode encryption engine that employs fast and thorough mixing functions to generate tweak values, which are XORed with both input and output of block ciphers, obfuscating counter values and preventing exploitable patterns, thereby mitigating DPA attacks without significantly increasing processing time or energy consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard XTS tweak mode encryption is used, then processing speed is fast and structure is simple, but the system becomes vulnerable to differential power analysis attacks due to regular patterns in tweak value computation
Solution Approach 1:
The patent transforms the linear Galois field multiplication sequence into a scrambled sequence by changing the parameter of the multiplication operation. Specifically, it uses a scrambled counter value that permutes the order of multiplications, thereby changing the computational pattern without altering the fundamental XTS encryption structure. This parameter change disrupts the regular power consumption patterns that DPA attacks exploit, while maintaining the efficiency of the original algorithm.
Solution Approach 2:
The patent introduces dynamic scrambling of the counter values used in Galois field multiplications. Instead of a fixed sequential order, the counter values are dynamically permuted using a scrambling function that varies the computation sequence. This dynamic approach ensures that each encryption operation follows a different computational path, preventing attackers from correlating power consumption patterns across multiple operations while maintaining the same cryptographic output.
2Reliability
If iterative Galois multiplications are performed to generate tweak values, then encryption security is maintained, but processing time increases for blocks far from the beginning of the plaintext
Solution Approach 1:
The patent performs preliminary scrambling of the counter values before they are used in the Galois field multiplications. By pre-computing the scrambled sequence and storing it in a lookup table or generating it once per encryption operation, the system avoids repeated scrambling computations for each block. This preliminary action reduces the computational overhead for distant blocks while maintaining the security benefits of the scrambled sequence.
3Reliability
If IV encryption is performed before encryption begins, then cryptographic security is ensured, but latency is introduced causing delay of the full encryption operation
Solution Approach 1:
The patent merges the IV encryption step with the main encryption process by integrating the scrambled counter generation into the existing tweak value computation pipeline. Instead of performing IV encryption as a separate preliminary step that blocks subsequent processing, the scrambled counter values are generated and applied concurrently with the block encryption operations. This merging eliminates the sequential dependency and reduces overall latency while maintaining cryptographic security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for providing a scrambled tweak mode of block cipher encryption for a device that mitigates the effect of side channel attacks based on differential power analysis (DPA). The scrambled tweak mode encryption engine creates noise at the start of the encryption process by obfuscating the counter value with the use of the very fast mixing function, such as a mixing function based on a XOR tree, substitution-permutation networks, or double-mix Feistel networks. The mixing function uses some secret key material, which diversifies its behavior between different instantiations. Because the counter values are scrambled and the mixing functions operate very fast in parallel hardware, the input of the block cipher is pseudorandom and groups of blocks can't be correlated.