Secret Key Randomization for Side-Channel Attack Resistance

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Cryptography devices are vulnerable to higher-order side-channel attacks, particularly observation attacks, which can exploit measurements from the device's operation to obtain information about the secret key, and existing methods do not provide a comprehensive solution for generating a secure mask for the secret key.

Innovation Solution

A method and device that randomize the components of a secret key using a random number generator, iteratively updating the reference mask and generating a working mask through a series of operations, ensuring that no d-tuple of intermediate variables reveals information about the secret key, thereby enhancing resistance to side-channel attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a random quantity is used to mask data manipulated by the cryptographic device, then the correlation between manipulated data and the secret key is masked, but the device remains vulnerable to higher-order side-channel attacks

Engineering Contradiction:
Improvesecurity against side-channel attacksVSAvoidcomplexity of mask generation
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The secret key is segmented into multiple components (k1, k2, ..., kd+1) that are combined with random values. Each component is processed separately through cryptographic functions, and the results are combined to form the masked key. This segmentation ensures that no single intermediate variable reveals information about the complete secret key, providing resistance against higher-order side-channel attacks.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

Random values are generated and combined with the secret key components before the cryptographic operation is performed. The masking process is prepared in advance by creating intermediate variables that already incorporate randomization, ensuring that when the cryptographic function is executed, the side-channel emissions reflect randomized values rather than direct key material.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If existing methods are used to mask data, then data to be encrypted is masked, but the secret key itself is not protected against observation attacks

Engineering Contradiction:
Improveprotection of secret keyVSAvoidapplicability to different cryptographic operations
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The mask generation method is designed to be universally applicable to different cryptographic operations and key types. The process takes a secret key and generates a masked version that can be used in various cryptographic contexts (encryption, authentication, etc.). The method works with different key lengths and cryptographic algorithms, making it a versatile solution for protecting secret keys across multiple applications.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP2599256B1Method and device for randomizing a secret key for protecting against attacks by auxiliary channels
Publication Date: 2014.03.19 THALES SA
  • EP2599256B1 patent drawingFigure 1
  • EP2599256B1 patent drawingFigure 2
  • EP2599256B1 patent drawingFigure 3A

AI summary

The invention relates to a method for randomizing components S1 (0)' …' SD+1 (0), belonging to a group G, of a reference mask for a secret key k, characterized in that it comprises at least the following steps: 1 - using the components of a reference mask for the given key k, S1 (0)' …' SD+1 (0) G a group provided with an internal operation O with k = S1 (0) O …O SD+1(0)' executing a loop on i=0 to λ-1 including the following steps 2 and 3: 2 - generating a new reference or working mask for said key k using a randomizer (7) producing the first D components of the mask of iteration i+1 where D and λ are security parameters (s1 ( i +1),...,SD( i +1)←rand(GD); 3- then determining the last component SD+1 (i+1) of the working or reference mask of iteration i+1 by combining the components S1 ( i )' …' SD+1 ( i ) of the mask of iteration i with the components S1 ( i +1)' …, SD ( i +1) of the mask of iteration i+1 generated in step 2, while observing an alternation of a component of iteration i and a component of iteration i+1; 4 - after λ iterations of steps 2 and 3 carried out in order to obtain said mask of components (S1 (λ)' …'SD+1 (λ), using said mask either to update the reference mask, or to execute a cryptographic process.