Secure NTT Butterfly Circuit With Coefficient Shuffling Against SCA
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Side-Channel Analysis (SCA) attacks pose a significant threat to cryptographic implementations, particularly in cloud computing, by exploiting information from power consumption or electromagnetic radiation, and existing countermeasures like masking incur substantial overheads in area, power consumption, and latency.
Innovation Solution
A circuit design for NTT and INTT operations that includes a memory, butterfly operator circuits, and a shuffle circuit to randomize the order of polynomial coefficients, using a random number generator to determine the execution order and a custom buffer to manage memory access, thereby obscuring the sequential order of operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If masking is used to mitigate multi-trace side-channel attacks, then security is improved, but area, power consumption, latency, and throughput increase by a factor of two or three
Solution Approach 1:
The patent applies dynamics by making the execution order of butterfly operations variable and random rather than fixed. A random number generator dynamically determines the permutation of polynomial coefficients at each iteration, causing the computational path to change with each execution. This dynamic behavior obscures side-channel leakage without requiring duplicate circuitry, thereby improving security while avoiding the area overhead of masking.
Solution Approach 2:
The patent changes the parameter of execution order from fixed to random by introducing a random number generator that produces different permutations for each iteration. This parameter change affects how polynomial coefficients are processed through the butterfly operations, making the timing and sequence variable. Such parameter variation disrupts side-channel analysis while maintaining the same computational functionality, resolving the contradiction between security and device complexity.
2Reliability
If masking is used to mitigate multi-trace side-channel attacks, then security is improved, but power consumption increases by a factor of two or three
Solution Approach 1:
The patent uses dynamics to vary the execution sequence of operations randomly, which obscures power consumption patterns that side-channel attacks exploit. By changing the order of butterfly operations based on random numbers, the power trace becomes unrelated to the secret data, providing security without the excessive power consumption of masking techniques that duplicate circuitry.
Solution Approach 2:
The patent changes the execution parameter from deterministic to random, which transforms the power consumption profile. The random permutation of operations ensures that power consumption at any given clock cycle does not correlate with secret key material, providing SCA resistance while avoiding the factor-of-two-or-three power overhead associated with masking.
3Reliability
If masking is used to mitigate multi-trace side-channel attacks, then security is improved, but latency increases by a factor of two or three
Solution Approach 1:
The patent applies dynamics by randomly reordering operations at each iteration, which prevents timing-based side-channel attacks without requiring multiple execution passes or redundant computations. The dynamic permutation is generated on-the-fly using a random number generator, adding minimal overhead while providing security against multi-trace attacks, thus avoiding the latency penalty of masking.
4Reliability
If masking is used to mitigate multi-trace side-channel attacks, then security is improved, but throughput decreases by a factor of two or three
Solution Approach 1:
The patent uses dynamic random permutation to process polynomial coefficients in varying orders, which maintains computational throughput while obscuring side-channel information. Since the same computational operations are performed just in a different order rather than being duplicated, the throughput penalty associated with masking is avoided, resolving the contradiction between security and productivity.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Devices, systems, and methods for secure number theoretic transform (NTT) and inverse NTT (INTT) operations are provided. A circuit includes a memory configured to store polynomial coefficients, butterfly operator circuits coupled to receive the polynomial coefficients and generate, after iterations of operating on the polynomial coefficients, transformed coefficients as outputs, a first subset of the butterfly operator circuits situated in series with each other and in parallel with a second subset of the butterfly operator circuits, and a shuffle circuit coupled between the memory and the butterfly operator circuits, the shuffle circuit configured to change an order in which the polynomial coefficients are provided to the butterfly operator circuits.