Secured Cryptographic Processing Through Segmented S-Box Lookups
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic schemes are vulnerable to white-box attacks, particularly DCA attacks, due to nonnegligible correlations between expected and masked intermediate values, especially in S-box implementations, which expose cryptographic keys.
Innovation Solution
Implementing S-boxes using a composition of first and second functions, with a first processing stage generating outputs through lookup tables and a second stage combining these outputs using linear or affine transformations, enhancing security by obfuscating intermediate values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional S-box implementations are used in white-box cryptography, then the cryptographic process can be executed, but the intermediate values exhibit nonnegligible correlations that expose cryptographic keys to DCA attacks
Solution Approach 1:
The S-box implementation is segmented into multiple processing stages (first processing stage and second processing stage), where each stage performs a portion of the transformation. This segmentation breaks the direct correlation between input and output that exists in traditional single-stage S-box implementations, making it harder for attackers to establish the statistical relationships needed for DCA attacks.
Solution Approach 2:
Masking values are introduced as intermediaries between the input data and the S-box transformation, and between the S-box output and the final result. These masking values act as mediators that obscure the statistical correlations between expected and actual intermediate values, preventing attackers from directly observing the relationships needed for key extraction.
2Reliability
If affine transformation and networked encoding are used to protect S-boxes, then some protection is provided, but the statistic distribution correlation remains nonnegligible under DCA attacks
Solution Approach 1:
The implementation uses dynamic masking values that change throughout the execution of the cryptographic process. Rather than using static masking, the masking values are updated and transformed along with the data, creating dynamic statistical properties that prevent attackers from establishing consistent correlations across multiple observations.
Solution Approach 2:
The patent changes the statistical parameters of the intermediate values through careful selection of masking values and transformation functions. By modifying the distribution characteristics of the intermediate values (making them more uniform or unpredictable), the patent reduces the statistical correlations that DCA attacks rely upon.
3Ease of operation
If cryptographic keys are hidden in S-boxes, then the cryptographic functionality is maintained, but the S-boxes become vulnerable to manipulation and analysis by attackers with full access
Solution Approach 1:
The cryptographic key is nested within multiple layers of protection including masking values and multi-stage transformations. Rather than placing the key directly in the S-box as in traditional implementations, the key is embedded within a complex structure of masked and transformed values that must be progressively unwrapped, making extraction extremely difficult for attackers with full access.
Solution Approach 2:
Multiple intermediary values and transformations are placed between the attacker's observable data and the hidden cryptographic key. These intermediaries (including masking values, transformation functions, and multi-stage processing) create a chain of dependencies that obscures the key's location and makes it impossible to directly observe or manipulate the key even with full access to the S-box implementation.
Data Source
Figure 1
Figure 2a~2b
Figure 3a~3b
AI summary
A method of performing a cryptographic process in a secured manner, wherein the cryptographic process generates output data based on input data, the generating of the output data involving generating a value y based on an amount of data x, the value y representing a combination, according to a linear transformation L, of respective outputs from a plurality of S-boxes Sn (n = 0, ..., N - 1) for integer N > 1, wherein each S-box Sn (n = 0, ..., N - 1) implements a respective function Hn that is either (a) the composition of a respective first function Fn and a respective linear or affine second function Gn so that Hn = Gn ∘ Fn, or (b) the composition of a respective first function Fn, a respective linear or affine second function Gn and a respective third function Wn so that Hn = Gn ∘ Fn ∘ Wn, wherein the method comprises: performing a first processing stage and a second processing stage to generate the value y based on the amount of data x, wherein: the first processing stage uses a plurality of first lookup tables to generate respective outputs, each output being based on at least part of the amount of data x, wherein, for each S-box Sn (n = 0, ..., N - 1), the respective first function Fn is implemented by a corresponding first lookup table; and the second processing stage combines outputs from a plurality of second lookup tables to generate the value y, wherein the input to each second lookup table is formed from the output of a plurality of the first lookup tables, and wherein the set of second lookup tables is based on the second functions Gn (n = 0, ..., N - 1) and the linear transformation L.