Self-Cancelling Mask for Substitution Table DPA Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems face vulnerabilities to power analysis attacks, particularly differential power analysis (DPA) attacks on substitution tables, which require costly countermeasures that increase system power consumption, memory usage, or processing speed, and existing solutions necessitate additional memory and computational overhead for mask generation and storage.
Innovation Solution
Implementing a self-cancelling mask for substitution tables in cryptographic processes, where each element of the substitution table is masked with a bitwise operation, such as XOR, and rotated to obfuscate outputs, allowing the mask to self-cancel during the cryptographic round without needing separate storage, thus providing resistance to DPA attacks with minimal computational and memory impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If substitution table masking is implemented to protect against DPA attacks, then security against power analysis attacks is improved, but computational cost and memory usage increase
Solution Approach 1:
The mask value is generated and applied to the substitution table entries, then automatically cancelled out through the cryptographic operation without requiring external intervention or additional memory storage. The mask serves itself by being integrated into the substitution table structure and eliminating the need for separate mask storage.
Solution Approach 2:
The mask value is merged with the substitution table entries through bitwise XOR operation, combining the masking function with the lookup table structure. This integration allows the mask to be applied during normal substitution operations without requiring separate mask storage or additional computational steps.
2Reliability
If traditional masking countermeasures are used, then resistance to DPA attacks is improved, but power consumption increases
Solution Approach 1:
The masking operation is performed automatically as part of the substitution table lookup process. The mask value is applied when the substitution table is accessed and is cancelled out through the cryptographic operation, eliminating the need for additional power-consuming mask generation and storage operations.
Solution Approach 2:
The mask value is pre-computed and stored in the substitution table structure before the cryptographic operation. This preliminary preparation allows the mask to be applied during normal operations without requiring additional real-time computational resources or power consumption for mask generation.
3Reliability
If separate mask storage is implemented, then masking functionality is improved, but memory requirements increase
Solution Approach 1:
The mask value is merged with the substitution table entries through bitwise XOR operation, combining the masking function with the lookup table structure. This integration eliminates the need for separate mask storage by embedding the mask directly within the substitution table data structure.
Solution Approach 2:
The substitution table structure itself provides the masking functionality through its internal structure. The mask value is generated and applied to the substitution table entries, then automatically cancelled out through the cryptographic operation without requiring external intervention or additional memory storage.
Data Source
AI summary
A computing device-implemented method and system is provided for obtaining an interim masked substitution table value for a given input component in a cryptographic round, such as an AES cryptographic round, using a substitution table and a self-cancelling mask. A mask with a length equal to an entry in the substitution table is provided, wherein the mask comprises a plurality of mask components of equal length such that a bitwise logical inequality operation such as XOR on the mask components equals zero, and the substitution table is masked with this mask. For each of input component, an interim masked substitution table value is obtained from the substitution table thus masked.