Side-Channel Analysis Protection Circuit
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic circuits and software are vulnerable to side channel analysis attacks, such as SPA, DPA, CPA, and EMA, which can reveal secret data like encryption keys by measuring current consumption or electromagnetic radiation, and existing countermeasures like masking and blinding do not provide sufficient protection.
Innovation Solution
A method that combines a first input data with all possible data pairs from a second input set, ensuring each word in the output set has the same number of occurrences of all possible values, and uses XOR operations to generate and arrange output data in a way that detects errors and ensures all possible values are represented, thereby masking the secret key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional cryptographic operations are performed directly on secret data, then the operation is simple and fast, but the circuit becomes vulnerable to side channel analysis attacks
Solution Approach 1:
The secret data is segmented into multiple shares or components, and the cryptographic operation is performed on these segmented parts rather than on the complete secret data directly. This segmentation prevents side channel analysis from revealing information about the original secret while maintaining operational functionality.
Solution Approach 2:
An intermediary structure (such as a lookup table or intermediate computation layer) is introduced between the secret data and the cryptographic operation. This intermediary masks the direct relationship between secret data and operation results, preventing side channel leakage while enabling the operation to proceed.
2Reliability
If masking techniques are applied to protect secret data, then security against side channel analysis improves, but the operation time and computational overhead increase
Solution Approach 1:
Masking values and intermediate structures are prepared in advance before the cryptographic operation executes. Lookup tables are pre-computed and stored, so that during the actual operation, only simple table lookups are needed rather than complex computations, significantly reducing operation time while maintaining security.
Solution Approach 2:
Different masking strategies are applied to different parts of the cryptographic operation based on their specific security requirements and performance characteristics. Critical paths use optimized local masking techniques that minimize time overhead, while less critical operations use more robust but slower masking approaches.
3Reliability
If the circuit processes all possible data pairs to mask secret key, then security against side channel analysis improves, but the quantity of operations and energy consumption increase
Solution Approach 1:
The processing of all possible data pairs is organized into periodic cycles or batches rather than continuous processing. This allows the circuit to process data in structured intervals, enabling power management techniques and reducing peak energy consumption while still achieving comprehensive masking coverage over time.
Solution Approach 2:
Instead of processing all possible data pairs with equal depth, the circuit performs partial processing on high-probability candidates first, and less extensive processing on lower-probability cases. This excessive action on critical paths provides sufficient security while reducing overall energy consumption compared to uniform full processing.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
The invention relates to a method for executing by a circuit an operation (OPR) combining first and second input data (X1, X2) and providing an output data (X1 ⊕ X2) of the same size, the method comprising: generating from the first input data a first input set (PX1) comprising all possible data in relation with the size of the first data, generating from the second input data a second input set (PX2) comprising all possible data in relation with the size of the second data, applying the operation to each pair of data comprising a data of the first input set and a data of the second input set, an output set (PR2) of the operation comprising data resulting from the application of the operation to each of the pairs of data.