Split Masked Tables for DPA Resistance in Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems face challenges in resisting power analysis attacks, such as differential power analysis (DPA), which compromise security by monitoring power consumption, and require additional resources like memory and processor power for countermeasures like table regeneration or masking, which are not always feasible.
Innovation Solution
The implementation of split masked tables generated using an original substitution table and random values, where each entry is masked with multiple random values to create multiple split masked tables, reducing the overhead and enhancing resistance to DPA attacks by limiting available samples and varying masks for substitution tables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If frequent regeneration of tables using different random output masks is used, then resistance to power analysis attacks is improved, but memory and processor resources are increased
Solution Approach 1:
The substitution table is divided into multiple split masked tables, each containing masked versions of table entries with different random masks. This segmentation allows the system to use multiple tables simultaneously, providing resistance to power analysis attacks while managing memory resources through efficient table structure organization.
Solution Approach 2:
The patent implements dynamic masking where table entries are masked with random values that can change over time. The system regenerates masks periodically or upon detection of power analysis attack attempts, creating a dynamic defense mechanism that adapts to attack patterns without requiring static resource allocation.
2Reliability
If multiple masked tables or transformations are used, then resistance to DPA attacks is improved, but power consumption is increased
Solution Approach 1:
Instead of masking entire tables uniformly, the patent applies masking selectively to specific table entries or portions of tables based on the cryptographic operation being performed. This local masking approach reduces the total number of masked entries that need to be processed, thereby lowering power consumption while maintaining security against DPA attacks.
Solution Approach 2:
The system uses multiple masked tables (more than strictly necessary) to provide a security margin against DPA attacks. By having excess masked tables available, the system can switch between them to confuse attackers while using only the minimum required computational resources for the actual cryptographic operation.
3Reliability
If table regeneration or masking countermeasures are implemented, then security against power analysis attacks is improved, but latency overhead is increased
Solution Approach 1:
The patent pre-generates multiple masked versions of substitution table entries during system initialization or idle periods. These pre-computed masked tables are stored in memory and can be immediately accessed during cryptographic operations, eliminating the need for real-time table regeneration and reducing latency overhead while maintaining security.
Solution Approach 2:
Instead of regenerating tables from scratch, the system creates copies of the original substitution table with pre-computed random masks applied to specific entries. These copy operations are performed efficiently during initialization and can be rapidly switched between during operations, minimizing latency while providing the necessary security countermeasures.
Data Source
AI summary
For a defined cryptographic process including an original substitution table, split masked substitution tables are provided to resist cryptographic attacks. The split masked substitution tables are defined with reference to a set of random value data words and a mask value. An entry in the split masked substitution tables is defined by selecting bits from the corresponding entry in the original masked substitution table, as masked by the corresponding one of the set of random value data words and by selecting bits from the corresponding one of the set of random value data words as masked by the mask value. The split masked substitution tables are usable in a modified cryptographic process based on the defined cryptographic process to permit a masked output to be generated. The split masked substitution tables are refreshed by each entry in the tables being refreshed upon access during execution of the modified cryptographic process.