Cryptographic Substitution Table Segmentation for Side-Channel Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic algorithms, such as AES, are vulnerable to side-channel attacks due to physical quantity variations like electrical consumption and electromagnetic radiation, which can reveal secret keys through statistical analysis, and existing masking techniques like affine and Boolean masking are not compatible with substitution tables, leading to performance and security trade-offs.
Innovation Solution
A method that uses a combination of precalculated substitution tables for power and affine functions to mask secret variables, applying a masking function to separate the secret variable into shares, and then applying these tables to obtain a masked representation that is robust against side-channel attacks while maintaining performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If masking techniques (affine or Boolean masking) are applied to protect against side-channel attacks, then security against side-channel attacks is improved, but compatibility with substitution tables deteriorates and performance deteriorates
Solution Approach 1:
The substitution table is divided into multiple sub-tables, each handling a specific portion of the masked input. Instead of using a single large substitution table that would require recalculation for each masking variation, the method segments the table into smaller units that can be efficiently combined to produce the final masked output, thereby maintaining performance while achieving security
Solution Approach 2:
The substitution tables are pre-calculated and stored before execution. By performing the computationally intensive table construction in advance rather than during cryptographic operations, the method eliminates runtime overhead while maintaining security against side-channel attacks through proper masking integration
2Reliability
If masking techniques are applied to protect secret variables, then security against side-channel attacks is improved, but memory footprint increases
Solution Approach 1:
The large substitution table is segmented into multiple smaller sub-tables that can be stored more efficiently in memory. Each sub-table contains only the necessary data for a specific masking scenario, reducing the total memory footprint compared to storing complete tables for all possible masking variations
Solution Approach 2:
Different portions of the substitution table are optimized for different purposes: some sub-tables are optimized for speed while others are optimized for compact storage. This local optimization allows the system to balance memory usage and performance characteristics across different parts of the cryptographic operation
3Reliability
If substitution tables are recalculated for each masking variable change, then security against side-channel attacks is improved, but execution time increases
Solution Approach 1:
The substitution tables are pre-calculated and cached before the cryptographic operation begins. This preliminary action eliminates the need for repeated calculations during execution, reducing execution time while maintaining security through proper masking
Solution Approach 2:
Multiple pre-calculated sub-tables are merged or combined during execution to produce the final result for varying masking scenarios. This combining approach allows the system to handle different masking variables without recalculating from scratch, significantly reducing execution time while maintaining security
Data Source
Figure 1~3
Figure 4
Figure 5~6
AI summary
The present invention relates to a method (100) for protecting an electronic device against side-channel attacks. The electronic device is configured to execute a cryptographic algorithm manipulating variables belonging to a finite field E and involving at least one nonlinear function Sub applied to a secret variable s to be protected. The function Sub comprises a power-raising function k and an affine function Aff such that Sub(x) = Aff(xk). The method includes masking (101) the secret variable s in the form M(s) = m.s + b or in the form M(s) = m.s²p + b, as well as the use (102, 103) of two substitution tables Tpow and Taff. The elements of Tpow and Taff are pre-calculated for the different values that can be taken by the variables m, b, and p. Access to each of these two static tables is performed by a strict subset of the variables m, b, and possibly p used to form M(s).