Cryptographic Substitution Table Segmentation for Side-Channel Protection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current cryptographic algorithms, such as AES, are vulnerable to side-channel attacks due to physical quantity variations like electrical consumption and electromagnetic radiation, which can reveal secret keys through statistical analysis, and existing masking techniques like affine and Boolean masking are not compatible with substitution tables, leading to performance and security trade-offs.

Innovation Solution

A method that uses a combination of precalculated substitution tables for power and affine functions to mask secret variables, applying a masking function to separate the secret variable into shares, and then applying these tables to obtain a masked representation that is robust against side-channel attacks while maintaining performance.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If masking techniques (affine or Boolean masking) are applied to protect against side-channel attacks, then security against side-channel attacks is improved, but compatibility with substitution tables deteriorates and performance deteriorates

Engineering Contradiction:
Improvesecurity against side-channel attacksVSAvoidperformance
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The substitution table is divided into multiple sub-tables, each handling a specific portion of the masked input. Instead of using a single large substitution table that would require recalculation for each masking variation, the method segments the table into smaller units that can be efficiently combined to produce the final masked output, thereby maintaining performance while achieving security

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The substitution tables are pre-calculated and stored before execution. By performing the computationally intensive table construction in advance rather than during cryptographic operations, the method eliminates runtime overhead while maintaining security against side-channel attacks through proper masking integration

Inventive Principle:
Principle #10Preliminary action

2Reliability

If masking techniques are applied to protect secret variables, then security against side-channel attacks is improved, but memory footprint increases

Engineering Contradiction:
Improvesecurity against side-channel attacksVSAvoidmemory footprint
Core Design Contradiction:
ReliabilityVSWeight of stationary object

Solution Approach 1:

The large substitution table is segmented into multiple smaller sub-tables that can be stored more efficiently in memory. Each sub-table contains only the necessary data for a specific masking scenario, reducing the total memory footprint compared to storing complete tables for all possible masking variations

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

Different portions of the substitution table are optimized for different purposes: some sub-tables are optimized for speed while others are optimized for compact storage. This local optimization allows the system to balance memory usage and performance characteristics across different parts of the cryptographic operation

Inventive Principle:
Principle #3Local quality

3Reliability

If substitution tables are recalculated for each masking variable change, then security against side-channel attacks is improved, but execution time increases

Engineering Contradiction:
Improvesecurity against side-channel attacksVSAvoidexecution time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The substitution tables are pre-calculated and cached before the cryptographic operation begins. This preliminary action eliminates the need for repeated calculations during execution, reducing execution time while maintaining security through proper masking

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

Multiple pre-calculated sub-tables are merged or combined during execution to produce the final result for varying masking scenarios. This combining approach allows the system to handle different masking variables without recalculating from scratch, significantly reducing execution time while maintaining security

Inventive Principle:
Principle #5Merging (Combining)

Data Source

PatentEP4404501A1Protection against side-channel attacks of a cryptographic algorithm involving a substitution table
Publication Date: 2024.07.24 COMMISSARIAT A LENERGIE ATOMIQUE ET AUX ENERGIES ALTERNATIVES
  • EP4404501A1 patent drawingFigure 1~3
  • EP4404501A1 patent drawingFigure 4
  • EP4404501A1 patent drawingFigure 5~6

AI summary

The present invention relates to a method (100) for protecting an electronic device against side-channel attacks. The electronic device is configured to execute a cryptographic algorithm manipulating variables belonging to a finite field E and involving at least one nonlinear function Sub applied to a secret variable s to be protected. The function Sub comprises a power-raising function k and an affine function Aff such that Sub(x) = Aff(xk). The method includes masking (101) the secret variable s in the form M(s) = m.s + b or in the form M(s) = m.s²p + b, as well as the use (102, 103) of two substitution tables Tpow and Taff. The elements of Tpow and Taff are pre-calculated for the different values ​​that can be taken by the variables m, b, and p. Access to each of these two static tables is performed by a strict subset of the variables m, b, and possibly p used to form M(s).