Transrandomized S-Box Masking for Side-Channel Attack Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing block cipher algorithms are vulnerable to high-order side-channel attacks, such as Differential Power Analysis, which can recover secret keys by analyzing power consumption or electromagnetic signatures, and current countermeasures like high-order masking are costly and resource-intensive, especially for non-linear operations like Sboxes.
Innovation Solution
A method that generates a series of transrandomized Substitution boxes by iteratively masking an initial Substitution box with uniformly distributed random values, using Boolean exclusive OR operations, to protect against N-order side-channel attacks, reducing resource consumption by avoiding data splitting into multiple shares.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If high-order masking is used to protect against N-order side-channel attacks, then security is improved, but resource consumption increases significantly
Solution Approach 1:
The patent applies segmentation by dividing the substitution box into multiple randomized versions (S0, S1, S2, ..., SN) that are generated iteratively through masking operations. Each randomized substitution box represents a segmented version of the original, allowing the system to select appropriate levels of protection without always using the most resource-intensive N-order masking. This enables graduated security levels that consume fewer resources while maintaining adequate protection.
2Reliability
If high-order masking with N different masks is applied to non-linear operations like Sboxes, then protection against Nth order side-channel attacks is achieved, but computational cost and complexity increase
Solution Approach 1:
The patent implements preliminary action by pre-generating multiple randomized substitution boxes (S0, S1, S2, ..., SN) before the actual encryption process. These pre-computed randomized versions are stored and can be quickly selected during encryption without performing complex masking operations in real-time. This shifts the computational complexity to a pre-processing phase, reducing the burden during actual encryption while maintaining high-order attack protection.
Solution Approach 2:
The patent applies dynamics by making the substitution box selection adaptive and variable. Instead of using a fixed substitution box, the system dynamically selects from multiple randomized versions (S0, S1, S2, ..., SN) generated through iterative masking. This dynamic approach allows the system to adjust the level of randomization and protection based on security requirements, optimizing the balance between security and complexity without being locked into a single complex configuration.
Data Source
AI summary
The present invention relates to a method for securing against N-order side-channel attacks a cryptographic process using in a plurality of encryption rounds an initial Substitution box S0 comprising the steps of: —generating (E12) a first randomized substitution box S1 by masking said initial substitution box S0 such that S1(x XOR m1)=S0(x) XOR m2, with m1, m2 uniformly-distributed random values, for any input value x of the initial substitution box S0, —generating (E13) a first transrandomized Substitution box S(1,1) from the first randomized substitution box S1 and from masks m1,1, m′1,1 such that S(1, 1)[x]=S1[x xor (m1 xor m1,1)] xor (m2 xor m′1,1) for any input value x of the first transrandomized Substitution box S(1,1), —generating (E14) from the first transrandomized Substitution box S(1,1) a N−1th transrandomized Substitution box S(1, N−1) by performing iteratively N−2 times a step of generation of a ith transrandomized Substitution box S(1, i) from a i−1th transrandomized substitution box S(1, i−1) and from a plurality of masks m 1,i, m′1,i, m1,i−1, m′1,i−1 such that S(1, i)[x]=S(1, i−1)[x xor (m1,i-1 xor m1,i)] xor (m′1,i−1 xor m′1,i) for any input value x of the ith transrandomized substitution box S(1, i), with i an integer comprised in {2, . . . N−1}, —performing the cryptographic process using (E15) the N−1th transrandomized Substitution box S(1, N−1) instead of the initial Substitution box S0 in at least said first round of the cryptographic process.