Tweakable Block Cipher Masking for Side-Channel Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Tweakable modes of operation, particularly the AES-XTS mode, are vulnerable to side-channel attacks due to side-channel information leaked through modular multiplications, compromising the security of data stored in sector-addressable storage devices.
Innovation Solution
A block cipher encryption device and method that incorporates a combinatorial function unit to determine a tweak block value and a masking unit to apply a data masking algorithm, providing additional security layers against side-channel attacks by masking tweak blocks and sensitive data, using techniques like additive or multiplicative masking algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If tweakable modes of operation (AES-XTS) are used for disk encryption, then data confidentiality and fast retrieval are improved, but vulnerability to side-channel attacks increases due to leaked information through modular multiplications
Solution Approach 1:
The patent introduces an intermediary masking operation between the tweak block generation and the plaintext encryption process. A masking value is generated and applied to intermediate values to prevent direct observation of sensitive data through side-channel attacks, while still allowing the encryption to function correctly
Solution Approach 2:
The patent changes the parameters of the encryption process by introducing masking values that modify the intermediate computational values. This transforms the vulnerable modular multiplication operations into masked operations that leak no useful information to side-channel attackers
2Reliability
If masking operations are applied to protect against side-channel attacks, then security against attacks is improved, but device complexity increases due to additional combinatorial function units and masking units
Solution Approach 1:
The patent segments the encryption process into distinct functional units: a combinatorial function unit for generating tweak blocks, a masking unit for applying masks, and a block cipher unit for encryption. This modular segmentation allows each unit to be optimized independently and facilitates implementation in hardware
3Reliability
If additional masking operations are performed on tweak blocks, then protection against side-channel attacks is improved, but computational overhead and processing time increase
Solution Approach 1:
The patent performs preliminary masking operations on the tweak block values before they are used in the main encryption process. By pre-computing and applying masks to intermediate values, the actual encryption operation can proceed efficiently without requiring additional masking steps during the critical path
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A block cipher encryption device for encrypting a data unit plaintext into blocks of ciphertexts, the data unit plaintext being assigned a tweak value and being divided into one or more plaintext blocks. The block cipher encryption device comprises: - a combinatorial function unit (82-j) associated with each plaintext block (Pj), the combinatorial function unit (82-j) being configured to determine a tweak block value (Tj) by applying a combinatorial function between a value derived from the tweak value and a function of a block index assigned to the plaintext block, - a first masking unit (83-j) in association with each plaintext block (Pj), the first masking unit (83-j) being configured to determine a masked value Mj(Tj) by applying a data masking algorithm to the tweak block value (Tj) determined by the combinatorial function unit (82-j) associated with the plaintext block.