Two-Register Value Selection Using Constant-Time Rotation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for selecting a value from two values stored in different registers are vulnerable to side-channel attacks, as they result in observable changes in power consumption, execution time, or electromagnetic fields, allowing attackers to determine the selection bit, particularly in cryptographic applications.
Innovation Solution
A method involving concatenation, rotation, and deletion of values stored in registers to obscure the selection bit, using a two-step rotation process that maintains a constant execution time and Hamming weight, independent of the selection bit value, thereby masking the selection process from attackers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional selection methods (if-then-else, array access, masking) are used to select a value from two registers, then the selection operation can be performed, but the execution time, power consumption, or electromagnetic field changes vary depending on the selection bit value, making the system vulnerable to side-channel attacks
Solution Approach 1:
The patent changes the parameter of rotation angle based on the selection bit value. Instead of using conditional branches or variable masks, the invention rotates the concatenated word by either 0 degrees or 180 degrees (for a 16-bit value) depending on the selection bit. This parameter change approach ensures that the same instruction sequence is always executed, but the rotational parameter varies, thereby maintaining constant execution time and power consumption characteristics while still achieving the selection function.
Solution Approach 2:
The patent introduces an intermediary rotation operation between the concatenation of two values and the final selection. By using rotation as an intermediary transformation, the invention avoids direct conditional operations that would leak information through side channels. The rotation operation serves as a mediator that transforms the concatenated data in a way that is independent of control flow, thereby preventing attackers from inferring the selection bit through execution time or power analysis.
2Ease of operation
If conditional instruction sequences are used based on the selection bit value, then the correct value can be selected, but the execution time varies depending on the selection bit, allowing attackers to determine the selection bit through timing analysis
Solution Approach 1:
The patent ensures continuous execution of the same instruction sequence regardless of the selection bit value. The rotation operation is always performed with a calculated angle that depends on the selection bit, but the instruction flow continues without branching or conditional jumps. This continuity eliminates execution time variations that would otherwise occur with conditional instruction sequences, thereby preventing timing-based side-channel attacks while maintaining operational simplicity.
3Productivity
If masks with different Hamming weights are used for selection, then the selection can be performed, but the power consumption varies significantly depending on the mask selected, allowing attackers to recover the selection bit through power analysis
Solution Approach 1:
The patent changes the rotation parameter instead of using masks with varying Hamming weights. The rotation operation inherently preserves the Hamming weight characteristics because it merely repositions bits without changing their values. This parameter-based approach achieves efficient selection while avoiding the power consumption variations that would result from using masks with different numbers of set bits, thereby preventing power analysis attacks.
4Speed
If cache memory is used to store and access values based on the selection bit, then the selection operation can be performed, but the access time varies based on cache hits or misses, allowing attackers to determine the selection bit through cache timing analysis
Solution Approach 1:
The patent replaces the mechanical cache access mechanism with a rotational transformation operation. Instead of storing values in cache and accessing them based on the selection bit (which would cause variable access times due to cache hits and misses), the invention performs an in-register rotation operation. This substitution eliminates the need for cache memory access during the selection process, thereby eliminating the timing variations that would otherwise leak information about the selection bit.
Data Source
Figure 1~2
AI summary
According to one aspect, a computer-implemented method is proposed for selecting a value from among two values recorded in two different registers using a selection bit, the method comprising: - a concatenation (20) of the two values recorded in the two registers so as to obtain a concatenated word presenting said two values in two distinct portions of the concatenated word, then - a rotation (21, 21a, 21b) of said concatenated word according to the value of the selection bit so as to position the selected value in a given portion of the concatenated word among said two portions, then - a deletion (22) of the unselected value in the concatenated word so as to retain only the selected value in the concatenated word by eliminating the unselected value from the concatenated word.