White Box AES Implementation Hardening Against Statistical Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current white box implementations of the AES cryptographic algorithm are susceptible to statistical attacks, allowing potential extraction of secret information from side channel outputs.
Innovation Solution
A processor device with a hardened white-box masked implementation of AES, where round input values are concatenated with obfuscation values and processed using invertible masking and affine mappings to reduce the extractability of secret information, incorporating additional transformations like unmasking, remasking, and random affine mappings to create statistically balanced outputs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If white box implementation of AES is used to conceal security-critical data, then access protection is improved, but susceptibility to statistical attacks increases
Solution Approach 1:
The patent applies preliminary action by pre-processing round input values through invertible masking mappings before they enter the AES rounds. This preliminary transformation conceals the actual input values in a statistically balanced manner, preventing attackers from performing statistical analysis on side channel outputs to extract secret information.
Solution Approach 2:
The patent changes parameters by introducing statistically balanced masking mappings that transform the distribution of input values. The masking mappings are designed to produce uniformly distributed output values regardless of the input distribution, thereby eliminating statistical correlations that attackers could exploit.
2Reliability
If round input values are masked with invertible masking mappings, then security against statistical attacks is improved, but implementation complexity increases
Solution Approach 1:
The masking mappings are prepared and integrated into the AES implementation in advance. The preprocessing step of applying invertible masking mappings to round input values is performed automatically as part of the algorithm flow, reducing the perceived complexity during execution while maintaining security.
Solution Approach 2:
The invertible masking mappings act as intermediaries between the actual round input values and the AES transformation. These mappings serve as a protective layer that complicates the relationship between inputs and outputs, making statistical attacks infeasible while maintaining a relatively simple implementation structure.
Data Source
AI summary
A processor device with a white-box masked implementation of the cryptographic algorithm AES implemented thereon, which comprises a SubBytes transformation. The white-box masked implementation is hardened in that white-box round input values x′ are supplied at the round input of rounds instead of the round input values x, said white-box round input values being formed from a concatenation of: (i) the round input values x that are masked by means of the invertible masking mapping A and (ii) obfuscation values y that are likewise masked with the invertible masking mapping A; wherein from the white-box round input values x′ only the (i) round input values x are fed to the SubBytes transformation T, and (ii) the masked obfuscation values y are not.