White Box Cryptography Key Protection via State Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current white box cryptography implementations are vulnerable to attacks such as side-channel and fault attacks, as well as collision attacks, due to their sensitivity to internal state extraction and linear transformations, which compromise the security of secret keys in cryptographic algorithms like DES and AES.
Innovation Solution
The method involves splitting internal states into multiple fragments and using non-linear sharing functions and bijective encodings to protect secret keys, with a combination of non-linear permutation and linear multiplexing functions, ensuring that even if an attacker has full access to the software implementation, the secret keys remain secure by making it impossible to retrieve them from the encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If white box cryptography implementations are used to protect against key extraction, then security against key retrieval is improved, but vulnerability to side-channel and fault attacks increases due to exposure of internal states
Solution Approach 1:
The patent divides the internal state into multiple shares (S1, S2, ..., Sm) that are distributed across different memory locations. Each share is processed independently through separate S-boxes, and the final result is obtained by combining the outputs. This segmentation prevents attackers from extracting complete key information through side-channel or fault attacks on any single memory location, as each share contributes only partial information.
Solution Approach 2:
The patent introduces intermediate variables (T1, T2, ..., Tm) as mediators between the input data and the final output. These intermediates represent the results of processing each share through its corresponding S-box. The intermediates are then combined through a linear function to produce the final result. This intermediary structure allows the system to maintain security by keeping the intermediates obscured while still enabling correct computation.
2Reliability
If internal states are masked with random permutations to hide keys, then key retrieval resistance is improved, but susceptibility to collision attacks increases due to linear transformations
Solution Approach 1:
The patent applies non-linear S-box transformations locally to each share independently, while using a linear function only for the final combination of results. Each local S-box processing introduces non-linearity that resists collision attacks. The linear combination at the end is necessary for efficient computation but operates on already-obfuscated intermediate values, maintaining security against collision attacks on the overall system.
Solution Approach 2:
The patent combines multiple non-linear S-box transformations with a linear combination function to create a composite encryption structure. The non-linear S-boxes provide resistance to collision attacks by ensuring that identical inputs produce different intermediate outputs, while the linear combination efficiently aggregates the results. This composite approach maintains both security and computational efficiency.
3Reliability
If multiple S-boxes are used to process data blocks, then encryption strength is improved, but computational complexity increases
Solution Approach 1:
The patent segments the data block into multiple shares (S1, S2, ..., Sm) that are processed in parallel through separate S-boxes. This segmentation allows the encryption strength to be distributed across multiple simpler operations rather than requiring one complex S-box, reducing the computational burden on any single processing unit while maintaining overall encryption strength.
Solution Approach 2:
The patent uses a limited number of S-boxes (m shares) that is sufficient to provide adequate encryption strength without excessive computational overhead. The linear combination function efficiently aggregates the results from these partial operations, avoiding the need for more complex multi-round processing while still achieving secure encryption.
Data Source
AI summary
A method for encrypting or decrypting a n-tuple of data ({ai}i∈[[0,n-1]]) with a n-tuple of secret keys ({ki}i∈[[0,n-1]]). The method uses a data-processor to perform the steps of: (a) for each element (ai), determining m>n first internal states ({yij}j∈[[0,m-1]]) by application of m first operations, each: represented by a table (Tij), and defined as the combination of a single bijective internal encoding (Gij), of a non-linear sharing function (Di, Ei, Fi . . . ), and of a given non-linear permutation function (ƒ) parameterized with the secret key (ki), and (b) for each n-tuple of first internal states ({yij}i∈[[0,n-1]]), determining a second internal state (zj) by application of a second operation: represented by a table (TLj), and defined as the combination of a second single bijective internal encoding (GLj), a linear multiplexing function (L), and the inverses of the first bijective internal encodings (Gij).