Back to results
US 9,959,429 B2Granted
Asymmetrically masked multiplication
AssigneeCryptography Research, Inc.
InventorJoshua M. Jaffe
Life of this patent
Estimating the term…
Abstract
Methods and systems for masking certain cryptographic operations in a manner designed to defeat side-channel attacks are disclosed herein. Squaring operations can be masked to make squaring operations indistinguishable or less distinguishable from multiplication operations. In general, squaring operations are converted into multiplication operations by masking them asymmetrically. Additional methods and systems are disclosed for defeating DPA, cross-correlation, and high-order DPA attacks against modular exponentiation.
Claims25
A computer-implemented method, comprising:
- asymmetrically masking an operation in modular exponentiation to increase, resistance to Simple Power Analysis (SPA) attacks using a processor and at least one memory, by:
- receiving one or more inputs at the processor, wherein the inputs comprise one or more operands;
- defining a mask value and a fix value, wherein the mask value and the fix value are stored in a first location of the at least one memory;
- defining a left-hand-side (LHS) parameter and a right-hand side (RHS) parameter to be each equal to the one or more inputs;
- calculating a plurality of temporary values using the LHS and RHS parameters and the mask value;
- generating an output based on one of the plurality of temporary values and the fix value;
- and
- using the output in a modular exponentiation operation,
- wherein the modular exponentiation operation is a squaring operation or a multiplication operation, and
- if the modular exponentiation operation is a multiplication operation, the fix value is a function of the mask value and one of the inputs, and the fix value is stored in a second location of the at least one memory.
7 more elements
A computer-implemented method, comprising:
- asymmetrically masking an operation in modular exponentiation to increase resistance to Simple Power Analysis (SPA) attacks using a processor and at least one memory, by:
- receiving one or more inputs at the processor, wherein the inputs comprise one or more operands;
- defining a mask value and a fix value, wherein the mask value and the fix value are stored in a first location of the at least one memory;
- defining a left-hand-side (LHS) parameter and a right-hand side (RHS) parameter to be each equal to the one or more inputs;
- calculating a plurality of temporary values using the LHS and RHS parameters and the mask value;
- generating an output based on one of the plurality of temporary values and the fix value;
- determining whether two consecutive operations comprise a multiplication operation followed by a square operation;
- if the two consecutive operations comprise a multiplication operation followed by a square operation:
- inserting a first mask between the multiplication operation and the square operation, and
- using the output in a modular exponentiation operation,
- wherein the modular exponentiation operation comprises a plurality of squaring operations and multiplication operations.
8 more elements
A computer-implemented method, comprising:
- asymmetrically masking an operation in modular exponentiation to increase resistance to Simple Power Analysis (SPA) attacks using processor and at least one memory, by;
- receiving one or more inputs at the processor, wherein the inputs comprise one or more operands;
- defining a mask value and a fix value, wherein the mask value and the fix value are stored in a first location of the at least one memory;
- defining a left-hand-side (LHS) parameter and, a right-hand side (RHS) parameter to be each equal to the one or more inputs;
- calculating a plurality of temporary values using the LHS and RHS parameters and the mask value;
- performing an update step to switch the mask value to another mask value during the modular exponentiation;
- generating an output based on one of the plurality of temporary values and the fix value;
- and
- using the output in a modular exponentiation operation,
- wherein the another mask value is an inverse of the mask value or a square of the mask value.
7 more elements
A computer-implemented method, comprising:
- asymmetrically masking an operation in modular exponentiation to increase resistance to Simple Power Analysis (SPA) attacks using a processor and at least one memory, by:
- receiving one or more inputs at the processor, wherein the inputs comprise one or more operands;
- defining a mask value and a fix value, wherein the mask value and the fix value are stored in a first location of the at least one memory;
- defining a left-hand-side (LHS) parameter and a right-hand side (RHS) parameter to be each equal to the one or more inputs;
- calculating a plurality of temporary values using the LHS and RHS parameters and the mask value;
- increasing a number of clusters during the modular exponentiation;
- generating an output based on one of the plurality of temporary values and the fix value;
- and
- using the output in a modular exponentiation operation,
- wherein the number of clusters is increased by switching the LHS parameter with the RHS parameter, and
- wherein increasing the number of clusters is accomplished by at least one of multiplication, different circuit paths, switching at least two parameters, and negating at least one parameter.
8 more elements
A computer-implemented method, comprising:
- asymmetrically masking an operation in modular exponentiation to increase resistance to Simple Power Analysis (SPA) attacks using a processor and at least one memory, by;
- receiving one or more inputs at the processor, wherein the inputs comprise one or more operands;
- defining a mask value and a fix value, wherein the mask value and the fix value are stored in a first location of the at least one memory;
- defining a left-hand-side (LHS) parameter and a right-hand side (RHS) parameter to be each equal to the one or more inputs;
- calculating a plurality of temporary values using the LHS and RHS parameters and the mask value;
- adding dummy multiplication operations in the modular exponentiation to create a symmetrical square-multiplication sequence;
- generating an output based on one of the plurality of temporary values and the fix value;
- and
- using the output in a modular exponentiation operation.
6 more elements
A computer-implemented method, comprising:
- asymmetrically masking an operation in modular exponentiation to increase resistance to Simple Power Analysis (SPA) attacks using a processor and at least one memory, by:
- receiving one or more inputs, wherein the inputs comprise one or more operands;
- defining a mask value and a fix value, wherein the mask value and the fix value are stored in a first location of the at least one memory;
- defining a left-hand-side (LHS) parameter and a right-hand side (RHS) parameter to be each equal to the one or more inputs;
- calculating a plurality of temporary values using the LHS and RHS parameters and the mask value;
- applying mid-loop updates to resist against higher order Differential Power Analysis (DPA) attacks;
- generating an output based on one of the plurality of temporary values and the fix value;
- and
- using the output in a modular exponentiation operation.
6 more elements
Dependencies are inferred from the claim text.