Patent Description:
Cryptography is implemented in computing systems to provide for secure data storage and communication, including security against side-channel attacks (SCAs). A side channel attack is an attack based on leaked information in a computing system, such as in the form of power consumption, electromagnetic emissions, or other signal observations from a circuit.

In particular, certain secure operations, such as ECDSA (Elliptic Curve Digital Signature Algorithm) Sign and ECDH (Elliptic Curve Diffie-Hellman), apply elliptic curve scalar multiplication (ESM) to perform platform attestation and key exchange. ECDSA Sign and ECDH operations may be utilized to successfully provide high security based on a secret key because of the extreme difficulty in factoring the calculation based on elliptic curve output values.

However, advanced hardware attacks based on power or electromagnetic (EM) side channels can reveal the secret key used in these operations. In such an attack, an adversary may be able to exploit ESM operation through power/electromagnetic side channels to extract the integer scalar that is the secret key used for ECDSA Sign and ECDH operations, and thereby allow for defeating the security measures implemented for a system. As a result, additional countermeasures may be necessary for protected sign and key exchange operations. <CIT> refers to methods, apparatuses, and systems to bolster communication security, and more particularly to utilize a constant time cryptographic co-processor engine for such communication security. For example, a method for secure communication comprises receiving encrypted data at a receiving device; obtaining a randomization for at least one bit of the encrypted data; modifying an execution of a cryptographic algorithm on the at least one bit to obtain a randomized cryptographic algorithm based on the randomization; and executing the randomized cryptographic algorithm on the at least one bit of encrypted data to recover original data associated with the encrypted data. The invention is set forth in the independent claims. Embodiment of the invention are described in the dependent claims.

Embodiments described here are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings in which like reference numerals refer to similar elements.

Embodiments described herein are directed to countermeasures for side-channel attacks on protected sign and key exchange operations, and in particular to protection of cryptographic operations (sign and key exchange) against timing, power, and EM side channel attacks.

ECDSA (Elliptic Curve Digital Signature Algorithm) Sign and ECDH (Elliptic Curve Diffie-Hellman) technologies apply elliptic curve scalar multiplication (ESM) to perform platform attestation and key exchange, utilizing the algebraic structure of elliptic curves over finite fields to provide highly secure operations. In ESM processing, a secret scalar value is applied in generation of output values.

However, execution of an elliptic curve scalar multiplication can leak information regarding the secret scalar value due to three root causes:.

In some embodiments, an apparatus, system, or process includes one or more of technologies to mitigate the individual causes of scalar value leakage, the technologies including:.

In some embodiments, integration of such technologies results in an apparatus, system, or process enables a more robust ESM technique that can protect high-value assets utilizing ECDSA-based platform attestation and ECDH-based symmetric key generation against advanced physical (timing, power and electromagnetic) side-channel attacks.

Post-Quantum Cryptography (also referred to as "quantum-proof", "quantum-safe", "quantum-resistant", or simply "PQC") takes a futuristic and realistic approach to cryptography. It prepares those responsible for cryptography as well as end-users to know the cryptography is outdated; rather, it needs to evolve to be able to successfully address the evolving computing devices into quantum computing and post-quantum computing.

It is well-understood that cryptography allows for protection of data that is communicated online between individuals and entities and stored using various networks. This communication of data can range from sending and receiving of emails, purchasing of goods or services online, accessing banking or other personal information using websites, etc..

Conventional cryptography and its typical factoring and calculating of difficult mathematical scenarios may not matter when dealing with quantum computing. These mathematical problems, such as discrete logarithm, integer factorization, and elliptic-curve discrete logarithm, etc., are not capable of withstanding an attack from a powerful quantum computer. Although any post-quantum cryptography could be built on the current cryptography, the novel approach would need to be intelligent, fast, and precise enough to resist and defeat any attacks by quantum computers.

Today's PQC is mostly focused on the following approaches: <NUM>) hash-based cryptography based on Merkle's hash tree public-key signature system of <NUM>, which is built upon a one-message-signature idea of Lamport and Diffie; <NUM>) code-based cryptography, such as McEliece's hidden-Goppa-code public-key encryption system; <NUM>) lattice-based cryptography based on Hoffstein-Pipher-Silverman public-key-encryption system of <NUM>; <NUM>) multivariate-quadratic equations cryptography based on Patarin's Hidden Field Equation (HFE) public-key-signature system of <NUM> that is further based on the Matumoto-Imai proposal; <NUM>) supersingular elliptical curve isogeny cryptography that relies on supersingular elliptic curves and supersingular isogeny graphs; and <NUM>) symmetric key quantum resistance, such as HBS.

<FIG> illustrate a one-time hash-based signatures scheme and a multi-time hash-based signatures scheme, respectively. As aforesaid, hash-based cryptography is based on cryptographic systems like Lamport signatures, Merkle Signatures, extended Merkle signature scheme (XMSS), SPHINCS scheme, SPELINCS+ scheme, etc. With the advent of quantum computing and in anticipation of its growth, there have been concerns about various challenges that quantum computing could pose and what could be done to counter such challenges using the area of cryptography.

One area that is being explored to counter quantum computing challenges is hash-based signatures (HBS) since these schemes have been around for a long while and possess the necessary basic ingredients, such as relying on symmetric cryptography building blocks (e.g., hash functions), to counter the quantum counting and post-quantum computing challenges. HBS schemes are regarded as fast signature algorithms working with fast platform secured-boot, which is regarded as the most resistant to quantum attacks.

For example, as illustrated with respect to <FIG>, a scheme of HBS is shown that uses Merkle trees along with one-time signature (OTS) scheme <NUM>, such as using a private key to sign a message and a corresponding public key to verify the OTS message, where a private key only signs a single message.

Similarly, as illustrated with respect to <FIG>, another HBS scheme is shown, where this one relates to multi-time signatures (MTS) scheme <NUM>, where a private key can sign multiple messages.

<FIG> and <FIG> illustrate a one-time signature scheme and a multi-time signature scheme, respectively. Continuing with HBS-based OTS scheme <NUM> of <FIG> and MTS scheme <NUM> of <FIG>, <FIG> illustrates Winternitz OTS (WOTS) scheme <NUM>, which was offered by Robert Winternitz of Stanford Mathematics Department, while <FIG> illustrates XMSS MTS scheme <NUM>, respectively.

For example, WOTS scheme <NUM> of <FIG> provides for hashing and parsing of messages into M, with <NUM> integers between [<NUM>, <NUM>, <NUM>,. , <NUM>], such as private key, sk, <NUM>, signature, s, <NUM>, and public key, pk, <NUM>, with each having <NUM> components of <NUM> bytes each.

Now, for example, <FIG> illustrates XMSS MTS scheme <NUM> that allows for a combination of WOTS scheme <NUM> of <FIG> and XMSS scheme <NUM> having XMSS Merkle tree <NUM>. As discussed previously with respect to <FIG>, WOTS scheme <NUM> is based on a one-time public key, pk, <NUM>, having <NUM> components of <NUM> bytes each, that is then put through L-Tree compression algorithm <NUM> to offer WOTS compressed pk <NUM> to take a place in the XMSS Merkle tree <NUM> of XMSS scheme <NUM>. It is contemplated that XMSS signature verification may include computing WOTS verification and checking to determine whether a reconstructed root node matches the XMSS public key, such as root node = XMSS public key.

<FIG> is an illustration of an apparatus including a processing element to perform elliptic curve scalar multiplication, according to some embodiments. As illustrated, a processing element <NUM>, such as a processor of the one or more processors <NUM> illustrated in <FIG>, includes one or more processing cores <NUM>. The processing cores may include processing of one or more of ECDSA (Elliptic curve Diffie-Hellman) Sign and ECDH (Elliptic Curve Diffie-Hellman) operations for platform attestation and key exchange, including processing of an ECS (Elliptic Curve Scalar Multiplication) algorithm <NUM>. ESM multiplication is the primary operation for both ECDSA and ECDH operations, and the processing of the ESM algorithm includes use of a secret integer scalar <NUM>, as further illustrated in <FIG>.

However, the operation of the processing element <NUM> may allow access to one or more side channels <NUM>, wherein the side channels may include access to one or more of timing, power, or electromagnetic signals. This may be exploited in a side channel attack <NUM> utilizing certain forms of side channel detection <NUM>. For example, the processing element <NUM> may include multiple tile elements, which may allow for an attacker to access signal or power links, include possible electromagnetic signals. An adversary can exploit ESM operation through the side-channels <NUM> to extract the secret integer scalar <NUM>, thus enabling an attack on ECDSA Sign and ECDH operations.

In some embodiments, an apparatus, system, or process includes one or more side channel attack countermeasure technologies <NUM> to repel timing, power, and EM side channel attacks on the operation of the processing element, wherein the technologies include one or more of Balanced Execution <NUM>, Point Randomization <NUM>, and Scalar Splitting <NUM>, as further described below.

<FIG> is an illustration of aspects of a conventional elliptic curve multiplication algorithm that may be utilized in ECDSA Sign and ECDH operations. The following is a conventional algorithm for executing elliptic curve scalar multiplication that is commonly represented by the notation [k]G, with k (e, p) representing a secret scalar value and G and R representing points on the elliptic curve:.

As shown in <FIG>, the algorithm <NUM> executes [k]G iteratively from a left most bit of k (most significant bit (MSB)) to a right most bit. Each iteration of the calculation consists of a Point Double operation and a conditional Point Add operation, wherein the addition operation occurs only when the relevant bit of the secret scalar value k equals <NUM>.

In general the calculation of R cannot not be practically be determined based on the output values. However, if an attacker can exploit side channel leakages, the attacker can determine the value of the secret integer scalar k, and thus potentially replicate the elliptic curve scalar multiplication in order to crack the platform attestation and key exchange in a system.

In some embodiments, as further described below, an apparatus, system, or process is to provide the one or more novel countermeasures <NUM>, as illustrated in <FIG>, relating to the ESM calculation to significantly reduce the likelihood of a successful side channel attack.

<FIG> is an illustration of side channel leakages and countermeasures for ESM calculation according to some embodiments. As illustrated in <FIG>, side channel leakages <NUM> in the operation of ESM calculation are derived from multiple sources, wherein the sources may include algorithmic weaknesses <NUM> (further illustrated in <FIG>), data dependent vulnerabilities <NUM> (further illustrated in <FIG>), and implementation specific leakages <NUM> (further illustrated in <FIG>).

In some embodiments, an apparatus, system, or process is to provide countermeasures to address the sources of side channel leakages. The countermeasures may include one or more of balanced execution <NUM> of ESM calculation (as illustrated in <FIG>, and <FIG>) to address algorithmic weaknesses <NUM>; input randomness <NUM> in ESM calculation (as illustrated in <FIG> and <FIG>) to address data dependent vulnerabilities <NUM>; and scalar splitting <NUM> of ESM calculation (as illustrated in <FIG> and <FIG>) to address implementation specific weaknesses <NUM>.

<FIG> illustrate timing, power, and EM side channel leakages that may be addressed by embodiments of novel countermeasure technologies to repel side channel attacks. <FIG> illustrates an algorithmic weakness in the ESM algorithm <NUM> illustrated in <FIG>. The algorithm <NUM> executes [k]G iteratively from a left most bit of k to a right most bit. Each iteration consists of a Point Double operation and a conditional Point Add operation, wherein the addition operation will occur when the k value equals <NUM>.

As illustrated in <FIG>, the nature of the ESM algorithm operation in providing a different calculation for operations in which the k bit value is <NUM> (a Point Double (DBL) operation) and in which the k bit value is <NUM> (a Point Double operation and a Point Add (ADD) operation), it is possible for an attacker to determine the entire k value utilizing a single power or EM measurement by detecting the differences between the signal produced by the calculation operation for k = <NUM> value and the signal produced by the calculation operation for k = <NUM> value. In this way, the attacker can potentially determine the full secret scalar value and utilize this to defeat the security of a system.

For example, <FIG> illustrates an operation in which certain bits of the k scalar are <NUM>, <NUM>, <NUM>, <NUM>. As shown, the differing power signatures over time for the DBL operation and the ADD operation may be applied to determine a pattern of DBL, ADD, DBL, ADD, DBL, DBL, ADD, which thus may reveal the <NUM>, <NUM>, <NUM>, <NUM> bit values in one detection operation.

<FIG> illustrates data dependent vulnerabilities of the ESM operation. The power consumption and EM emanations from the underlying hardware of a processing unit are correlated with the input data G. However, these side-channel variations and the resulting leakages have smaller amplitude in comparison with the algorithmic weakness illustrated in <FIG>, and as a result are not exploitable through a single measurement. However, multiple measurements can potentially extract the entire k value through Differential Power/EM Analysis (DPA/DEMA) and Correlation Power/EM Analysis (CPA/CEMA), which thus can be utilized to establish a static key ECDH used for symmetric key generation.

For example, <FIG> illustrates the results of a statistical test to detect data dependent leakage, the illustrated graph providing the correlation t statistic versus a number of traces in a particular example. The increasing value of the t-statistic shows that an increasing amount of information can be extracted with additional traces, which may eventually be used to recover the secret scalar value if such traces can be performed by an attacker.

<FIG> illustrates implementation specific leakages in an ESM operation showing a distribution of power values across multiple scalars. There may be certain implementation differences in hardware that cause side-channel variations for processing a secret scalar bit <NUM> versus a scalar bit <NUM>. For example, register placements, related routings, and fan-outs within the processor hardware may result in different power consumption and EM signatures depending on the particular scalar value.

In a particular implementation illustrated in <FIG>, the power magnitude associated with the generation of a bit with a value of <NUM> differs from the power magnitude associated with the generation of a bit with a value of <NUM>. As illustrated in <FIG>, the precise value of the power magnitude for a particular instance will vary within a certain range for bit values of both <NUM> and <NUM> values and may overlap for certain measurements. Such implementation specific leakages will have a smaller amplitude in comparison with the algorithmic weakness illustrated in <FIG>, but these leakages may be exploitable through multiple measurements. The plot in <FIG> shows an exemplary experimental result in which power consumption at a specific time instant for processing a scalar bit <NUM> vs <NUM> forms two sets with an overlap. However, over a large number of traces the leakage of the <NUM> and <NUM> values provide patterns that may be utilized by an attacker to successfully determine the secret scalar value.

In an application of ESM calculation such as ECDSA Sign, if the attacker can identify a few bits of the secret scalar, then the attacker may gather a few bits of each of the multiple scalars to mount a lattice attack for discovering the signing key. In addition, if the attacker can measure the power/EM side-channels for a same scalar multiplication multiple times, by averaging these measurements the attacker may be able to reduce the noise level to extract the small implementation specific information leakages. <FIG> illustrates experimental data for finding one secret bit by gathering <NUM> measurements. In this example, the attacker can repeat the same analysis using the same measurements for finding other bits of the entire secret scalar.

<FIG> is an illustration of an improved elliptic curve scalar multiplication algorithm that may be utilized in ECDSA Sign and ECDH operations, according to some embodiments. In some embodiments, the algorithm includes a Montgomery ladder approach to improve protection against physical side channel attack. In a conventional Montgomery ladder approach, the point multiplication operations are to each be computed a fixed amount of time. This can be beneficial when timing or power consumption measurements are exposed to an attacker performing a side-channel attack.

In some embodiments, an improved algorithm provides for executing elliptic curve scalar multiplication includes a revised Montgomery Ladder operation. The improved algorithm may include the following:.

A conventional algorithm including a traditional Montgomery Ladder, such as illustrated in <FIG>, protects intermediate bits of the scalar if the most significant bit of the scalar is <NUM>. However, the secret scalars in most applications are generated randomly, and may consist of some number of zeros in the leading most significant bits. For such a scalar value, the traditional Montgomery Ladder executes the Point Double and Point Add with a special operand called Point-at-Infinity (O), which has a specific side-channel signature. An attacker may thus apply a single measurement to identify this signature, and then discover the leading zero bits.

In some embodiments, to protect against this vulnerability, an improved algorithm <NUM> provides for skipping and counting the leading zeros (if any) at the initial phases of the algorithm. The algorithm then proceeds with executing the same number of extra (dummy) iterations at the end of the process (as shown in <FIG>). This provides protection of the entire scalar against single measurement-based attacks, as further illustrated in <FIG> and <FIG>.

The algorithm <NUM> further includes point randomization in which the G values includes an additional random value of p. The introduction of value randomization may be utilized to prevent the detection of a leaked bit value over a number of traces, as further illustrated in <FIG> and <FIG>.

In addition, the algorithm <NUM> may be implemented to include scalar splitting, the scalar introducing a new random input (k1) to provide security against implementation specific leakages, as further illustrated in <FIG> and <FIG>.

<FIG> is an illustration of balanced execution for elliptic curve scalar multiplication, according to some embodiments. As shown in <FIG>, in implementing an improved ESM algorithm <NUM>, as provided in <FIG>, the scalar leakage provided by differing bit values is greatly reduced because for every bit value, <NUM> or <NUM>, each point add operation is followed by a corresponding point double operation. In this manner, an embodiment of an apparatus, system, or process operates to prevent the identification of secret scalar bits through the observation a single side-channel measurement, as was illustrated in <FIG>.

In the particular example illustrated in <FIG>, certain intermediate scalar values in k may be <NUM>, <NUM>, <NUM>. However, if the power signatures of the DBL and ADD operations are determined, the operations would be ADD, DBL, ADD, DBL, ADD, DBL, thus preventing an attacker from distinguishing between the <NUM> bit values and the <NUM> bit values in k.

<FIG> is a flowchart to illustrate a process for balanced execution in elliptic curve scalar multiplication operation, according to some embodiments. A process <NUM> includes ECDSA Sign or ECDH operation including ESM operation <NUM>. The operation may provide processing utilizing the improved ESM algorithm <NUM> illustrated in <FIG>. In some embodiments, the process includes skipping and counting initial zero bits from the most significant bit (MSB) <NUM>. (In this example, the number of bits is <NUM>, P-<NUM> being the elliptic curve currently specified in NSA Suite B Cryptography for the ECDSA and ECDH algorithms. However, embodiments are not limited to any particular number of bits. ) In this example operation, the mth bit is the most significant non-zero bit, and j is initially set to m - <NUM> (<NUM>). The process then proceeds with the calculation of Point Addition and Point Double operations <NUM> for the bit, wherein the operations may be as provided in algorithm <NUM> of <FIG>.

The process then proceeds with a determination whether j = <NUM> (<NUM>). If not, then there are one or more additional bits for calculation, with j then decremented (j = j - <NUM>) <NUM>, and the process proceeds with an additional iteration of the Point Addition and Point Double operations <NUM> for the next bit of k. Thus, the Point Addition and Point Double operations <NUM> are performed for each bit, regardless of value. When the determination indicates that j = <NUM> (<NUM>), then the bits between the most significant non-zero bit and the final bit have been calculated.

In some embodiments, the process then proceeds with a set of zero or more iterations of dummy operations to represent the timing of the skipped zero bits at the beginning of the iterative calculations. In this process, j is then set to a value of <NUM> - m - <NUM> (<NUM>), and a Point Addition operation and a Point Double operation are performed for the bit <NUM>, wherein the operations may be as provided in algorithm <NUM> of <FIG>.

The process then proceeds with a determination whether a determination whether j = <NUM> (<NUM>). If not, then there are one or more additional initial zero bits for calculation, with j then decremented (j = j - <NUM>) <NUM>, and the proceeds with an additional iteration of the Point Addition and Point Double operations <NUM>. When the determination indicates that j = <NUM> (<NUM>), then dummy operations for the initial zero bits are completed, and the process proceeds with returning the R<NUM> value <NUM>.

<FIG> is an illustration of data randomization to counter data dependent vulnerabilities in elliptic curve scalar multiplication, according to some embodiments. As shown in <FIG>, in implementing an improved ESM algorithm <NUM>, as provided in <FIG>, data randomization is introduced. In some embodiments, an apparatus, system, or process is to convert the input point G to a Random Projective Coordinate and compute each Point Add and Point Double operation on different randomized points in the new Montgomery Ladder algorithm <NUM> as illustrated in <FIG>.

The introduced data randomization operates to reduce or remove correlation between timing, power, and EM signals and the input data. In addition, each underlying operation is computed in constant time to ensure that the randomization technique not only protects against data dependent vulnerabilities but also does not create any additional timing side-channels.

<FIG> depicts experimental results for an embodiment where p is the parameter used in algorithm <NUM> in <FIG> to randomize the input point. The reduced t value curve with input randomization in comparison with the curve without randomization demonstrates that the embodiment operates to maintain the data protection as the number of traces available to the attacker is increased.

<FIG> is a flowchart to illustrate a process including data randomization to counter data dependent vulnerabilities in elliptic curve scalar multiplication, according to some embodiments. In some embodiments, a process <NUM> includes ECDSA Sign or ECDH operation including ESM calculation <NUM>. The operation may provide processing utilizing the improved ESM algorithm <NUM> illustrated in <FIG> including a new Montgomery ladder operation providing for the performance of ESM calculation with input randomization <NUM>.

In some embodiments, the process includes determining or obtaining a random value p (<NUM>), and converting G to a random projective coordinate utilizing the p value <NUM>. The process then proceeds with the performance of the ESM calculations utilizing the improved ESM algorithm <NUM>, wherein the calculation includes computing each Point Add and Point Double on different randomized points in the new Montgomery Ladder <NUM>. In some embodiments, the process further includes performing each underlying operation in constant time <NUM>, the performance in constant time ensures that the randomization technology not only protects against data dependent vulnerabilities but also prevents the creation of any additional timing side channels that could be exploited by an attacker. The operation then continues and returns the calculation result R<NUM> <NUM>.

<FIG> is an illustration of scalar splitting to counter implementation specific leakages in elliptic curve scalar multiplication, according to some embodiments. In a particular implementation of a processing element there may be certain implementation differences in the hardware that cause side-channel variations for processing a secret scalar bit <NUM> versus a scalar bit <NUM>, such as register placements, related routings, and fan-outs within the processor, and these implementation details may result in different power consumption and EM signatures depending on the particular scalar value. In some embodiments, to prevent exploitation of the implementation specific leakages, an apparatus, system, or process is to provide scalar splitting in ESM calculation.

As shown in <FIG>, in implementing an improved ESM algorithm <NUM>, as provided in <FIG>, scalar splitting is based on a random value k<NUM> that is applied in conjunction with the secret scalar value k to provide additional protection against a side channel attack. As shown, a value k<NUM> is generated as the difference between the secret scalar k and the random value k<NUM> <NUM>. The G value is then projected to point locations H<NUM> and H<NUM> on the elliptic curve based on the k<NUM> value <NUM>.

In some embodiments, the randomized values are then utilized to generate a first intermediate Q1 value for [k<NUM>]H<NUM> <NUM> and a second intermediate Q2 value for [k<NUM>]H<NUM> <NUM>, wherein each calculation may include constant time and balanced execution to prevent generation of side channel leakages. The Q1 and Q2 values are then added to generate a Q value <NUM> that represents the [k]G output.

In some embodiments, through the application of the scalar splitting technology illustrated in <FIG>, an attacker is unable to obtain multiple traces of elliptic curve scalar multiplications with the same scalar because of the introduction of the random element in the splitting operation. This thus provides strong protection for both ECDSA Sign (in platform attestation) and ECDH (in key generation) against power and EM based side channel attacks. For ECDSA Sign, the scalar splitting operation isolates the attacker from gathering enough ephemera keys with a few known bits and further protects from the attacker mounting a lattice-based attack to recover a signing key. For ECDH, the scalar splitting operation prevents the attacker from collecting multiple measurements for the purpose of reducing noise by averaging the measurements in an attempt to identify the secret bits through correlation analysis.

<FIG> is a flowchart to illustrate a process including scalar splitting to counter implementation specific leakages in elliptic curve scalar multiplication, according to some embodiments. In some embodiments, a process <NUM> provides ECDSA Sign or ECDH operation including ESM calculation <NUM>, the process including ESM operation with scalar splitting <NUM>.

In some embodiments, the scalar splitting operation includes inputting k and k<NUM> values, where k is the secret scalar value and k<NUM> is a random value, with k<NUM> being equal to k<NUM> minus k (<NUM>). Base point G is received <NUM>. and G is projected onto multiple points H<NUM> and H<NUM> based on the random k<NUM> value <NUM>. Utilizing the projected values H<NUM> and H<NUM> the process then proceeds with generation of intermediate values Q<NUM> and Q<NUM> utilizing the H<NUM> and H<NUM> points <NUM>, where: <MAT> <MAT> The resulting Q<NUM> and Q<NUM> values are then added to generate Q <NUM>, the result is returned, where Q = [k]G <NUM>.

<FIG> illustrates an embodiment of an exemplary computing architecture for implementing countermeasures for side-channel attacks on protected sign and key exchange operations, according to some embodiments. In various embodiments as described above, a computing architecture <NUM> may comprise or be implemented as part of an electronic device. In some embodiments, the computing architecture <NUM> may be representative, for example, of a computer system that implements one or more components of the operating environments described above. In some embodiments, computing architecture <NUM> may be representative of one or more portions or components of a Deep Neural Network (DNN) training system that implement one or more techniques described herein.

As used in this application, the terms "system" and "component" and "module" are intended to refer to a computer-related entity, either hardware, a combination of hardware and software, software, or software in execution, examples of which are provided by the exemplary computing architecture <NUM>. For example, a component can be, but is not limited to being, a process running on a processor, a processor, a hard disk drive or solid state drive (SSD), multiple storage drives (of optical and/or magnetic storage medium), an object, an executable, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on a server and the server can be a component. One or more components can reside within a process and/or thread of execution, and a component can be localized on one computer and/or distributed between two or more computers. Further, components may be communicatively coupled to each other by various types of communications media to coordinate operations. The coordination may involve the unidirectional or bi-directional exchange of information. For instance, the components may communicate information in the form of signals communicated over the communications media. The information can be implemented as signals allocated to various signal lines. In such allocations, each message is a signal. Further embodiments, however, may alternatively employ data messages. Such data messages may be sent across various connections. Exemplary connections include parallel interfaces, serial interfaces, and bus interfaces.

In some embodiments, the computing elements are to provide for countermeasures for side-channel attacks on protected sign and key exchange operations, and in particular to protection of cryptographic operations (sign and key exchange) against timing, power, and EM side channel attacks.

As shown in <FIG>, the computing architecture <NUM> includes one or more processors <NUM> and one or more graphics processors <NUM>, and may be a single processor desktop system, a multiprocessor workstation system, or a server system having a large number of processors <NUM> or processor cores <NUM>. In one embodiment, the system <NUM> is a processing platform incorporated within a system-on-a-chip (SoC or SOC) integrated circuit for use in mobile, handheld, or embedded devices.

An embodiment of system <NUM> can include, or be incorporated within, a server-based gaming platform, a game console, including a game and media console, a mobile gaming console, a handheld game console, or an online game console. In some embodiments system <NUM> is a mobile phone, smart phone, tablet computing device or mobile Internet device. Data processing system <NUM> can also include, couple with, or be integrated within a wearable device, such as a smart watch wearable device, smart eyewear device, augmented reality device, or virtual reality device. In some embodiments, data processing system <NUM> is a television or set top box device having one or more processors <NUM> and a graphical interface generated by one or more graphics processors <NUM>.

In some embodiments, the cache memory <NUM> is shared among various components of the processor <NUM>.

In some embodiments, one or more processor(s) <NUM> are coupled with one or more interface bus(es) <NUM> to transmit communication signals such as address, data, or control signals between processor <NUM> and other components in the system. The interface bus <NUM>, in one embodiment, can be a processor bus, such as a version of the Direct Media Interface (DMI) bus. However, processor buses are not limited to the DMI bus, and may include one or more Peripheral Component Interconnect buses (e.g., PCI, PCI Express), memory buses, or other types of interface buses. In one embodiment the processor(s) <NUM> include an integrated memory controller <NUM> and a platform controller hub <NUM>. The memory controller <NUM> facilitates communication between a memory device and other components of the system <NUM>, while the platform controller hub (PCH) <NUM> provides connections to I/O devices via a local I/O bus.

Memory device <NUM> can be a dynamic random-access memory (DRAM) device, a static random-access memory (SRAM) device, flash memory device, phase-change memory device, or some other memory device having suitable performance to serve as process memory. In one embodiment the memory device <NUM> can operate as system memory for the system <NUM>, to store data <NUM> and instructions <NUM> for use when the one or more processors <NUM> execute an application or process. Memory controller hub <NUM> also couples with an optional external graphics processor <NUM>, which may communicate with the one or more graphics processors <NUM> in processors <NUM> to perform graphics and media operations. In some embodiments a display device <NUM> can connect to the processor(s) <NUM>. The display device <NUM> can be one or more of an internal display device, as in a mobile electronic device or a laptop device, or an external display device attached via a display interface (e.g., DisplayPort, etc.). In one embodiment the display device <NUM> can be a head mounted display (HMD) such as a stereoscopic display device for use in virtual reality (VR) applications or augmented reality (AR) applications.

In some embodiments the platform controller hub <NUM> enables peripherals to connect to memory device <NUM> and processor <NUM> via a high-speed I/O bus. The I/O peripherals include, but are not limited to, an audio controller <NUM>, a network controller <NUM>, a firmware interface <NUM>, a wireless transceiver <NUM>, touch sensors <NUM>, a data storage device <NUM> (e.g., hard disk drive, flash memory, etc.). The data storage device <NUM> can connect via a storage interface (e.g., SATA) or via a peripheral bus, such as a Peripheral Component Interconnect bus (e.g., PCI, PCI Express). The touch sensors <NUM> can include touch screen sensors, pressure sensors, or fingerprint sensors. The wireless transceiver <NUM> can be a Wi-Fi transceiver, a Bluetooth transceiver, or a mobile network transceiver such as a <NUM>, <NUM>, Long Term Evolution (LTE), or <NUM> transceiver. The firmware interface <NUM> enables communication with system firmware, and can be, for example, a unified extensible firmware interface (UEFI). The network controller <NUM> can enable a network connection to a wired network. In some embodiments, a high-performance network controller (not shown) couples with the interface bus <NUM>. The audio controller <NUM>, in one embodiment, is a multi-channel high definition audio controller. In one embodiment the system <NUM> includes an optional legacy I/O controller <NUM> for coupling legacy (e.g., Personal System <NUM> (PS/<NUM>)) devices to the system. The platform controller hub <NUM> can also connect to one or more Universal Serial Bus (USB) controllers <NUM> connect input devices, such as keyboard and mouse <NUM> combinations, a camera <NUM>, or other USB input devices.

In some embodiments, one or more non-transitory computer-readable storage mediums having stored thereon executable computer program instructions that, when executed by one or more processors, cause the one or more processors to perform operations including: commencing a process including an elliptic curve scalar multiplication (ESM) operation, the operation including application of a secret scalar value; counting a number of leading '<NUM>' bits in the secret scalar value; skipping the number of leading '<NUM>' bits in the secret scalar value for processing; performing an ESM iteration for each bit of the secret scalar value beginning with a most significant '<NUM>' bit of the secret scalar value, wherein the performance of the ESM iteration includes a Point Addition operation and a Point Double operation for each bit of the secret scalar value; performing an ESM operation for each of a number of dummy operations, the number of dummy operations being equal to the number of leading '<NUM>' bits in the secret scalar value; and returning an output result for the ESM operation.

In some embodiments, the one or more storage mediums further include instructions for converting an input value for the ESM operation to random projective coordinates using a random value; and generating randomized points based on the random projective coordinates.

In some embodiments, the one or more storage mediums further include instructions for performing the Point Addition operation and the Point Double operation on the randomized points.

In some embodiments, the one or more storage mediums further include instructions for performing each operation in the ESM operation in constant time.

In some embodiments, the one or more storage mediums further include instructions for splitting the secret scalar value into a first scalar value and a second scalar value based on a random value.

In some embodiments, the one or more storage mediums further include instructions for projecting an input value to multiple points based on the random value; generating an intermediate value based on each of the multiple points; and adding the intermediate values to generate the output result.

In some embodiments, the process includes one or more of platform attestation or key exchange.

In some embodiments, the process includes one or more of an ECDSA (Elliptic Curve Digital Signature Algorithm) Sign operation; or an ECDH (Elliptic Curve Diffie-Hellman) operation.

In some embodiments, a system includes one or more processors including one or more processing cores, the one or more processor to perform one or more secure operations utilizing elliptic curve scalar multiplication (ESM); and a memory for storage of data, including data for one or more secure operations, wherein the one or more processors include a capability to provide one or more countermeasures to hardware side channel attacks on ESM processing, the one or more processors to: perform an elliptic curve scalar multiplication (ESM) operation, the operation including application of a secret scalar value; count a number of leading '<NUM>' bits in the secret scalar value; skip the number of leading '<NUM>' bits in the secret scalar value for processing; perform an ESM iteration for each bit of the secret scalar value beginning with a most significant '<NUM>' bit of the secret scalar value, wherein the performance of the ESM operation includes a Point Addition operation and a Point Double operation for each bit of the secret scalar value; perform an ESM iteration for a number of dummy operations, the number of dummy iterations being equal to the number of leading '<NUM>' bits in the secret scalar value; and return an output result for the ESM operation.

In some embodiments, the one or more processors are further to: convert an input value for the ESM operation to random projective coordinates using a random value; and generate randomized points based on the random projective coordinates.

In some embodiments, the one or more processors are further to: perform the Point Addition operation and the Point Double operation on the randomized points.

In some embodiments, the one or more processors are to perform each operation in the ESM operation in constant time.

In some embodiments, the one or more processors are further to: split the secret scalar value into a first scalar value and a second scalar value based on a random value.

In some embodiments, the one or more processors are further to: project an input value to multiple points based on the random value; generate an intermediate value based on each of the multiple points; and add the intermediate values to generate the output result.

In some embodiments, the one or more secure operations include: platform attestation including an ECDSA (Elliptic Curve Digital Signature Algorithm) Sign operation; or key exchange utilizing an ECDH (Elliptic Curve Diffie-Hellman) operation.

In some embodiments, a method includes receiving a request to perform a secure operation in a computing system; and performing an elliptic curve scalar multiplication (ESM) operation for the secure operation according to an algorithm, the ESM operation including application of a secret scalar value; wherein the algorithm provides one or more countermeasures to physical side channel attacks on ESM processing, the algorithm including: counting a number of leading '<NUM>' bits in the secret scalar value; skipping the number of leading '<NUM>' bits in the secret scalar value for processing; performing the ESM operation for each bit of the secret scalar value beginning with a most significant '<NUM>' bit of the secret scalar value, wherein the performance of the ESM operation includes a Point Addition operation and a Point Double operation for each bit of the secret scalar value; performing the ESM operation for a number of dummy operations, the number of dummy operations being equal to the number of leading '<NUM>' bits in the secret scalar value; and returning an output result for the ESM operation.

In some embodiments, the algorithm further includes: converting an input value for the ESM operation to random projective coordinates using a random value; generating randomized points based on the random projective coordinates; and performing the Point Addition operation and the Point Double operation on the randomized points.

In some embodiments, the method further includes performing each operation in the ESM operation in constant time.

In some embodiments, the algorithm further includes: splitting the secret scalar value into a first scalar value and a second scalar value based on a random value; projecting an input value to multiple points based on the random value; generating an intermediate value based on each of the multiple points; and adding the intermediate values to generate the output result.

In some embodiments, the one or more countermeasures to physical side channel attacks include countermeasures to one or more of timing, power, and electromagnetic (EM) side channel attacks.

In some embodiments, an apparatus includes means for commencing a process including an elliptic curve scalar multiplication (ESM) operation, the operation including application of a secret scalar value; means for counting a number of leading '<NUM>' bits in the secret scalar value; means for skipping the number of leading '<NUM>' bits in the secret scalar value for processing; means for performing an ESM iteration for each bit of the secret scalar value beginning with a most significant '<NUM>' bit of the secret scalar value, wherein the performance of the ESM iteration includes a Point Addition operation and a Point Double operation for each bit of the secret scalar value; means for performing an ESM operation for each of a number of dummy operations, the number of dummy operations being equal to the number of leading '<NUM>' bits in the secret scalar value; and means for returning an output result for the ESM operation.

In some embodiments, the apparatus further includes means for converting an input value for the ESM operation to random projective coordinates using a random value; and means for generating randomized points based on the random projective coordinates.

In some embodiments, the apparatus further includes means for performing the Point Addition operation and the Point Double operation on the randomized points.

In some embodiments, the apparatus further includes means for performing each operation in the ESM operation in constant time.

In some embodiments, the apparatus further includes means for splitting the secret scalar value into a first scalar value and a second scalar value based on a random value.

In some embodiments, the apparatus further includes means for projecting an input value to multiple points based on the random value; means for generating an intermediate value based on each of the multiple points; and means for adding the intermediate values to generate the output result.

In some embodiments, the process includes one of an ECDSA (Elliptic Curve Digital Signature Algorithm) Sign operation; or an ECDH (Elliptic Curve Diffie-Hellman) operation.

In the description above, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the described embodiments. It will be apparent, however, to one skilled in the art that embodiments may be practiced without some of these specific details. In other instances, well-known structures and devices are shown in block diagram form. There may be intermediate structure between illustrated components. The components described or illustrated herein may have additional inputs or outputs that are not illustrated or described.

Various embodiments may include various processes. These processes may be performed by hardware components or may be embodied in computer program or machine-executable instructions, which may be used to cause a general-purpose or special-purpose processor or logic circuits programmed with the instructions to perform the processes. Alternatively, the processes may be performed by a combination of hardware and software.

Portions of various embodiments may be provided as a computer program product, which may include a computer-readable medium having stored thereon computer program instructions, which may be used to program a computer (or other electronic devices) for execution by one or more processors to perform a process according to certain embodiments. The computer-readable medium may include, but is not limited to, magnetic disks, optical disks, read-only memory (ROM), random access memory (RAM), erasable programmable read-only memory (EPROM), electrically-erasable programmable read-only memory (EEPROM), magnetic or optical cards, flash memory, or other type of computer-readable medium suitable for storing electronic instructions. Moreover, embodiments may also be downloaded as a computer program product, wherein the program may be transferred from a remote computer to a requesting computer.

Many of the methods are described in their most basic form, but processes can be added to or deleted from any of the methods and information can be added or subtracted from any of the described messages without departing from the basic scope of the present embodiments. It will be apparent to those skilled in the art that many further modifications and adaptations can be made. The particular embodiments are not provided to limit the concept but to illustrate it. The scope of the embodiments is not to be determined by the specific examples provided above but only by the claims below.

If it is said that an element "A" is coupled to or with element "B," element A may be directly coupled to element B or be indirectly coupled through, for example, element C. When the specification or claims state that a component, feature, structure, process, or characteristic A "causes" a component, feature, structure, process, or characteristic B, it means that "A" is at least a partial cause of "B" but that there may also be at least one other component, feature, structure, process, or characteristic that assists in causing "B. " If the specification indicates that a component, feature, structure, process, or characteristic "may", "might", or "could" be included, that particular component, feature, structure, process, or characteristic is not required to be included. If the specification or claim refers to "a" or "an" element, this does not mean there is only one of the described elements.

Claim 1:
One or more non-transitory computer-readable storage mediums having stored thereon executable computer program instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
performing a secure operation in a computing system, the secure operation being one of attesting to a platform for the computing system or performing a secure key exchange for the computing system, the secure operation including:
performing an elliptic curve scalar multiplication, ESM, operation based on data for the secure operation, the operation including application of a secret scalar value including a plurality of bits;
counting (<NUM>) a number of leading '<NUM>' bits in the plurality of bits of the secret scalar value;
skipping the number of leading '<NUM>' bits in the secret scalar value in processing of the secret scalar value;
performing (<NUM>) an ESM iteration for each bit of the secret scalar value beginning with a most significant '<NUM>' bit of the secret scalar value after the leading '<NUM>' bits, wherein the performance of the ESM iteration includes a Point Addition operation and a Point Double operation for each bit of the secret scalar value after the leading '<NUM>' bits;
following performance of the ESM iterations for the secret scalar value, performing (<NUM>) ESM iterations for each of a number of dummy operations, the number of dummy ESM iterations being equal to the number of leading '<NUM>' bits in the secret scalar value, wherein a total number of ESM iterations for the secret scalar value and the dummy operations equals a total number of the plurality of bits of the secret scalar value;
returning an output result for the ESM operation; and
applying the output result in the secure operation to attest to the platform for the computing system or to perform the secure key exchange for the computing system.