Derivative works — US Patent 7020281

Defensive Disclosure: Timing-Resistant Cryptographic Implementations and Applications

Publication Date: May 4, 2026
Reference ID: DP-2026-0504-001

This document discloses novel variations, applications, and integrations of methods for performing cryptographic group operations in a manner resistant to side-channel attacks, particularly timing analysis. The disclosures herein are intended to enter the public domain to serve as prior art for future patent applications in this field. The following descriptions build upon the principles of constant-time cryptographic computation as described in US Patent 7,020,281.

Derivatives of Claim 1: State-Based Constant-Time Operation

The core concept of this claim is a method where each bit of a secret vector is processed with similar operations using a state machine that toggles between performing an operation with a group element and its inverse to achieve a constant execution time.

1. Material & Component Substitution

Derivative 1.1: Implementation on Neuromorphic Processors
- Enabling Description: The state-based algorithm is implemented on a neuromorphic processor utilizing spiking neural networks (SNNs). The cryptographic state (e.g., H0 or H1) is represented by the firing or non-firing state of a specific neuron or a small cluster of neurons. Group operations (e.g., point-add, point-double) are triggered by spike trains. The inherent parallelism and event-driven nature of SNNs are used to obscure power consumption patterns. The 'double' operation is a fixed spike sequence sent to an accumulator neuron cluster, while the 'add' or 'subtract' operation is a state-dependent sequence. The near-uniform energy cost of propagating a spike, regardless of the data it represents, provides a hardware-level defense against power and timing analysis.
- ```
graph TD
    A[Start: Initialize Q, Counter i=N] --> B{Process Bit b_i};
    B --> C[Spike Train for Double Operation on Q];
    C --> D{Check Neuron State H};
    D -- State H0 (Spike) --> E[Trigger Spike Train for +P];
    D -- State H1 (Quiescent) --> F[Trigger Spike Train for -P];
    E --> G{Update Neuron State based on b_i};
    F --> G;
    G --> H{i > 0?};
    H -- Yes --> B;
    H -- No --> I[End: Final Correction if needed];
```
Derivative 1.2: Implementation using Optical Computing Components
- Enabling Description: The cryptographic operation is performed using optical computing elements. The intermediate value Q is stored as a phase and amplitude of a coherent light beam. Group operations are performed using phase modulators and beam splitters. The state is stored in a bistable optical switch. The 'double' operation corresponds to a fixed phase shift, while the 'add' or 'subtract' operations are phase shifts in opposite directions, controlled by the optical switch. Since the light path and number of components traversed are identical for every bit, the time of flight for photons is constant, providing resistance to timing attacks.
- ```
sequenceDiagram
    participant Controller;
    participant LaserSource;
    participant Q_Beam as Coherent Beam (Q);
    participant P_Modulator as Phase Modulator (+/- P);
    participant StateSwitch as Optical Switch (H);

    Controller->>LaserSource: Pulse for bit i;
    LaserSource->>Q_Beam: Modulate with Double(Q);
    Controller->>StateSwitch: Read State H;
    alt State H0
        Controller->>P_Modulator: Apply positive phase shift (+P);
    else State H1
        Controller->>P_Modulator: Apply negative phase shift (-P);
    end
    P_Modulator->>Q_Beam: Apply phase shift;
    Controller->>StateSwitch: Update State H based on bit_i;
```

2. Operational Parameter Expansion

Derivative 1.3: Cryogenic Temperature Operation for Quantum Computing
- Enabling Description: The method is adapted for use in the control systems of a quantum computer operating at cryogenic temperatures (sub-4 Kelvin). The cryptographic operations are used to secure classical control instructions sent to quantum gates. The binary vector is a private key used to sign instruction sets. The state-based algorithm is executed on a classical co-processor integrated with the quantum control hardware. At these temperatures, thermal noise is minimal, making subtle variations in power consumption or electromagnetic emissions more pronounced. The constant-time algorithm ensures that the classical control signals for signed instructions do not leak key information through these side channels, which is critical in a high-sensitivity quantum environment.
- ```
stateDiagram-v2
    [*] --> Initializing
    Initializing --> Processing_MSB : Key Loaded
    state Processing_Loop {
        H0: Double(Q), Add(P)
        H1: Double(Q), Sub(P)
        H0 --> H0 : Next bit is 1
        H0 --> H1 : Next bit is 0
        H1 --> H0 : Next bit is 1
        H1 --> H1 : Next bit is 0
    }
    Processing_MSB --> H0
    Processing_Loop --> Final_Correction : All bits processed
    Final_Correction --> [*] : Result Output
    note right of H1
        Operations executed on
        cryogenic classical co-processor
        to prevent thermal side-channels.
    end note
```

3. Cross-Domain Application

Derivative 1.4: Aerospace - Secure Satellite Command Authentication
- Enabling Description: The method is used to authenticate commands sent to a satellite or unmanned aerial vehicle (UAV). The private key is stored in a radiation-hardened FPGA on the satellite. Ground control signs a command packet with the key, and the satellite must verify it before execution. The limited computational power and harsh environment of space make side-channel attacks more feasible. This constant-time algorithm is implemented in the satellite's command and control module to verify signatures on critical commands (e.g., orbital maneuvers, payload activation) without leaking the private key through power or timing analysis, which could be monitored by an adversary.
- ```
flowchart LR
    subgraph GroundStation
        A[Command Packet] --> B{Sign with Private Key k};
        B --> C[Transmit Signed Command];
    end
    subgraph Satellite
        D[Receive Command] --> E{Verify Signature using kP};
        subgraph FPGA [Rad-Hardened FPGA]
            E -- uses --> F(Constant-Time ECC Verification);
        end
        E -- Valid --> G[Execute Command];
        E -- Invalid --> H[Reject Command];
    end
    C --> D;
```
Derivative 1.5: AgTech - Encrypted Drone Fleet Coordination
- Enabling Description: A fleet of autonomous agricultural drones (e.g., for spraying, monitoring) uses the method to secure peer-to-peer communications. Each drone has a private key for signing its telemetry and command data. To prevent hijacking or spoofing, a drone verifies messages from other drones. Given that drones are low-power, resource-constrained devices operating in a physically accessible environment, they are vulnerable to side-channel attacks. Implementing the constant-time algorithm ensures that one compromised drone cannot extract the keys of other drones by monitoring their radio transmission timings or power draw during cryptographic verification.
- ```
sequenceDiagram
    participant Drone_A;
    participant Drone_B;
    Drone_A->>Drone_B: Signed Command {Move to X,Y};
    activate Drone_B;
    Note over Drone_B: Verify Signature using\nConstant-Time Algorithm;
    Drone_B->>Drone_A: ACK;
    deactivate Drone_B;
```
Derivative 1.6: Consumer Electronics - Secure Bootloader for IoT Devices
- Enabling Description: The method is embedded into the secure bootloader of a consumer IoT device (e.g., smart lock, security camera). The device's firmware is signed by the manufacturer. Upon startup, the bootloader must verify the firmware's signature before loading it into memory. An attacker with physical access could use a timing attack to extract the manufacturer's public key verification counterpart (the private key is not on the device, but the principle applies to secret operations). The use of this algorithm prevents such attacks, ensuring that only authentic, unmodified firmware can be loaded, preventing device bricking or compromise.
- ```
graph TD
    A[Device Power On] --> B[Execute Secure Bootloader];
    B --> C{Verify Firmware Signature};
    C -- Constant-Time ECC --> D{Signature Valid?};
    D -- Yes --> E[Load Firmware];
    D -- No --> F[Halt & Enter Recovery Mode];
    E --> G[Normal Operation];
```

4. Integration with Emerging Tech

Derivative 1.7: AI-Driven Side-Channel Counter-Optimization
- Enabling Description: A machine learning model, specifically a generative adversarial network (GAN), is used to dynamically adjust the operational parameters of the constant-time algorithm. The generator network proposes minor, non-functional variations in the execution (e.g., inserting random NOPs, slightly varying clock frequency within a safe range), while the discriminator network is trained on side-channel leakage data (power traces, EM signals) to detect patterns. The system optimizes for execution profiles that the discriminator finds most difficult to distinguish, effectively "learning" to mask any residual information leakage not covered by the core algorithm.
- ```
flowchart LR
    subgraph Training
        A[Power Traces] --> B(Discriminator);
        C(Generator) --> D[Proposed NOP Insertions];
        D --> B;
    end
    subgraph Inference
        E[Start Crypto Op] --> F{Get Obfuscation Pattern};
        F -- from --> C;
        F --> G[Execute Constant-Time Algorithm with NOPs];
        G --> H[End Op];
    end
```

5. The "Inverse" or Failure Mode

Derivative 1.8: Graceful Degradation Mode for Low-Power Devices
- Enabling Description: The device operates in a low-power "sentinel" mode. Instead of performing the full constant-time operation for every bit, the algorithm is modified to perform a "dummy" operation that is computationally cheaper but preserves the exact timing and power profile of the real operation. For example, in ECC, the point addition/subtraction is replaced with a simple XOR of coordinates, which is much faster but consumes a similar amount of power for a brief period. This allows the device to respond to authentication challenges in a way that appears cryptographically active, deterring further probing, but without spending the power on a full verification. If a high-priority challenge is received, it switches to the full, secure implementation.
- ```
stateDiagram-v2
    state "Low Power Mode" as LowP
    state "High Security Mode" as HighP

    [*] --> LowP
    LowP --> HighP : High-Priority Challenge
    HighP --> LowP : Timeout / Op Complete

    state LowP {
        H0: Double(Q), Dummy_Add(P)
        H1: Double(Q), Dummy_Sub(P)
        note right of H1
            Dummy operations are XOR-based
            to mimic timing/power profile
            with minimal energy cost.
        end note
    }
    state HighP {
         H0_Secure: Double(Q), Add(P)
         H1_Secure: Double(Q), Sub(P)
    }
```

Derivatives of Claim 6: Signed-Digit Recoding

The core concept of this claim is a method of recoding a binary vector into a signed-digit representation (+1, -1) and then performing additions or subtractions, which naturally creates a more regular operational flow.

1. Material & Component Substitution

Derivative 6.1: Ternary Logic Gate Implementation
- Enabling Description: The entire cryptographic processor is designed using ternary logic gates, which natively handle three states (+1, 0, -1). The secret key is stored directly in its signed-digit (non-adjacent form) representation in ternary memory cells. The processing loop iterates through the ternary digits (trits). For a '+1' trit, an addition is performed. For a '-1' trit, a subtraction is performed. For a '0' trit, only the doubling/squaring is performed. The instruction set is designed so that the "double-and-add/subtract" sequence is a single, constant-time macro-operation, invoked regardless of the trit value, with the ALU simply ignoring the add/subtract portion if the trit is '0'.
- ```
graph TD
    A[Start] --> B{Load Scalar k in Ternary NAF};
    B --> C{For each trit k_i};
    C --> D[Q = Double(Q)];
    C -- k_i == +1 --> E[Q = Q + P];
    C -- k_i == -1 --> F[Q = Q - P];
    C -- k_i == 0 --> G[No Op];
    E --> H{Next trit};
    F --> H;
    G --> H;
    H --> C;
    H -- Done --> I[Result Q];
```

2. Operational Parameter Expansion

Derivative 6.2: High-Frequency Radio Signal Modulation
- Enabling Description: The signed-digit representation is used to directly modulate a high-frequency carrier signal for secure, low-probability-of-intercept communication. A '+1' digit corresponds to a specific phase shift (e.g., +90 degrees), a '-1' to the inverse shift (-90 degrees), and a '0' to no phase shift. The cryptographic operation itself is the generation of this secure modulation scheme. An adversary monitoring the radio spectrum would only see a uniform series of phase transitions, without being able to distinguish the underlying secret key bits, as the symbol rate remains constant.
- ```
sequenceDiagram
    participant KeySource;
    participant Modulator;
    participant Transmitter;

    KeySource->>Modulator: Next Signed Digit d_i;
    alt d_i is +1
        Modulator->>Transmitter: Apply +90 deg Phase Shift;
    else d_i is -1
        Modulator->>Transmitter: Apply -90 deg Phase Shift;
    else d_i is 0
        Modulator->>Transmitter: Maintain Phase;
    end
```

3. Cross-Domain Application

Derivative 6.3: Automotive - Secure Vehicle-to-Vehicle (V2V) Communication
- Enabling Description: In a V2V network, vehicles broadcast signed messages about their position, speed, and intent (e.g., braking, turning). To ensure authenticity and prevent malicious actors from causing accidents by spoofing messages, these messages must be verified quickly. The signed-digit recoding method is implemented in the vehicle's Telematics Control Unit (TCU) on a dedicated hardware security module (HSM). This provides a fast, regular, and timing-attack-resistant way to verify the signatures of incoming messages from other vehicles, which is critical in a real-time, safety-critical environment.
- ```
flowchart LR
    A[Incoming V2V Message] --> B(HSM in TCU);
    B --> C{Extract Signature};
    C --> D[Recode Scalar to Signed-Digit];
    D --> E[Perform Constant-Time Verification];
    E --> F{Signature OK?};
    F -- Yes --> G[Trust Message Data];
    F -- No --> H[Discard Message];
```

4. Integration with Emerging Tech

Derivative 6.4: Blockchain - Verifiable Delay Function (VDF)
- Enabling Description: The signed-digit recoding algorithm is used as the core of a Verifiable Delay Function (VDF), a cryptographic primitive that requires a specific amount of sequential computation to evaluate. The VDF input is used to generate a very large scalar, which is then recoded. The VDF computation involves performing the scalar multiplication on a group element of unknown order. The constant-time nature of the signed-digit evaluation ensures that the time taken is purely a function of the scalar's length, not its bit values, making the delay predictable and fair. This is used in blockchain consensus mechanisms to ensure a fair and unpredictable leader election process.
- ```
graph TD
    subgraph VDF Setup
        A[Blockchain Block Hash] --> B{Generate Large Scalar k};
    end
    subgraph VDF Computation
        C[Recode k to NAF Signed-Digit] --> D(Start Timer);
        D --> E{For each digit in k};
        E --> F[Double & Add/Subtract];
        F --> E;
        E -- Last Digit --> G(Stop Timer);
    end
    subgraph VDF Verification
        G --> H{Publish Result & Proof};
        H --> I[Fast Verification by Network];
    end
```

5. The "Inverse" or Failure Mode

Derivative 6.5: Probabilistic Recoding for Error Injection Resistance
- Enabling Description: This is a version designed to resist fault injection attacks. The recoding from binary to signed-digit is made probabilistic. For example, the binary string '11' can be recoded as '+10-1' or as '+1+1'. The algorithm randomly chooses between valid signed-digit representations for the same scalar each time an operation is performed. An attacker attempting to inject a fault to flip a bit would find the effect unpredictable, as the underlying representation changes with each execution. While this might introduce minor timing variations, it is paired with blinding techniques to obscure them, with the primary goal of thwarting fault attacks rather than pure timing attacks.
- ```
classDiagram
    class Scalar {
        +binary_string
        +toProbabilisticNAF() List~SignedDigit~
    }
    class SignedDigit {
        value: {-1, 0, 1}
    }
    class CryptoProcessor {
        +execute(scalar)
    }
    Scalar "1" -- "1" CryptoProcessor : uses
    Scalar ..> SignedDigit : creates
    note for Scalar "For '11', can output [+1, 0, -1] or [+1, +1]"
```

Combination Prior Art Scenarios

Combination with FIDO2/WebAuthn Standard:
- Description: The state-based constant-time algorithm of Claim 1 is implemented within the firmware of a FIDO2-compliant hardware security key (e.g., a YubiKey). When a user authenticates to a website, the key must sign a challenge using its private key (typically an ECDSA key). The signing operation, which involves scalar multiplication, is performed using the method of Claim 1 to prevent side-channel attacks that could extract the private key from the authenticator. This combines the open WebAuthn standard with the patented method for a hardened hardware implementation.
Combination with OpenSSL Library:
- Description: The signed-digit recoding method of Claim 6 is integrated into the core libcrypto library of OpenSSL as a selectable engine for ECC operations. A developer could configure their OpenSSL-based application (e.g., a web server, a VPN) to use this engine for all EC_POINT_mul() calls. This would provide a timing-resistant implementation that benefits the wide ecosystem of applications relying on OpenSSL for their TLS and other cryptographic functions. The implementation would be contributed to the open-source project, placing the combination firmly in the public domain.
Combination with RISC-V Cryptography Extension:
- Description: A custom instruction is added to the open RISC-V instruction set architecture (ISA) as part of its cryptography extension ("Zk"). This instruction, ecc.mul.ct, performs an entire constant-time scalar multiplication based on the state-based method of Claim 1. The inputs would be pointers to the scalar, base point, and result, and the instruction would execute in a fixed number of cycles determined only by the bit length of the scalar. This hardwires the timing-attack resistance into the processor architecture itself, making it available for any software running on a compliant RISC-V core.