Gemalto Sa

Thales Dis France Sa

Thales Dis France Sas

Cryptoexperts Sas

France Telecom

Université De Caen Basse Normandie

Cryptoexperts

Aline Gouget

Marc Lamberton

Pascal Paillier

Mariya Georgieva

Jan Vacek

Cécile Delerablee

HongQian Karen Lu

Hervé Sibert

Jean-Yves Fine

Louis Goubin

Olivier Joffray

Karine Villegas

Mourad Faher

Sylvain Leveque

Benoît Gonzalvo

Michael Webster

Amira Barki

Dan Tam Pham

Georges Debois

Eric Bretagne

Stéphane Grellier

Michael Adjedj

Lorenzo Gaston Guirao

Michael Gardiner

Sylvain Morandi

Arnaud Schwartz

Hongqian Karen Lu

Hongquian Karen Lu

Guennolé Tripotin

The present disclosure relates to a method for secure, traceable and privacy-preserving with anonymity revocation digital currency transfer to at least a first user from a second user among a plurality of banked and unbanked users by using a distributed ledger comprising a plurality of ledger nodes, wherein said users perform Digital Currency transfers by adding transactions on this ledger using user devices configured to be connected to said nodes, to a registration authority and to a revocation authority, said authorities owning each one a public/private key pair, comprising:

Method for secure, traceable and privacy-preserving digital currency transfer with anonymity revocation on a distributed ledger

Provided is a method for testing if a candidate data element, belongs to a list of reference data elements, performed by a client device () and comprising the steps of generating an encrypted candidate data element (y') by encrypting said candidate data element (x′) with a leveled fully homomorphic encryption scheme, transmitting said encrypted candidate data element (y′) to a server device (), storing said reference data elements (x) receiving, from said server device, a delta value depending on a product of differences, decrypting said delta value with said leveled fully homomorphic encryption scheme, based on said decrypted delta value, determining whether said candidate data element (x′) belongs to said list of reference data elements (x). Other embodiments disclosed.

Method for testing if a data element belongs to a list of reference data elements

Generation of stateful hash based signatures of messages to be signed in a key management system including a plurality of tamper-proof computing devices by a manager device of generating a master merkle tree, triggering generating a predetermined number of slave merkle trees, for each message to be signed selecting a tamper-proof computing device for signing, assigning one yet unassigned generated slave merkle tree to said selected tamper-proof computing device, generating and sending to said selected tamper-proof computing device a command comprising said message to be signed, data enabling to obtain an OTS private key of the assigned slave merkle tree to be used to generate an OTS signature of the message to be signed, and a state value associated to said assigned slave merkle tree and keeping track of the OTS private keys of said assigned slave merkle tree already used for generating a signature.

Method for generating stateful hash based signatures of messages to be signed

Decryption of an RSA encrypted message encrypted with a public RSA key by receiving encrypted key share components computed by generating a private RSA key d and a RSA modulus integer N, where N and d are integers; splitting the private key into key shares, encrypting with a fully homomorphic encryption (FHE) algorithm each key share component by using a Fully Homomorphic Encryption secret key ps associated with a set Ss to generate the encrypted key share components of said secure RSA key, computing an intermediate value YS for each set SS from said encrypted key share components, such that said computed intermediate value is a part of the RSA decrypted message, under FHE-encrypted form, and decrypting the encrypted message by combining said computed intermediate values for all sets.

Method of RSA signature or decryption protected using a homomorphic encryption

Provided is a method for generating a digital signature of an input message (M) based on a secret key (d) of a client device having access to a first set and a second set of precomputed data stored in a storage unit. The first set of precomputed data comprises private element parts (k) protected with an homomorphic encryption. The second set of precomputed data comprises public element parts (Q) paired with the private element parts of the first set. Each private element part is a discrete logarithm of the public element part paired therewith. The private element (k), can be homomorphically encrypted, by combining homomorphically encrypted private element parts selected in the first set (k). The selection of the public and private element parts depends on the input message. Other embodiments are disclosed.

Method for generating a digital signature of an input message

Protection of a data file to be used by a white-box cryptography software application installed in memory of a device to prevent the malevolent use of a digital copy of the data file by a white-box cryptography (WBC) software application installed in memory of another device. The mechanism includes extracting an unique identifier for the device from the environment of the device and modifying data in the data file according to the unique identifier, the available white-box cryptography software application includes a software security layer to retrieve the unique identifier from the environment of the device in which the software application is installed and to use this unique identifier in combination with the stored data file when executing, the result of the execution being correct only in case where the correct unique identifier has been extracted by the executed WBC software application.

Anti cloning for white box protected data

Secure computation of a random number sequence in a cryptographic device. The computation is secured by receiving a homomorphic ciphertext seed vector, selecting an initial internal state from the seed vector, the initial internal state composed of a subset of elements of the seed vector, updating an internal state from a previous internal state using multivariate functions accepting elements of the previous internal state as inputs to produce a homomorphic ciphertext from homomorphic ciphertext input values, generating an intermediate result vector of homomorphic ciphertexts from the homomorphic ciphertext internal state multivariate functions accepting the elements of the internal state as inputs to produce a homomorphic ciphertext from homomorphic ciphertext input values, and decrypting the intermediate result vector elements into plaintext vector elements, thereby producing a plaintext deterministic random sequence vector corresponding to plaintext seed elements used to produce the seed vector. Other systems and methods are disclosed.

Cryptography device having secure provision of random number sequences

The present invention relates to a method for reaching a consensus for appending, at a current round (j), a new block of data to a permissioned ledger distributed through a network comprising network connected devices authorized by the ledger, called nodes,

Consensus protocol for permissioned ledgers

The present invention relates to a method for a secure execution of a whitebox cryptographic algorithm applied to a message (m) and protected by countermeasures based on pseudo-random values, comprising the steps of:

Method for protecting a source of entropy used in countermeasures securing a white-box cryptographic algorithm

The present invention relates to a method of generating a secure RSA key by a server comprising the steps of: &#x2022;generating (S) a private RSA key d and a RSA modulus integer N; &#x2022;splitting (S) the secret key integer d in j key shares dof length n, with j in [1, J], J being an integer, and such that d=d+d+ . . . +dmod phi(N), with each key share dbeing equal to (d. . . d. . . d) with each key share component djin {0 . . . 2{circumflex over (&#x2003;)}b&#x2212;1} and i in [0, n/b&#x2212;1], b being an integer inferior to n and phi the Euler's totient function; &#x2022;encrypting (S) with a fully homomorphic encryption (FHE) algorithm each key share component dof the private RSA key d by using a Fully Homomorphic Encryption secret key pof a set Scomprising the index couple (i,j), to generate an encrypted key share component edof said secure RSA key, said set Sbeing a set of integer couples, among a predetermined integer number u of disjoint sets {S, SS, S, . . . S} generated such that: U{S}={(i,j) such that i in [0, n/b&#x2212;1], j in [1, J]} and each said set among {S, . . . S} being associated with a Fully Homomorphic Encryption (FHE) secret key.

Secure cryptography operations on a white-box cryptography device. Receiving a first message. Receiving a cryptographic key encrypted using a homomorphic encryption scheme. Performing a cryptographic operation, e.g., decryption or digital signature, using the encrypted cryptographic key. Performing a homorphically encrypted tracer calculation that traces the performance of the cryptography operations on the white-box cryptography device thereby allowing verification that all steps of the cryptography operation has been performed without external manipulation. Performing a key-exchange operation. Decrypting the key-exchange output using an alternate cryptographic key stored on the cryptographic device.

Cryptography device having improved security against side-channel attacks

The present invention relates to a method to counter DCA attacks of order 2 and higher order applied on an encoded table-based (TCabi,j) implementation of block-cipher of a cryptographic algorithm to be applied to a message (m), said method comprising the steps of: &#x2014;translating a cryptographic algorithm block-cipher to be applied on a message (m) into a series of look-up tables (Tabi,j),&#x2014;applying secret invertible encodings to get a series of look-up tables (TCi,j),&#x2014;computing message-dependent masking values, comprising the computation of at least two shares of masking value (mmask1, mmask2) for the input of the table network based on at least two different message derivation functions (F1, F2),&#x2014;re-randomizing the tables (TCi,j) using the computed message-dependent masking values (mmask1, mmask2),&#x2014;computing rounds to be applied on the message (m) based on the randomized network of tables (TCi,j).

Method to counter DCA attacks of order 2 and higher on table-based implementations

A method for operating an attribute assertion device having a processor and memory to create an unlinkable digital signature-equivalent of an assertion message that is verifiable&#x2014;by a service provider receiving the unlinkable digital signature-equivalent&#x2014;as being generated from a digital signature of a known attribute provider having a public key PK. Operating the processor of the attribute assertion device to transform a digital signature of the attribute message into an unlinkable digital signature-equivalent using a one-way transformation of the signature, with the transformation process using a random value generated by the attribute assertion device and a challenge provided by the service provider.

Secure electronic device with mechanism to provide unlinkable attribute assertion verifiable by a service provider

Secure generation of an RSA signature of a message to be signed with a private exponent component d of an RSA key (p, q, N, d, e), by obtaining a hashed message, said hashed message being computed by hashing said message with a public hash function H:{0,1}*&#x2192;Z*, generating a first part of the RSA signature from said hashed message and said first private exponent component share, generating a second part of the RSA signature from said first part of the RSA signature and said second private exponent component share, determining the RSA signature from said second part of the RSA signature, and wherein the step of generation of a part of the RSA signature from the smaller private exponent component share among the first and second private exponent component shares is performed using a whitebox protection method and the step of generation of a part of the RSA signature from the bigger private exponent component share among the first and second private exponent component shares is performed using lower security requirements.

Method of RSA signature of decryption protected using assymetric multiplicative splitting

The present invention relates to a security management system for performing a secure transmission of data from a token to a service provider server by means of an identity provider server, wherein said security management system comprises: &#x2014;said identity provider server which is adapted to: &#x2014;open with said token a secure messaging channel by means of a General Authentication Procedure using at least one certificate; &#x2014;receive via said secure messaging channel from said token enciphered data; &#x2014;transmit to said service provider server said enciphered data; &#x2014;said service provider server which is adapted to: &#x2014;receive from said identity provider server enciphered data of said token; &#x2014;decipher said enciphered data to extract said data; &#x2014;said token which is adapted to: &#x2014;encipher data; and&#x2014;transmit via said secure messaging channel to said identity provider server said enciphered data.

Security management system for performing a secure transmission of data from a token to a service provider server by means of an identity provider server

Growing community of inventors

Paris, France

Aline Gouget