Qualcomm Incorporated

Billy Brumley

David Merrill Jacobson

Can Acar

Vinoth Kumar Deivasigamani

Alexander W Dent

Satish Anand

Erich Plondke

Roberto Avanzi

Robert Paul Turner

Disclosed is a method for protecting message data. In the method, the message data is padded with padding bits generated based on a deterministic function performed on the message data. The padded message data is compressed to generate compressed data. A length of the compressed data is dependent on the padding bits. The compressed data is encrypted to generate encrypted message data.

Apparatus and method for protecting message data

Various features pertain to digital signatures for use in signing messages. In one aspect, a digital signature is generated based on a nonce derived using a per-message salt value, particularly a salt selected to provide a semi-deterministic nonce (i.e. a nonce that is neither fully deterministic nor completely random.) In one example, the nonce is generated by concatenating the salt value with a long-term private key and then applying the result to a key derivation function along with a hash of the message to be signed. The salt value may be, e.g., a counter, a context-specific message or may be randomly generated within a restricted range of values (relative to a full range of values associated with the particular digital signature generation protocol used to generate a digital signature from the nonce.)

Semi-deterministic digital signature generation

One feature pertains to an efficient procedure for storing data units in a storage device that allows for authentication of data units to prevent rollback attacks and other attacks such as cut-and-paste attacks. In one aspect, a message authentication code (MAC) is generated or otherwise obtained based on a primary key, a data unit to be stored, a corresponding index for the data unit (such as a page index) and a secondary key for the corresponding data unit, which is generated for each new write operation. The MAC and the corresponding data unit are stored in a bulk storage device such as a relatively insecure off-chip storage. Secondary keys are stored in a separate storage device such as a more secure on-chip storage. In some examples, new secondary keys are generated upon each data write based on a non-zero random or pseudorandom value.

Data integrity protection from rollback attacks for use with systems employing message authentication code tags

One feature pertains to encrypting data to improve data confidentiality. In one aspect, a modified form of XTS encryption is provided for use with reduced-round block ciphers. A data unit index of data to be applied to the reduced-round cipher is encrypted under a secret key to generate or otherwise obtain a modified secret key for applying to the reduced-round cipher. That is, data to be encrypted by the reduced-round cipher is not encrypted under a static key but is instead encrypted under a dynamic key that varies according to the index of the data. If an attacker were to derive the value of the key applied to the reduced-round cipher by analyzing data encrypted by the cipher, the attacker would only obtain the dynamic key corresponding to one particular data unit index, rather than a global static key applied to an entire address space. Decryption procedures are also described.

Dynamic encryption keys for use with XTS encryption systems employing reduced-round ciphers

One feature pertains to elliptic curve (EC) point multiplication for use in generating digital signatures. In one aspect, a scalar multiplier (k) of a base point (P) of order (n) is selected on an elliptic curve for use with EC point multiplication. An integer value (r) is then randomly generated from within a range of values constrained so that, regardless of the particular value of (r) obtained within the range, EC point multiplication procedures performed using the scalar multiplier (k) summed with a product of the integer multiplier (r) and the order (n) consume device resources independent of the value of the scalar multiplier (k) to thereby reduce or eliminate side-channel leakage. This may be achieved by determining the range of values for r so that the bit position of the most significant bit of k+(r*n) will be even and fixed for a particular elliptic curve.

Elliptic curve point multiplication procedure resistant to side-channel information leakage

Techniques for protecting contents of a stack associated with a processor are provided. The techniques include a method including receiving a store instruction from a software program being executed by the processor, the store instruction including control information associated with a subroutine, altering the control information to generate secured control information responsive to receiving the store instruction from the software program, storing the secured control information on the stack, receiving a load instruction from the software program; and responsive to receiving the load instruction from the software program, loading the secured control information from the stack, altering the secured control information to recover the control information, and returning the control information to the software program.

Hardware-based stack control information protection

One feature pertains to a mechanism to secure a data structure by using a computationally efficient algorithm. A plurality of keys and/or masks may be pre-generated upon boot-up or initiation of a session. An authentication code may be computed for each data structure (e.g., memory block or header block) by selecting a subset of the plurality of pre-generated keys and/or a mask from the plurality of pre-generated masks. The authentication code may be stored within the data structure for future verification of the integrity of the data structure. The keys and/or masks used for all authentication codes (e.g., for other data structures) may be selected from the same plurality of keys and/or masks during the same cycle or session.

Method for protecting the integrity of a fixed-length data structure

A method for authenticating a message by a wireless device is described. The wireless device obtains the input message. The wireless device generates a keystream. The wireless device computes a message authentication code using the keystream and a universal hash function. The universal hash function is computed using carryless multiplication.

Message authentication using a universal hash function computed with carryless multiplication

A wireless communication device is described. The wireless communication device includes a linear feedback shift register. The linear feedback shift register is initialized. The linear feedback shift register is a word based odd characteristic linear feedback shift register. The linear feedback shift register includes multiple 64-bit registers. A feedback function output is generated using the 64-bit registers. The feedback function output is placed into a highest register of the linear feedback shift register.

Growing community of inventors

San Diego, CA, United States of America

Billy Brumley