Nxp B.v.

Björn Fay

Joppe Willem Bos

Tobias Schneider

Joost Roland Renes

Melissa Azouaoui

Christine Van Vredendaal

Soenke Ostertun

Miroslav Knezevic

Alexander Vogt

Vitaly Ocheretny

Marc Gourjon

Durgesh Pattamatta

Various embodiments relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a cryptographic operation including matrix multiplication for lattice-based cryptography in a processor, the instructions, including: applying a first function to the rows of a matrix of polynomials to generate first outputs, wherein the first function excludes the identity function; adding an additional row to the matrix of polynomials to produce a modified matrix, wherein each element in the additional row is generated by a second function applied to a column of outputs associated with each element in the additional row; multiplying the modified matrix with a vector of polynomials to produce an output vector of polynomials; applying a verification function to the output vector that produces an indication of whether a fault occurred in the multiplication of the modified matrix with the vector of polynomials; and carrying out a cryptographic operation using output vector when the verification function indicates that no fault occurred in the multiplication of the modified matrix with the vector of polynomials.

Fault detection in post-quantum cyptography

Various embodiments relate to a fault detection system and method for a digital signature algorithm, including: producing a digital signature of a message using a digital signature algorithm; storing parameters from a last round of the digital signature algorithm; executing the last round of the digital signature algorithm using the stored parameters to produce a check signature; comparing the digital signature to the check signature; and outputting the digital signature when the digital signature is the same as the check signature.

Fault countermeasures for digital signatures with aborts

A method for encoding data to be stored in a memory, including: encoding the data to be stored in memory with an error correcting code (ECC) as first encoded data, wherein the ECC is configured to have a minimum Hamming distance of at least 4t+1 in order to correct up to t bit errors and detect up to 3t bit errors where t≥1; determining a Hamming weight of the first encoded data; encoding the determined Hamming weight, wherein for all higher Hamming weights the encoding should have at least 2t+1 bit-positions that change from 1 to 0 per Hamming weight; concatenating the first encoded data and the encoded Hamming weight as concatenated data; and storing the concatenated data in the memory.

Enhanced tearing save encoding

Various embodiments relate to a method for storing and reading data from a memory. Data words stored in the memory may be grouped, and word specific parity information and shared parity information is generated, and the shared parity information is distributed among the group of words. During reading of a word, if more errors are detected than can be corrected with word parity data, the shared parity data is retrieved and used to make the error corrections.

Method to increase the usable word width of a memory providing an error correction scheme

Various embodiments relate to a memory controller configured to read data from a memory array, including: an error correction codes (ECC) encoder configured to encode data stored in the memory array; an ECC decoder configured to decode first data read from the memory array based upon a first read request and detect errors in the first data read from the memory array; and a fault controller configured to: command the memory controller to read other data from the memory array when the ECC detects an error; command the memory controller to re-read the first data from the memory array; when the ECC detects an error; compare the re-read first data to the read first data; and signal a fault attack when the re-read first data is different from the read first data.

Ring oscillator based true random number generator and a method for generating a random number

Embodiments of a physical unclonable function (PUF) device and a method for generating helper data for a PUF device with an array of cells are disclosed. In an embodiment, the PUF device comprises an array of cells, wherein each cell of the array generates an output signal, a reliable cell group detector coupled to the array of cells to find reliable groups of cells in the array of cells having sufficient reliable cells and output addresses of the reliable groups of cells, and a storage device coupled to the reliable cell group detector to store the addresses of the reliable groups of cells to be used as helper data for PUF response operations.

Reducing helper data size for physical unclonable function device

A method is provided for secure provisioning of a device. In the method, a plurality of integrated circuit (IC) devices is manufactured by a first entity for use in the device. The first entity provides signed provisioning software and stores in at least one provisioning IC device one or more keys used for provisioning the plurality of ICs. The provisioning device with the signed provisioning software is provided to a second entity. The second entity verifies the provisioning software using a stored key. The provisioning software encrypts provisioning assets provided by the second entity and provides the encrypted provisioning assets to the third entity. The signed provisioning software is provided to a third entity by the first entity. During manufacturing of the manufactured products by the third entity, the provisioning software verifies and decrypts the encrypted provisioning assets of the second entity to provision all the plurality of IC devices.

Method for securely provisioning a device incorporating an integrated circuit without using a secure environment

Various embodiments relate to a method for masked decoding of a polynomial a using an arithmetic sharing a to perform a cryptographic operation in a data processing system using a modulus q, the method for use in a processor of the data processing system, including: subtracting an offset &#x3b4; from each coefficient of the polynomial a; applying an arithmetic to Boolean (A2B) function on the arithmetic shares of each coefficient aof the polynomial a to produce Boolean shares &#xe2;that encode the same secret value a; and performing in parallel for all coefficients a shared binary search to determine which of coefficients aare greater than a threshold t to produce a Boolean sharing value {circumflex over (b)} of the bitstring b where each bit of b decodes a coefficient of the polynomial a.

Masked decoding of polynomials

Various embodiments relate to a method and system for encoding data to be stored in a memory, including: encoding the data to be stored in memory with an error detection code (EDC), that can detect up to 4 bit errors, as first encoded data; determining the Hamming weight of the first encoded data; inverting the determined Hamming weight; concatenating the first encoded data and three copies of the inverted Hamming weight as concatenated data; encoding the concatenated data with an error correcting code (ECC), that can correct 1 bit error, as second encoded data; and storing the second encoded data in the memory.

Growing community of inventors

Brande-Hörnerkirchen, Germany

Björn Fay