Nxp B.v.

Bruce Murray

Joppe Willem Bos

Peter Thueringer

Hans De Jong

Paul Hubmer

Heike Neumann

Susanne Stern

Bjorn Fay

Jan Hoogerbrugge

Wilhelmus Petrus Adrianus Johannus Michiels

Pim Theo Tuyls

Ventzislav Nikov

Marcel Medwed

Thomas Ernst Wille

Andreas Lessiak

Mathias Wagner

Dimitri Warnez

Ernst Haselsteiner

Mario Lamberger

Pieter Janssens

Christiaan Kuipers

Thierry Gouraud

Frank Siedel

Helmut Alexander Goettl

Sven Heine

Rafael Jan Josef Meeusen

Martin Schaffer

Marcel Rene Van Loon

A memory system, comprising: i) a first electronic device comprising a processor, ii) a second electronic device being external to the first electronic device and comprising a memory, wherein the memory stores a memory image over at least a part of a data set stored on the memory, and iii) a hash value related to the memory image. The first electronic device and the second electronic device are coupled such that the processor has at least partial control over the second electronic device. The processor is configured to, when updating the data set stored on the memory of the second electronic device, also update the hash value related to the memory image using an incremental hashing operation so that only those parts of the memory image are processed that have changed.

Memory system with an incremental hashing operation and method

A device for providing a random number generator is provided. The device may include a true random number generator, at least one deterministic random number generator, and an exclusive OR logic function. The TRNG has an output and the at least one DRNG has an output. The exclusive OR logic function has a first input coupled to the output of the TRNG and a second input coupled to the output of the at least one DRNG, and an output for providing a random number. The TRNG and the at least one DRNG may include separate and independent entropy sources. A method for generating a random number is also provided.

Random number generator using multiple entropy sources and a method for generating random numbers

A method is provided for generating an elliptic curve cryptography key pair that uses two topologically identical pseudo-random number generators operating in parallel and in step with each other. One generator operates in the scalar number domain and the other generator operates in the elliptic curve point domain. Parallel sequences of pseudo-random elliptic curve points aG and corresponding scalars a are generated in this manner. A scalar a becomes a private key and an elliptic curve point aG is a public key of a key pair. Each generator is advanced by one iteration successively, and the isomorphic relationship ensures that the point domain generator always contains values which are multiples of the system base point according to values contained in the corresponding position in the number domain generator. In one embodiment, the pseudo-random number generators are each characterized as being lagged Fibonacci generators.

Method of generating an elliptic curve cryptographic key pair

A method for implementing a pseudo-random function (PRF) using a white-box implementation of a cryptographic function in N rounds, including: receiving an input to the PRF; receiving a cryptographic key in a first round; encrypting, using the white-box implementation of the cryptographic function and the cryptographic key, an input message that is one of M possible input messages based upon a portion of the input to produce a first output; for each succeeding round: encrypting, using the white-box implementation of the cryptographic function and an icryptographic key, further input messages that are one of M possible input messages based upon a further portion of the input to produce an ioutput, wherein the icryptographic key is the output from the preceding round, wherein the white-box implementation of the cryptographic function only produces a correct output for the M possible input messages and produces an incorrect output for input messages that are not one of the M possible input messages.

Using white-box in a leakage-resilient primitive

A method of calculating the x-coordinate(x) of a point mapping in an elliptic curve Diffie-Hellman key exchange protocol (EC-DHKF), wherein the point mapping is defined as sG+H, where sG is a point (x,y) on an elliptic curve and H is a point (x,y) on the elliptic curve, including: computing V=ybased upon the elliptic curve and x; computing W=ybased upon the elliptic curve and x; computing U=sqrt(W&#xb7;V)mod p, where p is a large prime number; choosing U'=U or U&#x2032;=p&#x2212;U such that U&#x2032; based upon a characteristic agreed upon by the parties to the EC-DHKF; computing xbased upon V, W, U&#x2032;, x, x, and p.

X-only generic mapping function for PACE protocol

In high security devices, like smart cards, the on-board software may be embedded in ROM (read only memory). But, based on flexibility arguments, non-volatile flash memory based software storage can be more preferred. This invention describes a method to recover from a situation of data loss on flash devices by combining the on-device available secure boot-loading with embedded physical unclonable functions (PUF), where the PUF provides the cryptographic key for starting the data recovery procedure.

PUF based boot-loading for data recovery on secure flash devices

A method is provided for performing elliptic curve cryptography that reduces the number of required computations to produce, for example, a key pair. The number of computations is reduced by changing how a random nonce used in the computations is selected. In an embodiment, a look-up table is generated having pre-computed scalar values and elliptic curve points. Every time a new pseudo-random value is created for use in the ECDSA, a combination of the look-up table values is used to create multiple intermediate values. One of the multiple intermediate values is randomly chosen as a replacement value for one of the existing table entries. Each time the look-up table is used, multiple entries in the look-up table are updated to new look-up table values as described. In this manner, new randomness is provided in every step to generate the next pseudo-random nonce as a combination of multiple internally stored temporary look-up table values. Alternately, another mathematical group may be used.

Method of generating cryptographic key pairs

A data processing system having a PUF and method for providing multiple enrollments, or instantiations, of the PUF are provided. A PUF segment includes a plurality of SRAM cells on an integrated circuit. A PUF response from the PUF segment is used to create a first activation code and a first PUF key. A second PUF key may be created from the PUF response. Initially, during a second enrollment, the PUF response is combined with the first activation code to reproduce a codeword. The first secret string is reconstructed by encoding the codeword. The codeword is combined with the first activation code to reproduce the PUF response. Inverse anti-aging is applied to the PUF response. Then a second secret string is generated using a random number generator (RNG). The second secret string is encoded to produce a new codeword. The new codeword is combined with the recovered PUF response to create a second activation code. The second activation coded is hashed with the second secret string to provide a second PUF key.

Method for performing multiple enrollments of a physically uncloneable function

Reader () for determining the validity of a connection to a transponder (), designed to measure a response time of a transponder () and to authenticate the transponder () in two separate steps. Transponder () for determining the validity of a connection to a reader (), wherein the transponder () is designed to provide information for response time measurement to said reader () and to provide information for authentication to said reader () in two separate steps, wherein at least a part of data used for the authentication is included in a communication message transmitted between the reader () and the transponder () during the measuring of the response time.

Decoupling of measuring the response time of a transponder and its authentication

There is disclosed a method of providing a software update to a secure element comprised in a host device, comprising converting the software update into a sequence of ciphertext blocks using a chained encryption scheme, and transmitting said sequence of ciphertext blocks to the host device. Furthermore, there is disclosed a method of installing a software update on a secure element comprised in a host device, comprising receiving, by the host device, a sequence of ciphertext blocks generated by a method of providing a software update of the kind set forth, converting said sequence of ciphertext blocks into the software update, and installing the software update on the secure element. Furthermore, corresponding computer program products and a corresponding host device are disclosed.

Updating software on a secure element

Device for generating a message authentication code for authenticating a message, wherein the message is divided in blocks (M) with a specified block length, the device comprising a generating unit for generating the message authentication code based on a message by using a block cipher algorithm, and an encrypting unit for performing an exclusive disjunction on the last block with a first key (K, K) and for performing an exclusive disjunction on the first and/or the last block additionally with a second key (K, K) for generating the message authentication code.

Device for generating a message authentication code for authenticating a message

It is described a method for operating a transponder (), the method comprising: receiving, by the transponder, in particular wirelessly, transmitted reader data () representing x and sqrt[b]/x, wherein x is an element of a binary Galois field and b is a scalar; processing, by the transponder, the reader data () to determine, whether x is a first coordinate of a point on an elliptic curve defined by the elliptic curve equation y+xy=x+ax+b, wherein the elliptic curve is defined over the Galois field such that x and y are elements of the Galois field, wherein y is a second coordinate of the point on the elliptic curve. Further a transponder, a method for operating a reader and a reader are described.

Transponder, reader and methods for operating the same

Transponder () having stored a fixed identification number, which expands said identification number with a random number, encrypts said expanded number with a key, and sends it to a reader () on its request. Reader (), which on request receives an encrypted number from a transponder (), decrypts a received encrypted number with a key, which was also used by the transponder (), and extracts a fixed identification number associated with the transponder ().

System of providing a fixed identification of a transponder while keeping privacy and avoiding tracking

Transponder (), comprising a storage unit () having stored a number of different applications, a processing unit () which, on request of a reader (), is adapted to generate a response interpretable using an encryption scheme known by both the transponder () and the reader () so that the reader () is capable of determining whether an application is supported by the transponder () by analyzing the response using the encryption scheme, and a transmission unit () adapted to send the response to said reader ().

Reader and transponder for obscuring the applications supported by a reader and/or a transponder and method thereof

The present invention provides for an electronic device having cryptographic computation means arranged to generate cryptographic data within the device for enhancing security of communications therewith, the device including an onboard power supplying means arranged to provide for the driving of the said cryptographic computational means, and so as to provide a device by way of a manufacturing phase and a post manufacturing phase arranged for distribution and/or marketing of the device, and wherein the step of generating the cryptographic data occurs during the post manufacturing phase.

Growing community of inventors

Hamburg, Germany

Bruce Murray