Koninklijke Philips Corporation N.v.

Philips Lighting Holding B.v.

Taiwan Semiconductor Manufacturing Comp. Ltd.

Signify Holding B.v.

Koninklijkle Philips N.v.

Koninklijke Philips Electronics N.v.

Ludovicus Marinus Gerardus Maria Tolhuizen

Ronald Rietman

Oscar Garcia Morchon

Bozena Erdmann

Armand Michel Marie Lelkens

Sauvik Bhattacharya

Paulus Mathias Hubertus Mechtildis Antonius Gorissen

Sebastiaan Jacobus Antonius De Hoogh

Constant Paul Marie Jozef Baggen

Serverius Petrus Paulus Pronk

Sandeep Shankaran Kumar

Arthur Robert Van Es

Hendrik Dirk Lodewijk Hollmann

Alphons Antonius Maria Lambertus Bruekers

Koen Johanna Guillaume Holtman

Sri Andari Husen

Adrianus Johannes Josephus Van Der Horst

Xiaobo Zhang

Ashish Vijay Pandharipande

Wilhelmus Petrus Adrianus Johannus Michiels

Ni Ma

Andries Pieter Hekstra

Matthew Peter John Baker

Maarten Peter Bodlaender

Arie Geert Cornelis Koppelaar

Qi Zhou

Boris Skoric

Martinus Wilhelmus Blum

Marten Erik Van Dijk

Emmanuel David Lucas Michael Frimout

Ying Wang

Willem Charles Mallon

Oliver Schreyer

Onno Eerenberg

Hendrik Jan Jozef Hubertus Schepers

Bas Willibrord De Wit

Mina Deng

Oscar Garcia-Morchon

Wei Yuan

Meng Zhao

Domingo Gomez

Jose Luis Torre Arce

Stephan Schlumbohm

Sahil Sharma

Esko Olavi Dijk

Wicher Ido-Jan Gispen

Santos Merino Del Pozo

Jaime Gutierrez

Ewa Barbara Hekstra-Nowacka

Wicher I Gispen

Lelkens Michel Marie Lelkens

Bozema Erdmann

Theodorus Jacobs Johannes Denteneer

Emmanuel David Lucas Frimout

Zhizhong Zhang

Peiliang Dong

Oscar Oscar Garcia

Paulus Mathias Hubertus Mechtildis A Gorissen

Alan Pestrin

Willem Mallon

Some embodiments are directed to a communication system comprising a one or more clients, a server and a middlebox. The middlebox may access to the multiple short-term server private keys of the server. The middlebox may recover a shared key that is negotiated between server and client by decapsulating encapsulation data using a stored client public key and a server private key from the key storage.

Middlebox visibility for post quantum KEM

Some embodiments are directed to a system with a first cryptographic device () and second cryptographic device (). The devices may compute a final seed from a preshared secret known to the devices, and on a pre-seed that exchanged between them. The final seed may be used to derive a common object (a).

Authenticated lattice-based key agreement or key encapsulation

Some embodiments relate to a first electronic network node is provided () configured for a cryptographic operation. The first network node is configured to receive as input a difficulty parameter (d), and a structure parameter (n), and to obtain a shared matrix (A), the shared matrix being shared a second network node through a communication interface, entries in the shared matrix A being selected modulo a first modulus (q), the shared matrix (A) being a square matrix (k×k) of dimension (k) equal to the difficulty parameter (d) divided by the structure parameter (n), the entries in the shared matrix (A) being polynomials modulo a reduction polynomial (ƒ) of degree equal to the structure parameter (n), said cryptographic operation using the shared matrix.

Configurable cryptographic device

Some embodiments are directed to a second cryptographic device () and a first cryptographic device (). The first and second cryptographic devices may be configured to transfer a key seed. The key seed may be protected using a public key from one party and a private key from the other party. For example, a public key may be obtained from a private key through a noisy multiplication. At least one of the first and second cryptographic device may validate an obtained public key, e.g., to avoid leakage of the key seed or of a private key.

Public/private key system with increased security

Some embodiments are directed to a public-key encryption device () and a private-key decryption device (). The public-key encryption device is configured to compute a second public-key matrix (u), the second public-key matrix (u) having fewer matrix elements than the first public-key matrix (b) of the private-key decryption device. This reduces computation and bandwidth requirements at the side of the public-key encryption device.

Public/private key system with decreased public key size

Some embodiments are directed to an electronic cryptographic device arranged to perform a cryptographic operation on input data obtaining output data. The cryptographic device stores an internal state as sets of shares. Fourier coefficients corresponding to the sets of shares satisfy a predetermined relationship among them. The cryptographic operation is performed by repeatedly updating the internal state.

Cryptographic device and method

An electronic calculating device () arranged to convert an input number (y) represented ((y, y, . . . , y)) m a residue number system (RNS) to an output number represented in a radix representation ((e, e, . . . e)), the calculating device comprising an input interface () arranged to receive the input number (y) represented in the residue number system, and a processor circuit () configured to iteratively update an intermediate number (&#x177;) represented in the residue number system, wherein iterations produce the digits (e, e, . . . e) in the radix representation with respect to the bases (b, b, . . . , b), at least one iteration comprises computing the intermediate number modulo a base (b) of the radix representation to obtain a digit (e=(&#x177;)) of the radix representation, updating the intermediate number (&#x177;&#x2190;(&#x177;&#x2212;e+F)/b) by subtracting the digit from the intermediate number, adding an obfuscating number (F; F), and dividing by the base (b).

Secure transformation from a residue number system to a radix representation

An electronic key pre-distribution device for configuring multiple network nodes with local key information is provided. The key pre-distribution device applies at least a first hash function and a second hash function to a digital identifier of a network node. The first and second hash functions map the digital identifier to a first public point and a second public point on a first elliptic curve and second elliptic curve. A first and second secret isogeny are applied to the first and second public elliptic curve points, to obtain a first private elliptic curve point and second private elliptic curve point that are part of private key material for the network node.

Elliptic curve isogeny based key agreement protocol

Some embodiments relate to a first electronic network node is provided () configured for a cryptographic operation. The first network node is configured to receive as input a difficulty parameter (d), and a structure parameter (n), and to obtain a shared matrix (A), the shared matrix being shared a second network node through a communication interface, entries in the shared matrix (A) being selected modulo a first modulus (q), the shared matrix (A) being a square matrix (k&#xd7;k) of dimension (k) equal to the difficulty parameter (d) divided by the structure parameter (n), the entries in the shared matrix (A) being polynomials modulo a reduction polynomial (&#x192;) of degree equal to the structure parameter (n), said cryptographic operation using the shared matrix.

Configurable device for lattice-based cryptography

Some embodiments are directed to a cryptographic device (). A reliable bit function may be applied to a raw shared key (k*) to obtain reliable indices, indicating coefficients of a raw shared key, and reliable bits derived from the indicated coefficients. Reconciliation data (h) may be generated for the indicated coefficients of the raw shared key. A code word may be encapsulated using the reliable bits by applying an encapsulation function, obtaining encapsulated data (c) which may be transferred.

Key encapsulation protocols

A first device and a second device are disclosed for reaching agreement on a secret value. Herein, the second device comprises a receiver configured to receive information indicative of a reconciliation data h from the first device, a processor configured to compute a common secret s based on an integer value b, an equation, and system parameters. The processor is configured to compute b based on a key exchange protocol. The first device has a number a in approximate agreement with the number b. The first device comprises a processor configured to determine a common secret s based on an integer value a an equation, and system parameters, and determine a reconciliation data h. The first device further comprises a transmitter configured to transmit information indicative of the reconciliation data h to the second device.

Reaching agreement on a secret value

Some embodiments relate to an electronic network node () configured for a cryptographic operation. The network node obtains a shared matrix (A) by selecting integers, polynomials, and/or polynomial-coefficients from a shared pool, the shared pool being shared with the second network node, wherein the selecting is done according to one or more selection functions.

Cryptographic device with updatable shared matrix

A network node () is provided configured for a cryptographic protocol based on a shared matrix. The network node is arranged to construct the shared matrix (A) in accordance with the selection data and a shared sequence of values. Multiple entries of the shared matrix are assigned to multiple values of the sequence of data as assigned by the selection data. The shared matrix is applied in the cryptographic protocol.

Device and method sharing a matrix for use in a cryptographic protocol

Growing community of inventors

Waalre, Netherlands

Ludovicus Marinus Gerardus Maria Tolhuizen