Nxp B.v.

Markus Schoenauer

Tobias Schneider

Melissa Azouaoui

Christine Van Vredendaal

Joost Roland Renes

Olivier Bronchain

A data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a fault detection in a digital signature algorithm in a processor, the instructions, including: computing vector z based on a secret nonce vector y, a first secret key vector s, and a challenge polynomial c, wherein vectors z, y, and sinclude l polynomials having n coefficients, wherein polynomial c has n coefficients, and wherein l and n are integers; computing a difference value between all of the coefficients of the polynomials in the vector z; computing a number of how many of the computed difference values are outside a specified value range; computing a digital signature for an input message; and rejecting the digital signature when the computed number is greater than a threshold value.

Fault detection of differential fault attack in lattice based cryptography

Various implementations relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a cryptographic operation including a masked decomposition of a polynomial a having narithmetic shares into a high part aand a low part afor lattice-based cryptography in a processor, the instructions, including: performing a rounded Euclidian division of the polynomial a by a base α to compute t; extracting Boolean shares afrom n low bits of t by performing an arithmetic share to Boolean share (A2B) conversion on tand performing an AND with ζ−1, where ζ=−αis a power of 2; unmasking aby combining Boolean shares of a; calculating arithmetic shares aof the low part a; and performing a cryptographic function using aand a.

Masked decomposition of polynomials for lattice-based cryptography

Various embodiments relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for masked sampling of polynomials for lattice-based cryptography in a processor, the instructions, including: determining a number m of random bits to be sampled based upon a sample bound parameter β; producing a plurality of Boolean masked shares of a polynomial coefficient each having the determined number m of random bits using a uniform random function; determining that the polynomial coefficient is within a range of values based upon the sample bound parameter β; converting the plurality of Boolean masked shares of the polynomial coefficient to a plurality of arithmetic masked shares of the polynomial coefficient; and shifting the plurality of arithmetic masked shares based upon the sample bound parameter β.

Growing community of inventors

Vienna, Austria

Markus Schoenauer