Nxp B.v.

Nxp Usa, Inc.

Melissa Azouaoui

Tobias Schneider

Christine Van Vredendaal

Joost Roland Renes

Joppe Willem Bos

Björn Fay

Markus Schoenauer

Olivier Bronchain

Mohamed ElGhamrawy

A secure processing system configured to produce a hash based digital signature of a message, including: random number generator (RNG); a monotonic counter device configured to produce a monotonically increasing counter value; a hash accelerator configured to produce a hash of the message based upon a random number from the RNG and the counter value; and a run time integrity check (RTIC) device configured to check the integrity of the operation of the hash accelerator based upon the counter value.

Processor to accelerate and secure hash-based signature computations

Various embodiments relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a cryptographic operation including matrix multiplication for lattice-based cryptography in a processor, the instructions, including: applying a first function to the rows of a matrix of polynomials to generate first outputs, wherein the first function excludes the identity function; adding an additional row to the matrix of polynomials to produce a modified matrix, wherein each element in the additional row is generated by a second function applied to a column of outputs associated with each element in the additional row; multiplying the modified matrix with a vector of polynomials to produce an output vector of polynomials; applying a verification function to the output vector that produces an indication of whether a fault occurred in the multiplication of the modified matrix with the vector of polynomials; and carrying out a cryptographic operation using output vector when the verification function indicates that no fault occurred in the multiplication of the modified matrix with the vector of polynomials.

Fault detection in post-quantum cyptography

A data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a fault detection in a digital signature algorithm in a processor, the instructions, including: computing vector z based on a secret nonce vector y, a first secret key vector s, and a challenge polynomial c, wherein vectors z, y, and sinclude l polynomials having n coefficients, wherein polynomial c has n coefficients, and wherein l and n are integers; computing a difference value between all of the coefficients of the polynomials in the vector z; computing a number of how many of the computed difference values are outside a specified value range; computing a digital signature for an input message; and rejecting the digital signature when the computed number is greater than a threshold value.

Fault detection of differential fault attack in lattice based cryptography

A method of performing a Dilithium signature operation on a message M using a secret key sk, including: generating a polynomial y using an ExpandMask function; calculating a polynomial z based upon y, c, and s; performing a bound check on z based upon γand β; performing a bound check on ctbased upon γ; calculating a polynomial {tilde over (r)} based upon A, z, c, t, α, and w; performing a bound check on {tilde over (r)} based upon γand β; calculating a hint polynomial h based on the {tilde over (r)}; and returning a digital signature of the message M where the digital signature includes z and h.

Low-memory masked Dilithium with alternative signing algorithm

Various embodiments relate to a fault detection system and method for a digital signature algorithm, including: producing a digital signature of a message using a digital signature algorithm; storing parameters from a last round of the digital signature algorithm; executing the last round of the digital signature algorithm using the stored parameters to produce a check signature; comparing the digital signature to the check signature; and outputting the digital signature when the digital signature is the same as the check signature.

Fault countermeasures for digital signatures with aborts

A device includes a computer readable memory storing a plurality of one-time signature (OTS) keypairs and a processor that is configured to execute a hash function on a message using a first private key of a first OTS keypair of the plurality of OTS keypairs to determine a message signature, execute the hash function to calculate a leaf node value of a hash tree using the first OTS keypair, determine a plurality of authentication path nodes in the hash tree, retrieve, from the computer readable memory, values of a first subset of the plurality of authentication path nodes, calculate values for each node in a second subset of the plurality of authentication path nodes, and store, in the computer readable memory, the values for each node in the authentication path and the value of the leaf node.

Lightweight fault countermeasure for stateful hash-based cryptography

A plurality of objects that comprise an input to a cryptographic signing function. For each object in the plurality of objects, an output value yof a hash function is calculated, where the value i is equal to an index value of the object, a compressed output value xof a compression function is calculated, the output value yfrom the computer readable memory, and the compressed output value xis stored. For each object in the plurality of objects, an output value y'of the hash function is calculated, where the value i is equal to the index value of the object, a compressed output value x′of the compression function executed on the output value y′is calculated, the output value x′is determined to be equal to the output value x, and the output value y′is transmitted in an output data stream.

Lightweight fault detection mechanism for streaming of cryptographic data objects

Various implementations relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a cryptographic operation including a masked decomposition of a polynomial a having narithmetic shares into a high part aand a low part afor lattice-based cryptography in a processor, the instructions, including: performing a rounded Euclidian division of the polynomial a by a base α to compute t; extracting Boolean shares afrom n low bits of t by performing an arithmetic share to Boolean share (A2B) conversion on tand performing an AND with ζ−1, where ζ=−αis a power of 2; unmasking aby combining Boolean shares of a; calculating arithmetic shares aof the low part a; and performing a cryptographic function using aand a.

Growing community of inventors

Norderstedt, Germany

Melissa Azouaoui