Cryptography Research, Inc.

Michael Hutter

Pankaj Rohatgi

Mark Evan Marson

Matthew Pond Baker

Michael Tunstall

Elke De Mulder

Elena Trichina

Jean-Michel Cioranesco

Samatha Gummalla

Begül Bilgin

Pascal Sasdrich

Bart Stevens

Systems and methods for efficient computation of stream ciphers. An example system for implementing a stream cipher, may comprise: a sub-round computation circuit of a first type configured to perform a subset of transformations of a cipher computation round on a round input state, each transformation of the subset of transformations including at least one of: a bitwise addition operation, a bitwise exclusive disjunction operation, or a bitwise rotation operation. The sub-round computation circuit of the first type may comprise: one or more of sub-round computation circuits of a second type, wherein each sub-round computation circuit of the second type is configured to perform the subset of transformations of the cipher computation round on a respective part of the round input state.

Hardware circuit to perform round computations of ARX-based stream ciphers

A first arithmetic input share and a second arithmetic input share of an initial arithmetically-masked cryptographic value are received. A sequence of operations using the arithmetic input shares and a randomly generated number is performed, where a current operation in the sequence of operations generates a corresponding intermediate value that is used in a subsequent operation. At the end of the sequence of operations, a first Boolean output share and a second Boolean output share are generated. The arithmetic-to-Boolean mask conversion is independent of the input bit length.

Constant time secure arithmetic-to-Boolean mask conversion

A first input share value, a second input share value, and a third input share value may be received. The first input share value may be converted to a summation or subtraction between an input value and a combination of the second input share value and the third input share value. A random number value may be generated and combined with the second input share value and the third input share value to generate a combined value. Furthermore, a first output share value may be generated based on a combination of the converted first input share value, the combined value, and additional random number values.

Converting a boolean masked value to an arithmetically masked value for cryptographic operations

Disclosed is a method and a system to execute the method to perform a first hashing operation to compute a first hash value, store the first hash value in a plurality of output registers, store a second message in a plurality of input registers, perform a first iteration of a second hashing operation, with an input to the second hashing operation including the second message and the first hash value, determine that a first portion of the second message, stored in a first register of the plurality of input registers, has been processed in course of the second hashing operation, and move a first portion of the first hash value stored in a first register of the plurality of output registers to the first register of the plurality of input registers.

Memory optimization for nested hash operations

A first plurality of logic gates and a second plurality of logic gates may be associated with a symmetric configuration. A first output at a first value may be generated by the first plurality of logic gates based on a first portion of input signals. A second output may be generated by the second plurality of logic gates at the first value based on a second portion of the input signals. A subsequent first output at a particular value may be generated by the first plurality of logic gates based on a first portion of a second plurality of input signals and a subsequent second output may be generated by the second plurality of logic gates based on a second portion of the second plurality of input signals. A value of the subsequent second output may be complementary to the particular value of the subsequent first output.

Freeze logic

Share values for use in a cryptographic operation may be received and the cryptographic operation may be performed based on the share values. A pseudorandom number that is to be used by the cryptographic operation may be identified and the pseudorandom number may be generated based on a portion of the share values that are used in the cryptographic operation. The cryptographic operation may then be performed based on the generated pseudorandom number.

Generating a pseudorandom number based on a portion of shares used in a cryptographic operation

An integrated circuit may implement a masked substitution box that includes substitution function components, a decoder, and a logic component. Each of the substitution function components may receive a same input value and a different mask value and may generate a respective output mask value based on the same input value and respective different mask value The decoder may receive an input mask value and generate a decoded output value that is based on the received input mask value. The logic component may select one of the output mask values from one of the substitution function components based on the decoded output value.

Hardware masked substitution box for the data encryption standard

A first hash value is calculated by using a first input value that is stored in a first set of registers. The first hash value is then stored in a second set of registers. A second input value is stored in the first set of registers after calculating the first hash value. The second hash value is calculated based on the first hash value and the second input value. During the calculating of the second hash value, the first hash value is shifted from the second set of registers to a portion of the first set of registers when the calculating of the second hash value has reached a state where the portion of the first set of registers is no longer used to store the second input value.

A first plurality of logic gates and a second plurality of logic gates may be associated with a symmetric configuration. A first output at a first value may be generated by the first plurality of logic gates based on a first portion of input signals. A second output may be generated by the second plurality of logic gates at the first value based on a second portion of the input signals. A subsequent first output at a particular value may be generated by the first plurality of logic gates based on a first portion of a second plurality of input signals and a subsequent second output maybe generated by the second plurality of logic gates based on a second portion of the second plurality of input signals. A value of the subsequent second output may be complementary to the particular value of the subsequent first output.

An integrated circuit may implement a masked substitution box that includes a counter that generates counter values. An input mask component may generate unmasked input values based on a combination of respective counter values and an input mask value. Furthermore, a substitution function component may receive the unmasked input values and may generate output values based on respective unmasked input values and a substitution function. An output mask component may generate masked output values based on a combination of respective output values and an output mask value. The masked output values may be stored at memory elements.

Growing community of inventors

Walnut Creek, CA, United States of America

Michael Hutter