Koninklijke Philips Corporation N.v.

Philips Lighting Holding B.v.

Signify Holding B.v.

Nxp B.v.

Koninklijke Philips Electronics N.v.

Philips Intellectual Property & Standards Gmbh

Ronald Rietman

Michel Cornelis Josephus Marie Vissenberg

Ronaldus Maria Aarts

Ludovicus Marinus Gerardus Maria Tolhuizen

Sebastiaan Jacobus Antonius De Hoogh

Oscar Garcia Morchon

Lorenzo Feri

Constant Paul Marie Jozef Baggen

Ying Wang

Sauvik Bhattacharya

Robert James Davies

Paul Henricus Johannes Maria Van Voorthuisen

Hendrik Dirk Lodewijk Hollmann

Ashish Vijay Pandharipande

Willem Franke Pasveer

Ruud Vlutters

Alessio Filippi

Maarten Peter Bodlaender

Paul Anthony Shrubsole

Oscar Garcia-Morchon

Santos Merino Del Pozo

Nicolaas Lambert

Frederik Jan De Bruijn

Tim Corneel Wilhelmus Schenk

Serverius Petrus Paulus Pronk

Okke Ouweltjes

Johan P M G Linnartz

Paulus Mathias Hubertus Mechtildis Antonius Gorissen

Sel Brian Colak

Stephanus Joseph Johannes Nijssen

Sri Andari Husen

Hendricus Theodorus Gerardus Maria Penning De Vries

Mohammed Meftah

Bart Michiel De Boer

Tim Schenk

Willem Charles Mallon

Ludovicus M G M Tolhuizen

Jeroen Veen

Bastiaan Feddes

Sahil Sharma

Lena Gourmelon

Paulus H A Damink

Theodorus J J Denteneer

Theodorus Denteneer

Maurice H J Draaijer

Luca Giangaspero

Marinus Gerardus Maria Tolhuizen

Tim Corneel Wilhel Schenk

Frits De Bruijn

Santiago Gonzalez Pestana

Nick Boot

Ludovicus Marinus Gerardus Maria Tohluizen

Ivo Jean-Baptiste Adan

Sebastiaan Jacobus De Hoogh

Hendricus Theodorus Gerardus Penning De Vries

Karin Klabunde

Willem Mallon

Paul A Shrubsole

Ivo J-B F Adan

Some embodiments are directed to a computation device for performing a computation on at least a set of values. The values are stored in memory as a plurality of shares that define the value. An operation of the computation may be performed on a set of input values to obtain an output value. The output value may be defined by at least one shared share and at least one computed share. The at least one shared share may also define a further value, e.g., an output of a previously performed computation or an output of a further operation performed in parallel with the operation. The at least one computed share is computed from the at least one shared share and shares of the set of input values. A fault in the shared share affects the further value but a fault in the computed share, complicating share reduction attacks.

Computation device using shared shares

Some embodiments are directed to a circuit compiling device for compiling a function into a binary circuit and a function evaluation device for evaluating a function using such a binary circuit. The binary circuit comprises conjunction subcircuits each computing a conjunction of function input bits and XOR subcircuits each computing a function output bit. Each function output bit may be represented as a sum of interpolation terms, the plurality of function input bits and the interpolation terms of the one or more function output bits together forming a plurality of interpolation terms. A conjunction subcircuit computes an interpolation term as a conjunction of two interpolation terms. A XOR subcircuit computes a function output bit as a XOR of interpolation terms. Thereby, the first interpolation term and second interpolation term are also used in XOR subcircuits, hence the binary circuit has a smaller number or likelihood of ineffective faults.

Circuit compiling device and circuit evaluation device

Some embodiments are directed to an electronic cryptographic device arranged to perform a cryptographic operation on input data obtaining output data. The cryptographic device stores an internal state as sets of shares. Fourier coefficients corresponding to the sets of shares satisfy a predetermined relationship among them. The cryptographic operation is performed by repeatedly updating the internal state.

Cryptographic device and method

An electronic calculating device () arranged to convert an input number (y) represented ((y, y, . . . , y)) m a residue number system (RNS) to an output number represented in a radix representation ((e, e, . . . e)), the calculating device comprising an input interface () arranged to receive the input number (y) represented in the residue number system, and a processor circuit () configured to iteratively update an intermediate number (&#x177;) represented in the residue number system, wherein iterations produce the digits (e, e, . . . e) in the radix representation with respect to the bases (b, b, . . . , b), at least one iteration comprises computing the intermediate number modulo a base (b) of the radix representation to obtain a digit (e=(&#x177;)) of the radix representation, updating the intermediate number (&#x177;&#x2190;(&#x177;&#x2212;e+F)/b) by subtracting the digit from the intermediate number, adding an obfuscating number (F; F), and dividing by the base (b).

Secure transformation from a residue number system to a radix representation

An electronic key pre-distribution device for configuring multiple network nodes with local key information is provided. The key pre-distribution device applies at least a first hash function and a second hash function to a digital identifier of a network node. The first and second hash functions map the digital identifier to a first public point and a second public point on a first elliptic curve and second elliptic curve. A first and second secret isogeny are applied to the first and second public elliptic curve points, to obtain a first private elliptic curve point and second private elliptic curve point that are part of private key material for the network node.

Elliptic curve isogeny based key agreement protocol

A first device and a second device are disclosed for reaching agreement on a secret value. Herein, the second device comprises a receiver configured to receive information indicative of a reconciliation data h from the first device, a processor configured to compute a common secret s based on an integer value b, an equation, and system parameters. The processor is configured to compute b based on a key exchange protocol. The first device has a number a in approximate agreement with the number b. The first device comprises a processor configured to determine a common secret s based on an integer value a an equation, and system parameters, and determine a reconciliation data h. The first device further comprises a transmitter configured to transmit information indicative of the reconciliation data h to the second device.

Reaching agreement on a secret value

Some embodiments are directed to an electronic computation device () arranged for obfuscated execution of a multiplication. The device comprises a storage () arranged for storing multiple variables used in the execution of an arithmetic operation, a variable (x: y; 2) of the multiple variables being represented as multiple multiplicative shares (X=(x, x, . . . , x); Y=(y, y, . . . , y);), said multiplicative shares being represented in the storage as multiple additive shares (x=(x,x, . . . , x); Yi=(y,0,y, . . . , y);).

Computation device and method

The invention relates to an operational state determination apparatus () for determining whether a variation in a determined electrical parameter of an electrical network () is caused by a variation in an operational state of an electrical consumer of the electrical network. The electrical network comprises multiple electrical consumers () and a voltage source (), wherein a variation classification unit () determines whether a variation in the determined electrical parameter of the electrical network is caused by a variation in the operational state of an electrical consumer of the network depending on a decision variable which depends on a variation in a measured voltage and a variation in a measured current of the electrical network. This determination can be performed, without directly using the variation in the determined electrical parameter of the electrical network and is therefore less influenced by random voltage fluctuations in the electrical network.

Operational state determination apparatus

A cryptographic device () arranged to compute a target block cipher (B) on an input message (), the device comprising a first and second block cipher unit () arranged to compute the target block cipher (B) on the input message, and a first control unit () arranged to take the first block cipher result and the second block cipher result as input, and to produces the first block cipher result only if the block cipher results are equal.

Cryptographic device arranged to compute a target block cipher

An electronic point multiplication device () is provided for computing a point multiplication (kG) on an elliptic curve between a multiplier (k) and a base point (G) on the elliptic curve (E) for use in a cryptographic protocol. The device being arranged to compute from a first set of multiple joint encodings (A) a blinded base multiplier (A,), and a second set of multiple joint encodings (B) multiple blinded auxiliary multipliers (&#x3b7;). The device performs obtains the point multiplication () (kG) of the multiplier (k) and the base point (G) by computing the point addition of the point multiplication of the blinded base multiplier and the base point on the elliptic curve, and the multiple point multiplications of a blinded auxiliary multiplier and an auxiliary point. The blinded base multiplier and auxiliary multipliers may be represented in a plain format during the performing of the elliptic curve arithmetic.

Elliptic curve point multiplication device and method in a white-box context

A network node () is provided configured for a cryptographic protocol based on a shared matrix. The network node is arranged to construct the shared matrix (A) in accordance with the selection data and a shared sequence of values. Multiple entries of the shared matrix are assigned to multiple values of the sequence of data as assigned by the selection data. The shared matrix is applied in the cryptographic protocol.

Device and method sharing a matrix for use in a cryptographic protocol

A computation device () arranged to evaluate a data function (S) mapping a number (n) of input variables to a number of output variables (m). The computation device comprises selection mechanism () receiving as input selection variables and an evaluation mechanism () arranged to receive the one or more evaluation variables and to evaluate the evaluation functions for the received evaluation variables, an evaluation function receiving as input the evaluation variables.

A first electronic network node () is provided configured for goo a key exchange (KEX) protocol, the first network node is configured to&#x2014;obtain a shared matrix (A) shared with a second network node, entries in the shared matrix A being selected modulo a first modulus q, generate a private key matrix (S), entries in the private key matrix being bounded in absolute value by a bound (s) generate a public key matrix (P) by computing a matrix product between the shared matrix (A) and the private key matrix (S) modulo the first modulus (q) and scaling the entries in the matrix product down to a second modulus (p).

Key exchange devices and methods

Growing community of inventors

Eindhoven, Netherlands

Ronald Rietman