Nxp B.v.

Nxp USA, Inc.

Tobias Schneider

Joost Roland Renes

Christine Van Vredendaal

Joppe Willem Bos

Melissa Azouaoui

Marcel Medwed

Björn Fay

Olivier Bronchain

Markus Schoenauer

Ventzislav Nikov

Marc Gourjon

Erik Kraft

Eduardo Pimentel De Alvarenga

Jan Hoogerbrugge

Nikita Veshchikov

Stefan Lemsitzer

Mario Lamberger

Rudi Verslegers

Robert Spreitzer

Jorge Miguel Ventuzelos Pereira

Mohamed ElGhamrawy

A hardware converter configured to convert d arithmetic shares of x to d Boolean shares of x. The hardware converter has a plurality of addition layers in a tree structure. Each layer has a plurality of secure bit adders.

Flexible hardware accelerators for masking conversions with a power of two modulus

A secure processing system configured to produce a hash based digital signature of a message, including: random number generator (RNG); a monotonic counter device configured to produce a monotonically increasing counter value; a hash accelerator configured to produce a hash of the message based upon a random number from the RNG and the counter value; and a run time integrity check (RTIC) device configured to check the integrity of the operation of the hash accelerator based upon the counter value.

Processor to accelerate and secure hash-based signature computations

In an ultra-wideband (UWB) communication network, a controller anchor changes which anchor of a group of anchors serves as initiator for each of multiple ranging rounds. Based on the capabilities of the anchors in the UWB communication network, the controller selects among multiple modes for designating which anchor serves as initiator for each ranging round. In a first mode, the anchors take turns serving as the initiator for successive ranging rounds in round robin fashion. In a second mode, the anchors randomly take turns serving as the initiator for ranging rounds. By dynamically selecting an initiator for each ranging round, launching a successful jamming attack becomes significantly more complicated.

Jammer resilient ranging scheme

Various embodiments relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a cryptographic operation including matrix multiplication for lattice-based cryptography in a processor, the instructions, including: applying a first function to the rows of a matrix of polynomials to generate first outputs, wherein the first function excludes the identity function; adding an additional row to the matrix of polynomials to produce a modified matrix, wherein each element in the additional row is generated by a second function applied to a column of outputs associated with each element in the additional row; multiplying the modified matrix with a vector of polynomials to produce an output vector of polynomials; applying a verification function to the output vector that produces an indication of whether a fault occurred in the multiplication of the modified matrix with the vector of polynomials; and carrying out a cryptographic operation using output vector when the verification function indicates that no fault occurred in the multiplication of the modified matrix with the vector of polynomials.

Fault detection in post-quantum cyptography

A data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a fault detection in a digital signature algorithm in a processor, the instructions, including: computing vector z based on a secret nonce vector y, a first secret key vector s, and a challenge polynomial c, wherein vectors z, y, and sinclude l polynomials having n coefficients, wherein polynomial c has n coefficients, and wherein l and n are integers; computing a difference value between all of the coefficients of the polynomials in the vector z; computing a number of how many of the computed difference values are outside a specified value range; computing a digital signature for an input message; and rejecting the digital signature when the computed number is greater than a threshold value.

Fault detection of differential fault attack in lattice based cryptography

A method of performing a Dilithium signature operation on a message M using a secret key sk, including: generating a polynomial y using an ExpandMask function; calculating a polynomial z based upon y, c, and s; performing a bound check on z based upon γand β; performing a bound check on ctbased upon γ; calculating a polynomial {tilde over (r)} based upon A, z, c, t, α, and w; performing a bound check on {tilde over (r)} based upon γand β; calculating a hint polynomial h based on the {tilde over (r)}; and returning a digital signature of the message M where the digital signature includes z and h.

Low-memory masked Dilithium with alternative signing algorithm

A method is provided for detecting interference in a radar system. The method includes transmitting, by a transmitter of the radar system, a sequence of radar pulses at a regular interval with a rest period following each radar pulse of the sequence of radar pulses. The transmitter is disabled during each rest period. A receiver is enabled to receive reflected radar pulses from a target during the rest period following each radar pulse of the sequence of radar pulses. Some of the radar pulses are selected to be omitted and not transmitted. The receiver is still enabled during the rest periods following the omitted transmission pulses. Any reflected pulses received during the rest periods following the omitted transmission pulses may be an indication of a targeted interference of the radar system. In another embodiment, a radar system is provided.

Method and radar system for detecting targeted radar interference

A data processing system and method for norm checking a cryptographic operation for lattice-based cryptography in a processor, the instructions, including: multiplying a first polynomial by a second polynomial to produce a first output, wherein the d arithmetic shares have a modulus q'; securely converting the first output to d Boolean shares; securely subtracting a third polynomial from the first output to produce a second output, wherein the third polynomial is randomly generated and then offset by a first constant parameter; securely adding a first constant based upon a bound check and the first constant parameter to the second output to shift the values of the second output to positive values to produce a third output; and securely adding a second constant based upon the bound check to the third output to produce a carry bit.

Masked infinity norm check for crystals-dilithium signature generation

One example securely updates an integrated circuit to mitigate undesirable modifications and this involves an application circuit accessing an external network while a (e.g., nonvolatile) program memory is write protected; and a reset-boot circuit resetting and booting the application circuit while access to the external network is disabled, and causing an update for the application circuit. In response to an indication that an update is downloaded for installation, the downloaded update is installed in the memory while access to the external network is disabled, and execution of the reset mode is permitted after the update is installed. Also, a retrieval module may download, in response to an indication that an update is not downloaded, an update provided via the external network while the memory is write-protected and thereby permitting execution of the reset mode after the update is downloaded.

Apparatuses and methods with secure configuration update

Various embodiments relate to a fault detection system and method for a digital signature algorithm, including: producing a digital signature of a message using a digital signature algorithm; storing parameters from a last round of the digital signature algorithm; executing the last round of the digital signature algorithm using the stored parameters to produce a check signature; comparing the digital signature to the check signature; and outputting the digital signature when the digital signature is the same as the check signature.

Fault countermeasures for digital signatures with aborts

A device includes a computer readable memory storing a plurality of one-time signature (OTS) keypairs and a processor that is configured to execute a hash function on a message using a first private key of a first OTS keypair of the plurality of OTS keypairs to determine a message signature, execute the hash function to calculate a leaf node value of a hash tree using the first OTS keypair, determine a plurality of authentication path nodes in the hash tree, retrieve, from the computer readable memory, values of a first subset of the plurality of authentication path nodes, calculate values for each node in a second subset of the plurality of authentication path nodes, and store, in the computer readable memory, the values for each node in the authentication path and the value of the leaf node.

Lightweight fault countermeasure for stateful hash-based cryptography

Various embodiments relate to a data processing system including instructions embodied in a non-transitory computer readable medium, the instructions for a cryptographic operation using masked coefficients of a polynomial having d arithmetic shares for lattice-based cryptography in a processor, the instructions, including: shifting an arithmetic share of the d arithmetic shares by a first bound λ; converting the d shifted arithmetic shares to d Boolean shares; securely subtracting the first bound λand a second bound λfrom the Boolean shares to obtain z'having d shares, wherein k is the number of bits in the masked coefficients of the polynomial; setting the shares of a boundary check bit to a sign bit of z′; and carrying out a cryptographic operation using the d arithmetic shares of the polynomial when the d shares of the boundary check bit indicate that the coefficients of the polynomial are within the first bound λand second bound λ.

Rejection of masked polynomials

A plurality of objects that comprise an input to a cryptographic signing function. For each object in the plurality of objects, an output value yof a hash function is calculated, where the value i is equal to an index value of the object, a compressed output value xof a compression function is calculated, the output value yfrom the computer readable memory, and the compressed output value xis stored. For each object in the plurality of objects, an output value y'of the hash function is calculated, where the value i is equal to the index value of the object, a compressed output value x′of the compression function executed on the output value y′is calculated, the output value x′is determined to be equal to the output value x, and the output value y′is transmitted in an output data stream.

Lightweight fault detection mechanism for streaming of cryptographic data objects

Various embodiments relate to a hardware device configured to compute a plurality of chained hash functions in parallel, including: a processor implementing p hash functions configured to operate on a small input, where p is an integer; a data unit connected to the plurality of hash functions, configured to store the outputs of plurality of hash functions that are then used as the input to a next round of computing the hash function, wherein the processor receives a single instruction and p small data inputs, and wherein each of the p hash functions are used to perform a chained hash function operation on a respective small input of the p small inputs.

Speeding up hash-chain computations

Various implementations relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a cryptographic operation including a masked decomposition of a polynomial a having narithmetic shares into a high part aand a low part afor lattice-based cryptography in a processor, the instructions, including: performing a rounded Euclidian division of the polynomial a by a base α to compute t; extracting Boolean shares afrom n low bits of t by performing an arithmetic share to Boolean share (A2B) conversion on tand performing an AND with ζ−1, where ζ=−αis a power of 2; unmasking aby combining Boolean shares of a; calculating arithmetic shares aof the low part a; and performing a cryptographic function using aand a.

Growing community of inventors

Styria, Austria

Tobias Schneider