Conducting a cryptographic operation

Patent metadata

Field	Value
Publication number	US-10965462-B2
Application number	US-201816040971-A
Country	US
Kind code	B2
Filing date	Jul 20, 2018
Priority date	Aug 7, 2017
Publication date	Mar 30, 2021
Grant date	Mar 30, 2021

Abstract

A method for conducting an operation including (a) lifting coefficients of a data structure from a representation modulo q to a representation modulo q′, wherein the data structure comprises values which are reduced modulo q, wherein q and are integers; (b) randomizing the coefficients in modulo q′, wherein for each coefficient a random value is multiplied with the value of q and the result of this multiplication is added to the coefficient; (c) conducting an operation on the lifted and randomized coefficients; and (d) reducing the lifted and randomized coefficients by conducting an operation modulo q.

First claim

The invention claimed is:

1. A method for conducting a cryptographic operation in a security device in a manner that increases robustness of the cryptographic operation against side-channel attacks, the method comprising:
(a) lifting, by a hardware configured to perform cryptographic operations, coefficients of a data structure from a representation modulo q to a representation modulo q′, wherein the data structure comprises values which are reduced modulo q, wherein q and q′ are integers;
(b) randomizing, by the hardware, the coefficients in modulo q′, wherein for each coefficient a random value is multiplied with the value of q and the result of this multiplication is added to the coefficient;
(c) conducting the cryptographic operation on the lifted and randomized coefficients; and
(d) reducing, by the hardware, the lifted and randomized coefficients by conducting an operation modulo q to provide a result of the cryptographic operation.

2. The method according to claim 1 , wherein the value of q′ is larger than the value of q.

3. The method according to claim 1 , wherein the data structure comprises a polynomial, a matrix, or a vector.

4. The method according to claim 1 , wherein the cryptographic operation is an arithmetic operation.

5. The method according to claim 1 , wherein the cryptographic operation is a lattice-based operation.

6. The method according to claim 1 , further comprising after the step (c):
(c1) repeating the steps (b) and (c) at least once before branching to the step (d).

7. The method according to claim 1 , wherein the data structure is a secret data structure.

8. The method according to claim 1 , wherein the value of q and/or the value of q′ is a prime number or a power-of-two.

9. The method according to claim 1 , wherein the value of q′ is selected such that it corresponds to a width of an integrated processor.

10. The method according to claim 1 , wherein the value of q′ varies.

11. The method according to claim 1 , wherein the method security device comprises a FPGA, a processor, a controller, or a smartcard.

12. A security device for conducting a cryptographic operation in a manner that increases robustness of the cryptographic operation against side-channel attacks, comprising:
a processor;
a hardware which is coupled to the processor by a bus, and is configured to perform cryptographic operations,
wherein the hardware is arranged to:
(a) lift coefficients of a data structure from a representation modulo q to a representation modulo q′, wherein the data structure comprises values which are reduced modulo q, wherein q and q′ are integers; and
(b) randomize the coefficients in modulo q′, wherein for each coefficient a random value is multiplied with the value of q and the result of this multiplication is added to the coefficient;

wherein the processor is arranged to:
(c) conduct the cryptographic operation on the lifted and randomized coefficients; and

wherein the hardware is arranged to:
(d) reduce the lifted and randomized coefficients by conducting an operation modulo q to provide a result of the cryptographic operation.

13. The security device according to claim 12 , wherein the device is a FPGA, a processing unit, a controller or a smartcard.

14. The security device according to claim 12 , wherein the security device comprises a FPGA, a processing unit, a controller or a smartcard.

15. The security device according to claim 12 , wherein the security device comprises an integrated circuit (IC), a hardware security module (HSM), or a trusted platform module (TPM).

16. The security device according to claim 12 , wherein the hardware comprises a crypto processor, a crypto-portion of a security controller, a security-controller, a crypto core, or a crypto module.

17. The security device according to claim 12 , wherein the hardware comprises a hardware security module (HSM) or a trusted platform module (TPM).

18. The security device according to claim 17 , wherein the TPM comprises a central processing unit (CPU), a crypto module, and a crypto core.

19. A non-transitory computer program product directly loadable into a memory of a digital processor, comprising software code for performing a method for conducting a cryptographic operation in a security device in a manner that increases robustness of the cryptographic operation against side-channel attacks, the method comprising:
(a) lifting, by a hardware configured to perform crypto graphic operations, coefficients of a data structure from a representation modulo q to a representation modulo q′ wherein the data structure comprises values which are reduced modulo q′, wherein q and q′ are integers;
(b) randomizing, by the hardware, the coefficients in modulo q′, wherein for each coefficient a random value is multiplied with the value of and the result of this multiplication is added to the coefficient;
(c) conducting the cryptographic operation on the lifted and randomized coefficients; and
(d) reducing, by the hardware, the lifted and randomized coefficients by conducting an operation modulo q to provide a result of the cryptographic operation.

Assignees

• Infineon Technologies Ag

Inventors

• Poeppelmann Thomas

Classifications

• H04L2209/08

  Randomization, e.g. dummy operations or using noise · CPC title

• H04L9/002

  Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441) · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• H04L9/3093 Primary

  involving Lattices or polynomial equations, e.g. NTRU scheme · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title