Conducting a cryptographic operation

Patent metadata

Field	Value
Publication number	US-11139971-B2
Application number	US-201816040743-A
Country	US
Kind code	B2
Filing date	Jul 20, 2018
Priority date	Aug 7, 2017
Publication date	Oct 5, 2021
Grant date	Oct 5, 2021

Abstract

A method for checking results, including (a) determining a first result by conducting an operation g( ) based on test data; (b) determining combined data by performing a combining operation based on the test data and user data; (c) determining a second result conducting the operation g( ) based on the combined data; and (d) determining whether the second result is indicative of the first result.

First claim

The invention claimed is:

1. A method for checking results by a device having a crypto unit or a processor, comprising:
(a) determining, by the crypto unit or the processor, a first result by conducting an operation g( ) based on test data;
(b) determining, by the crypto unit or the processor, combined data by performing a combining operation based on the test data and user data;
(c) determining, by the crypto unit or the processor, a second result by conducting the operation g( ) based on the combined data; and
(d) determining, by the crypto unit or the processor, whether the second result is indicative of the first result to detect whether a fault occurred.

2. The method according to claim 1 , wherein:
the first result is determined by conducting the operation g( ) modulo an integer q′,
the second result is determined by conducting the operation g( ) modulo an integer q*, and the integer q* is larger than the integer q′, and
the step (d) further comprises determining whether the second result is indicative of the first result by comparing the second result modulo q′ with the first result.

3. The method according to claim 2 , wherein a predetermined first action is triggered in case the second result modulo q′ is different from the first result.

4. The method according to claim 2 , wherein a predetermined second action is triggered in case the second result modulo q′ is not different from the first result.

5. The method according to claim 2 , further comprising:
prior to the step (a), determining a third result by conducting the operation g( ) modulo q based on the user data; and
after the step (c), determining the second result modulo q,
wherein q*=q·q′.

6. The method according to claim 1 , wherein prior to the step (a), the test data are generated randomly, pseudo-randomly, or according to a deterministic algorithm.

7. The method according to claim 6 , wherein the test data are generated at a predetermined time or trigger.

8. The method according to claim 1 , wherein the combining operation determines one combined value based on a pair of one value of the test data and one value of the user data.

9. The method according to claim 1 , wherein the operation g( ) is an arithmetic operation.

10. The method according to claim 1 , wherein the operation g( ) is a cryptographic operation.

11. The method according to claim 1 , wherein the operation g( ) is a lattice-based operation, which is based on operations modulo an integer.

12. The method according to claim 1 , wherein the combining of the test data and the user data comprises:
z i [ j ]=( v i [ j ] q ′( q′ −1 mod q )+ r i [ j ] q ( q −1 mod q ′))mod q* , and

wherein v i is a value of the user data, r i is a value of the test data, z i is a value of the combined operation, q is an integer, q′ is an integer, q* is an integer, and q*=q·q′.

13. The method according claim 12 , wherein the integers q and q′ do not have an integer divisor that is greater than one.

14. The method according to claim 1 , wherein the method is used for operating a FPGA, a processor, a controller, or a smartcard.

15. A device, comprising:
a processor and/or
a crypto unit coupled together,
wherein the processor and/or the crypto unit is arranged to:
(a) determine a first result by conducting an operation g( ) based on test data; and
(b) determine combined data by performing a combining operation based on the test data and user data;
(c) determine a second result conducting the operation g( ) based on the combined data; and
(d) determine whether the second result is indicative of the first result to detect whether a fault occurred.

16. The device according to claim 15 , wherein the device is a FPGA, a processor, a controller, or a smartcard.

17. A non-transitory computer program product directly loadable into a memory of a digital processor, comprising software code for performing the steps of the method according to claim 1 .

Assignees

• Infineon Technologies Ag

Inventors

• Poeppelmann Thomas

Classifications

• G06F7/588

  Random number generators, i.e. based on natural stochastic processes · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• H04L9/004

  for fault attacks · CPC title

• H04L9/3093 Primary

  involving Lattices or polynomial equations, e.g. NTRU scheme · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title