Executing a cryptographic operation

Patent metadata

Field	Value
Publication number	US-11283608-B2
Application number	US-202016834432-A
Country	US
Kind code	B2
Filing date	Mar 30, 2020
Priority date	Mar 28, 2019
Publication date	Mar 22, 2022
Grant date	Mar 22, 2022

Abstract

A device and method for processing a ciphertext, including determining a seed using a secret key and the ciphertext, extracting a public key candidate from the ciphertext using the seed, determining a checkvalue candidate based on the public key candidate, comparing the checkvalue candidate with a checkvalue, and further processing the ciphertext if the comparison indicates that the checkvalue candidate corresponds to the checkvalue.

First claim

The invention claimed is:

1. A method for processing a ciphertext, comprising:
determining, by a hardware configured to process the ciphertext in a manner that increases robustness of the ciphertext processing against physical attacks, a seed using a secret key and the ciphertext;
extracting, by the hardware, a public key candidate from the ciphertext using the seed;
determining, by the hardware, a checkvalue candidate based on the public key candidate;
comparing, by the hardware, the checkvalue candidate with a checkvalue; and
further processing, by the hardware, the ciphertext to output decrypted ciphertext if the comparison indicates that the checkvalue candidate corresponds to the checkvalue.

2. The method according to claim 1 , further comprising:
storing, by the hardware, the secret key and the checkvalue with a decoder, or making the secret key and the checkvalue accessible to the decoder.

3. The method according to claim 1 , further comprising:
determining, by the hardware, a failure if the comparison indicates that the checkvalue candidate does not correspond to the checkvalue.

4. The method according to claim 1 , further comprising:
determining, by the hardware, the checkvalue based on a Hash function of the public key.

5. The method according to claim 1 , further comprising:
determining, by the hardware, the checkvalue based on a Hash function of two concatenated polynomials a and p,
wherein the polynomial a is part of the public key, and the polynomial p is the public key p=r 1 −a·r 2 with r 1 and r 2 being randomly generated polynomials.

6. The method according to claim 1 , further comprising:
extracting, by the hardware, public key candidate value components a′ and p′ from the ciphertext c 1 , c 2 by computing
a ′=( c 1 −e 2 ) e 1 −1 , and

p ′=( c 2 −RLWEencode( v ′)− e 3 ) e 1 −1 , and

wherein e 1 , e 2 and e 3 are noise polynomials, v′ is the decrypted ciphertext and RLWEencode ( ) is an encoding function.

7. The method according to claim 6 , further comprising:
generating, by the hardware, the noise polynomial e 1 to be invertible.

8. The method according to claim 1 , further comprising:
receiving the ciphertext;
determining, by the hardware using the secret key and the ciphertext, the seed by using a decryption operation; and
determining, by the hardware, the checkvalue candidate based on the public key candidate by feeding the public key candidate to a generation function.

9. The method according to claim 8 , further comprising:
decrypting, by the hardware, a payload message based on the seed.

10. The method according to claim 8 , further comprising:
determining, by the hardware, a payload message based on the decryption operation.

11. The method according to claim 10 , further comprising:
conducting, by the hardware, an integrity check of the payload message using the seed, another portion of the ciphertext, and at least one hash function.

12. The method according to claim 1 , wherein the processing uses the Number Theoretic Transform.

13. The method according to claim 1 , wherein the method is used on a security device or for operating a security device, wherein the security device comprises at least one of an integrated circuit, a hardware security module, a trusted platform module, a crypto unit, a FPGA, a processor, a controller, and a smartcard.

14. The method according to claim 1 , wherein processing the ciphertext uses at least one cryptographic Lattice operation.

15. A security device comprising a memory and at least one of an integrated circuit, a hardware security module, a trusted platform module, a crypto unit, a FPGA, a processor, a controller, and a smartcard configured to:
receive, by a hardware configured to process a ciphertext in a manner that increases robustness of the ciphertext processing against physical attacks, the ciphertext;
determine, by the hardware, a seed based on a secret key and the ciphertext;
extract, by the hardware, a public key candidate from the ciphertext utilizing the seed;
determine, by the hardware, a checkvalue candidate based on the public key candidate;
compare, by the hardware, the checkvalue candidate with a checkvalue; and
further process the ciphertext to output decrypted ciphertext if the comparison indicates that the checkvalue candidate corresponds to the checkvalue.

16. The security device according to claim 15 , wherein the security device is one of the following or comprises at least one of an integrated circuit, a hardware security module, a trusted platform module, a crypto unit, a FPGA, a processor, a controller, and a smartcard.

17. A non-transitory computer program product directly loadable into a memory of a digital processor for processing a ciphertext in a manner that increases robustness of the ciphertext processing against physical attacks, and comprising software code portions for causing the digital processor to determine a seed using a secret key and the ciphertext;
extract a public key candidate from the ciphertext using the seed; determine a checkvalue candidate based on the public key candidate; compare the checkvalue candidate with a checkvalue; and further process the ciphertext to output decrypted ciphertext if the comparison indicates that the checkvalue candidate corresponds to the checkvalue.

Assignees

• Infineon Technologies Ag

Inventors

• Poeppelmann Thomas

Classifications

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• H04L9/3093 Primary

  involving Lattices or polynomial equations, e.g. NTRU scheme · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title

• H04L9/002

  Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441) · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title