Providing a cryptographic information

Patent metadata

Field	Value
Publication number	US-11870911-B2
Application number	US-202117380634-A
Country	US
Kind code	B2
Filing date	Jul 20, 2021
Priority date	Jul 24, 2020
Publication date	Jan 9, 2024
Grant date	Jan 9, 2024

Abstract

Cryptographic information is compiled by: (a) determining a first portion of the cryptographic information based on an input and a randomness; (b) checking a rejection criterion based on the first portion; (b1) re-starting step (a) with a different randomness if the rejection criterion is fulfilled; (b2) if not all portions of the cryptographic information have been generated, determining a subsequent portion of the cryptographic information based on the input and the randomness and continuing with step (b) or, otherwise, continuing with step (c); (c) determining the first portion of the cryptographic information based on the input and the randomness; (d) conveying the respective portion of the cryptographic information; and (e) if not all portions of the cryptographic information have been generated, determining a subsequent portion of the cryptographic information based on the input and the randomness and continuing with step (d).

First claim

What is claimed is:

1. A method for compiling a cryptographic information, comprising:
(a) determining a first portion of the cryptographic information based on an input and a randomness;
(b) checking whether a rejection criterion based on the first portion of the cryptographic information is fulfilled; and
(c) re-starting step (a) with a new randomness in the event the rejection criterion is fulfilled with respect to the first portion of the cryptographic information; and,
(d) for each of at least one subsequent portion of the cryptographic information not yet determined,
(d1) determining the subsequent portion of the cryptographic information based on the input and the randomness for which the rejection criterion based on the first portion of the cryptographic information was not fulfilled,
(d2) checking whether the rejection criterion is fulfilled based on the subsequent portion of the cryptographic information, and
(d3) re-starting step (a) with a new randomness in the event the rejection criterion is fulfilled with respect to the respective subsequent portion of the cryptographic information; and

(e) conveying the determined first portion of the cryptographic information and each determined subsequent portion.

2. The method of claim 1 , wherein the method comprises determining all of the determined subsequent portions prior to said conveying, and storing the determined first portion and the determined subsequent portions until all of the subsequent portions have been determined.

3. The method of claim 1 , wherein the method comprises not storing more than one portion of the cryptographic information at one time when processing the loop determined by steps (a) to (d).

4. The method of claim 1 , wherein the method comprises, after it is determined for the first portion and all subsequent portions that the rejection criterion is not fulfilled:
re-generating the first portion of the cryptographic information and the one or more subsequent portions, based on the input and the randomness for which it was previously determined that the rejection criterion was not fulfilled for any portion of the cryptographic information, to obtain the determined first portion and one or more subsequent portions for conveying.

5. The method of claim 4 , further comprising:
for each portion of the cryptographic information determined by the loop of steps (a) to (d), generating and storing a first hash value that is associated with the respective portion of the cryptographic information;
within said step of re-generating the cryptographic information and the one or more subsequent portion, generating a second hash value for each portion of the cryptographic information and comparing the second hash value with the first hash value that is associated with the same portion of the cryptographic information; and
conveying the respective portion only if the first hash value corresponds to the second hash value.

6. The method of claim 5 , wherein in the event that the first hash value does not correspond to the second hash value, the method further comprises triggering at least one of any one or more of the following actions:
issuing a notification or an alarm;
stopping the method;
entering an exception handling;
re-starting step (a) with a different randomness.

7. The method of claim 1 , wherein the cryptographic information is or comprises at least one of any one or more of the following:
a signature;
a pairing information;
an information associated with a zero-knowledge-proof.

8. The method of claim 1 ,
wherein prior to step (e) the respective portion of the cryptographic information has been encrypted with a secret key; and
the method further comprises conveying the secret key.

9. The method of claim 8 , wherein the secret key is conveyed after the last encrypted portion of the cryptographic information has been conveyed.

10. The method of claim 1 , wherein the input is a message.

11. The method of claim 1 , wherein the cryptographic information is compiled based on the portions of the cryptographic information conveyed.

12. The method of claim 10 , comprising conducting an authentication based on the cryptographic information.

13. The method of claim 1 , wherein processing the cryptographic information or a portion of the cryptographic information utilizes at least one cryptographic Lattice operation.

14. The method of claim 1 , wherein the method is used on a security device or for operating a security device, wherein such security device comprises at least one of any one or more of the following:
an integrated circuit,
a hardware security module,
a trusted platform module,
a crypto unit,
a FPGA,
a processing unit,
a controller,
a smartcard.

15. A security device for compiling a cryptographic information, the security device comprising digital hardware and interface circuitry configured to:
(a) determine a first portion of the cryptographic information based on an input and a randomness;
(b) check whether a rejection criterion based on the first portion of the cryptographic information is fulfilled; and
(c) re-start step (a) with a new randomness in the event the rejection criterion is fulfilled with respect to the first portion of the cryptographic information; and,
(d) for each of at least one subsequent portion of the cryptographic information not yet determined,
(d1) determine a subsequent portion of the cryptographic information based on the input and the randomness for which the rejection criterion based on the first portion of the cryptographic information was not fulfilled,
(d2) check whether the rejection criterion is fulfilled based on the subsequent portion of the cryptographic information, and
(d3) re-start step (a) with a new randomness in the event the rejection criterion is fulfilled with respect to the respective subsequent portion of the cryptographic information; and

(e) convey the determined first portion of the cryptographic information and each determined subsequent portion.

16. A consumable comprising the security device of claim 15 .

17. A system comprising a security device according to claim 15 and a host, wherein the security device is arranged to convey the respective portion of the cryptographic information to the host.

18. The system of claim 17 , wherein the host is arranged to authenticate the security device based on the portions of the cryptographic information received.

19. A non-transitory computer-readable medium comprising, stored thereupon, a computer program product directly loadable into a memory of a digital processing device, the computer program product comprising software code portions for performing the steps of the method of claim 1 .

Assignees

• Infineon Technologies Ag

Inventors

• Poeppelmann Thomas

Classifications

• H04L9/3247 Primary

  involving digital signatures · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/3093

  involving Lattices or polynomial equations, e.g. NTRU scheme · CPC title

• H04L9/3218

  using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title