DATA PROCESSING DEVICE AND METHOD FOR PROTECTING A BOOLEAN MASKED ADDITION FROM ERRORS

Abstract

According to various embodiments, a data processing device is described which includes a Boolean masked addition processor designed to perform Boolean masked addition and a fault protection circuit designed to generate a checksum for a first part, generate a second checksum part, compare the first checksum part with the second checksum part, and trigger a safety action in response to a mismatch between the first checksum part and the second checksum part.

Description

[0001] The present disclosure relates to data processing equipment and methods for protecting a Boolean masked addition from errors.

[0002] Large quantum computers have the potential to compromise conventional public-key cryptography. In response, standardization bodies such as NIST (National Institute of Standards and Technology) are actively investigating alternative cryptosystems and a new generation of cryptographic algorithms specifically designed to resist attacks on quantum computers. These algorithms enable a secure transition from classical to post-quantum cryptography. Lattice-based cryptography, a subclass of post-quantum cryptography, is particularly attractive due to its ability to strike a good balance between security, performance, and scale.

[0003] Recently, NIST published the standards and / or specifications for three lattice-based cryptographic algorithms: one for key encapsulation (ML-KEM) and two for digital signatures (ML-DSA and FALCON). The next step in the transition to post-quantum cryptography requires the secure implementation of these algorithms. Implementations must be protected against side-channel and error attacks, in particular. While countermeasures against side-channel attacks have been studied, research on combining side-channel protection with error protection is limited. Typically, side-channel countermeasures employ masking techniques, where secret variables are split into multiple additive or Boolean (XOR-based) components. However, different parts of cryptographic algorithms are better suited to either the Boolean or the arithmetic domains, necessitating efficient switching between the two.Generally, nonlinear functions like sampling are better suited to the Boolean domain, while linear ring arithmetic operations are performed more efficiently in the arithmetic domain. The core operation for safely switching between Boolean and arithmetic masking is safe Boolean masked addition (that is, adding Boolean masked integers). Furthermore, Boolean masked addition offers the advantage of allowing direct addition operations within the Boolean domain, thus eliminating the need for transitions to the arithmetic domain for certain parts of grid-based algorithms.

[0004] Thus, Boolean masked addition is a crucial operation in any masked implementation of lattice-based cryptography. It should therefore be protected from errors, such as error attacks. Cost-effective detection of error attacks is of paramount importance, as Boolean masked addition is already one of the performance bottlenecks. The greatest challenge here lies in the fact that Boolean masked addition is non-linear, and that straightforward checksum calculations are not feasible to protect this operation. Therefore, approaches for effective and efficient protection of Boolean masked addition against error attacks are highly desirable.

[0005] In BACHE, F. [et al.]: Boolean Masking for Arithmetic Additions at Arbitrary Order in Hardware [In: Applied Sciences, Vol 12, 2022, No. 5. DOI: 10.3390 / app12052274], 3 adder designs were investigated with regard to their suitability for Boolean masking.

[0006] In BERNDT, S. [et al.]: Combined Fault and Leakage Resilience: Composability, Constructions and Compiler [In: Cryptology ePrint Archive, 2023. URL: https: / / eprint.iacr.org / 2023 / 1143.pdf - accessed on 09.01.2026] a compiler is presented that is based on polynomial masking and achieves linear computational complexity for affine functions and cubic complexity for nonlinear functions.

[0007] In the work by DAEMEN, J. [et al.]: Protecting against Statistical Ineffective Fault Attacks [In: IACR Transactions on Cryptographic Hardware and Embedded Systems, Vol. 2020, 2020, No. 3, pp. 508-543. DOI: 10.13154 / tches.v2020.i3.508-543], various countermeasures strategies against SIFA (Statistical Ineffective Fault Attacks) are described.

[0008] According to various embodiments, a data processing device (for example, a security device) is provided, which includes the following: • a Boolean masked addition processor designed to perform a Boolean masked addition of input values ​​to produce a result value, wherein each input value has one bit for each bit position of a plurality of bit positions and is represented by a Boolean combination of two or more corresponding parts, the result value has one bit for each bit position of the plurality of bit positions and is represented by a Boolean combination of two or more corresponding parts, and carry bits occurring in the addition are each represented by a Boolean combination of two or more corresponding parts, and • a fault protection circuit designed to • For each bit position, calculate a sum of the bits of the first parts of the input values, the bit of the first part of the result value, and the first part of a carry bit modulo 2, and generate a first checksum part by accumulating the calculated sums over the bit positions. • For each bit position, calculate a sum of the bits of the second parts of the input values, the bit of the second part of the result value, and the second part of a carry bit modulo 2, and generate a second checksum part by accumulating the calculated sums over the bit positions. ◯ to compare the first checksum part with the second checksum part, and ◯ to trigger a security measure in response to a mismatch between the first checksum part and the second checksum part.

[0009] In the drawings, similar reference numerals generally refer to the same parts across different views. The drawings are not necessarily to scale; instead, the emphasis is generally placed on illustrating the principles of the invention. The following description describes various aspects with reference to the following drawings, in which the following applies: Fig. Figure 1 shows a processing device. Fig. Figure 2 illustrates an example of how a safe AND gate can be implemented. Fig. Figure 3 shows an algorithm for bit slicing. Fig. Figure 4 shows an algorithm for Boolean masked addition. Fig. Figure 5 shows an algorithm for calculating and verifying a checksum. Fig. Figure 6 shows a flowchart illustrating the flow of an algorithm for performing a fault-protected Boolean masked addition according to one embodiment. Fig. Figure 7 shows a hardware device for performing a fault-protected Boolean masked addition as described above, according to one embodiment. Fig. Figure 8 shows a flowchart illustrating a method for protecting a Boolean masked addition from errors according to one embodiment.

[0010] The following detailed description refers to the accompanying drawings, which illustrate specific details and aspects of this disclosure in which the invention can be practiced. Other aspects may be used, and structural, logical, and electrical modifications may be made without departing from the scope of the invention. The various aspects of this disclosure are not necessarily mutually exclusive, as some aspects of this disclosure may be combined with one or more other aspects of this disclosure to form new aspects.

[0011] The examples described herein can be implemented as instructions that are processed by a processor of a security device such as a personal computer (with security measures), a smart card, a secure microcontroller, a hardware trust base, an (embedded) Secure Element (ESE), a Trusted Platform Module (TPM), or a Hardware Security Module (HSM).

[0012] Fig. Figure 1 shows an example of processing device 100, which includes CPU 101, RAM 102, non-volatile memory 103 (NVM), crypto module 104, analog module 106, input / output interface 107 and hardware random number generator 112.

[0013] In this example, the CPU 101 (which could be an application processor, for example) has access to at least one crypto module 104 (which could be part of a hardware security module) via a shared bus 105, to which each crypto module 104 is connected. The shared bus is just one example, and individual interfaces may exist between the various components. In particular, each crypto module 104 may include one or more crypto cores to perform specific cryptographic operations. Examples of crypto cores are: - AES kernel 109, - SHA core 110, - ECC core 111, and - Lattice-based Crypto (LBC) - Core 108.

[0014] The lattice-based crypto kernel 108 can be deployed to accelerate lattice-based cryptography.

[0015] The CPU 101, the hardware random number generator 112, the NVM 103, the crypto module 104, the RAM 102, and the input / output interface 107 are connected to the bus 105. The input / output interface 107 can have a connection to other devices that may be similar to the processing device 100.

[0016] The analog module 106 is supplied with electrical energy via an electrical contact and / or an electromagnetic field. This energy is supplied to drive the circuitry of the processing device 100 and, in particular, enables the input / output interface to initiate and / or maintain connections to other devices.

[0017] The bus 105 itself can be masked or blank. Instructions for performing the processing and algorithms described below can be stored in the NVM 103 and processed by the CPU 105. The processed data can be stored in the NVM 103 or in the RAM 102. Supporting functions can be provided by the crypto modules 104 (for example, extending pseudorandom data). Random numbers (for example, for masking) are supplied by the hardware random number generator 112.

[0018] The processing and algorithms described below can be performed exclusively or at least partially on the crypto module 104, for example, on the lattice-based crypto core 108 (although they can also be performed on the CPU 101 if no corresponding crypto module is present on the processing device 100). A crypto module 104 may or may not be equipped with hardware-based security features. Such hardware-based security features can be circuits that implement countermeasures against side-channel power analysis or fault injection (for example, by using a laser). This includes, in particular, masking, that is, splitting secret data into multiple parts. Such countermeasures can be implemented through the use of randomness, redundant hardware, or redundant processing.In general, the goal of countermeasures is to hide the internally processed values ​​from an attacker who is able to observe the physical impact of processing such values.

[0019] To execute the procedures described below, instructions can be stored in the lattice-based crypto core 108, or they can be provided by the CPU 101 via the bus 105. Data can be stored locally within the lattice-based crypto core 108. It is also possible for the data to be temporarily stored in the RAM 102 or the NVM 103. The lattice-based crypto core 108 can also use other crypto modules to provide supporting functions (for example, extending pseudorandom data). The lattice-based crypto core 108 can also include a hardware random number generator 112 or a means of generating physical and / or software random numbers (for example, for masking).

[0020] The components of the processing device 100 can, for example, be implemented on a single chip. The processing device 100 can be a chip card (or a chip card module) powered by direct electrical contact or by an electromagnetic field. The processing device 100 can be a fixed circuit or based on reconfigurable hardware (for example, a field-programmable gate array, FPGA). The processing device 100 can be coupled with a personal computer, a microcontroller, an FPGA, a system-on-a-chip (SoC), or other components of a smartphone.The processing device 100 can be a chip that functions as a Trusted Platform Module (TPM) providing cryptographic functionality (secure storage, secure time, signature generation and validation, attestation) according to a standardized interface to a computer, smartphone, Internet of Things (IoT) device or vehicle.

[0021] The following notations are used here: The subscript i of x i refers to the i-th bit of the variable x. To denote multiple bits from i to j, the notation x is used. {i:j} The i-th element of a vector variable x is denoted as x[i]. Superscript characters are used to access different masking components; for example, x {i:j}The reference is to elements i through j. If parentheses are omitted, this means that the entire element is being referred to, whether it is a vector or an array. To clarify the size of the element, its size is sometimes explicitly specified in parentheses.

[0022] According to various embodiments, the processing device 100 executes, in particular, a grid-based cryptographic algorithm. To protect against side-channel attacks, operations are performed in a masked manner. This includes, in particular, the operation s 0 ⊕ s 1 = (a 0 ⊕ a 1 ) + (b 0 ⊕ b 1 ) for operations performed in a Boolean domain, such as additions of Boolean masked coefficients of polynomials, or to switch between the Boolean domain and the arithmetic domain.

[0023] In the Boolean domain, values ​​are masked in a Boolean manner, meaning each value is represented as a (bitwise) XOR combination (or another Boolean combination) of two (or more) parts. In the arithmetic domain, values ​​are masked in an arithmetic manner, meaning each value is represented as the arithmetic sum of two (or more) parts.

[0024] In the expression s 0 ⊕ s 1 = (a 0 ⊕ a 1 ) + (b 0 ⊕ b 1 ) means ⊕ (bitwise) XOR, and + means "normal" addition (that is, arithmetic addition with carry). The result (that is, the sum) s is expressed as an XOR combination of the components s. 0 and s 1 represented, and the input values ​​a and b are represented as an XOR combination of the proportions a 0 and a 1 or as an XOR combination of the shares b 0 and b 1 depicted.

[0025] Since this operation frequently occurs in a lattice-based cryptographic algorithm, it should be protected against errors, especially error attacks, while simultaneously maintaining protection against side-channel attacks (i.e., preventing information loss that can occur when combining parts). The challenge, therefore, is to... 0 ⊕ s 1 = (a 0 ⊕ a 1 ) + (b 0 ⊕ b 1 to calculate without recombinating the components, and to additionally protect this operation from error attacks. Unless otherwise specified, the embodiments described in detail herein assume a scenario with two Boolean components. However, it should be noted that the approaches discussed herein can be applied to masking by using more than two components.

[0026] A straightforward approach to error detection is to duplicate all calculations and compare the results; however, this approach causes a significant increase in area and performance.

[0027] Therefore, according to various embodiments, instead of the twice parallel execution of Boolean masked addition s 0 ⊕ s 1 = (a 0 ⊕ a 1 ) + (b 0 ⊕ b 1 (which is costly when maintaining side channel protection) calculates a checksum together with Boolean masked addition, and fault protection is achieved by checking whether the checksum satisfies a checksum condition. An example of this approach is described in detail below.

[0028] s i = a i ⊕ b i ⊕ c i Let be the i-th bit of the sum (s), where a i and b ithe bits of the input operands (a, b) and c i The carry bit (c) is used for the carry calculation. The carry bit can be represented by c. i = (c i-1 Λ (a i ⊕ bi)) ⊕ (a i Λ b i ) can be calculated. It should be noted that c -1 = c in The carry input bit is (which can be set to zero). Let m be the bit length of the input operands. Then the last bit of the carry, also called the carry output c, is used. m-1 = C Ausgabe known, assigned to the last bit of the sum, that is, s m = c m-1 The following relationship contains: ∑i=0m−1(ai)+∑i=0m−1(bi)+c−1=∑i=0m−1(si)+∑i=0m−1(ci)+cm−1

[0029] This relationship allows the calculation of checksums for the input values ​​a and b (including the carry input bit) at the beginning of the Boolean masked addition process, which can then be compared with the checksums of the result values ​​s and c (including the carry output bit). Typically, the intermediate carry bits are discarded, as only the final carry output bit is needed for the last sum bit. However, according to one embodiment, all calculated carry bits are stored until the final checksum is generated.

[0030] In a masked setting, equation (1) can be expressed as ∑i=0m−1(ai0⊕ai1)+∑i=0m−1(bi0⊕bi1)+(c−10⊕c−11)=∑i=0m−1(si0⊕si1)+∑i=0m−1(ci0⊕ci1)+(cm−10⊕cm−11)

[0031] As mentioned above, the calculation of the carry bit involves AND combinations (denoted by Λ): c i = (c i-1 Λ (a i ⊕ b i ) ⊕ (ai Λ b i ).

[0032] These AND combinations make computation in a masked manner (i.e., with side-channel attack protection) costly. In the following examples, the AND combination with side-channel protection is executed by a function SecAnd(.) which requires two parts per input, for example: SecAnd(ai0,ai1,bi0,bi1).

[0033] Fig. Figure 2 illustrates an example of how SecAnd(.) can be implemented in the form of a masked AND gate 200.

[0034] The inputs A and B are each divided into two parts: A = A 0 ⊕ A 1 and B = B 0 ⊕ B 1The data is split, and there is re-masking (by a random bit R) during domain-crossing operations, with the first parts of the operands forming one domain and the second parts forming the other. Each of the four AND gates 201 receives a corresponding pair of the four pairs (more are possible) of a part of A and a part of B. Note that none of the AND gates receives both parts of the same operand, which would result in side-channel losses. The (masked) output is shown here with C = C. 0 ⊕ C 1 marked, and should not be confused with the carry bit mentioned above.

[0035] It can be seen that the masked AND combination is complex, and therefore requires a lot of computing power (in a software implementation) or a lot of chip area (in a hardware implementation), especially when it is executed (at least partially in parallel) for each bit of large values ​​(for example, 256 coefficients of polynomials, which are processed in the lattice-based cryptographic algorithm with 32 bits each).

[0036] Therefore, according to various embodiments, an approach is provided that enables the verification of the checksum condition without the need to execute safe AND combinations. These combinations are still necessary for the actual calculation of the Boolean masked addition, but their number is halved by activating error protection with the provided approach compared to a redundant calculation of the Boolean masked addition.

[0037] To simplify the notation of equation (2), the individual sums can be expressed as Hamming weights (HW). m ) are treated, where the Hamming weight of an m-bit integer is the number of bits set to the Boolean value "1": HWm(a0⊕a1)+HWm(b0⊕b1)+(c−10⊕c−11)=HWm+1(s0⊕s1)+HWm(c0⊕c1)

[0038] The calculation of the Hamming weight is known to be a complex computation in a masked setting, as it is a non-linear function, similar to masked addition. To break down the complexity, a bit-level checksum calculation is considered below. The relationship between input and output checksums at the bit level is (ai0⊕ai1)+(bi0⊕bi1)+(ci−10⊕ci−11)=(si0⊕si1)+2⋅(ci0⊕ci1)

[0039] It should be noted that the carry bit c iis considered twice, similar to equation (2). However, it is difficult to calculate the checksums without recombining the individual components. Equation (4) can be changed when switching from the integers ℤ to the finite field. F2 to simplify (that is, calculating the checksum modulo 2 at the bit level), which leads to the following ai0⊕ai1⊕bi0⊕bi1⊕ci−10⊕ci−11=si0⊕si1

[0040] Rearranging the variables to avoid recombining proportions leads to ai0⊕bi0⊕si0⊕ci−10=ai1⊕bi1⊕si1⊕ci−11

[0041] Since the shares are now clearly separated, the risk of unintentional recombinations (which could lead to information loss) is effectively eliminated.

[0042] Equation (6) requires operations on individual bits. However, extracting and manipulating individual bits is extremely inefficient in word-based processors. To address this problem, bit slicing can be used, for example, to improve the performance of nominal sampling in lattice-based cryptography. This technique allows the simultaneous processing of ω operations in parallel, for example, with ω = 32 in a 32-bit processor architecture. To take advantage of the performance benefits of bit slicing, it is necessary to perform a conversion to the bit-sliced ​​domain (called BitSlice) and then reverse this operation at the end (called RevBitSlice). Note that for ω-bit operands, the same function can be used for both BitSlice and RevBitSlice. Let x̂ be the bit-sliced ​​representation of the array x.While bit operations were applied in equation (6), the following equation is applied to full processor words. a^0[i]⊕b^0[i]⊕s^0[i]⊕c^0[i−1]=a^1[i]⊕b^1[i]⊕s^1[i]⊕c^1[i−1]

[0043] To calculate the checksum for the entire Boolean masked addition, the checksums of individual bits are combined into a single sum of checksums. However, remaining within the finite field is not possible. F2 This is unsuitable for this purpose, as it would lead to a loss of information. An error affecting multiple bits might go undetected. For example, if an error shifts several bits in such a way that parity is preserved—that is, the sum of the bits remains even or odd—the error may go unnoticed. To avoid this problem, calculations in ℤ are used instead for the sum of the bits. This preserves more information about individual bits, leading to the following equation. ∑i=0m−1(a^0[i]⊕b^0[i]⊕s^0[i]⊕c^0[i−1])=∑i=0m−1(a^1[i]⊕b^1[i]⊕s^1[i]⊕c^1[i−1])

[0044] In lattice-based cryptography, complete polynomials are typically processed. Therefore, it is assumed that Boolean masked addition for two polynomials, a {0:1} [0: n - 1] and b {0:1}[0: n - 1] with n coefficients each, is executed. Let ω be the processor width (ω ≥ m), and assume that both a and b are in the bit-sliced ​​domain. It is also assumed that the addition of the coefficients does not lead to overflows, i.e., the output carry bits are always zero. Under these conditions, one obtains ∑j=0n / ω−1(∑i=0m−1(a^0[ω⋅j+i]⊕b^0[ω⋅j+i]⊕s^0[ω⋅j+i]⊕c^0[ω⋅j+i−1])) =∑j=0n / ω−1(∑i=0m−1(a^1[ω⋅j+i]⊕b^1[ω⋅j+i]⊕s^1[ω⋅j+i]⊕c^1[ω⋅j+i−1]))

[0045] The Fig. 3, Fig. 4 and Fig. Figure 5 shows algorithms 1, 2, and 3, respectively, which provide a detailed algorithmic description of error-protected Boolean masked addition according to one embodiment. Here, it is assumed that a and b are coefficient vectors (each containing n coefficients, for example, n = 256 coefficients, each with 32 bits) of two polynomials. For example, the polynomials are elements of the ring Rq=ℤq / ϕ(x), where each element in Rq a polynomial of the form f(x) = f[0] + f[1]x + ... + f[n - 1]x n-1 Here, q is a prime number, and n is the length of the polynomial, which is usually chosen as a power of two, that is, n = 2. k . Each coefficient f[i] is an element of the field ℤ q .

[0046] Algorithm 1 and Algorithm 2 serve as supporting algorithms for the main algorithm, Algorithm 3. Algorithm 1 is responsible for converting an array between the normal domain and the bit-sliced ​​domain. The input is a word array x[0: ω - 1] with ω elements, where each element is an ω-bit value. For simplicity, it is assumed that the word length is equal to the length of the input operand (m = ω).

[0047] For example, the input array can consist of 32 coefficients, each with 32 bits. The algorithm initializes the output array in line 1. The nested loops in lines 2-4 perform the bit-slicing operation, which rearranges the bits of the input array. Specifically, the first bit of each coefficient is mapped to a single output array element, the second bit to another element, and so on. The j-th bit of the i-th input word (i.e., x[i]) is set to the i-th position in the j-th word of the output array (i.e., x̂[j]). The resulting bit-sliced ​​array x̂ is returned in line 5.

[0048] Algorithm 2 is the critical operation that requires error protection. It performs Boolean masked addition of two input arrays, serving as an example of a ripple carry adder. However, implementations are not limited to this specific type of adder.

[0049] Algorithm 2 relies on a SecAnd function, as mentioned above, which provides the values ​​z 0 and z 1 calculated securely, so that z 0 ⊕ z 1 = (x 0 ⊕ x 1 ) Λ (y 0 ⊕ y 1 ) without recombinating the two masking components. As in Fig. As illustrated in Figure 2, this can be achieved by using a new randomness (that is, by re-masking). Algorithm 2 takes the parameter ω and the two operands â {0:1} [0: ω - 1] and b̂ {0:1} [0: ω - 1] are taken as inputs, which are assumed to be in the bit-sliced ​​domain. Lines 1-4 contain the output sum ŝ {0:1} [0: ω] and the respective carry bits ĉ {0:1} [0: ω - 1] is initialized. The core of algorithm 2 is the loop in lines 5-18, which calculates the sums and carry bits (in bit-sliced ​​format) according to the equations shown above.

[0050] The calculations for the first round of the loop (i = 0) can be simplified by setting the carry bits to zero. Algorithm 2 not only handles carry continuation but also stores the carry values ​​for each round. In lines 19-20, the carry output is mapped to the last sum bits for the first and second parts, respectively. Finally, in line 21, the bit-sliced ​​sum and carry arrays are returned.

[0051] Algorithm 3 is the primary algorithm for protected Boolean masked addition. It takes as input two polynomials, a {0:1} [0: n - 1] and b {0:1} [0: n - 1], which are the input operands for the addition, and elements of Rq are. Additionally, it takes as input the parameter ω, which represents the processor's bit width. Algorithm 3 initializes the two parts for the checksums and the output sum of the addition in lines 1-4. The sum is calculated in blocks of ω coefficients in the loop-spanning lines 5-19. Within this loop, both parts of the input operands are transformed into the bit-sliced ​​domain in lines 6-9, which can be done locally since the operands are no longer needed in the normal domain. The next step is the calculation of the Boolean masked addition in line 10, which yields the sum ŝ {0:1} [0: ω] and the carry bits ĉ {0:1} [0: ω - 1] in the bit-sliced ​​domain.

[0052] It should be noted that the carry bits are usually zero if the input operands have at most ω - 1 bits, therefore ŝ {0:1}[ω] was discarded for simplification. Lines 11-12 reverse the bit-sliced ​​representation to obtain the sum in the normal domain for both masking components. The resulting ω coefficients s {0:1} [0: ω - 1] are assigned to the output total. The checksum calculations follow in lines 13-19. The final checksums chk 0 and chk 1 are updated incrementally for each element of the input and output vectors. Since the carry input bits are zero in this example, the operations for the first loop (i = 0) are simplified. Finally, the checksums are calculated in lines 20-23. 0 and chk 1 The algorithm compares the results. If they are identical, it returns no error. Otherwise, it returns an error.

[0053] It is noteworthy that the final comparison is not vulnerable to side-channel attacks, unlike the case where error protection is achieved through duplication (i.e., redundant computation). Additionally, Algorithm 3 is well-suited for integrating further countermeasures, such as shuffling at the for loops or random rotation of the operands during the checksum calculation (lines 14-19).

[0054] Fig. Figure 6 shows flowchart 600, which illustrates the flow of the complete algorithm for performing an error-protected Boolean masked addition according to one embodiment (for example, including algorithms 1 to 3).

[0055] At 601, the (entire) checksum components are initialized.

[0056] At 602, a loop is started over groups of coefficients (corresponding to the dimension of the bit slicing), which ends at 603 when all coefficients have been processed.

[0057] For each iteration of the loop, the coefficients are bit-sliced ​​at 604, and the Boolean masked addition is performed at 605. At 606, reverse bit-slicing of the result is performed, and the two partial checksums (for the current group of coefficients) are determined and added to the total checksum components at 607.

[0058] When the loop terminates, all checksum components are compared at 608, and an error flag is set at 609 if there is a mismatch. At 610, the error flag is not set if there is a match, and the Boolean masked addition process ends at 611. If the error flag is set, a safety action is triggered, such as discarding the result of the Boolean masked addition and repeating the process, raising an alarm, or resetting the device, etc.

[0059] Fig. Figure 7 shows hardware device 700 for performing fault-protected Boolean masked addition as described above, that is, a fault-protected Boolean masked adder.

[0060] It includes input / output memory 701, bit-slice processor 702, Boolean masked addition processor 703, and masked checksum checker 704 (including, in particular, a masked checksum calculator). Controller 705 causes these components to perform error-protected Boolean masked addition as described above. Specifically, the bit-slice processor 702 executes, for example, algorithm 1, the Boolean masked addition processor 703 executes, for example, algorithm 2, and the masked checksum checker 704 executes, for example, algorithm 3. The masked checksum checker 704 can thus be considered to implement an error protection circuit.

[0061] In summary, according to various embodiments, a data processing device (for example, a security device) is provided (for example, corresponding to the processing device 100 or the hardware device 700) which includes the following: • a Boolean masked addition processor (for example, corresponding to the Boolean masked addition processor 703) designed to perform a Boolean masked addition of input values ​​to produce a result value, wherein each input value has one bit for each bit position of a plurality of bit positions and is represented by a Boolean combination of two or more corresponding parts, the result value has one bit for each bit position of the plurality of bit positions and is represented by a Boolean combination of two or more corresponding parts, and carrier bits occurring in the addition are each represented by a Boolean combination of two or more corresponding parts, and • a fault protection circuit (for example, corresponding to the masked checksum tester 704) designed to • For each bit position, calculate a sum of the bits of the first parts of the input values, the bit of the first part of the output value, and the first part of a carry bit (carried over to the bit position; often zero for the first bit position) modulo 2 (see left-hand side of equation (6)), and generate a first checksum component by accumulating the calculated sums over the bit positions (see left-hand side of equation (8)). Accumulating the calculated sum means calculating the sum of the calculated sums. ◯ to calculate for each bit position a sum of the bits of the second parts of the input values ​​and the bit of the second part of the result value and the second part of a carry bit (carried over to the bit position, often it is zero for the first bit position) modulo 2 (see right-hand side of equation (6)), and to generate a second checksum part by accumulating the calculated sums over the bit positions (see right-hand side of equation (8)). ◯ to compare the first checksum part with the checksum for the second part, and ◯ to trigger a security measure in response to a mismatch between the first checksum part and the second checksum part.

[0062] In other words, according to various embodiments, an error countermeasure is provided for Boolean masked addition, resulting in Boolean masked addition with combined safety against error and side-channel attacks. The approach is based on storing intermediate results of the carry computation, thereby enabling the creation of checksums for input operands and the output of the safe addition. It further relies on an efficient ordering of masking components to prevent unintended recombinations, achieved through effective switching between ℤ and F2 This is achieved. Information about bit-level comparisons is retained to ensure effective error detection. Optionally, bit slicing can be used for increased performance.

[0063] According to one embodiment, a method as in Fig. 8 illustrated provided.

[0064] Fig. Figure 8 shows flowchart 800, which illustrates a method for protecting a Boolean masked addition from errors according to one embodiment.

[0065] In the 801, a Boolean masked addition of input values ​​is performed to produce a result value. Each input value has one bit for each bit position of a plurality of bit positions and is represented by a Boolean (for example, XOR) combination of two or more corresponding parts. The result value has one bit for each bit position of the plurality of bit positions and is represented by a Boolean (for example, XOR) combination of two or more corresponding parts. Carry bits that occur in the addition are also each represented by a Boolean (for example, XOR) combination of two or more corresponding parts. It is important to note that, generally, the same Boolean combination (for example, XOR) is used for the input values, the result value, and the carry bits.

[0066] In 802, the sum of the bits of the first parts of the input values ​​and the bit of the first part of the result value and the first part of a carry bit is calculated modulo 2 for each bit position, and a first checksum part (that is, a checksum for the first parts) is calculated by accumulating the calculated sums over the bit positions.

[0067] In 803, the sum of the bits of the second parts of the input values ​​and the bit of the second part of the result value and the second part of a carry bit is calculated for each bit position modulo 2, and a second checksum part (that is, a checksum for the second parts) is calculated by accumulating the calculated sums over the bit positions.

[0068] In 804, the first checksum part is compared with the second checksum part, and a security measure is triggered in response to a mismatch between the first checksum part and the second checksum part.

[0069] The following are several examples: Example 1 is a data processing device as described above (following the description of Fig. 7). Example 2 is the data processing device from Example 1, comprising an input designed to receive an array of first input values, comprising one input value for each of a plurality of input value positions, and an array of second input values, comprising one input value for each of the plurality of input value positions, wherein the Boolean masked addition processor is designed to perform Boolean masked addition for each input value position, wherein the input values ​​for Boolean masked addition for each input value position comprise the input value of the array of first input values ​​at the input value position and the input value of the array of second input values ​​at the input value position (see, for example, the output of Algorithm 2: the input array a and the input array b are added for each position (index 0, ..., w)). Example 3 is the data processing device from Example 2, which includes a bit-slice processor to convert the array of first input values ​​and the array of second input values ​​into a bit-sliced ​​domain. Example 4 is the data processing device from Example 3, where the Boolean masked addition processor and the error protection circuit are designed to work with the input values ​​in the bit-sliced ​​domain. Example 5 is the data processing device from Example 3 or 4, wherein the Boolean masked addition processor is designed to perform masked Boolean addition in parallel for multiple input value positions. Example 6 is the data processing device of any of Examples 2 to 5, wherein the fault protection circuit is designed to generate the first checksum part, generate the second checksum part, compare the first checksum part with the second checksum part, and trigger a safety action in response to the first checksum part and the second checksum part not matching for each Boolean masked addition performed by the Boolean masked addition processor on one input value position of the plurality of input value positions. Example 7 is the data processing device of Example 6, wherein the fault protection circuit is designed to generate the first checksum part, generate the second checksum part, and compare the first checksum part with the second checksum part in parallel for several Boolean masked additions performed by the Boolean masked addition processor for multiple input value positions of the plurality of input value positions. Example 8 is the data processing device from one of Examples 2 to 7, where the array of first input values ​​is an array of coefficients of a first polynomial, and the array of second input values ​​is an array of coefficients of a second polynomial. Example 9 is the data processing device of one of Examples 1 to 8, where the input values ​​comprise two operands and one input carry bit. Example 10 is the data processing device from one of Examples 1 to 9, where the result value is represented as a truncated result value (truncated to the bit size of the input values, i.e., the most significant bit is missing) and as an output carry bit. Example 11 is the data processing device of one of Examples 1 to 10, wherein the data processing device is designed to execute a cryptographic algorithm and to perform the Boolean masked addition as part of a processing operation of the cryptographic algorithm. Example 12 is the data processing device from Example 11, where the processing operation is a conversion between Boolean masking and arithmetic masking. Example 13 is the data processing device of Example 11 or 12, where the cryptographic algorithm is a lattice-based cryptographic algorithm. Example 14 is the data processing device from one of Examples 1 to 13, where the security measure is a security measure against a fault attack. Example 15 is a procedure as described with reference to Fig. 8 described.

[0070] The components of the data processing device (in particular the Boolean masked addition processor and the error protection circuit) and the method of Fig.8. These operations can be performed by a data processing device (for example, a computer or a microcontroller) with one or more data processing units or processors and one or more memories (storage of the data to be processed and instructions according to which the data is processed). The terms "data processing unit" and "processor" can be understood as any type of entity that enables the processing of data or signals. For example, the data or signals can be handled according to at least one (that is, one or more) specific functions performed by the data processing unit.A data processing unit may include or be composed of an analog circuit, a digital circuit, a logic circuit, a microprocessor, a microcontroller, a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a field-programmable gate array (FPGA), or any combination thereof. Any other means of implementing the respective functions described in more detail herein may also be understood to include a data processing unit, a processor, or a logic circuit. One or more of the procedural steps described in more detail herein may be performed (for example, implemented) by a data processing unit through one or more specific functions performed by the data processing unit.

[0071] According to one embodiment, a data processing device is provided comprising: means for Boolean masked addition for performing a Boolean masked addition of input values ​​to produce a result value, wherein each input value has one bit for each bit position of a plurality of bit positions and is represented by a Boolean combination of two or more corresponding parts; the result value has one bit for each bit position of the plurality of bit positions and is represented by a Boolean combination of two or more corresponding parts; and carry bits occurring in the addition are each represented by a Boolean combination of two or more corresponding parts; and computational means for calculating a sum of the bits of the first parts of the input values ​​and the bit of the first part of the result value and the first part of a carry bit modulo 2 for each bit position.and to generate a first checksum component by accumulating the calculated sums over the bit positions, and to calculate for each bit position a sum of the bits of the second parts of the input values ​​and the bit of the second part of the result value and the second part of a carry bit modulo 2, and to generate a first checksum component by accumulating the calculated sums over the bit positions, and, Security means for comparing the first checksum part with the second checksum part, and for triggering a security measure in response to a mismatch between the first checksum part and the second checksum part.

[0072] Although specific embodiments have been illustrated and described herein, those skilled in the art will recognize that a multitude of alternative and / or equivalent implementations can replace the specific embodiments shown and described without departing from the scope of the present invention. This application is intended to cover any adaptations or variations of the specific embodiments discussed herein. Therefore, this invention is to be limited only by the claims and their equivalents. Reference sign 100 processing devices 101 CPU 102 MB RAM 103 NVM 104 Crypto module 105 Bus 106 Analog Module 107 VO interface 108 LBC core 109 AES kernel 110 SHA core 111 ECC core 112 HRNG 200 Masked AND gate 201 AND gate 600 Flowchart 601-611 Processing 700 Hardware device 701 Input / Output Interface 702-bit slice processor 703 Processor for Boolean masked addition 704 checkers for masked checksums 705 Control 800 Flowchart 801-804 Processing

Claims

Data processing device (100, 700) comprising: a Boolean masked addition processor (703) designed to perform a Boolean masked addition of input values ​​to produce a result value, wherein each input value has one bit for each bit position of a plurality of bit positions and is represented by a Boolean combination of two or more corresponding parts, the result value has one bit for each bit position of the plurality of bit positions and is represented by a Boolean combination of two or more corresponding parts, and carry bits occurring in the addition are each represented by a Boolean combination of two or more corresponding parts;a fault protection circuit (704) designed to calculate, for each bit position, a sum of the bits of the first parts of the input values ​​and the bit of the first part of the result value and the first part of a carry bit modulo 2, and to generate a first checksum component by accumulating the calculated sums over the bit positions; to calculate, for each bit position, a sum of the bits of the second parts of the input values ​​and the bit of the second part of the result value and the second part of a carry bit modulo 2, and to generate a second checksum component by accumulating the calculated sums over the bit positions; to compare the first checksum component with the second checksum component; and to trigger a safety action in response to a mismatch between the first checksum component and the second checksum component. Data processing device (100, 700) according to claim 1, comprising an input configured to receive an array of first input values ​​comprising an input value for each of a plurality of input value positions, and an array of second input values ​​comprising an input value for each of the plurality of input value positions, wherein the Boolean masked addition processor (703) is configured to perform the Boolean masked addition for each input value position, wherein the input values ​​for the Boolean masked addition for each input value position comprise the input value of the array of first input values ​​at the input value position and the input value of the array of second input values ​​at the input value position. Data processing device (100, 700) according to claim 2, comprising a bit-slice processor (702) to convert the array of first input values ​​and the array of second input values ​​into a bit-sliced ​​domain. Data processing device (100, 700) according to claim 3, wherein the Boolean masked addition processor (703) and the error protection circuit (704) are designed to work with the input values ​​in the bit-sliced ​​domain. Data processing device (100, 700) according to claim 3 or 4, wherein the Boolean masked addition processor (703) is designed to perform Boolean masked addition in parallel for multiple input value positions. Data processing device (100, 700) according to one of claims 2 to 5, wherein the fault protection circuit (704) is configured to generate the first checksum component, generate the second checksum component, compare the first checksum component with the second checksum component, and trigger a safety measure in response to the fact that the first checksum component and the second checksum component do not match for each Boolean masked addition performed by the Boolean masked addition processor (703) for one input value position of the plurality of input value positions. Data processing device (100, 700) according to claim 6, wherein the fault protection circuit is designed to generate the first checksum component, generate the second checksum component, and compare the first checksum component with the second checksum component in parallel for several Boolean masked additions performed by the Boolean masked addition processor (703) for several input value positions of the plurality of input value positions. Data processing device (100, 700) according to one of claims 2 to 7, wherein the array of first input values ​​is an array of coefficients of a first polynomial, and the array of second input values ​​is an array of coefficients of a second polynomial. Data processing device (100, 700) according to one of claims 1 to 8, wherein the input values ​​comprise two operands and an input carry bit. Data processing device (100, 700) according to one of claims 1 to 9, wherein the result value is represented as a truncated result value and an output carry bit. Data processing device (100, 700) according to one of claims 1 to 10, wherein the data processing device is designed to execute a cryptographic algorithm and to perform Boolean masked addition as part of a processing operation of the cryptographic algorithm. Data processing device (100, 700) according to claim 11, wherein the processing operation is a conversion between Boolean masking and arithmetic masking. Data processing device (100, 700) according to one of claims 11 to 12, wherein the cryptographic algorithm is a grid-based cryptographic algorithm. Data processing device (100, 700) according to one of claims 1 to 13, wherein the security measure is a security measure against a fault attack. Method for protecting a Boolean masked addition from errors, comprising: performing a Boolean masked addition of input values ​​to produce a result value, wherein each input value has one bit for each bit position of a plurality of bit positions and is represented by a Boolean combination of two or more corresponding parts, the result value has one bit for each bit position of the plurality of bit positions and is represented by a Boolean combination of two or more corresponding parts, and carry bits occurring in the addition are each represented by a Boolean combination of two or more corresponding parts;Calculate, for each bit position, a sum of the bits of the first parts of the input values, the bit of the first part of the result value, and the first part of a carry bit, modulo 2, and generate a first checksum component by accumulating the calculated sums across the bit positions; calculate, for each bit position, a sum of the bits of the second parts of the input values, the bit of the second part of the result value, and the second part of a carry bit, modulo 2, and generate a second checksum component by accumulating the calculated sums across the bit positions; compare the first checksum component with the second checksum component; trigger a security measure in response to a mismatch between the first checksum component and the second checksum component.

Images