How to optimize the execution of crystal-dilithium post-quantum cryptography generation
The method optimizes crystal-dilithium signature generation by performing rejection tests on partial polynomial vectors and storing coefficients in packed format, addressing the memory constraints of resource-poor systems and enhancing security against quantum attacks.
Patent Information
- Application Number
- JP2025546466
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2023-02-21
- Filing Date
- 2024-02-15
- Publication Date
- 2026-02-26
AI Technical Summary
The increasing computational power of quantum computers poses a threat to classical cryptography methods like RSA or ECDSA, making them vulnerable to attacks, and lattice-based schemes like Dilithium have a memory footprint that is too large for resource-poor systems, especially those without dedicated NVM, which can be difficult to accommodate.
A method for generating crystal-dilithium post-quantum digital signatures that reduces memory footprint by performing rejection tests on partial polynomial vectors and storing coefficients in a packed format, allowing for efficient signature generation in resource-constrained devices.
The method significantly reduces memory usage and computation time by discarding unnecessary vectors from memory and storing coefficients in compressed form, enabling secure signature generation in devices with limited RAM.
Smart Images
Figure 2026506780000001_ABST
Abstract
Description
[Technical Field]
[0001] The present invention relates to the field of cryptography and related cryptographic devices, and more particularly to improvements to dilithium lattice-based systems. [Background technology]
[0002] The increasing computational power of quantum computers poses increasing threats to the security of classical cryptography methods such as RSA or ECDSA. Such methods will eventually become completely vulnerable to attacks carried out using quantum computers. Therefore, work is underway to develop new, efficient methods that are resistant to such attacks.
[0003] Lattice-based schemes have been proven resistant to quantum computer attacks, and among this class of schemes, Dillithium and Kyber have been selected by NIST to become post-quantum cryptography standards to support signing and encryption, respectively.
[0004] The Dilithium method has a footprint that can be as high as approximately 30 kilobytes of memory per invocation. Furthermore, the memory footprint of this method increases with the security level of the method, up to level 5. This footprint is expected to continue to increase due to future updates.
[0005] Such a footprint is approximately four times that of RSA cryptography and can be difficult to accommodate in resource-poor computing systems, especially those without dedicated NVM for the crypto engine, which may have 48 kB or less of RAM for system microcode, crypto engine, and user data.
[0006] Therefore, there is a need to improve the efficiency of the Dilithium scheme by reducing its memory footprint. Summary of the Invention
[0007] Therefore, for this purpose, according to a first aspect, the invention provides a method for the crystal-dilithium post-quantum digital signature of a message M with a private key sk=(ρ, K, tr, s1, s2, t0).
[0008]
number
[0009] By doing so, at least the first test vector r0 may be discarded from memory before calculating the second test vector z, which allows for reducing the memory footprint of the signature generation process.
[0010] According to one embodiment, generating either the first or second test vector and verifying whether the test vector satisfies the condition may include generating polynomial coefficients of the test vector one by one, and after one polynomial coefficient of the vector is generated, verifying whether the polynomial coefficient satisfies the condition before generating the next polynomial coefficient of the test vector.
[0011] By doing so, only one coefficient of the test vector is stored at a time instead of storing the complete vector before testing them.
[0012] The method according to the first aspect further comprises: i The method may include storing the coefficients of in a packed format before using them to generate the signature.
[0013] This allows for a reduction in the memory footprint of the coefficients of the second test vector, while keeping these values available for signature generation.
[0014] The method according to the first aspect includes: i This may include storing the coefficients of in a packed format after their generation.
[0015] As an example, n=256 and q=2^23-2^13+1.
[0016] According to a second aspect, the invention therefore also relates to a computer program product directly loadable into the memory of at least one computer, comprising software code instructions for carrying out the steps of the method according to the first aspect when the product is run on a computer.
[0017] According to a third aspect, the invention therefore also relates to an encryption device comprising a processor and a memory configured to carry out the steps of the method according to the first aspect. [Brief explanation of the drawings]
[0018] The following description and the annexed drawings set forth in detail certain illustrative aspects and indicate but a few of the various ways in which the principles of the embodiments may be employed. Other advantages and novel features will become apparent from the following detailed description when considered in conjunction with the drawings, and the disclosed embodiments are intended to include all such aspects and their equivalents. [Figure 1] 1 is a schematic diagram of an encryption device according to one embodiment of the present invention; [Figure 2] 1 is a schematic diagram of key generation, signature generation, and signature verification processes of the Dilithium cryptosystem. [Figure 3a] FIG. 2 is a schematic diagram of signature generation according to one embodiment of the present invention; [Figure 3b] FIG. 2 is a schematic diagram of signature generation according to one embodiment of the present invention; [Figure 4] 2 illustrates a schematic diagram of an example of signature generation according to an embodiment of the present invention; [Figure 5] 1 is a schematic diagram of the supporting algorithms of the Dilithium cryptosystem. [Figure 6] 1 is a schematic diagram of the supporting algorithms of the Dilithium cryptosystem. [Figure 7] 4 illustrates schematically another example of signature generation according to an embodiment of the present invention; DETAILED DESCRIPTION OF THE INVENTION
[0019] The present invention relates to a method and associated device for optimizing the performance of the generation of a crystal-dilithium post-quantum digital signature σ of a message M using a private key sk.
[0020] The methods and related devices described below are improvements to existing implementations of the Crystals-Dilithium signature scheme described in "CRYSTALS-Dilithium Algorithm specifications and supporting documentation (Version 3.1)" by S. Bai, L. Ducas, E. Kiltz, T. Lepoint, V. Lyubashevsky, P. Schwabe, G. Seiler, and D. Stehle, February 2021.
[0021] For the remainder of this document, as well as the references cited above: The private key sk is equal to (ρ, K, tr, s1, s2, t0), where ρ, K, and tr are 256-bit binary values, and t0 is a polynomial vector of length k, where k is an integer. Details of private key generation can be found in the references mentioned above and are reproduced in Figure 2. s1 and s2 are vectors of length l and k, respectively, of elements of the ring Rq = Zq[X] / (Xn+1), where l, n, and q are integers, and their coefficients are lower than a first predetermined value η, and the set of such vectors is
[0022]
number
[0023]
number
[0024] As an example, n may be chosen to be equal to 256 and q may be chosen to be equal to 2^23-2^13+1 (where "^" is the exponentiation operator). The integers k and l that define the size of matrix A may be chosen depending on the desired security level of the cryptographic process.
[0025] The generated signature σ is
[0026]
number
[0027] Such signature generation may be performed by a cryptographic device 100. Such a device may be, for example, a personal computer or a server, or may be a tamper-resistant device such as a Hardware Security Module (HSM), or may be a smaller device such as a smart chip.
[0028] FIG. 1 is a schematic diagram of such a cryptographic device 100. It may include a processor 101 connected via a bus 102 to a random access memory (RAM) 103, a read-only memory (ROM) 104, and / or a non-volatile memory (NVM) 105. It may further include a communication interface 106 connected to the bus, which may be used to connect the device to various forms of wireless networks, such as wide area networks, WiFi networks, or mobile telephone networks, or to wired networks such as Ethernet networks. It may also include an input / output interface 107 that provides an interface to an administrator, such as one or more screens, loudspeakers, a mouse, a tactile surface, a keyboard, etc. The cryptographic device may further include a coprocessor 108. This coprocessor may perform some of the operations to be performed in the frame of execution of the signature process. For example, it may be a hardware accelerator such as an FPGA or an ASIC. This coprocessor may be a separate chip within the cryptographic device or may be included together with the processor in an SoC. As an example, such a coprocessor may be used to calculate polynomial multiplication or perform matrix expansion.
[0029] The signature generation process of the scheme described in "CRYSTALS-Dilithium Algorithm specifications and supporting documentation (Version 3.1)" by S. Bai, L. Ducas, E. Kiltz, T. Lepoint, V. Lyubashevsky, P. Schwabe, G. Seiler and D. Stehle, February 2021 (Figure 4), is reproduced here in Figure 2.
[0030] The signature generation process uses rejection sampling to ensure the security of the generated signature. Candidate signature elements are generated and subjected to rejection tests. Each time one of these tests fails, the candidate signature is rejected and new candidate signature elements are generated until all rejection tests are satisfied.
[0031] More precisely, the algorithm of Figure 2 includes a simultaneous test on line 21 of the signing algorithm against a polynomial vector z, which is the second element of the signature to be generated, and another polynomial vector r. In the following description, polynomial vector r will be referred to as the first test vector, and polynomial vector z will be referred to as the second test vector. If this test is successful, then on line 24, a fourth polynomial vector h is generated, and the value c with the last element t of the previously generated challenge c and private key sk is added. * Another test is performed simultaneously for t0 and t1.
[0032] To generate the values to be tested in these tests, several values must be generated and stored in memory, namely: a masking vector y of length l needed to calculate the second test vector z, a first polynomial vector w of length k necessary to calculate the first test vector r0 and the fourth polynomial vector h; The first test vector r0 and the challenge c needed to calculate the value ct0, as well as the first signature part
[0033]
number
[0034] Assuming that each coefficient of a polynomial occupies a 32-bit memory word in memory and n=256, each polynomial occupies 1 kilobyte. Assuming that the size of the challenge c is also 1kB, then the maximum size is 2 * l+3 * This results in a global memory footprint of k+1kB.
[0035] To reduce this footprint, the first idea of our method is to perform separate tests on the first test vector r0 and the second test vector z. In fact, the evaluation of the norms of r0 and z, compared with the threshold, is completely independent. This property was part of the correctness proof in S. Bai, L. Ducas, E. Kiltz et al., "CRYSTALS-Dilithium: Digital Signatures from Module Lattices," (2021, p. 38). As a result, it is possible to generate the first test vector r0 and check whether it satisfies the appropriate conditions before calculating the second test vector z. Since the second test vector is equal to y + cs1, it is not calculated from either the third polynomial vector w0 or the first test vector r0. Neither of these two vectors is part of the signature. Therefore, it is possible to discard them from memory before calculating the second test vector z, which leads to a significant reduction in the amount of memory occupied simultaneously by the signature process. Similarly, vector s2 and value cs2 are no longer used after the first test vector r0 passes its test and can be discarded before computing the second test vector z.
[0036] The second idea of the method according to the invention is that instead of performing tests on the entire vector, tests are performed on a first test vector r0 and a second test vector z for each coefficient. As a result, it is no longer necessary to keep the entire test vector available in memory. Instead of storing vectors of size kkB and lkB, only one 1 kB coefficient for each vector is stored at the same time.
[0037] The third idea of the method according to the invention is to store more values in a compressed format, also called packed format. The compressed values are denoted using ~. In the reference algorithm of Fig. 2, before the end of the signature generation process, only the challenge c is stored in a compressed format,
[0038]
number
[0039] This allows offloading the unpacked versions of these values from memory. Assuming a compression factor of approximately 0.5, this saves approximately k / 2 kB of memory from storing the second polynomial vector w1 and 1 / 2 kB from storing the second test vector z. Even higher compression factors up to 0.9 may be achieved for storing the fourth polynomial vector h.
[0040] In the following paragraphs, we consider the signature of message M as explained in Figures 3a and 3b.
[0041]
number
[0042] In a first step S1, the encryption device generates a masking vector y.
[0043] In a second step S2, the encryption device calculates a first polynomial vector w=Ay.
[0044] In a third step S3, the encryption device encrypts all polynomial coefficients w in Ay for each i=0,...,k-1. i But wi =w1 i 2γ2+w0 i Determine a second polynomial vector w1 and a third polynomial vector w0 corresponding to the first polynomial vector w, where |w0 i |≦γ2
[0045] In a fourth step S4, the encryption device generates a challenge c based on the message M and the second polynomial vector w1.
[0046] The encryption device then performs rejection tests in a fifth step S5 to determine whether the masking vector y generated in the first step allows for the generation of a secure signature. These rejection tests include testing whether at least the first test vector r0 and then the second test vector z satisfy predetermined conditions. The encryption device may perform additional tests in the fifth step S5, such as tests on the value ct0 and tests on a fourth polynomial vector h described below.
[0047] More precisely, in the first sub-step S51 of the fifth step S5, following the determination of the third polynomial vector w0, the encryption device generates a first test vector r0 as w0-cs2 and checks whether the first test vector r0 satisfies a first condition. q It may be generated as (w-cs2,2γ2), and the function decomposition q is defined in Figure 5. The third polynomial vector w0 is no longer used in subsequent steps of the signature generation process and may therefore be discarded from memory at the end of the first sub-step S51 before the next step begins.
[0048] In a second sub-step S52, when the first test vector r0 satisfies the first condition, the encryption device can check whether the value ct0 verifies the third condition.
[0049] In a third sub-step S53, when the value ct0 verifies the third condition, the encryption device can generate a fourth polynomial vector h based on the second polynomial vector w1, the first test vector r0, and the value ct0, and check whether the fourth polynomial vector h verifies the fourth condition.
[0050] The first test vector r0 may be discarded from memory at the end of the third sub-step S53 before starting the next step, as it will no longer be used in subsequent steps of the signature generation process.
[0051] Next, in the fourth sub-step S54, if the first, third, and fourth conditions are met, the encryption device generates a second test vector z=y+cs1 and checks whether the second test vector z satisfies the second condition.
[0052] In a sixth step S6, when the first, second, third, and fourth conditions are met, the second test vector z and the fourth polynomial vector h may be used as the second and third elements, respectively, of a signature to be generated, and the signature is generated as a packed challenge vector.
[0053]
number
[0054] The signatures are
[0055]
number
[0056]
number
[0057]
number
[0058] If any of the first, second, third, and fourth conditions are not met in the first, second, third, or fourth substep, the encryption device restarts signature generation in the first step, and all steps and substeps from the first to fifth steps are repeated until all conditions are met and a signature is generated.
[0059] A detailed exemplary implementation of the calculations performed at all steps is given below.
[0060] In addition to reducing the memory footprint of the signature generation process, such a method of performing rejection sampling first for the first test vector r0 and then for the second test vector z also reduces the overall computation time of the signature generation. In fact, the second test vector z is calculated only after the first test vector r0 passes its test. Therefore, if other first test vectors r0 are generated and rejected before passing the test, the second test vectors z are not generated for these rejected first test vectors r0.
[0061] In one embodiment, generating either the first or second test vector and verifying whether the test vector satisfies the condition may include generating polynomial coefficients for the test vector one by one, and verifying whether the polynomial coefficient satisfies the condition after one polynomial coefficient for the vector is generated before generating the next polynomial coefficient for the test vector.
[0062] By doing so, it is no longer necessary to keep all the coefficients of the first test vector r0 available in memory at the same time. Similarly, it is no longer necessary to keep all the coefficients of the second test vector z available in memory at the same time. They can be generated and processed one at a time, then offloaded from memory before generating the next one.
[0063] Such vector coefficient calculation and processing may also be applied to the masking vector y, the first polynomial vector w, the second polynomial vector w1, the third polynomial vector w0, the fourth polynomial vector h, and the test value ct0, one at a time. An example is shown below.
[0064] In one embodiment, the encryption device may further include a second test vector z that satisfies a second condition when i is in {0,...,l-1}. i in packed form before using it to generate the signature. By doing so, the unpacked version of each coefficient can be discarded after it passes its test, as described in the previous paragraph, while still storing the value of the coefficient under packed form.
[0065] Similarly, the encryption device may generate a fourth polynomial vector h that satisfies the fourth condition for i in {0,...,k-1}. i It may be possible to store the coefficients of σ in packed form before using them for signature generation, and offload their unpacked versions from memory while keeping their packed versions in memory so that they can be unpacked for signature generation.
[0066] Similarly, the encryption device may generate the second polynomial vector w1 for i in {0,...,k-1} after the third step. i In a third substep S53, the coefficients of the fourth polynomial vector h may be stored in a packed format, where i is in {0,...,k-1}. i For the generation of coefficients of , it allows offloading their unpacked versions from memory while keeping their packed versions in memory.
[0067] The following paragraphs describe in detail an example of a first implementation form reproduced in Figure 4, in which the first test vector r0, the second test vector z, the first polynomial vector w, the second polynomial vector w1, the third polynomial vector w0, the fourth polynomial vector h, and the polynomial coefficients of the value ct0 are generated and / or tested one by one as described above. Furthermore, the coefficients of the second test vector z, the fourth polynomial vector h, and the second polynomial vector w1 are stored in a packed format, also as described above.
[0068] As a preliminary step S0', a matrix A is generated from the elements ρ of the private key using the function ExpandA defined in §5.3 of "CRYSTALS-Dilithium Algorithm specifications and supporting documentation (Version 3.1)" by S. Bai, L. Ducas, E. Kiltz, T. Lepoint, V. Lyubashevsky, P. Schwabe, G. Seiler, and D. Stehle, February 2021.
[0069] This function takes as input an element called seed ρ that matches the 256 bits used as input to the pseudorandom function. Depending on the variant of the Dilithium algorithm used, seed ρ can be used as input to the SHAKE-128 or AES-256-CTR function. In the first variant of SKAKE-128, seed ρ has the value 0≦256i+j<2 16 is absorbed as follows, where (i,j) represents the coefficient sampled as
[0070] When AES-256-CTR is used as the pseudorandom function, it is padded and extended with zeros to fit the value 256i+j, a 12-byte value called the nonce here. The output of the pseudorandom function is then scaled from 0 to 2 by setting the most significant bit of every third byte to zero and interpreting blocks of three consecutive bytes in little-endian byte order. 23 It is interpreted as a sequence of integers between -1 and
[0071] The value μ is generated as H(tr||M) where H is the hash function. The value κ is set to 0.
[0072] The value ρ′ is generated as H(K||μ), where K is the second element of the private key.
[0073] Then, in a first step S1′, the encryption device generates a masking vector y as ExpandMask(ρ′,κ) as defined in §5.3 of “CRYSTALS-Dilithium Algorithm specifications and supporting documentation” (Version 3.1) by S. Bai, L. Ducas, E. Kiltz, T. Lepoint, V. Lyubashevsky, P. Schwabe, G. Seiler, and D. Stehle, February 2021.
[0074] This function takes as input an element ρ' that fits into 512 bits and a nonce κ, where κ starts from 0 and is incremented by 1 for each polynomial sampled. Both inputs are passed to a pseudorandom function. Depending on the variant of the Dilithium algorithm used, the input ρ' can be used as input for either the SHAKE-256 or AES-256-CTR function. In the first case, in the SKAKE-256 variant, the seed 64 bytes of ρ' are concatenated with the value κ+i, represented by 2 bytes.
[0075] If AES-256-CTR is used as the pseudorandom function, then the 32 bytes of ρ′ are used as the key and the value κ+i is zero-padded to fit into 12 bytes, which are used as the nonce.
[0076] Since γ1 is a power of 2, the output of the pseudorandom function is directly interpreted as a sequence of integers between 0 and 2γ1-1 by taking 0 and either 18 or 20 bits of the output, depending on the Dilithium security level. The value γ1 is subtracted to obtain the desired coefficient in the interval [-γ1,γ1-1].
[0077] Then, the encryption device iteratively performs the second step S2′ and the third step S3′. At each iteration i of the second step, where i is in {0,...,k−1}, it calculates w i =(Ay) i One coefficient w of the first polynomial vector w is calculated by i Then, in the third step S3′ following the iteration i of the second step S2′, if i is in {0,...,k−1}, at each iteration i, the encryption device calculates w1 i , w0 i = decomposition q (w i , 2γ2) to calculate the corresponding i-th coefficient w1 of the third polynomial vector w0 corresponding to the decomposition of the second polynomial vector w1 and the first polynomial vector w. i i and w0 iDetermine the function Decompose q is defined in Figure 5. Coefficient w1 i Every time a is generated, it
[0078]
number
[0079] In a fourth step S4', the encryption device uses the function SampleInBall and the hash function
[0080]
number
[0081] The function SampleInBall is defined in §2.3 of "CRYSTALS-Dilithium Algorithm specifications and supporting documentation (Version 3.1)" by S. Bai, L. Ducas, E. Kiltz, T. Lepoint, V. Lyubashevsky, P. Schwabe, G. Stehle, and D. Stehle, February 2021.
[0082] The "SampleInBall" routine uses the SHAKE-256 algorithm to generate a random byte sequence from a value called a seed. The first τ bits in the first 8 bytes of the random stream are interpreted as τ random code bits in polynomial c, where each code bit can be either 0 or 1. The remaining 64-τ bits are discarded. The remainder of the random stream is used in a rejection sampling loop, where the next byte of the random stream from SHAKE-256 is interpreted as a number in the set {0,..,255}. The corresponding code is used to determine whether it is a value of 1 or -1.
[0083] A packed version of the generated challenge c may be generated as it is needed later in the sixth step S6' to generate the signature.
[0084] Then, to determine whether the masking vector y generated in the first step enables the generation of a secure signature, the encryption device iteratively performs the first, second, and third sub-steps S51', S52', and S53' of the fifth step S5' to perform rejection tests on the first test vector r0, the value ct0, and each coefficient of the fourth polynomial vector h.
[0085] If i in the first sub-step S51′ of the fifth step S5′ is in {0,...,k−1}, then at each iteration i, the encryption device i w0 i -cs2 i and check whether the infinity norm of this coefficient is lower than γ2-β. The coefficient w of the first polynomial vector w i The n elements of
[0086]
number
[0087]
number
[0088] Since the third polynomial vector w0 is no longer used in subsequent steps of the signature generation process, it may be discarded from memory at the end of the first sub-step S51' of the fifth step S5' before starting the next step.
[0089] Tested coefficient r0 of the first test vector r0 i If the test is passed, the encryption device performs iteration i of the second sub-step S52'. If i of the second sub-step S52' is in {0,...,k-1}, then at each iteration i, the encryption device performs iteration i of the value ct0. i Check whether the infinity norm of is lower than γ2.
[0090] If so, the encryption device performs the iteration i of the third sub-step S53'. If i of the third sub-step S53' is in {0,...,k-1}, at each iteration i, the encryption device performs the iteration i of the second polynomial vector w1. i Unpacks the fourth polynomial vector h and returns the i-th coefficient h i Calculate h i =MakeHint q (w1 i ,r0 i +ct0 i ,2γ2) is calculated using the MakeHint function defined in Figure 5. Then, the i-th coefficient h of the fourth polynomial vector h is calculated as i is all h i The fourth condition is to have the largest number of coefficients equal to 1 in
[0091]
number
[0092] The encryption device then calculates the next coefficient r0 of the first test vector r0. i+1 The iteration i+1 of the first sub-step S51' of the fifth step S5' is performed to generate the coefficient r0 of the first test vector r0 used in the iteration i of the third sub-step S53'. i may be discarded from memory at the end of the iteration of the third sub-step S53′ before starting the next iteration of the first sub-step S51′, since it is no longer used in subsequent steps of the signature generation process.
[0093] The encryption device iteratively performs the first sub-step S51', the second sub-step S52', and the third sub-step S53' until the first test vector r0, the value ct0, and all coefficients of the fourth polynomial vector h are successfully tested.
[0094] Next, in a fourth sub-step S54', the encryption device i =y i +cs1 i If the second test vector i is in {0,...,l-1}, we calculate the coefficient z i and each coefficient z of the second test vector z i Checks whether the infinity norm of is lower than γ1-β. After each coefficient successfully passes that test, it is packed and its unpacked version is freed from memory.
[0095] If any of these tests fail, the signature generation process returns to the first step to generate a new masking vector y. Because each coefficient of the first test vector r0, the value ct0, and the fourth polynomial vector h is tested before generating any of the others, the computational time spent generating the coefficients of these vectors before a test fails is reduced. Furthermore, if any coefficient of the first test vector r0, the value ct0, or the fourth polynomial vector h fails its test, no coefficients of the second test vector z are generated. The coefficients of the second test vector z are then also generated and tested one by one, ensuring that no coefficients are generated before verifying that all lower-index coefficients pass their tests.
[0096] Finally, in a sixth step S6', if the first, second, third, and fourth conditions are met, the second test vector z and the fourth polynomial vector h may be used as the second and third elements, respectively, of a signature to be generated, the signature being generated from the second test vector, from the packed challenge, and from the fourth polynomial vector h. Because the coefficients of the second test vector z and the fourth polynomial vector h were packed in previous steps of the method, they are unpacked to make available unpacked versions of the second test vector z and the fourth polynomial vector h.
[0097] Another embodiment of the method according to the invention is presented in Figure 7. This embodiment differs from the previous one in the following respects.
[0098] First, the matrix A is not completely generated in the preliminary step S0′, and the masking vector y is not completely generated in the first step S1′. Instead, in iteration i of the first step S1′, the encryption device uses a function ExpandColumn, which is similar to the ExpandA function except that it outputs only one column of the matrix, to generate a single coefficient y for i of the masking vector y in {0,...,l-1}. iIn the second step S2', in an iteration i, a vector w' whose coefficients each contain a part of the coefficients of the first polynomial vector w is generated as follows: w'=a * y i The first and second steps are repeated l times, and each generated vector w is added to the accumulator w. After the last iteration of the second step, the accumulator value is equal to the first polynomial vector w = Ay. By doing so, the size occupied in memory by just one column of matrix A at any time is l times smaller than the size of matrix A.
[0099] Second, in a fourth step S4', the encryption device first
[0100]
number
[0101]
number
[0102]
number
[0103]
number
[0104] Finally, the final difference is how the masking vector y is managed. In the implementation of Figure 4, the masking vector is generated entirely in the first step and kept in memory for future use in the fourth sub-step S54' of the fifth step. In the implementation of Figure 7, for i in the masking vector in {0,...,k-1}, each coefficient y i is, w'=ay i The memory usage is reduced from 1 kB to store the complete masking vector to only 1 kB to store one coefficient of the masking vector at a time. To do so, the corresponding coefficient z of the second test vector z is i In order to calculate the coefficients y of the masking vector in the fourth sub-step S54' of the fifth step, i However, each coefficient y of the masking vector needs to be regenerated one by one. i This additional generation of is not performed when a rejection occurs due to a failed test performed in one of the first three substeps of step 5. It is only needed after all coefficients have the first test vector with value ct0 and the fourth polynomial vector h and have successfully passed these tests.
[0105] 7, the memory occupied by the masking vector at any time is minimized to 1 kB, but at the cost of storing all the generated values w in an accumulator to compute the first polynomial vector w. At the end of the last iteration of the second step, this accumulator occupies kkB of memory.
[0106] To further minimize memory footprint, another embodiment may further reduce the coefficients w of the first polynomial vector w. i Calculate w1 one by one as in the implementation in Figure 4. i and w0 i However, in this last embodiment, if i in the second step S2′ is in {0,...,k−1}, then in iteration i, the coefficient w i Ay iInstead of calculating as i is the jth term Aji in {0,...,l-1} * y j are calculated one by one, and then summed in the accumulator to get the final value
[0107]
number
[0108] According to a second aspect, the present invention relates to a computer program product directly loadable into the memory of at least one computer, comprising software code instructions for carrying out the steps of the methods described herein above, when the product is run on a computer.
[0109] According to a third aspect, the invention also relates to an encryption device 100 comprising a processor and a memory as described above and adapted to carry out the steps of the method as described above.
[0110] In addition to these features, the computer program and encryption device according to the second and third aspects of the invention may be configured to perform or comprise any other feature previously described herein.
[0111] As a result, the crystal-dilithium signature generation process can be performed with a much smaller memory footprint because at least the first test vector r0 can be discarded from memory before calculating the second test vector z. Furthermore, the memory footprint can be further reduced by generating and testing test vectors one coefficient at a time and by packing the coefficients of the second polynomial vector w1, the second test vector z, and the fourth polynomial vector h as soon as possible.
Claims
1. Crystal-dilithium post-quantum digital signature of message M with private key sk = (ρ, K, tr, s1, s2, t0) [Equation 1] 1. A method for optimizing the performance of the generation of ρ, K, tr are 256-bit binary values, s1 and s2 are vectors of length l, respectively k, of elements of a ring Rq whose coefficients are lower than a first predetermined value η, and t0 is a polynomial vector of length k with integers k, l, n, and q; The crystal-dilithium post-quantum digital signature generation includes: a) generating a masking vector y of polynomial length l having coefficients less than a second predetermined value γ1 (S1); b) calculating (S2) a first polynomial vector w=Ay of length k, where A is a k×l matrix each of whose entries is a polynomial in the ring Rq=Zq[X] / (Xn+1); c) determining (S3) a second polynomial vector w1 and a third polynomial vector w0, both of length k, ｉ is w for i in 0,...,k-1 ｉ = w1 ｉ ・2γ2+w0 ｉ It is written as w0 ｉ ≦γ2, where γ2 is a third predetermined value; and d) generating a challenge c based on the message and the second polynomial vector w1 (S4); e) performing a rejection test (S5), which includes testing whether a test vector generated from the vector, the challenge, and the private key satisfies a predetermined condition; - if the condition is not met, restarting the signature generation from step a), otherwise generating the signature (S6), repeating steps a), b), c), d), and e) until the condition is met; The method is performed by an encryption device (100) comprising a processor (101) and a memory (103), Executing the rejection test (S5) After determining the third polynomial vector w0, generate a first test vector r0 as w0-cs2, and check whether the first test vector r0 satisfies a first condition (S51); - if the first condition is satisfied, generating a second test vector z=y+cs1 and checking whether the second test vector z satisfies a second condition (S54); If the second condition is met, the signature is generated from the second test vector (S6).
2. 2. The method of claim 1, wherein generating either the first or second test vector and verifying whether the test vector satisfies a condition comprises generating polynomial coefficients of the test vector one by one, and verifying whether the polynomial coefficient satisfies a condition after one polynomial coefficient of the vector is generated and before generating a next polynomial coefficient of the test vector.
3. The second test vector z that satisfies the second condition ｉ 3. The method of claim 2, comprising storing the coefficients of {overscore (x)} in a packed format before using them to generate the signature.
4. The second polynomial vector w1 ｉ 3. The method of claim 2, further comprising storing the coefficients of .times. ...
5. The method of any one of claims 1 to 4, wherein n=256 and q=2^23-2^13+1.
6. A computer program product directly loadable into the memory of at least one computer, said computer program product comprising software code instructions for carrying out the steps of any one of claims 1 to 5 when said product is run on said computer.
7. An encryption device (100) comprising a processor (101) and a memory (103) configured to perform the steps of any one of claims 1 to 5.