Secure processing system and method
By splitting cryptographic keys into multiple secret shares and performing masking calculations in a secure processing environment, the problems of limited secure memory and side-channel attacks are solved, enabling efficient key storage and strong security.
Patent Information
- Application Number
- CN202380046850.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2022-05-26
- Filing Date
- 2023-05-25
- Publication Date
- 2025-01-24
AI Technical Summary
In a secure processing environment, limited security memory cannot effectively store a large number of password keys, and there is a risk of side channel attacks.
By dividing the password key into multiple secret shares and performing masking calculations in the safe processing environment, the packaging key is generated to store and import the key to the key export and import of the key in the unsatisfactory memory.
Realize efficient storage and processing password keys in limited security memory, enhance the resistance of opposite channel attacks, and ensure the security of the password key.
Smart Images
Figure CN119366140A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to performing operations, such as cryptographic operations, in a secure processing environment. The present disclosure is relevant to post-quantum cryptographic systems that utilize masking as a countermeasure against side-channel attacks. Background Art
[0002] Cryptographic operations involve the use of cryptographic keys. In symmetric encryption systems where the same key is used to encrypt and decrypt messages, it is necessary to protect the key from exposure to malicious parties. Similarly, for asymmetric encryption systems that utilize private and public keys, it is necessary to protect the private key from exposure to malicious parties. To protect the security of cryptographic keys, it is known to perform cryptographic operations in a secure processing environment that includes a secure memory and a secure encryption processor. An example of such a secure processing environment is a hardware security module.
[0003] A problem with secure processing environments is that the amount of secure memory in the secure processing environment can be limited, preventing a large number of cryptographic keys from being stored in the secure memory. To address this problem, it is known to use a short symmetric key to generate a wrapped key for encrypting the cryptographic key, which can be stored in a less secure memory outside the secure processing environment, where only the short symmetric key is permanently stored in the secure memory of the secure processing environment. Examples of such less secure memories include untrusted system main memories and external storage such as hard disk drives and cloud-based data storage.
[0004] To perform operations using the wrapped key, the secure processing environment requires: an export function that encrypts the cryptographic key to generate the wrapped key and exports the wrapped key to the less secure memory; and a load function that imports the wrapped key from the less secure memory into the secure processing element and decrypts the wrapped key to recover the cryptographic key. In this way, the cryptographic key is never revealed in an unwrapped form outside the secure processing environment.
[0005] Processing performed in a secure processing environment can be vulnerable to side-channel attacks, in which an adversary learns side-channel information about the physical execution of an algorithm. Side-channel information can be derived from many sources such as run time, electromagnetic emissions, energy consumption, and acoustic emissions. One countermeasure proposed against side-channel attacks is masking, which relies on techniques from the fields of secret sharing and multi-party computation (MPC). As an example, given a sensitive value Masking x involves representing x as a tuple where d is the number of shares (also referred to as the sharing order), and in the context of masking, d - 1 is typically referred to as the masking order, such that (i) and (ii) t < d distinct x iAny subset thereof appears to be uniformly random. When d is clear from the context, the tuple may be denoted by the symbol or . The principle of masking is that an attacker with the ability to learn the values of t < d variables x i will learn nothing about x.
[0006] As discussed above, shares of a cryptographic key may be used instead of the cryptographic key itself to perform cryptographic processing operations in a secure processing environment. The present disclosure addresses techniques for securely deriving shares of a cryptographic key. SUMMARY OF THE INVENTION
[0007] Aspects of the invention are set out in the appended independent claims. Certain variations of the invention are then set out in the appended dependent claims. BRIEF DESCRIPTION OF THE DRAWINGS
[0008] Examples of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which:
[0009] Figure 1 is a schematic diagram showing the main components of a cryptographic system according to an example;
[0010] Figure 2 is a flowchart schematically showing operations performed to derive a plurality of shares corresponding to a masked cryptographic key in a wrapped form;
[0011] Figure 3 is a flowchart schematically showing operations performed to load wrapped data representing a cryptographic key and generate a plurality of shares corresponding to a masked cryptographic key; and
[0012] Figure 4 is a schematic diagram showing an example in which masking is applied to secret data. DETAILED DESCRIPTION
[0013] INTRODUCTION
[0014] Certain examples described herein relate to a cryptographic system implemented in a secure processing environment that forms part of a communicatively coupled computing system and securely performs cryptographic operations required by the computing system. For example, the cryptographic system may be provided as a system-on-chip device for inclusion in a larger computing circuit board and / or integrated circuit. The cryptographic system may be implemented in silicon, i.e., as a separately manufactured integrated circuit design (e.g., as a dedicated integrated circuit—ASIC), or implemented together with a larger computing system circuit, and / or implemented as a field programmable gate array (FPGA), for example, in the form of a specific configuration of an FPGA programmed with a suitable hardware description language. In an example, the secure processing environment of the cryptographic module is formed by a hardware security module that provides a trusted processing environment and secure memory. The hardware security module may be tamper-resistant, such as by using "encapsulated" hardware, and / or tamper-evident, so as to prevent and / or detect attempts to physically access components within the hardware security module.
[0015] The cryptographic system can be used as a "post-quantum" cryptographic module or coprocessor, for example, thereby allowing one or more processors of a communicatively coupled computing system to offload complex "post-quantum" cryptographic operations to achieve fast, secure computations. For example, the cryptographic system can be configured to perform key establishment and digital signature functions on behalf of the computing system. The cryptographic system has a security boundary such that other devices and integrated circuits of the computing system (including the computing system itself) do not have access to secret data manipulated within the cryptographic system. The cryptographic system can be configured to autonomously perform post-quantum cryptographic operations as part of a larger hardware system (such as a larger ASIC or FPGA design).
[0016] The term "post-quantum" is used herein to describe cryptographic operations and functions that are protected from attacks by quantum computers. It is a well-known term in the field of cryptography. For example, many popular public key algorithms are not post-quantum secure and can be efficiently cracked using a sufficiently powerful quantum computer. These "quantum-unsafe" cryptographic algorithms include those based on the integer factorization problem, the discrete logarithm problem, or the elliptic curve discrete logarithm problem; all of which can be easily solved on a sufficiently powerful quantum computer using Shor's algorithm. Operations and functions that have been proven to be post-quantum secure include those based on one or more of the following: lattice-based cryptography; multivariate cryptography; hash-based cryptography; encoding-based cryptography; and supersingular elliptic curve homology cryptography.
[0017] The cryptographic system of the example is suitable for use in a variety of computing systems from Internet servers to embedded devices. In one implementation, the cryptographic system can be provided as part of a cryptographic system-on-chip (SoC), which can allow many low-cost embedded devices to implement "post-quantum" cryptography and provide a "post-quantum" security system. For example, the functions implemented by the cryptographic math unit can allow the rapid execution of coded or lattice-based cryptographic operations, for example, by unloading many common low-level binary logic functions, such as integer addition, subtraction and / or multiplication. The cryptographic system can be configured or preprogrammed to have a set of available functions that can be updated over time. The cryptographic system can quickly calculate certain functions by avoiding the need to load and interpret the different instructions required by the processor of the coupled computing system. The cryptographic system can be considered to be a specialized computing device (i.e., computer) designed to be integrated with a larger general-purpose computing device (e.g., used as a computer within a computer).
[0018] Example Password System
[0019] Figure 1 A computing system 1 according to an example is shown. The computer system 1 includes at least one processor 3, input / output devices 5, a main system memory 7, and a removable memory 9, such as a hard disk device, etc. In addition, the computing system 1 includes a cryptographic system 11, which provides a secure processing environment in which cryptographic processing operations are performed. In this example, the cryptographic system 11 is embodied in a hardware security module.
[0020] The cryptographic system 11 comprises a processor 13, a secure memory 15 and an input / output device 17 which enables communication with the rest of the computer system 1. The secure memory 15 comprises a data memory 17, a program memory 19 and a working memory 21. The data memory 17 stores a confidentiality key K c 21 and the integrity key K i The program memory 19 stores a key derivation module 27, a key loading module 29 and a cryptographic processing module 31.
[0021] Processor 13 may include a reduced instruction set computer (RISC) processor, such as a RISC-V central processing unit (CPU). Processor 13 may include a 32-bit or 64-bit microprocessor (e.g., such as an RV32-I / E- / M / C Pluto core). Processor 13 may include one or more processing cores.
[0022] In this example, computer system 1 also has access to cloud storage via network communications (eg, via the Internet).
[0023] The cryptographic system 11 uses cryptographic keys to perform cryptographic processing operations. The cryptographic processing operations include: a key establishment function, which includes one or more of encryption and decryption; a digital signature function, which includes one or more of digital signature generation and digital signature verification; and a stateful hash-based signature. In this example, the cryptographic system 11 is optimized for lattice-based and encoding-based cryptography (and other post-quantum methods) and "big integer" arithmetic (e.g., arithmetic on large integer values defined by n bits, where n can be, for example, 32 or 64).
[0024] In certain examples described herein, the security of the cryptographic system 11 is increased using masked computing, in which sensitive data processed by a computer system is represented within the cryptographic system by multiple secret shares, such that all of the secret shares are required to derive information about the sensitive data. Masked computing provides protection against side channel attacks by manipulating not the sensitive data itself but rather the shares of the sensitive data, which attempt to determine the bit pattern of the data being manipulated by the cryptographic system 11 based on secret information leaked, for example, via electromagnetic emissions, fluctuations in power usage, timing of operations, or other unintended side channels. The number of data shares may be configurable and set by a parameter of the cryptographic system 11 (e.g., there may be d data shares). Typical values for the number of shares d are two or three, but other numbers of shares are possible.
[0025] The cryptographic system 11 may use many different cryptographic keys to perform cryptographic operations, and in particular, for asymmetric cryptographic operations, the number of bits in each cryptographic key may be large. The amount of non-volatile memory in the secure memory 15 may not be sufficient to store all cryptographic keys, and this problem is exacerbated when the cryptographic keys are represented by multiple shares. Therefore, the key derivation module 27 enables the cryptographic keys to be stored in an encrypted form outside the cryptographic system 11, while the key loading module 29 enables the encrypted cryptographic keys to be imported into the cryptographic system 11 and converted into a new set of secret shares for use in cryptographic processing operations within the cryptographic system 11. The operation of the key derivation module 27 and the key loading module 29 will now be described in more detail.
[0026] Key derivation module
[0027] Key derivation module 27 includes a set of processor-implementable instructions that, when implemented by processor 13, process a plurality of shares corresponding to a cryptographic key to generate ciphertext that can be securely exported outside of cryptographic system 11. In this example, the ciphertext is exported as part of a data packet that includes an integrity tag that enables verification of the integrity of the data stored in the data packet.
[0028] In this example, Figure 2 is a flowchart showing the main operations performed by the key derivation module 27. As shown, in this example, the key derivation module 27 uses the function E(K c ,N) at S1 to generate the cover data t, which takes as input the confidentiality key K c and a unique random value N and outputs a vector of uniformly distributed bits of arbitrary length or a vector of uniformly distributed numbers in the range [0, q - 1] (where q is an arbitrary integer). Rejection sampling can be used to obtain a uniformly distributed number in the range [0, q - 1] from a uniformly distributed bit string. In this process, a consecutive segment of b = ceil(log2(q)) bits is taken. The bit string can be interpreted as an integer x that is uniformly distributed in the range 0 ≤ x < 2b, where q < 2b. For each x, if the condition x < q is satisfied, then x is accepted as being uniformly distributed in the range [0, q - 1], and if x ≥ q, then all the bits in x are rejected and a new bit segment is taken until an x that satisfies x < q is found. This process is repeated until the entire vector is completed. Another method that will produce a distribution that is close but not exactly uniform is to choose a larger b-bit string 2b > q and reduce x from the range [0, 2b - 1] via a simple modulo operation: x mod q.
[0029] The confidentiality key K c can be a symmetric key of 128, 256, or more bits, a masked share of such a key, a hashed or protected password or password phrase, an access token, a secure key storage handle, or can be generated by a key derivation function or any similar mechanism. The confidentiality key K c can be hard-coded into the cryptosystem 11 and thus not actually passed to the function E(K c ,N).
[0030] The output vector is cryptographically secure because it is infeasible to determine anything about the confidentiality key K c from the output vector or, conversely, to observe any statistical anomalies or additional features in the vector without the confidentiality key K c .
[0031] The function E(K c ,N) can be instantiated using a secure block cipher (such as the Advanced Encryption Standard AES in counter mode), a stream cipher (such as ChaCha20), or a hash function or an Extensible Output Function (XOF) (such as SHAKE). Generally, the cryptographic function E(K c ,N) itself is protected against side-channel attacks via masking or other countermeasures.
[0032] Return Figure 2 , the key derivation module 27 performs a sequence of addition operations at S3 to generate the sum of the cover data t and the multiple secret shares S[1..d]. Specifically, the sum of the cover data t and the multiple secret shares S[1..d] from E(K c ,N) is loaded into a temporary vector t. The secret shares S[1..d] are then added to the temporary vector t in a sequence of addition operations, where each element is reduced (mod q) under arithmetic masking, and the resulting vector t is then returned as the sum Sc. These processing operations can be expressed as follows:
[0033]
[0034] In the case of Boolean masking, an exclusive-OR (XOR) operation replaces the modular addition of the vectors.
[0035] The sum Sc satisfies Sc=S+E(K c ,N). If E(K c ,N) is secure and its output distribution is uniform, then the confidentiality of S is fully protected. Therefore, this result is similar to a "one-time pad", where the c ,N)'s "one-time pad" is modulo q.
[0036] To provide side-channel security, in this example, the overwrite string E(K c ,N) to S[1]. In contrast, if S[1..d] were first added together before adding E(Kc,N), the numerical result would be the same, but the entire secret S would be temporarily stored by the cryptographic system 11 and could therefore be compromised via leakage. Although in this example the cover string E(Kc,N) is done before the addition of the other shares, c ,N) with S[1], but it will be appreciated that as long as one of the operands of the last addition operation in the sequence of addition operations is one of the shares S[1..d] of the cryptographic key, the entire secret will not be temporarily stored by the cryptographic system 11.
[0037] The key derivation module 27 then generates at S5 a ciphertext indicative of the sum Sc. In this example, the ciphertext is the sum Sc, but it will be appreciated that a deterministic arithmetic operation may be performed on the sum Sc to generate the ciphertext.
[0038] In this example, the key derivation module 27 then generates an integrity tag Si at S7. Specifically, in this example, the generation of the integrity tag Si includes using the integrity key K stored in the secure memory 15 i23 encrypts the ciphertext and metadata A associated with the generation of the ciphertext. In this example, the metadata A includes the random value N, the modulus q, the length of the vector l (the number of elements mod q), the number of shares d, the algorithm identifier id, and any additional public or private key parameters pk and sk. More specifically, in this example, the integrity tag Si is equal to MAC(K i ,Sc,A), where MAC is a keyed message authentication code that can be instantiated using HMAC, KMAC, or similar standard algorithms.
[0039] Finally, at S9, the key derivation module 27 exports the data packet including the ciphertext Sc, the random value N and the integrity tag Si from the secure processing environment of the cryptographic system 11 to a less secure storage environment, which may be, for example, in the main system memory 7, the removable memory 9 or the cloud storage 31.
[0040] Key loading module
[0041] The key loading module 29 includes a set of processor-implementable instructions that, when implemented by the processor 13, retrieves a data packet including a ciphertext indicating a cryptographic key S stored in a protected form from a memory external to the cryptographic system, and generates a plurality of d secret shares S[1..d] corresponding to the cryptographic key. In this example, as discussed above, the data packet also includes a random value N and an integrity tag Si.
[0042] In this example, Figure 3 2 is a flow chart showing the main operations performed by the key loading module 29. As shown in the figure, in this example, the key loading module 27 imports a data packet at S21 and uses the integrity key Si to verify the data within the data packet at S23. Specifically, the key loading module 27 decodes the data packet to recover the ciphertext Sc, the random number N and the integrity tag Si, constructs the metadata A, and then calculates a MAC (K i ,Sc,A). If the test tag Ti matches the integrity tag Si, the data of the data packet is verified, and the key loading module continues to generate a plurality of d secret shares. However, if the test tag Ti does not match the integrity tag Si, this indicates that the data of the data packet has been tampered with, and the key loading module 29 ends the processing operation.
[0043] After the integrity tag has been verified, the key loading module 29 generates d-1 uniform random secret shares S[1..d-1] at S25. To generate the uniform random secret shares S[1..d-1], the output of the secure random bit generator may be subjected to the above for E(K c ,N) describes the rejection sampling process.
[0044] Then, the key loading module 29 uses the confidentiality key K stored in the secure memory 15 at S27. c and the random number N recovered from the imported packet using the function E(K c ,N) to generate the coverage data. Then, the key loading module 29 performs a sequence of inverse addition operations at S29 to subtract each of the d-1 uniform random shares and the value of the coverage data from the value of the ciphertext to generate the final share S[d]. These processing operations can be expressed as follows:
[0045]
[0046] It will be appreciated that for Boolean masking, the inverse addition operation "-" may be replaced by an XOR operation.
[0047] Again, in order to avoid the cryptographic key S being temporarily stored by the cryptographic system, the order of the inverse addition operations is important. Although subtracting the cover vector is performed last in the above routine, it will be appreciated that any order that does not involve subtracting the cover data from the ciphertext will have a desired improvement in data security. In other words, the first additive inverse operation should include as operands the value of one of the one or more uniform random shares and the value of the ciphertext.
[0048] The random secret shares [S1..d] do not need to match the secret shares used to generate the data packet. Instead, refreshing the secret shares improves security against side channel attacks by making any data leaked due to such side channel attacks more difficult to analyze. Indeed, the number of secret shares d may be different if and when the secret shares S[1..d] are refreshed.
[0049] Password processing module
[0050] In masked cryptographic calculations, arithmetic can be transformed into corresponding masked operations. For example, an unmasked (ordinary) arithmetic operation between variables X and Y, i.e., Z = X op Y, with a result of Z, can be transformed into the fraction {X i} and {Y i} to provide the share {Z i}. Figure 4 This example is shown in .
[0051] Figure 4An operation 400 is shown performed on two input data variables 410 and 420 (shown as X and Y). Each of the two input variables 410 and 420 is split into a respective set of data shares 430 and 440. In this example, there are three data shares, such that the first input variable 410 is split into data shares 432, 434, and 436, and the second input variable 420 is split into data shares 442, 444, and 446. Each of the data shares may include a bit sequence of the same length as the bit sequence representing the input variable. Figure 4 In the example of , the input variables are split into data shares using Boolean masking; however, different forms of masking may be provided as configurable or selectable control parameters. For example, there may be options for generating data shares using Boolean masking or arithmetic masking (among others). The cryptographic system may further be configured to switch between different forms of masking for certain operations.
[0052] Data shares can be used to perform operation 450. Operation 450 is performed as a set of independent operations 452, 454 and 456, each operation receiving a corresponding data share from two sets of data shares 430 and 440, for example, operation 452 is performed using data shares 432 and 442 as input, operation 454 is performed using data shares 434 and 444 as input, and operation 456 is performed using data shares 436 and 446 as input. Each independent operation 452 to 456 is a repetition of the same arithmetic unit operation. Each of the masked arithmetic operations 452 to 456 (including conversions to masked forms) is designed so that all intermediate variables are statistically independent of the (secret) sum of the shares. Operations 452 to 456 are performed on the secret data shares, but the data shares are not "merged" to re-form the secret. Therefore, the original secret will not be "leaked" to a side channel attack.
[0053] exist Figure 4 , after performing operation 450 on the corresponding pair of data shares, the results from each of the individual operations 452, 454, and 456 are provided as corresponding outputs 462, 464, and 466. The output sets of data shares 460 can be reassembled to provide the results of operation 450 (i.e., Z=oper(X,Y)) applied to input variables 410 and 420. Figure 4 In the example, the reorganization can be done by reordering individual data shares (i.e., Z = Z 1 ⊕Z 2 ⊕Z 3) is performed by performing an XOR sum. This may be performed as a final stage, for example, when the data is provided as an output via a set of bus interfaces 120, or after completion of operation 450, may be performed externally (e.g., by an external computing system), or even only when the data shares are encrypted, as described below.
[0054] In certain implementations (and / or defined configurations), secret information may be maintained as data shares throughout the lifecycle of a key. For example, a secret key may be generated as a share, stored and loaded into memory (e.g., both internal memory and external memory, with storage and loading into external memory performed via cryptographic registers 122), and used as a share (e.g., in cryptographic operations). At the end of the life of the key, the share may be reset to zero. In some cases, secret information is operated on only as a data share. In these cases, if a set of data shares representing the secret information is encrypted (e.g., using an encryption and / or encapsulation algorithm implemented by a cryptographic system), the set of data shares may be merged together after encryption because the data is no longer "secret" (i.e., it is protected by encryption). For example, a stream cipher may produce a ciphertext C from a plaintext P and a key stream Z = cipher(key) via C = P XOR Z, where decryption is performed as P = C XOR Z. In cases where the cipher is implemented in a masked manner, the key stream share Z 1 , Z 2 , Z 3 Can be obtained from the masked key - key 1 、key 2 、key 3 In this case, different ciphertext parts can use corresponding key stream shares C 1 =P 1 XOR Z 1 , C 2 =P 2 XOR Z 2 and C 3 =P 3 XOR Z 3 After encryption, the masks can now be combined without revealing the secret information, i.e., C = C 1 XOR C 2 XOR C 3 . C can then be securely derived in an encrypted form that does not reveal information about P.
[0055] although Figure 4The example of shows the case of Boolean masking, but in other examples, arithmetic masking can be used instead. In one case, arithmetic masking in the form of additive masking can be used to generate data shares. Additive masking is similar to XOR masking, but uses integer addition or modular addition. In one case, the share is calculated as: X = (∑ d X i ) mod (q), where q can be a small prime number related to the algorithm or q = 2 n As an example, additive masking can be performed by wrapping the addition modulo 2 16 The fixed constant q can vary for different cryptographic algorithms. For many cryptographic algorithms, the size of q is less than 16 or 32 bits, or is exactly a power of 2. As an example, the KYBER algorithm uses a q value of 3329, and the SABER algorithm uses a q value of 2. 13 The value of q for different cryptographic algorithms may be hard-coded into the implementation of the cryptographic math unit 130. As an example, the number X=1238 may use the share X 1 =1111,X 2 =2222 and X 3 =1234, where q is 3329, because X 1 +X 2 +X 3 ==4567mod q=1238 (using modular wrap-around addition).
[0056] In some examples, the cryptographic system 110 may be arranged to perform an operation that converts between two different masking formats. For example, if the data shares are in corresponding masking formats, a linear operation such as XOR or addition may be applied to the data shares independently only. In one case, Boolean masking may be converted to and from arithmetic masking. In the case where Boolean masking is converted to arithmetic masking, this may be accomplished by determining the second set of data shares {Y i}, the second set of data shares has the same value as the first set of data shares {X i}, for example, S = ⊕X i =∑Y i In the case where the arithmetic mask is converted to a Boolean mask, the reverse operation can be performed, for example, the second set of data shares {Y i}, the second set of data shares has the same value as the first set of data shares {X i}, for example, S = ∑X i =⊕Y i. In some cases, the control unit 150 can be programmed to perform a conversion operation in the hardware of the cryptographic system 110 using the arithmetic unit 136 and the matrix memory 132, which is similar to the conversion operation described in the following paper: "An Instruction Set Extension to Support Software-Based Masking" by Gao et al., Cryptology ePrint Archive, Report 2020 / 77, which is incorporated herein by reference. For example, the aforementioned paper defines BOOL2ARITH and ARITH2BOOL conversion functions, which in turn utilize basic Boolean addition (BOOLADD) and Boolean substitution (BOOLSUB) operations. These Boolean addition and Boolean substitution operations, in turn, include relatively complex sequences of bit manipulations involving "masked random" inputs. The cryptographic system 110 of the present invention provides a great advantage over the software implementation of the paper (e.g., typically performed by the central processing unit of an external computing system) because the cryptographic math unit 130 is designed (and optimized) for Boolean operations (e.g., such as Figure 3 Thus, cryptographic system 110 allows for much faster operations.
[0057] Certain arithmetic primitives applied as operations by arithmetic unit 136 may be implemented with the aid of conversion functions within a masked operation mode (or the conversion functions may be implemented using direct operations). For example, for Boolean masked addition and subtraction, a set of output data shares {Z i} can be obtained from the input share {X i} and {Y i} is calculated so that the XOR sum satisfies X+Y=Z or XY=Z(mod q). Other masked functions can follow the same pattern. Bitwise logic in the masked pattern can be performed by applying, for example, AND, OR, and XOR operations to arithmetic masked or Boolean masked data shares. Similarly, shifts, rotations, and bit manipulations can be applied to arithmetic masked or Boolean masked data shares. Comparisons can be performed by analyzing the equality or ordering of masked variables (e.g., using less than or greater than). The result of the comparison can also be masked (e.g., a true or false value can be a masked bit). Domain arithmetic and special functions of post-quantum cryptography can also be applied to masked variables.
[0058] Some post-quantum cryptographic operations operate on ring polynomials. For example, lattice-based cryptography utilizes ring polynomials and matrix multiplications. Many of these multiplications are performed between secret polynomials and public polynomials. In these cases, the secret polynomial can be masked, and the public polynomial does not need to be masked. In the case of multiplying a secret polynomial X with a public polynomial C, the secret polynomial can be split into d data shares for use in a masked operation mode, for example, such that CX=CX 1 +CX 2 +CX 3 (mod q). In this case, multiplication by a constant (the public polynomial C) results in only a complexity increase of O(d). This means that lattice-based post-quantum cryptography is particularly well suited for masked modes of operation. By comparison, multiplication of two masked representations, e.g., (x 1 +X 2 +X 3 )*(Y 1 +Y 2 +Y 3 ), which results in at least O(d 2 ) (i.e., quadratic) overhead. Similarly, for many number theoretic transformations (NTTs) used to implement rings and modular algebraic objects for known lattice cryptographic schemes, only one input to the NTT multiplication needs to be masked. This limits the overhead of applying masking patterns. Lattice cryptography additionally uses mixed bit-oriented operations such as right shifts, "roundings," and masked comparisons. These tasks can be accomplished using more efficient partial masking transformations customized for each operation.
[0059] Masking is applied as a side channel attack countermeasure in the examples herein. The cryptographic system 11 provides hardware accelerated cryptographic operations with overall hardware masking support. Masking can be configured to meet the requirements of "non-invasive attack countermeasures" described in FIPS 140-3 and ISO 19790 security standards, both of which are incorporated herein by reference (e.g., those security standards defined in Section 7.8 of ISO / IEC 19790:2012(E)). Testing of the effectiveness of countermeasures such as masking described herein can be performed using laboratory procedures, such as those described in ISO / IEC17825:2016(E) "Testing methods for the mitigation of non-invasive attackclasses against cryptographic modules", which are incorporated herein by reference and are more generally referred to as test vector leakage assessment (TVLA).
[0060] Modifications and further examples
[0061] In the key derivation example described above, the temporary vector t and the stored secret Sc themselves are not masked. In an alternative example, the masked temporary vector is split into shares t[1], t[2], ..., t[e], which add up to the temporary vector t, and the masked stored secret [[Sc]] is stored. Example implementation, key derivation function and key loading function for such an arrangement will now be described. In this example implementation, for simplicity, it is assumed that the ciphertext [[Sc]] also has e shares, but this is not required.
[0062] To generate the masked temporary vector t, the example implementation utilizes a masked encryption function E(Kc,N)[i], which generates e shares t[1], t[2], ..., t[e], such that t[1]+t[2]+..+t[e]=cover data, where e is less than or equal to d. The masked encryption function E(Kc,N) can be, for example, a masked implementation of a hash function SHAKE or a block cipher such as AES. Each of the e shares is then loaded into a corresponding share t[i] of the temporary vector.
[0063] After generating the masked temporary vector t, the key derivation function performs a sequence of masked addition operations in which each of the d shares S[1], S[2], ..., S[d] of the secret S is added to one of the e shares t[1], t[2], ..., t[e] of the temporary vector t. This can be performed, for example, in a loop so that S[1] is added to t[1], S[2] is added to t[2], and so on until S[e] is added to t[e], after which S[e+1] is added to t[1] (so that t[1] = t[1] + S[1] + S[e+1] compared to the original share t[1] output by the masked encryption function E(Kc,N), and so on. The resulting masked vector with e shares is then returned as the ciphertext [[Sc]]. These processing operations can be expressed as follows:
[0064]
[0065] In this way, each share of the ciphertext corresponds to the modular addition of a share of the temporary vector t and one or more shares of the secret S, whereby the share of the ciphertext corresponds to the sum of the share of the sensitive data and the share of the cover data. In the case of Boolean masking, an exclusive OR (XOR) operation replaces the modular addition of the vectors.
[0066] It will be appreciated that the ordering of indices i and j may be randomized.
[0067] In the corresponding key loading function for recovering the secret share [[S]], each of the e shares of the ciphertext is loaded into a corresponding share of the temporary vector t. A set of d random uniform vectors S[1], S[2], ..., S[d] is then generated, and each random uniform vector is subtracted from one of the shares of the temporary vector by performing inverse modulo q addition to generate a modified temporary vector having e shares. Again, this can be performed in a loop. The masked encryption function E(Kc, N)[i] is then used to generate e shares of the cover data, and then, each share of the cover data is subtracted from a corresponding one of the e shares of the modified temporary vector. Finally, the resulting e shares of the modified temporary vector are added to the corresponding vectors in a set of random uniform vectors S[1], S[2], ..., S[d], and the resulting set of d vectors forms d shares of sensitive data S (e.g., a cryptographic key). These processing operations can be implemented as follows:
[0068]
[0069] It will be appreciated that for Boolean masking, the inverse addition operation "-" may be replaced by an XOR operation.
[0070] By using a uniform random vector u, d shares of the sensitive data S are effectively refreshed each time the key loading function is executed, which provides additional protection against side channel attacks.
[0071] A brief overview of the sample features
[0072] Certain examples described herein provide devices (e.g., cryptographic systems or coprocessors) capable of performing post-quantum cryptography using masked arithmetic (i.e., data provided as masked data shares for side-channel protection). The masked operation modes may utilize one or more of Boolean and arithmetic masking, and the devices may provide conversions between (at least these) different forms of masking. The described examples provide novel cryptographic system structures or configurations that perform masked operations in a flexible and efficient manner to allow both accelerated post-quantum cryptographic coprocessing and high security against side-channel attacks.
[0073] Certain examples described herein provide devices (e.g., cryptographic systems or coprocessors) that can assist and / or accelerate cryptographic computations and autonomously perform certain complete post-quantum cryptographic operations. For example, the device allows public key key establishment and encryption, such as generating public-private key pairs, encapsulation and / or encryption, and decapsulation and / or decryption. The device further allows digital signature functions, such as generating public-private integrity key pairs, signature generation and signature verification, and stateful hash-based signatures, such as assisting and / or accelerating key generation, signature generation, and / or signature verification functions. Such devices can be provided as a system on chip (e.g., integrated within a silicon design and / or provided as a separate FPGA / ASIC chip that can be attached).
[0074] Certain examples described herein provide cryptographic systems capable of providing secure cryptographic computations. For example, one or more of the following post-quantum public key encryption algorithms may be implemented: Classic McEliece, (CRYSTALS-)KYBER, NTRU, SABER, BIKE, FrodoKEM, HQC, NTRU Prime, SIKE, and Supersingular Isogeneous Diffie-Hellman (SIDH); and one or more of the following post-quantum digital signature algorithms: (CRYSTALS-)DILITHIUM, FALCON, Rainbow, GeMSS, and Picnic. Further details of these algorithms may be found in the available NIST publication on the "Post-Quantum Cryptography Project," and the publication of the CRYSTALS project ("Cryptographic Suite for Algebraic Lattices-Kyber and Dilithium"), which are incorporated herein by reference.
[0075] Certain examples described herein have a control unit that controls cryptographic operations without handling sensitive data (so-called "touchless" operations). For example, the control unit may not have access to sensitive data in a cryptographic math unit during an operation.
[0076] Certain examples further provide a method by which a control unit or processor can provide secure tracking of secret data throughout a cryptographic operation; thus, the control unit or processor can track the flow of sensitive information within a cryptographic system without having access to the data.
[0077] It will be appreciated that the presence of an integrity tag is optional. If an integrity tag is present, the confidentiality key may also be used as the integrity key, making the confidentiality key and the integrity key the same, rather than having an integrity key separate from the confidentiality key.
[0078] The functions provided in the secure processing environment can be implemented in software, hardware, or a combination of software and hardware. Therefore, the key derivation module 27, the key loading module 29, and the cryptographic processing module 31 can be implemented as: processor-implemented instructions that perform their corresponding functions when executed by the processor or execute hardware circuits that perform their corresponding functions, such as FPGA or ASIC; or a combination of processor-implemented instructions and hardware.
[0079] The above examples should be understood to be illustrative. Other examples are contemplated. Although certain components of each example have been described separately, it should be understood that the functionality described with reference to one example may be suitable for implementation in another example, and certain components may be omitted depending on the implementation. It should be understood that any feature described with respect to any one example may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other example, or in combination with any combination of any other example. For example, features described with respect to system components may also be suitable for execution as part of the described method. In addition, equivalents and modifications not described above may also be adopted without departing from the scope of the invention as defined in the appended claims.
Claims
1. A secure processing environment configured to perform a masked processing operation using a plurality of shares corresponding to sensitive data, the secure processing environment comprising: a memory storing a confidentiality key; a first module configured to perform at least one masked processing operation using a plurality of shares corresponding to sensitive data; and The second module is configured as follows: generating coverage data, the generating comprising encrypting a random value using a confidentiality key stored within the secure processing environment; after generating the coverage data, performing a sequence of addition operations using the share of the sensitive data and the coverage data to generate a sum; generating a ciphertext indicative of the sum; as well as A data packet including the ciphertext and the random value is exported.
2. The secure processing environment of claim 1, wherein: The overlay data is unmasked and one of the operands for a final addition operation in the sequence of addition operations is one of the shares of the sensitive data.
3. The secure processing environment of claim 2, wherein: One of the operands for a first addition operation in the sequence of addition operations is the coverage data.
4. A secure processing environment according to any preceding claim, wherein: The sequence of addition operations includes modular addition operations.
5. The secure processing environment of claim 4, wherein: The modular addition operation includes at least one of: arithmetic modular q addition, where q is a prime number or a power of 2; and Boolean XOR bitwise addition.
6. A secure processing environment according to any preceding claim, wherein: The second module is configured to generate masked coverage data having multiple shares, and for each of the multiple shares of the sensitive data, perform an addition operation with the share of the coverage data to generate multiple shares corresponding to the sum of the share of the sensitive data and the share of the coverage data.
7. A secure processing environment according to any preceding claim, further comprising generating an integrity tag and including the integrity tag in the data packet, wherein Generating the integrity tag includes encrypting the ciphertext and metadata associated with the ciphertext using an integrity key stored in the memory.
8. The secure processing environment of claim 7, wherein: The metadata includes the random value.
9. A secure processing environment according to claim 7 or claim 8, wherein: The integrity key is the confidentiality key.
10. The secure processing environment according to any one of claims 7 to 9, wherein: The integrity tag includes a method authentication code for the data packet.
11. A secure processing environment according to any preceding claim, wherein: The memory further includes a third module, and the third module is configured to: importing the data packet including the ciphertext and the random value; generating one or more uniform random shares; generating coverage data, the generating of the coverage data comprising encrypting the random value using the confidentiality key; A sequence of addition operations is performed to subtract each uniform random share and the value of the cover data from the value of the ciphertext to generate a plurality of shares corresponding to the sensitive data.
12. The secure processing environment of claim 11, wherein: The cover data is unmasked and a first addition operation uses the value of one of the uniform random shares and the value of the ciphertext as operands.
13. The secure processing environment of claim 12, wherein: The operand for the final addition operation in the sequence of addition operations includes the value of the overlay data.
14. A secure processing environment according to claim 12 or claim 13, wherein: The sequence of addition operations includes modular addition operations.
15. The secure processing environment of claim 14, wherein: The modular addition operation includes at least one of: arithmetic modular q addition, where q is a prime number or a power of 2; and Boolean XOR bitwise addition.
16. The secure processing environment of claim 11, wherein: The ciphertext includes a first plurality of shares, and generating the cover data includes generating a second plurality of shares, and the modular addition operation modifies at least some of the uniform random shares with values of the first plurality of shares and the second plurality of shares.
17. A secure processing environment according to any one of claims 11 to 16, wherein: The data packet further includes an integrity tag, and wherein the processor-implementable instructions cause the processor to verify the integrity tag before generating the plurality of shares from the ciphertext by: generating a verification tag by encrypting the ciphertext and metadata associated with the ciphertext using an integrity key stored in the memory; checking that the verification tag matches the integrity tag; and If the verification tag matches the integrity tag, the plurality of shares are generated.
18. The secure processing environment of claim 17, wherein: The metadata includes the random value.
19. A secure processing environment according to claim 17 or claim 18, wherein: The integrity key is the confidentiality key.
20. A secure processing environment according to any one of claims 17 to 19, wherein: The integrity tag includes a method authentication code for the data packet.
21. A secure processing environment configured to perform a masked processing operation using a first plurality of shares corresponding to sensitive data, the secure processing environment comprising: a memory storing a confidentiality key; and module, the module is configured to: Import a data packet including ciphertext and random value; generating one or more uniform random shares; and generating coverage data, the generating of the coverage data comprising encrypting the random value using the confidentiality key; as well as A sequence of additive inverse operations is performed to subtract each uniform random share and the value of the cover data from the value of the ciphertext to generate a second plurality of shares corresponding to the sensitive data.
22. The secure processing environment of claim 21, wherein: The cover data is unmasked and a first addition operation uses the value of one of the uniform random shares and the value of the ciphertext as operands.
23. The secure processing environment of claim 22, wherein: The operand for a final addition operation in a sequence of addition operations includes the value of the overlay data.
24. A secure processing environment as claimed in claim 22 or claim 23, wherein: The inverse addition sequence includes modular addition operations.
25. The secure processing environment of claim 24, wherein: The modular addition operation includes at least one of: arithmetic modular q addition, where q is a prime number or a power of 2; and Boolean XOR bitwise addition.
26. The secure processing environment of claim 21, wherein: The ciphertext includes a first plurality of shares, and generating the cover data includes generating a second plurality of shares, and a modular addition operation modifies at least some of the uniform random shares with values of the first plurality of shares and the second plurality of shares.
27. A secure processing environment according to any one of claims 17 to 20, wherein: The data packet further comprises an integrity tag, and wherein the module is configured to verify the integrity tag before generating the plurality of shares from the ciphertext by: generating a verification tag by encrypting the ciphertext and metadata associated with the ciphertext using an integrity key stored in the memory; checking that the verification tag matches the integrity tag; and If the verification tag matches the integrity tag, the plurality of shares are generated.
28. The secure processing environment of claim 27, wherein: The metadata includes the random value.
29. A secure processing environment according to claim 27 or claim 28, wherein: The integrity key is the confidentiality key.
30. A secure processing environment according to any one of claims 27 to 29, wherein: The integrity tag includes a method authentication code for the data packet.
31. A secure processing environment according to any preceding claim, wherein: The secure processing environment is provided by a hardware security module.
32. A computing device comprising a secure processing environment according to any preceding claim.
33. A method of storing a plurality of shares corresponding to sensitive data and utilized within a secure processing environment to perform masked processing operations, the method comprising: generating coverage data, the generating comprising encrypting a random value using a confidentiality key stored within the secure processing environment; After generating the coverage data, performing a sequence of addition operations to generate a sum of the share of the sensitive data and the coverage data; generating a ciphertext indicative of the sum; as well as A data packet including the ciphertext and the random value is exported for storage outside of the secure processing environment.
34. A method of generating a plurality of shares within a secure processing environment, the plurality of shares corresponding to sensitive data and utilized within the secure processing environment to perform a masked processing operation, the method comprising: importing a data packet including a ciphertext and a random value, the ciphertext being based on the sensitive data and the random value; generating one or more uniform random shares; generating coverage data, the generating of the coverage data comprising encrypting the random value using a confidentiality key; as well as A sequence of additive inverse operations is performed to subtract each uniform random share and the value of the cover data from the value of the ciphertext to generate the plurality of shares corresponding to the sensitive data.