Method and apparatus for storing / recovering plurality of secret shares

Abstract

A computer-implemented method and apparatus are disclosed for storing data corresponding to secret data represented by a plurality of shares, each of the plurality of shares having a first number of bits. A plurality of random keys is generated, each random key having a second number of bits less than the first number of bits, where the plurality of random keys are one less than the plurality of shares. For each random key, the generated random key is used as a seed value for a deterministic function that outputs corresponding intermediate data having a first number of bits. A plurality of modulo-addition operations are performed to generate working data having a first number of bits and corresponding to modulo-addition of the value of the share and modulo-addition or inverse modulo-addition of the value of the intermediate data corresponding to each of the random keys. The working data and the plurality of random keys are then stored. In this manner, data corresponding to the secret data is stored in a compressed format compared to storing the plurality of shares representing the secret data.

Description

Technical Field

[0001] The present disclosure relates to the storage of secret data such as cryptographic keys. The present disclosure relates to post-quantum cryptographic systems implemented in a secure processing environment and utilizing masking as a countermeasure against side-channel attacks. Background Art

[0002] Cryptographic processing operations involve the use of cryptographic keys. In symmetric encryption systems where the same key is used to encrypt and decrypt messages, it is necessary to protect the key from exposure to malicious parties. Similarly, for asymmetric encryption systems that utilize private and public keys, it is necessary to protect the private key from exposure to malicious parties. To protect the security of cryptographic keys, it is known to perform cryptographic processing operations in a secure processing environment having a secure memory and a secure cryptographic processor. An example of such a secure processing environment is a hardware security module.

[0003] Processing performed in a secure processing environment can be vulnerable to side-channel attacks, in which an adversary learns side-channel information about the physical execution of an algorithm. Side-channel information can be derived from many sources such as run time, electromagnetic emissions, energy consumption, and acoustic emissions. One countermeasure proposed against side-channel attacks is masking, which relies on techniques from the fields of secret sharing and multi-party computation (MPC). As an example, given a sensitive value masking x involves representing x as a tuple where d is the number of shares (also referred to as the sharing order), and in the context of masking, d - 1 is typically referred to as the masking order, such that (i) and (ii) any subset of t < d distinct x i appears to be uniformly random. When d is clear from the context, the tuple can be represented by the symbol or The principle of masking is that an attacker with the ability to learn the values of t < d variables x i will learn nothing about x.

[0004] Shares of a cryptographic key can be used instead of the cryptographic key itself to perform cryptographic processing operations in a secure processing environment. The present disclosure presents techniques for securely storing shares of a cryptographic key or other secret data either within or external to a secure processing environment. The problem with storing a cryptographic key represented as multiple shares is that multiple shares require additional storage compared to the cryptographic key itself. This is a particular problem if it is desired to store multiple shares in a secure processing environment, since the amount of secure memory in a secure processing environment is typically limited. Summary of the Invention

[0005] According to one aspect of the present invention, there is provided a computer-implemented method for storing secret data represented by a plurality of shares, wherein each share in the plurality of shares has a first number of bits. The method involves generating a plurality of random keys, each of which has a second number of bits less than the first number of bits, wherein the number of random keys is one less than the number of shares. Each random key is used as a seed value for a deterministic function that outputs corresponding intermediate data having a first number of bits. A plurality of modular addition operations involve a plurality of shares and intermediate data associated with each random key to generate working data having a first number of bits and a value corresponding to a modular addition of the value of the share together with an inverse modular addition of the value of the intermediate data for each of the random keys. The working data is then stored with the plurality of random keys. Since the random keys have fewer bits than the shares, the memory requirements are reduced compared to the memory requirements for storing the plurality of shares.

[0006] According to another aspect of the present invention, there is provided a computer-implemented method for recovering a plurality of shares corresponding to secret data from stored working data and one or more random keys, wherein each of the plurality of secret shares has a first number of bits, and each of the plurality of random keys has a second number of bits less than the first number of bits, and wherein the number of the one or more random keys is one less than the number of the plurality of secret shares. The method comprises determining, for a random key or each of the one or more random keys, intermediate data by using the random key as a seed value for a deterministic function, the deterministic function outputting corresponding intermediate data having the first number of bits. Then, the plurality of secret shares are determined such that a modulo addition of the plurality of secret shares corresponds to a modulo addition of the working data and the intermediate data corresponding to each of the one or more random keys. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Examples of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which:

[0008] Figure 1 is a schematic diagram showing the main components of a cryptographic system according to an example;

[0009] Figure 2 is a flow chart schematically illustrating operations performed to package a plurality of secret shares corresponding to a cryptographic key into a compressed format for storage;

[0010] Figure 3 is a flow chart schematically illustrating operations performed to unpack data stored in a compressed format to recover a plurality of secret shares corresponding to a cryptographic key; and

[0011] Figure 4is a schematic diagram showing an example in which masking is applied to secret data. DETAILED DESCRIPTION

[0012] introduction

[0013] Certain examples described herein relate to a cryptographic system implemented in a secure processing environment that forms part of a communicatively coupled computing system and securely performs cryptographic operations required by the computing system. For example, the cryptographic system may be provided as a system-on-chip device for inclusion in a larger computing circuit board and / or integrated circuit. The cryptographic system may be implemented in silicon, i.e., as a separately manufactured integrated circuit design (e.g., as a dedicated integrated circuit—ASIC), or implemented together with a larger computing system circuit, and / or implemented as a field programmable gate array (FPGA), for example, in the form of a specific configuration of an FPGA programmed with a suitable hardware description language. In an example, the secure processing environment of the cryptographic module is formed by a hardware security module that provides a trusted processing environment and secure memory. The hardware security module may be tamper-resistant, such as by using "encapsulated" hardware, and / or tamper-evident, so as to prevent and / or detect attempts to physically access components within the hardware security module.

[0014] The cryptographic system can be used as a "post-quantum" cryptographic module or coprocessor, allowing one or more processors of a communicatively coupled computing system to offload complex "post-quantum" cryptographic operations to achieve fast, secure computations. For example, the cryptographic system can be configured to implement key establishment and digital signature functions on behalf of the computing system. The cryptographic system has a security boundary so that other devices and integrated circuits of the computing system (including the computing system itself) do not have access to secret data manipulated within the cryptographic system. The cryptographic system can be configured to autonomously perform post-quantum cryptographic operations as part of a larger hardware system (such as a larger ASIC or FPGA design).

[0015] The term "post-quantum" is used herein to describe cryptographic operations and functions that are protected from attacks by quantum computers. It is a well-known term in the field of cryptography. For example, many popular public key algorithms are not post-quantum safe because they can be efficiently cracked using a sufficiently powerful quantum computer. These "quantum-unsafe" cryptographic algorithms include those based on the integer factorization problem, the discrete logarithm problem, or the elliptic curve discrete logarithm problem; all of which can be easily solved on a sufficiently powerful quantum computer using Shor's algorithm. Operations and functions that have been proven to be post-quantum safe include those based on one or more of the following: lattice-based cryptography; multivariate cryptography; hash-based cryptography; encoding-based cryptography; and supersingular elliptic curve homology cryptography.

[0016] The cryptographic system of the example is suitable for use in a variety of computing systems from Internet servers to embedded devices. In one implementation, the cryptographic system can be provided as part of a cryptographic system-on-chip (SoC), which can allow many low-cost embedded devices to implement "post-quantum" cryptography and provide a "post-quantum" security system. For example, the functions implemented by the cryptographic math unit can allow the rapid execution of coded or lattice-based cryptographic operations, for example, by unloading many common low-level binary logic functions, such as integer addition, subtraction and / or multiplication. The cryptographic system can be configured or preprogrammed to have a set of available functions that can be updated over time. The cryptographic system can quickly calculate certain functions by avoiding the need to load and interpret the different instructions required by the processor of the coupled computing system. The cryptographic system can be considered to be a specialized computing device (i.e., computer) designed to be integrated with a larger general-purpose computing device (e.g., used as a computer within a computer).

[0017] Example Password System

[0018] Figure 1 A computing system 1 according to an example is shown. The computer system 1 includes at least one processor 3, input / output devices 5, a main system memory 7, and a removable memory 9, such as a hard disk device, etc. In addition, the computing system 1 includes a cryptographic system 11, which provides a secure processing environment in which cryptographic processing operations are performed. In this example, the cryptographic system 11 is embodied in a hardware security module.

[0019] The cryptographic system 11 comprises a processor 13, a secure memory 15 and an input / output device 17 which enables communication with the rest of the computer system 1. The secure memory 15 comprises a data memory 19, a program memory 21 and a working memory 23. The data memory 19 comprises a key repository 25 for storing data corresponding to one or more masked cryptographic keys in a compressed format. The program memory 21 stores a packing module 27, an unpacking module 29, a (pseudo) random key generator module 31, a deterministic function module 33 and a cryptographic processing module 35.

[0020] Processor 13 may include a reduced instruction set computer (RISC) processor, such as a RISC-V central processing unit (CPU). Processor 13 may include a 32-bit or 64-bit microprocessor (e.g., such as an RV32-I / E- / M / C Pluto core). Processor 13 may include one or more processing cores.

[0021] In this example, the computer system 1 also has access to cloud storage 37 via network communications (eg, via the Internet).

[0022] The cryptographic processing module 35 of the cryptographic system 11 performs cryptographic processing operations using cryptographic keys. The cryptographic processing operations include: a key establishment function, which includes one or more of encryption and decryption; a digital signature function, which includes one or more of digital signature generation and digital signature verification; and a stateful hash-based signature. In this example, the cryptographic system 11 is optimized for lattice-based and encoding-based cryptography (and other post-quantum methods) and "big integer" arithmetic (e.g., arithmetic on large integer values ​​defined by n bits, where n can be, for example, 32 or 64).

[0023] The security of the cryptographic system 11 is increased using masked computing, where secret data (such as a cryptographic key) processed by the computer system 1 is represented within the cryptographic system 11 by multiple secret shares, such that all of the secret shares are required to derive information about the secret data. Masked computing provides protection against side channel attacks that attempt to determine the bit pattern of the data being manipulated by the cryptographic system 11 based on secret information leaked, for example, via electromagnetic emissions, fluctuations in power usage, timing of operations, or other unintended side channels by manipulating not the secret data itself but rather the shares of the secret data. The number of secret shares may be configurable and set by a parameter of the cryptographic system 11 (e.g., there may be d secret shares, where d is an integer value). Typical values ​​for the number of secret shares d are two or three, but other numbers of shares are possible.

[0024] The cryptographic system 11 can use many different cryptographic keys to perform cryptographic operations, and in particular, for asymmetric cryptographic operations, the number of bits in each cryptographic key can be large. The amount of non-volatile memory in the secure memory 15 may not be sufficient to store multiple cryptographic keys in an uncompressed format, and this problem is exacerbated when the cryptographic key is represented by multiple shares. The packaging module 27 enables multiple shares corresponding to the cryptographic key to be stored in a compressed format, and the unpacking module 29 enables the multiple shares corresponding to the cryptographic key to be recovered from the stored compressed data. The recovered multiple shares do not need to be the same as the multiple shares before the compressed storage, because the unpacking module 29 can automatically perform a refresh operation. Such refresh operations improve protection against side channel attacks. The (pseudo) random key generator module 31 and the deterministic function module 33 are used during the execution of the packaging module 27 and the unpacking module 29, as will now be described in detail.

[0025] Packaging Modules

[0026] The packaging module 27 processes a plurality of secret shares corresponding to the cryptographic key to generate compressed data that can be stored in the key repository 25 of the cryptographic system 11, or alternatively, exported to the main system memory 7 or the removable memory 9 or the cloud storage 37 of the computer system 1. In this example, there are d secret shares, where d is any integer greater than 1, and each secret share has n bits, where n is typically greater than one thousand. In this example, the cryptographic key and the secret share corresponding to the cryptographic key are modulo q numbers, where q can be, for example, 2, a composite number (such as 256 that allows addition / subtraction of bytes), or a prime number (such as 3, 9, 257, 3329, 7681, 12289, 65537, or 8380417).

[0027] Figure 2 is a flow chart showing the main operations performed by the packaging module 27. As shown, in this example, the packaging module uses the (pseudo) random key generator module 31 to generate d-1 random keys at S1. Each of the d-1 random keys has m bits, where m is less than n and is large enough to be cryptographically secure (e.g., 128 or 256 bits).

[0028] Then, the packing module 27 inputs each of the d-1 random keys as a seed value K for the deterministic function module 37. For each input seed value K, the deterministic function module 37 outputs intermediate data having n bits according to the deterministic function z=f(K), which receives the seed value K and generates modulo q intermediate data. The deterministic function f(K) may be based on a cryptographic hash function, an extensible output function (such as SHAKE128 or SHAKE256), or may be based on a cryptographic block cipher (such as AES) or a stream cipher that uses K as a key and operates in counter mode. The deterministic function f(K) may include a rejection sampler or similar mechanism to ensure that the output intermediate data is in the modulo q distribution. The deterministic function f(K) may or may not be masked.

[0029] Back to Figure 2 , the packaging module 27 then performs a series of modular addition operations on the secret shares and the intermediate data corresponding to the random key at S5 to generate working data corresponding to the modular addition of the values ​​of the secret shares and the inverse modular addition of the intermediate data. There are many different ways to perform the series of modular addition operations to achieve this result. In this example, the series of modular addition operations avoids starting with the modular addition of the values ​​of all secret shares, because this will result in the generation of a cryptographic key, and therefore will be easy to directly discover the cryptographic key through a side channel attack.

[0030] Finally, the packing module 27 stores the working data and d - 1 random keys at S7 as a representation of the cryptographic key. It should be understood that the working data has n bits, and each random key has m < n bits, and thus, the number of bits required is less than storing d secret shares. For example, if d = 8, m = 256 bits, and n = 8192 bits, then the storage is reduced from 65536 bits to 9984 bits.

[0031] In the instance where d = 2, Figure 2 An example of the processing operation of can be represented by the function PackRefresh(S[1], S[2]), as follows:

[0032] Step 1. K = new random key

[0033] Step 2. Z = f(K)

[0034] Step 3. t = S[1] – z (mod q)

[0035] Step 4. S’ = S[2] + t (mod q)

[0036] Step 5. Return (S’, K)

[0037] Step 1 involves the generation of a new random key. Step 2 uses the deterministic function f(K) to generate the intermediate data z. Step 3 performs an inverse modular addition to subtract the intermediate data z from the first secret share S[1] to generate the temporary data t. Step 4 performs a modular addition operation on the second secret share S[2] and the temporary data t to generate the working data S’. Step 5 returns the working data S’ and the random key K. It should be understood that the working data S’ corresponds to the modular addition of the first share S[1] and the second secret share S[2] and the inverse modular addition of the intermediate data z.

[0038] For the more general case where there are any number d of secret shares, Figure 2 An example of the processing operation of can be represented by the function PackRefresh-Long(S[1], S[2],…S[d]), as follows:

[0039] Step 1. S’ = S[1]

[0040] Step 2.1. for i = 1, 2,…d - 1 do:

[0041] Step 2.2. (S’, K[i]) = PackRefresh(S’, S[i + 1])

[0042] Step 2.3. end do

[0043] Step 3 returns (S’, K[1], K[2]…K[d - 1])

[0044] In this example, S' represents the working variable that forms the working data at the end of the routine. In step 1, the working variable S' is assigned the value of the first share. Steps 2.1 to 2.3 iterate the PackRefresh algorithm described above for the remaining shares S[2] to S[d], with the working variable S' and the share S[i+1] as input. At each iteration, the value of the secret share S[i] is added to the working variable, and the intermediate data z[i] corresponding to the random key K[i] is subtracted from the random data. Step 3 then returns the working data S' and d-1 random keys.

[0045] Unpacking Modules

[0046] It will be appreciated that the stored working data is equivalent to the value of the cryptographic key [[S]] minus the intermediate data z corresponding to each random key K. Unpacking module 29 generates a set of d secret shares corresponding to the cryptographic key. As will become apparent below, the set of d secret shares generated by unpacking module 29 will typically be different from the set of d secret shares used to generate the working data, and therefore, unpacking module 29 may refresh the set of secret shares compared to the secret shares used to generate the stored working data.

[0047] Figure 3 is a flow chart showing the main operations performed by the unpacking module 29. The unpacking module 29 recovers the stored working data and one or more random keys from the memory location where the working data and one or more random keys were stored by the packaging module 27 at S21. Then, the unpacking module 29 determines the intermediate data corresponding to the or each random key by using the random key as a seed value for the deterministic function at S23. Then, the unpacking module determines a plurality of secret shares satisfying the following condition at S25: the modular addition of the determined plurality of secret shares corresponds to the modular addition of the working data and the intermediate data corresponding to the or each random key.

[0048] It should be understood that, assuming that the working data generated by the packing module 27 corresponds to the modulo addition of the values ​​of the first plurality of secret shares and the inverse modulo addition of the intermediate data corresponding to the or each random key, the modulo addition of the multiple secret shares generated by the unpacking module 29 is equal to the modulo addition of the first plurality of secret shares and therefore corresponds to the cryptographic key.

[0049] In the example where d=2, Figure 3 An example of the processing operation can be represented by the function UnPackRefresh(S',K) as follows:

[0050] Step 1. t = arbitrary random data with n bits

[0051] Step 2. S[1] = S' + t(mod q)

[0052] Step 3. S[2] = f(K) – t(mod q)

[0053] Step 4. Return (S[1], S[2])

[0054] In this example, in step 1, refresh data t is optionally generated from a uniform random distribution. The refresh data t has n bits, which is the same number of bits as each of the secret shares. Step 2 sets the first secret share to the modulo addition of the working data S' and the refresh data t. Step 3 sets the second secret share to the inverse modulo addition of the intermediate data corresponding to the random key K and the refresh data t. In step 4, the first secret share and the second secret share are returned.

[0055] By generating new refresh data t each time the function UnPackRefresh(S',K) is executed, different groups of shares can be generated from the same compressed data. Although this is an optional feature, and alternatively the refresh data can be omitted or set to a fixed value to reduce computational requirements, from a security perspective, generating new random refresh data each time the function UnPackRefresh(S',K) is executed improves security against side channel attacks.

[0056] For the more general case where there are any number d of secret shares, Figure 2 An example of the processing operation can be represented by the function UnPackRefresh-Long(S', K[1], K[2], ... K[d-1]), as follows:

[0057] Step 1. v = S'

[0058] Step 2.1. for i=1,2,..d-1do:

[0059] Step 2.2. (v, S[i]) = UnPackRefresh(v, K[i])

[0060] Step 2.3.end do

[0061] Step 3. S[d] = v

[0062] In step 1, the value of the working variable v is set to the value of the working data S'. Steps 2.1 to 2.3 iterate the UnPackRefresh algorithm discussed above, where the working variable v and the random key K[i] are used as input to generate an updated value of the working variable v and a secret share S[i] corresponding to the random key K[i]. Finally, in step 3, the final secret share S[d] is assigned the value of the working variable v after the iteration is completed.

[0063] Password processing module

[0064] In masked cryptographic calculations, arithmetic can be transformed into corresponding masked operations. For example, an unmasked (ordinary) arithmetic operation between variables X and Y, i.e., Z = X op Y, with a result of Z, can be transformed into the fraction {X i} and {Y i} to provide the share {Z i}. Figure 4 This example is shown in .

[0065] Figure 4 An operation 400 is shown performed on two input data variables 410 and 420 (shown as X and Y). Each of the two input variables 410 and 420 is split into a respective set of data shares 430 and 440. In this example, there are three data shares, such that the first input variable 410 is split into data shares 432, 434, and 436, and the second input variable 420 is split into data shares 442, 444, and 446. Each of the data shares may include a bit sequence of the same length as the bit sequence representing the input variable. Figure 4 In the example of , the input variables are split into data shares using Boolean masking; however, different forms of masking may be provided as configurable or selectable control parameters. For example, there may be options for generating data shares using Boolean masking or arithmetic masking (among others). The cryptographic system may further be configured to switch between different forms of masking for certain operations.

[0066] Data shares can be used to perform operation 450. Operation 450 is performed as a set of independent operations 452, 454 and 456, each operation receiving a corresponding data share from two sets of data shares 430 and 440, for example, operation 452 is performed using data shares 432 and 442 as input, operation 454 is performed using data shares 434 and 444 as input, and operation 456 is performed using data shares 436 and 446 as input. Each independent operation 452 to 456 is a repetition of the same arithmetic unit operation. Each of the masked arithmetic operations 452 to 456 (including conversions to masked forms) is designed so that all intermediate variables are statistically independent of the (secret) sum of the shares. Operations 452 to 456 are performed on the secret data shares, but the data shares are not "merged" to re-form the secret. Therefore, the original secret will not be "leaked" to a side channel attack.

[0067] exist Figure 4, after performing operation 450 on the corresponding pair of data shares, the results from each of the individual operations 452, 454, and 456 are provided as corresponding outputs 462, 464, and 466. The output sets of data shares 460 can be reassembled to provide the results of operation 450 (i.e., Z=oper(X,Y)) applied to input variables 410 and 420. Figure 4 In the example of , the reassembly can be performed by XOR summing the individual data shares (i.e., Z = Z1 ⊕ Z2 ⊕ Z3). This can be performed as a final stage, for example, when the data is provided as output via a set of bus interfaces 120, or after completion of operation 450, can be performed externally (e.g., by an external computing system), or even only when the data shares are encrypted, as described below.

[0068] In certain implementations (and / or defined configurations), secret information may be maintained as data shares throughout the lifecycle of a key. For example, a secret key may be generated as a share, packaged and stored in a compressed format, and subsequently unpacked as a share and loaded into memory (e.g., loaded into both internal and external memory, loaded into external memory via the cryptographic register 122), and used as a share (e.g., in cryptographic operations). At the end of the life of the key, the share may be reset to zero. In some cases, secret information is operated on only as a data share. In these cases, if a set of data shares representing the secret information is encrypted (e.g., using an encryption and / or encapsulation algorithm implemented by a cryptographic system), the set of data shares may be merged together after encryption because the data is no longer "secret" (i.e., it is protected by encryption). For example, a stream cipher may generate a ciphertext C from a plaintext P and a key stream Z=cipher(key) via C=P XOR Z, where decryption is performed as P=CXOR Z. In the case where the cipher is implemented in a masked manner, the keystream shares Z1, Z2, Z3 can be generated from the masked keys - key1, key2, key3. In this case, the different ciphertext parts can be encrypted using the corresponding keystream shares C1 = P1 XOR Z1, C2 = P2 XOR Z2 and C3 = P3 XOR Z3. After encryption, the masks can now be combined without revealing the secret information, i.e., C = C1 XOR C2 XOR C3. Then, C can be securely derived in an encrypted form that does not reveal information about P.

[0069] although Figure 4The example of shows the case of Boolean masking, but in other examples, arithmetic masking can be used instead. In one case, arithmetic masking in the form of additive masking can be used to generate data shares. Additive masking is similar to XOR masking, but uses integer addition or modular addition. In one case, the share is calculated as: X = (∑ d X i ) mod (q), where q can be a small prime number related to the algorithm or q = 2 n As an example, additive masking can be performed by wrapping the addition modulo 2 16 The fixed constant q can vary for different cryptographic algorithms. For many cryptographic algorithms, the size of q is less than 16 or 32 bits, or is exactly a power of 2. As an example, the KYBER algorithm uses a q value of 3329, and the SABER algorithm uses a q value of 2. 13 The value of q for different cryptographic algorithms may be hard-coded into the implementation of the cryptographic math unit 130. As an example, the quantity X=1238 may be represented using shares X1=1111, X2=2222, and X3=1234, where the value of q is 3329, since X1+X2+X3==4567 mod q=1238 (using modular wraparound addition).

[0070] In some examples, the cryptographic system 110 may be arranged to perform an operation that converts between two different masking formats. For example, if the data shares are in corresponding masking formats, a linear operation such as XOR or addition may be applied to the data shares independently only. In one case, Boolean masking may be converted to and from arithmetic masking. In the case where Boolean masking is converted to arithmetic masking, this may be accomplished by determining the second set of data shares {Y i}, the second set of data shares has the same value as the first set of data shares {X i}, for example, S = ⊕X i =∑Y i In the case where the arithmetic mask is converted to a Boolean mask, the reverse operation can be performed, for example, the second set of data shares {Y i}, the second set of data shares has the same value as the first set of data shares {X i}, for example, S = ∑X i =⊕Y i. In some cases, the control unit 150 can be programmed to perform a conversion operation in the hardware of the cryptographic system 110 using the arithmetic unit 136 and the matrix memory 132, which is similar to the conversion operation described in the following paper: "An Instrumentation Set Extension to Support Software-Based Masking" by Gao et al., Cryptography Print Archive, Report 2020 / 77, which is incorporated herein by reference. For example, the aforementioned paper defines BOOL2ARITH and ARITH2BOOL conversion functions, which in turn utilize basic Boolean addition (BOOLADD) and Boolean substitution (BOOLSUB) operations. These Boolean addition and Boolean substitution operations, in turn, include relatively complex sequences of bit manipulations involving "masked random" inputs. The cryptographic system 110 of the present invention provides a great advantage over the software implementation of the paper (e.g., typically performed by the central processing unit of an external computing system) because the cryptographic math unit 130 is designed (and optimized) for Boolean operations (e.g., such as Figure 3 Thus, cryptographic system 110 allows for much faster operations.

[0071] Certain arithmetic primitives applied as operations by arithmetic unit 136 may be implemented with the aid of conversion functions within a masked operation mode (or the conversion functions may be implemented using direct operations). For example, for Boolean masked addition and subtraction, a set of output data shares {Z i} can be obtained from the input share {X i} and {Y i} is calculated so that the XOR sum satisfies X+Y=Z or XY=Z(mod q). Other masked functions can follow the same pattern. Bitwise logic in the masked pattern can be performed by applying, for example, AND, OR, and XOR operations to arithmetic masked or Boolean masked data shares. Similarly, shifts, rotations, and bit manipulations can be applied to arithmetic masked or Boolean masked data shares. Comparisons can be performed by analyzing the equality or ordering of masked variables (e.g., using less than or greater than). The result of the comparison can also be masked (e.g., a true or false value can be a masked bit). Domain arithmetic and special functions of post-quantum cryptography can also be applied to masked variables.

[0072] Some post-quantum cryptographic operations operate on ring polynomials. For example, lattice-based cryptography utilizes ring polynomials and matrix multiplications. Many of these multiplications are performed between secret polynomials and public polynomials. In these cases, the secret polynomial can be masked, and the public polynomial does not need to be masked. In the case of multiplying a secret polynomial X with a public polynomial C, the secret polynomial can be split into d data shares for use in a masked mode of operation, for example, such that CX=CX1+CX2+CX3(mod q). In this case, multiplication by a constant (the public polynomial C) only results in an increase in complexity of O(d). This means that lattice-based post-quantum cryptography is particularly well suited for masked modes of operation. In comparison, multiplication of two masked representations, for example, (X1+X2+X3)*(Y1+Y2+Y3), results in at least O(d) relative to the number of shares. 2 ) (i.e., quadratic) overhead. Similarly, for many number theoretic transformations (NTTs) used to implement rings and modular algebraic objects for known lattice cryptographic schemes, only one input to the NTT multiplication needs to be masked. This limits the overhead of applying masking patterns. Lattice cryptography additionally uses mixed bit-oriented operations such as right shifts, "roundings," and masked comparisons. These tasks can be accomplished using more efficient partial masking transformations customized for each operation.

[0073] Masking is applied as a side channel attack countermeasure in the examples of this article. Cryptographic system 11 provides hardware-accelerated cryptographic operations with overall hardware masking support. Masking can be configured to meet the requirements of "non-invasive attack countermeasures" described in FIPS140-3 and ISO 19790 security standards, both of which are incorporated herein by reference (e.g., those security standards defined in Section 7.8 of ISO / IEC 19790:2012(E)). Testing of the effectiveness of countermeasures such as masking described herein can be performed using laboratory procedures, such as those described in ISO / IEC 17825:2016(E) "Testing methods for the mitigation of non-invasive attack classesagainst cryptographic modules", which are incorporated herein by reference and are more generally referred to as test vector leakage assessment (TVLA).

[0074] In an example of the present invention, the cryptographic processing module 35 performs data processing operations associated with one or both of the KYBER and DILITH IUM post-quantum cryptographic algorithms.

[0075] Modifications and further examples

[0076] With respect to the packing module 27 and the unpacking module 29, it should be understood that there are many variations of the described algorithm that can be used to achieve the same result. For example, the order of processing of the pairs in PackRefresh-Long need not facilitate sequential processing of the individual working variables, but if d is a power of 2 (such as 8 or 16), it can be calculated in parallel by using the following:

[0077] For I={1,2,..d / 2}, (S'[i],K[i])=PackRefresh(S[2*i-1],S[2*i])

[0078] The first iteration of such an arrangement produces d / 2 random keys K[i] and d / 2 shares S'[i]. Shares S'[i] are then processed in parallel to create d / 4 random keys K[i] and d / 4 shares S'[i] until a single share S' remains, at which point d-1 random keys have been generated as in the sequential calculation.

[0079] The secret share may be in various formats, such as a vector format, a matrix format, or a polynomial format. Therefore, the intermediate data and the working data may also be in various formats to match the format of the secret share.

[0080] It should be understood that although the secret shares in the described examples correspond to cryptographic keys, the secret shares may represent other forms of secret data. For example, the secret shares may represent financial data such as a bank account number.

[0081] Although in the above example, the work data generated in the packing operation corresponds to the modular addition of the value of the share and the inverse modular addition of the value of the intermediate data corresponding to each of the random keys, and in the unpacking operation, the multiple secret shares correspond to the modular addition of the work data and the intermediate data corresponding to each of the one or more random keys, in an alternative, the packing operation may involve the modular addition of the value of the share and the value of the intermediate data corresponding to each of the random keys, and in the unpacking operation, the multiple secret shares correspond to the modular addition of the work data and the inverse modular addition of the intermediate data corresponding to each of the one or more random keys.

[0082] Certain examples described herein provide devices (e.g., cryptographic systems or coprocessors) capable of performing post-quantum cryptography using masked arithmetic (i.e., data provided as masked data shares for side-channel protection). The masked operation modes may utilize one or more of Boolean and arithmetic masking, and the devices may provide conversions between (at least these) different forms of masking. The described examples provide novel cryptographic system structures or configurations that perform masked operations in a flexible and efficient manner to allow both accelerated post-quantum cryptographic coprocessing and high security against side-channel attacks.

[0083] Certain examples described herein provide devices (e.g., cryptographic systems or coprocessors) that can assist and / or accelerate cryptographic computations and autonomously perform certain complete post-quantum cryptographic operations. For example, the device allows public key key establishment and encryption, such as generating public-private key pairs, encapsulation and / or encryption, and decapsulation and / or decryption. The device further allows digital signature functions, such as generating public-private integrity key pairs, signature generation and signature verification, and stateful hash-based signatures, such as assisting and / or accelerating key generation, signature generation, and / or signature verification functions. Such devices can be provided as a system on chip (e.g., integrated within a silicon design and / or provided as a separate FPGA / ASIC chip that can be attached).

[0084] Certain examples described herein provide cryptographic systems capable of providing secure cryptographic computations. For example, one or more of the following post-quantum public key encryption algorithms may be implemented: Classic Mc Eliece, (CRYSTALS-) KYBER, NTRU, SABER, BIKE, FrodoKEM, HQC, NTRU Prime, SIKE, and supersingular homologous Diffie-Hellman (SIDH); and one or more of the following post-quantum digital signature algorithms: (CRYSTALS-) DILI THIUM, FALCON, Rainbow, GeMSS, and Picnic. Further details of these algorithms may be found in: available NIST publications on the "Post-Quantum Cryptography Project", and publications of the CRYSTALS project ("Cryptographic Suite for Algebraic Lat tices-Kyber and Dilithium"), which are incorporated herein by reference.

[0085] Certain examples described herein have a control unit that controls cryptographic operations without handling sensitive data (so-called "touchless" operations). For example, the control unit may not have access to sensitive data in a cryptographic math unit during an operation.

[0086] Certain examples further provide a method by which a control unit or processor can provide secure tracking of secret data throughout a cryptographic operation; thus, the control unit or processor can track the flow of sensitive information within a cryptographic system without having access to the data.

[0087] The functions provided in the secure processing environment can be implemented in software, hardware, or a combination of software and hardware. Therefore, the packing module 27, the unpacking module 29, and the cryptographic processing module 35 can be implemented as: processor-implemented instructions that perform their corresponding functions when executed by the processor or hardware circuits that perform their corresponding functions, such as FPGA or ASIC; or a combination of processor-implemented instructions and hardware.

[0088] The above examples should be understood to be illustrative. Other examples are contemplated. Although certain components of each example have been described separately, it should be understood that the functionality described with reference to one example may be suitable for implementation in another example, and certain components may be omitted depending on the implementation. It should be understood that any feature described with respect to any one example may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other example, or in combination with any combination of any other example. For example, features described with respect to system components may also be suitable for execution as part of the described method. In addition, equivalents and modifications not described above may also be adopted without departing from the scope of the invention as defined in the appended claims.

Claims

1. A computer-implemented method of storing data corresponding to secret data represented by a plurality of shares, each share of the plurality of shares having a first number of bits, the method comprising: generating a plurality of random keys, each random key having a second number of bits less than the first number of bits, wherein the plurality of random keys is one less than the plurality of shares; for each random key of the plurality of random keys, using the generated random key as a seed value for a deterministic function that outputs corresponding intermediate data having the first number of bits; performing a plurality of modular addition operations to generate working data having the first number of bits and corresponding to modular addition of the values ​​of the shares and modular addition or inverse modular addition of the values ​​of the intermediate data corresponding to each of the random keys; and The working data and the plurality of random keys are stored.

2. The computer-implemented method of claim 1 , wherein: Performing the modular addition operation includes performing an inverse modular addition of at least one of the values ​​of the intermediate data before performing the modular addition of the values ​​of all of the shares.

3. The computer-implemented method of claim 1 or 2, wherein: Generating the working data includes setting one of the multiple shares as temporary data, and for the remaining shares of the multiple shares, iteratively generating updated temporary data by performing modular addition of the value of the share and the value of the temporary data and then performing inverse modular addition of the corresponding intermediate data, wherein the updated temporary data is used as temporary data for the next iteration, and the updated temporary data after the last iteration forms the working data.

4. The computer-implemented method of claim 1 or 2, wherein: The number of the plurality of shares is a power of 2, and wherein generating the working data comprises iteratively: splitting the plurality of shares into pairs; For each pair, generating first data by performing an inverse modular addition of a value of one of the pair and a value of the corresponding intermediate data, and generating second data by performing a modular addition of a value of the other of the pair and the first data; setting the second data generated for each pair as the plurality of shares for a next iteration; The second data of the last iteration forms the working data.

5. A computer-implemented method according to any preceding claim, wherein: The method is performed within a secure processing environment.

6. A computer-implemented method of recovering a plurality of shares corresponding to secret data from stored working data and one or more random keys, wherein: each of the plurality of secret shares has a first number of bits and each of the plurality of random keys has a second number of bits less than the first number of bits, and wherein the number of the one or more random keys is one less than the number of the plurality of secret shares, The method comprises: for the or each random key of the one or more random keys, determining intermediate data by using the random key as a seed value for a deterministic function, the deterministic function outputting corresponding intermediate data having the first number of bits; Determine the multiple secret shares so that a modulo addition of the multiple secret shares corresponds to a modulo addition of the working data and the intermediate data corresponding to each of the one or more random keys or an inverse modulo addition of the working data and the intermediate data corresponding to each of the one or more random keys.

7. The computer-implemented method of claim 6, wherein: The plurality of secret shares include two secret shares, and there is a random key, and wherein determining the two secret shares includes: generating random data having said first number of bits; and performing a modulo operation of the working data and the random data to generate a first secret share; and An inverse modular addition of the intermediate data corresponding to the one random key and the random data is performed.

8. The computer-implemented method of claim 6, wherein: The method comprises: Setting the value of the working variable to the value of the working data; For each of the random keys, iteratively: generating random data having said first number of bits; calculating a corresponding one of the remaining secret shares by performing an inverse modular addition of the corresponding intermediate data and the random data; and updating the working variable by performing a modular addition of the working variable and the random data; and After generating the remaining secret shares, the one secret share is set to the value of the working variable.

9. A device configured to perform a masked processing operation using a plurality of shares corresponding to secret data, each share in the plurality of shares having a first number of bits, the device configured to: generating a plurality of random keys, each random key having a second number of bits less than the first number of bits, wherein The plurality of random keys is one less than the plurality of shares; for each random key of the plurality of random keys, using the generated random key as a seed value for a deterministic function that outputs corresponding intermediate data having the first number of bits; performing a plurality of modular addition operations to generate working data, the working data having the first number of bits and corresponding to modular addition of the value of the share and modular addition or inverse modular addition of the value of the intermediate data corresponding to each of the random keys; as well as The working data and the plurality of random keys are stored.

10. The device according to claim 9, wherein: Performing the modular addition operation includes performing an inverse modular addition of at least one of the values ​​of the intermediate data, the modular addition having been performed for all of the values ​​of the shares.

11. The device according to claim 9 or 10, wherein: Generating the working data includes setting one of the multiple shares as temporary data, and for the remaining shares of the multiple shares, iteratively generating updated temporary data by performing modular addition of the value of the share and the value of the temporary data and then performing inverse modular addition of the corresponding intermediate data, wherein the updated temporary data is used as temporary data for the next iteration, and the updated temporary data after the last iteration forms the working data.

12. The device according to claim 9 or 10, wherein: The number of the plurality of shares is a power of 2, and wherein generating the working data comprises iteratively: splitting the plurality of shares into pairs; For each pair, generating first data by performing an inverse modular addition of a value of one of the pair and a value of the corresponding intermediate data, and generating second data by performing a modular addition of a value of the other of the pair and the first data; setting the second data generated for each pair as the plurality of shares for a next iteration; The second data of the last iteration forms the working data.

13. The apparatus according to any one of claims 9 to 12, wherein: The apparatus provides a secure processing environment in which the masked processing operations are performed.

14. A device configured to perform a masked processing operation using a plurality of shares corresponding to secret data, each of the plurality of shares having a first number of bits, the device configured to recover the plurality of shares corresponding to the secret data from stored working data and one or more random keys, wherein Each secret share in the plurality of secret shares has a first number of bits, and each random key in the plurality of random keys has a second number of bits less than the first number of bits, and wherein the number of the one or more random keys is one less than the number of the plurality of secret shares, by: for the or each random key of the one or more random keys, determining intermediate data by using the random key as a seed value for a deterministic function, the deterministic function outputting corresponding intermediate data having the first number of bits; Determine the multiple secret shares so that a modulo addition of the multiple secret shares corresponds to a modulo addition of the working data and the intermediate data corresponding to each of the one or more random keys or an inverse modulo addition of the working data and the intermediate data corresponding to each of the one or more random keys.

15. The device according to claim 14, wherein: The plurality of secret shares include two secret shares, and there is a random key, and wherein determining the two secret shares includes: generating random data having said first number of bits; and performing a modulo operation of the working data and the random data to generate a first secret share; and An inverse modular addition of the intermediate data corresponding to the one random key and the random data is performed.

16. The apparatus according to claim 14, wherein: The device is configured to: Setting the value of the working variable to the value of the working data; For each of the random keys, iteratively: generating random data having said first number of bits; Calculating a corresponding one of the remaining secret shares by performing an inverse modular addition of the corresponding intermediate data and the random data; as well as updating the working variable by performing a modular addition of the working variable and the random data; and After generating the remaining secret shares, the one secret share is set to the value of the working variable.

17. Apparatus according to any one of claims 14 to 16, wherein: The apparatus provides a secure processing environment in which the masked processing operations are performed.

18. Apparatus according to any one of claims 9 to 17, wherein: The device is configured to perform masked processing operations implementing at least one of a KYBER cryptographic algorithm and a DILITHIUM cryptographic algorithm.

19. A computing system comprising the apparatus according to any one of claims 9 to 18.

Images