Apparatus, method and medium for determining integrity of generated cryptographic signatures

Abstract

Various examples relate to apparatuses, methods, and media for determining integrity of a generated cryptographic signature. The apparatus generates redundancy information of at least one cryptographic secret used to generate the cryptographic signature prior to generating the cryptographic signature, generates the cryptographic signature using the at least one cryptographic secret, compares the redundancy information with the at least one cryptographic secret after generating the cryptographic signature to determine whether the redundancy information matches the at least one cryptographic secret, and transmits the cryptographic signature to the apparatus. And using a cryptographic signature if the redundancy information matches at least one cryptographic secret.

Description

Technical Field

[0001] The present disclosure relates to apparatus, devices, methods and computer programs for determining the integrity of a generated cryptographic signature. Background Art

[0002] Crystals-Dilithium is a cryptographic algorithm that was selected as the leading candidate for future digital signatures in a competition held by the National Institute for Standards and Technology (NIST) on post-quantum cryptographic algorithms. The standardization of Crystals-Dilithium is expected to be completed in 2024. Crystals-Dilithium is expected to replace the non-quantum-secure ECDSA (Elliptic Curve Digital Signature Algorithm) / RSA (Rivest-Shamir-Adleman) based digital signature schemes and become the new standard. Dilithium has randomized and deterministic signature modes. In randomized mode, it generates random tokens, while in deterministic mode it uses tokens that depend on the message.

[0003] If dilithium is used as a signature scheme for post-quantum cryptography, the algorithm will be widely deployed. Its resilience to error attacks is crucial because it could reveal sensitive private keys. The so-called Rowhammer attack is a well-known technique for inducing errors on general-purpose CPUs (central processing units) without any physical access, see Kim et al: Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors (ACM International Symposium on Computer Architecture. 2014). Islam et al: Signature Correction Attack on Dilithium Signature Scheme (IEEE European Symposium on Security and Privacy. 2022) demonstrated the use of a row hammer attack to reveal dilithium private keys. In addition, Bruinderink et al.'s "Differential fault attacks on deterministic lattice signatures (IACR Transactions on Cryptographic Hardware and Embedded Systems. 2018)" shows that any general fault attack on dilithium can be exploited as a hammer-type attack. The latter two papers proposed a defense method that exploits temporal redundancy: re-execute signature generation and compare two signatures generated at different times. This re-execution of the signature (temporal redundancy) requires more than 100% performance overhead. In addition, these two papers also proposed another defense method (post-signature verification), which is to verify the signature after it is generated. Post-signature verification can provide fault tolerance against hammer attacks, but it still introduces a 30% performance overhead. Summary of the invention

[0004] According to an embodiment of the present disclosure, a device for determining the integrity of a generated cryptographic signature is provided, the device comprising a memory circuit, machine-readable instructions, and a processor circuit, the processor circuit being used to execute the machine-readable instructions to: before generating the cryptographic signature, generate redundancy information of at least one cryptographic secret used to generate the cryptographic signature; generate the cryptographic signature using the at least one cryptographic secret; after generating the cryptographic signature, compare the redundancy information with the at least one cryptographic secret to determine whether the redundancy information matches the at least one cryptographic secret; and if the redundancy information matches the at least one cryptographic secret, use the cryptographic signature.

[0005] According to an embodiment of the present disclosure, a method for determining the integrity of a generated cryptographic signature is provided, the method comprising: before generating the cryptographic signature, generating redundancy information of at least one cryptographic secret used to generate the cryptographic signature; using the at least one cryptographic secret to generate the cryptographic signature; after generating the cryptographic signature, comparing the redundancy information and the at least one cryptographic secret to determine whether the redundancy information matches the at least one cryptographic secret; and if the redundancy information matches the at least one cryptographic secret, using the cryptographic signature.

[0006] According to an embodiment of the present disclosure, a non-transitory computer-readable medium is provided, including a program code. When the program code is executed on a processor, a computer or a programmable hardware component, the program code causes the processor, the computer or the programmable hardware component to perform the above method. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Some examples of apparatus and / or methods will now be described, by way of example only, with reference to the accompanying drawings, in which:

[0008] Figure 1a A schematic diagram showing an example of an apparatus or device for determining the integrity of a generated cryptographic signature and a computer system or mobile device including such an apparatus or device;

[0009] Figure 1b A flow chart illustrating an example of a method for determining the integrity of a generated cryptographic signature;

[0010] Figure 2 A schematic diagram showing performance overhead; and

[0011] Figure 3 A schematic diagram showing memory overhead is shown. DETAILED DESCRIPTION

[0012] Some examples are now described in more detail with reference to the accompanying drawings. However, other possible examples are not limited to the features of these embodiments described in detail. Other examples may include modifications to these features, as well as the equivalents and substitutions of these features. In addition, the terms used herein to describe certain examples should not limit other possible examples.

[0013] Throughout the description of the drawings, the same or similar reference numerals refer to the same or similar elements and / or features, which may be the same or implemented in a modified form while providing the same or similar functions. The thickness of the lines, layers and / or regions in the drawings may also be exaggerated for clarity.

[0014] When two elements A and B are combined using "or", this should be understood as disclosing all possible combinations, i.e., only A, only B, and A and B, unless otherwise explicitly defined in individual cases. As an alternative wording for the same combination, "at least one of A and B" or "A and / or B" can be used. This applies equally to combinations of more than two elements.

[0015] If singular forms such as "a", "an" and "the" are used, and there is no explicit or implicit limitation that only a single element is mandatory, other examples may also use several elements to achieve the same function. If a function is described below as being implemented using multiple elements, other examples may use a single element or a single processing entity to achieve the same function. It is also understood that the terms "comprises" and / or "comprising" when used describe the presence of specified features, integers, steps, operations, processes, elements, components and / or groups thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, processes, elements, components and / or groups thereof.

[0016] In the following description, specific details are set forth, but examples of the technology described herein can be implemented without these specific details. Well-known circuits, structures, and techniques are not shown in detail to avoid obscuring the understanding of this specification. "An example / example", "various examples / examples", "some examples / examples", and the like may include features, structures, or characteristics, but not every example necessarily includes the particular feature, structure, or characteristic.

[0017] Some examples may have some, all, or none of the features described for other examples. "First," "second," "third," and the like describe common elements and indicate that different instances of similar elements are mentioned. Such adjectives do not mean that the elements so described must be in a given sequence, whether in time or space, in ranking, or in any other manner. "Connected" may indicate that elements are in direct physical or electrical contact with each other, while "coupled" may indicate that elements cooperate or interact with each other, but they may or may not be in direct physical or electrical contact.

[0018] As used herein, the terms "operate," "execute," or "enable" are used interchangeably when referring to software or firmware associated with a system, device, platform, or resource, and may refer to software or firmware stored in one or more computer-readable storage media accessible to the system, device, platform, or resource, even if the instructions contained in the software or firmware are not being actively executed by the system, device, platform, or resource.

[0019] The description may use the phrases "in an example / example", "in an example / example", "in some examples / examples", and / or "in various examples / examples", each of which may refer to one or more of the same or different examples. In addition, the terms "including", "comprising", "having", etc., used with respect to the examples of the present disclosure, are synonymous.

[0020] Figure 1a A schematic diagram of an example of an apparatus 10 or device 10 for determining the integrity of a generated cryptographic signature and a computer system 100 or mobile device 100 including such an apparatus 10 or device 10 is shown. The apparatus 10 includes circuitry for providing the functionality of the apparatus 10. For example, the circuitry of the apparatus 10 may be configured to provide the functionality of the apparatus 10. For example, Figure 1a The apparatus 10 includes an optional interface circuit 12, a processor circuit 14, and a memory circuit 16. For example, the processor circuit 14 can be coupled to the interface circuit 12 and to the memory circuit 16. For example, the processor circuit 14 can provide the functionality of the apparatus in combination with the interface circuit 12 (for exchanging information, such as exchanging information with other components inside or outside the computer system 100 or mobile device 10 including the apparatus 10 or device 10) and the memory circuit 16 (for storing information, such as machine-readable instructions). Similarly, the device 10 may include means for providing the functionality of the device 10. For example, these means may be configured to provide the functionality of the device 10. The components of the device 10 are defined as component means, which may correspond to or be implemented by individual structural components of the device 10. For example, Figure 1aThe device 10 includes: a device 14 for processing, which may correspond to the processor circuit 14 or be implemented by the processor circuit 14; a device 12 for communication, which may correspond to the interface circuit 12 or be implemented by the interface circuit 12; (optionally) a device 16 for storing information, which may correspond to the memory circuit 16 or be implemented by the memory circuit 16. In general, the functions of the processor circuit 14 or the device 14 for processing can be implemented by the processor circuit 14 or the device 14 for processing executing machine-readable instructions. Therefore, any characteristics given to the processor circuit 14 or the device 14 for processing can be defined by one or more instructions of a plurality of machine-readable instructions. The device 10 or apparatus 10 may include machine-readable instructions, for example, in a memory circuit 16, a storage circuit (not shown), or a device 16 for storing information.

[0021] The processor circuit 14 or the means for processing 14 generates redundancy information of at least one cryptographic secret used to generate the cryptographic signature before generating the cryptographic signature. The processor circuit 14 or the means for processing 14 uses the at least one cryptographic secret to generate the cryptographic signature. The processor circuit 14 or the means for processing 14 compares the redundancy information and the at least one cryptographic secret after generating the cryptographic signature to determine whether the redundancy information matches the at least one cryptographic secret. If the redundancy information matches the at least one cryptographic secret, the processor circuit 14 or the means for processing 14 uses the cryptographic signature.

[0022] Figure 1b A flow chart of an example of a corresponding method for determining the integrity of a generated cryptographic signature is shown. The method includes, before generating the cryptographic signature, generating (110) redundancy information for at least one cryptographic secret, the at least one cryptographic secret being used to generate the cryptographic signature. The method includes generating (120) the cryptographic signature using the at least one cryptographic secret. The method includes, after generating the cryptographic signature, comparing (130) the redundancy information and the at least one cryptographic secret to determine whether the redundancy information matches the at least one cryptographic secret. The method includes, if the redundancy information matches the at least one cryptographic secret, using (150) the cryptographic signature. For example, the method may be performed by a computer system 100 or a mobile device 100, such as by an apparatus 10 or device 10 of the computer system 100 or the mobile device 100.

[0023] In the following, features of the apparatus 10, device 10, computer system / mobile device 100, method and corresponding computer program will be described in more detail with reference to the apparatus 10. Features described in connection with the apparatus 10 may also be included in the corresponding device 10, computer system / mobile device 100, method and corresponding computer program.

[0024] Various examples of the present disclosure relate to digital cryptographic signatures, and more particularly to protecting such digital cryptographic signatures from manipulation during signature generation, which manipulation can be used to spy on the cryptographic secret bit by bit, with the goal of ultimately reconstructing the cryptographic secret. Such an attack can be achieved, for example, by flipping random bits of a secret key (using a hammer attack) in order to generate an erroneous signature. Although an erroneous signature cannot be verified, it is possible to modify the erroneous signature using a signature correction algorithm to determine the flipped bits, because a bit flip of 1 bit results in a compromised cryptographic secret modified by a certain number of bits (i.e., 1 bit), resulting in a 2*bit number of cryptographic secret differences between the correct cryptographic secret and the erroneous cryptographic secret. By canceling the values ​​of the individual differences in the erroneous cryptographic secret, the attacker can know which difference results in a verifiable signature, and thus the original value of the flipped bit. To obtain the entire cryptographic secret (e.g., a private key), it is necessary to repeat this process for a sufficient number of bits of the cryptographic secret. The basis of this attack is that the attacker has the erroneous signature. In this regard, the proposed concept introduces an additional spatial redundancy check that avoids revealing the erroneous cryptographic signatures, thereby making it impossible for the attacker to use them to reconstruct the cryptographic secret.

[0025] The proposed concept is based on two techniques: spatial redundancy, and verification of the cryptographic secret being used by means of spatial redundancy. This spatial redundancy is based on making a copy of the relevant cryptographic secret(s) used to generate the cryptographic signature before generating the cryptographic signature, and comparing the cryptographic secret used to generate the cryptographic signature with the copy. In this context, this copy is not necessarily a bit-for-bit copy of the cryptographic secret, in some examples, as will be shown below, a hash of the cryptographic secret is sufficient. In any case, the redundancy information is stored in a spatially separated manner from the cryptographic secret, so that a bit flip triggered in the cryptographic secret will not also be triggered in the redundancy information.

[0026] Before generating a cryptographic signature, the processor circuit generates redundant information of at least one cryptographic secret used to generate the cryptographic signature. In this context, a cryptographic secret is a secret bit value used as a parameter for generating a cryptographic signature. Therefore, the cryptographic secret itself is generally not encrypted, but is used to perform encryption and / or signing. For example, the redundancy information can be generated when each cryptographic secret is initialized or when a computer system or mobile device generating a cryptographic signature is started. In some cases, a part of at least one cryptographic secret (e.g., at least one long-term cryptographic parameter, such as a private key for generating a cryptographic secret) can be stored as part of the redundancy information at the time of initialization (initialization of each cryptographic parameter or computer system / mobile device), while another part (e.g., at least one short-term cryptographic parameter (e.g., μ of the crystal-dilithium signature algorithm)) can be stored as part of the redundancy information once it is generated during the algorithm. Alternatively, short-term cryptographic parameters that may only be used once may not be redundantly stored at all. More generally, at least one cryptographic secret may include at least one short-term cryptographic parameter (e.g., a cryptographic secret valid only for a single signature operation) and at least one long-term cryptographic parameter (e.g., a cryptographic secret valid in multiple signature operations, such as a secret / private key). For example, at least one cryptographic secret may include at least one of the cryptographic parameters s1 (secret vector 1), A (public matrix, derived from p), μ (message), and p (seed, which may be randomly or pseudo-randomly derived from the information being signed) of the Crystal-Dilithium cryptographic signature algorithm. Of these parameters, s1 may be a long-term cryptographic parameter (and optionally, A and p, if p is not pseudo-randomly derived from the information being signed), and μ (and optionally, A and p, if p is pseudo-randomly derived from the information being signed) may be a short-term cryptographic parameter. As described in connection with Figure 2 and Figure 3 As described, short-term cryptographic parameters may be stored in a short-term buffer, and long-term cryptographic parameters may be stored in a long-term buffer. More information about the crystal-dilithium algorithm can be found in the following document: Shi Bai et al: CRYSTALS-Dilithium. Algorithm Specifications and Supporting Documentation (Version 3.1) (February 8th, 2021) (Shi Bai et al: Crystal-Dilithium Algorithm Specifications and Supporting Documentation (Version 3.1) (February 8th, 2021), which is used as the basis for the variable terminology used in this document. The processor circuit can abandon generating redundant information for at least one short-term cryptographic parameter (because it is only valid once in any key).

[0027] In some examples, the redundancy information may include one or more copies of at least a portion of at least one cryptographic secret, for example, one or more copies of long-term cryptographic parameters, and optionally, one or more copies of one or more short-term cryptographic parameters. In other words, the redundancy information may include at least one redundant copy of at least a portion of at least one cryptographic secret. Preferably, to further reduce the likelihood of a successful attack, multiple redundant copies may be used. For example, the redundancy information may include at least three (or at least four, or at least five) redundant copies of at least a portion of at least one cryptographic secret. Figure 2 As shown in Figure 2, the number of redundant copies directly affects the attacker's success probability. If at least part of the cryptographic secret has 5 redundant copies, the attacker's success probability will reach 2. -64 However, the number of redundant copies may depend on the memory circuit used (e.g., dynamic random access memory DRAM circuit). For example, the processor circuit may determine the number of redundant copies by testing the memory circuit used to store at least one cryptographic secret. Figure 1b As further shown in , the method may include determining (112) a number of redundant copies by testing (114) a memory circuit used to store at least one cryptographic secret. Specifically, the processor circuit may test the memory circuit by repeatedly accessing memory cells located near the target cell to determine the amount of work required to flip at least one bit stored in the target cell, i.e., consistent with the row hammer attack vector. Depending on the amount of work required to flip the bit stored in the target cell, and based on a desired maximum attacker success probability, an appropriate number of redundant copies may be selected (e.g., in accordance with the number of redundant copies associated with the target cell). Figure 2 Additionally, or alternatively, if the amount of work to flip bits varies throughout the memory circuit, the processor circuit may store at least one cryptographic secret and / or one or more redundant copies in portions of the memory circuit that require more work to flip bits.

[0028] As described above, some portions of at least one cryptographic secret may be used in different signing processes (i.e., (one or more) long-term cryptographic parameters), while other portions may be used only once or a few times, and thus may be less susceptible to corruption. This distinction may be taken into account when making redundant copies. For example, the processor circuit may generate a greater number of redundant copies for at least one long-term cryptographic parameter than for at least one short-term cryptographic parameter. Thus, the method may include generating (116) a greater number of redundant copies (e.g., at least one more, at least two more, or at least three more) for at least one long-term cryptographic parameter than for at least one short-term cryptographic parameter. In some examples, as described above, the number of redundant copies of at least one short-term cryptographic parameter may be zero. In other words, the processor circuit may forgo generating redundant copies for at least one short-term cryptographic parameter.

[0029] As an alternative to (or in addition to) the redundant copy, at least one cryptographic secret may be hashed and the hash may be stored in the redundancy information. For example, the redundancy information may include a hash of the at least one cryptographic secret. This may increase computational overhead while reducing memory overhead. For example, a similar level of protection may be achieved using only a fraction of the memory required to make the redundant copy, since manipulating the hash value to match the manipulated cryptographic secret would require a large number of bit flips (if the hash value is built on an avalanche-based hash algorithm). For example, the processor circuit may generate the hash using a cryptographic hash function, for example, using a variant of the Secure Hash Algorithm (SHA, e.g., SHA, SHA-2, or SHA-3). Thus, the method may include generating (118a) a hash using a cryptographic hash function. If a hash value is used as a comparison target, in order to compare the at least one cryptographic secret with the redundancy information, the hash may be regenerated after generating the cryptographic signature, and the two hashes may be compared. In other words, the processor circuit may regenerate the hash based on the at least one cryptographic secret after generating the cryptographic signature, and compare the hash and the regenerated hash. Thus, if Figure 1b As further shown in , the method may include regenerating ( 118b ) a hash based on at least one cryptographic secret after generating the cryptographic signature, and comparing the hash to the regenerated hash.

[0030] Processor circuit 14 generates a cryptographic signature using at least one cryptographic secret, for example, using an appropriate signature algorithm. For example, the cryptographic signature may be generated according to a quantum-safe cryptographic signature algorithm, such as the crystalline-dilithium cryptographic signature algorithm. Such algorithms promise to be less susceptible or less susceptible to brute force attacks by quantum computers, and thus they are considered more secure than conventionally used cryptographic algorithms.

[0031] After the cryptographic signature is generated (or while the cryptographic signature is being generated, but after at least one cryptographic secret is read out from the memory circuit during the cryptographic signature generation), the redundancy information and the at least one cryptographic secret are compared to determine whether the redundancy information matches the at least one cryptographic secret. For example, (a portion of) the at least one cryptographic secret may be compared with (all) redundant copies of (a portion of) the at least one cryptographic secret. Alternatively, or in addition, after regenerating the hash (value) after reading out the at least one cryptographic secret from the memory circuit during the cryptographic signature generation, the regenerated hash may be compared with the hash stored in the redundancy information. This comparison is performed in order to detect differences between the stored redundancy information and the at least one cryptographic signature that has been / is being used to generate the cryptographic signature. In practice, if the redundancy information fails to match the at least one cryptographic secret, the processor circuit may determine that the at least one cryptographic secret or the redundancy information has been manipulated. If this occurs, the processor circuit may discard the cryptographic signature if manipulation has occurred. Thus, if Figure 1b As further shown in , the method may include, if the redundancy information fails to match the at least one cryptographic secret, determining (140) a manipulation of the at least one cryptographic secret or of the redundancy information, and discarding (155) the cryptographic signature if the manipulation can be determined. Specifically, bit flips may be detected, such as bit flips caused by a row hammer attack. More generally, the manipulation may be based on electrical interactions between adjacent memory cells of the memory circuit due to repeated accesses to the memory cells (i.e., "row hammer"). If the cryptographic signature is discarded, it cannot be used by an attacker to recreate the at least one cryptographic secret.

[0032] If no manipulation is detected, ie, if the redundancy information matches at least one cryptographic secret, the generated cryptographic secret may be used, for example, to sign a message, document or other information package.

[0033] The interface circuit 12 or the means for communicating 12 may correspond to one or more inputs and / or outputs for receiving and / or sending information, which may be digital (bit) values ​​according to a specified code within a module, between modules, or between modules of different entities. For example, the interface circuit 12 or the means for communicating 12 may include circuits configured to receive and / or send information.

[0034] For example, the processor circuit 14 or the means for processing 14 may be implemented using one or more processing units, one or more processing devices, any means for processing, such as a processor, a computer, or a programmable hardware component that can be operated using corresponding adapted software. In other words, the functions of the processor circuit 14 or the means for processing may also be implemented using software, which is then executed on one or more programmable hardware components. Such hardware components may include general-purpose processors, digital signal processors (DSPs), microcontrollers, and the like.

[0035] For example, the memory circuit 16 or the means for storing information 16 may be a volatile memory, for example a random access memory, such as a dynamic random-access memory (DRAM) or a static random-access memory (SRAM).

[0036] For example, the computer system 100 may be at least one of a client computer system, a server computer system, a rack server, a desktop computer system, a mobile computer system, a security gateway, and a router. The mobile device 100 may be one of a smart phone, a tablet computer, a wearable device, and a mobile computer.

[0037] Linking the proposed concept or the preceding or following context (e.g. Figures 2 to 3 ) One or more examples described in the foregoing description mention more details and aspects of the apparatus 10, device 10, mobile device / computer system 100, method and corresponding computer program. The apparatus 10, device 10, mobile device / computer system 100, method and computer program may include one or more additional optional features corresponding to one or more aspects of the proposed concept or one or more examples described above or below.

[0038] Various examples of the present disclosure relate to a concept and method for protecting crystalline-dilithium from row hammer attack.

[0039] Different from the solution to the row hammer attack based on temporal redundancy, the present disclosure proposes a technique requiring spatial redundancy and integrity verification to achieve a solution with reduced or minimal memory overhead.

[0040] Typically, the baseline spatial redundancy approach would copy the entire address space, resulting in a linear increase in memory overhead. To reduce spatial redundancy, a subset of sensitive key material that is vulnerable to hammer errors is identified during the dilithium signing process. This subset of sensitive keys is stored and integrity verified before the signature is finalized. This technique results in 60% lower memory requirements (1800KB vs. 4500KB compared to the baseline spatial redundancy approach) while reducing the probability of a successful attack to 2. -64 , significantly improving the robustness against hammer attacks, and this technology has a lower performance overhead for signature calculation, i.e. 10%, compared to the 30% overhead when using temporal redundancy.

[0041] The proposed method provides robustness against row hammer attacks for the dilithium signature algorithm with reduced performance and memory overhead compared to other techniques. The proposed technique improves algorithms in the post-quantum cryptography space by providing a robust digital signature scheme for applications such as forensics, TLS, etc.

[0042] Below, a defense method for potential row hammer attacks on dilithium will be shown. Compared with traditional error attacks, row hammer attacks have some constraints. The limitations of the row hammer on the dilithium signature generation function have been identified, and these limitations are used to develop an in-depth defense mechanism that exploits spatial redundancy. Specifically, the proposed concept is based on identifying potential targets of the row hammer in the dilithium signature: the secret polynomial s1, the public matrix A, the seed ρ for generating the public matrix, the message digest μ, and the round constants of SHA-3 (Secure Hash Algorithm 3). Multiple (N) copies of (all) potentially vulnerable row hammer variables are retained. At the end of the signing process, the copies (and the original) are compared to confirm that all copies are equal before releasing the signature. In a row hammer-based attack, if there are no erroneous signatures, the attacker cannot discover the private key. However, it is not feasible to induce exactly the same bit flip at N different locations during the same time, so the attack will be blocked by the spatial redundancy of the potential targets.

[0043] In general, post-signature verification may introduce a 30% performance overhead. Re-executing the signature algorithm to compare the results may introduce a 100% performance overhead. A naive copy of the entire address space may incur N*100% memory overhead. The present disclosure explores a more efficient approach by exploiting the fact that for a row hammer attack to be successful, it must trigger an error at a specific but non-arbitrary location in a variable present in dynamic random access memory (with physical page backup).

[0044] In the above, potential targets of the row hammer are identified: s1, A, μ, ρ, and the buffers allocated by the hash function H. If a row hammer attack is launched against the server, one or more bits in these buffers must be flipped when the algorithm terminates. Therefore, an effective defense can apply spatial redundancy to these buffers. In the defense, buffers in the dilithium algorithm that are vulnerable to row hammer attacks are identified. Some buffers may be long-term buffers (e.g., ρ) and some may be short-term buffers (e.g., μ). The difference between long-term buffers and short-term buffers is the duration of the buffer allocation. Short-term buffers may only be allocated within the algorithm. Long-term buffers may be allocated from key generation and remain allocated across multiple dilithium executions.

[0045] For the long-term buffer, N copies of it may have been allocated at key generation time. After dilithium termination, the N copies can be compared to see if they are equal. Therefore, if an attacker wants to bypass this defense, they need to trigger the same error in N different copies. As N becomes larger than 2, this task may not be possible from a heuristic point of view. This defense can be further improved by profiling the DRAM (Dynamic Random Access Memory). For example, the defender / system administrator can profile the entire DRAM and identify the rows / physical pages that are vulnerable to row hammer attacks. When allocating N copies of the long-term buffer, it is possible to avoid mapping them to vulnerable locations. In this way, most of the effort (allocating N copies) is spent on key generation. When a signature request comes in, the time spent on comparing the buffers in real time is minimal.

[0046] For a short-term buffer, N copies may be allocated during dilithium execution, and N copies (and the original) may be compared when the algorithm terminates. The performance overhead scales with N, but should be less than 30 percent.

[0047] Next, an overhead analysis is performed. Probabilistic Assumptions: When analyzing the security of the proposed N-copy defense, it is assumed that the probability of flipping a bit is at most 0.06% (see Kim et al., Flipping Bits in Memory Without Accessing: An Experimental Study of DRAM Scramble Errors). Assuming that an attacker flips a bit in one of the target buffers that is vulnerable to the row hammer attack, the probability of triggering the same scramble pattern in the N other copies will be 0.0006. N *(1-0.0006) N*8191This equation is based on the probability of a single bit flip being bounded at 0.0006, and on the fact that when an attacker hammers a victim row, they must hammer the entire row (typically 8192 bits) together, rather than focusing on a single bit. To trigger a bit flip at a specific location and not at all other locations, the attacker has 0.0006*(1-0.0006) possible 8191 Finally, when scaled to N copies, the result is 0.0006 N *(1-0.0006) N*8191 .

[0048] In the experimental setup, the target was Dilithium Security Level 5 (reference implementation of Dilithium NIST submission). For performance overhead, the time taken to perform a Dilithium signature operation using the proposed defense mechanism with N copies allocated for spatial redundancy was measured. As a baseline performance overhead, the time required to perform a Dilithium signature plus verification operation was measured.

[0049] For memory overhead, we measure the peak RSS (resident set size) of the dilithium signature, which reflects the maximum amount of physical memory allocated for the program. The RSS of our defense mechanism is reported while varying N. The baseline memory overhead is reported as N times the RSS of the undefended dilithium signature (N=0);

[0050] For each experiment, 10,000 iterations were performed and the number of copies N was varied. When measuring the time, we used the x86 instruction RDTSC to determine the current processor cycles.

[0051] Figure 2 A schematic diagram of the performance overhead is shown in Figure 2 , the experimental results of the performance overhead are shown. On the x-axis, the number of copies N is plotted. On the left y-axis (point 210), the processor cycles spent by the CPU in executing the dilithium signature with the proposed defense (when changing N). On the right y-axis (point 220), the probability of an attacker successfully bypassing the defense (when changing N) is shown, assuming that each bit can be flipped with a probability of 0.06%. For the baseline defense of verifying and signing, 1.4×10 10 Using the proposed defense mechanism, when N=5, overwhelmingly high security can be achieved, and the probability of an attacker bypassing the defense is (2 -64 ) can be ignored, and the CPU cycle is 1.2×10 10 , equivalent to a 10% performance overhead.

[0052] Figure 3 A schematic diagram of memory overhead is shown in Figure 3, experimental results of memory overhead are presented. On the x-axis, the number of copies N is plotted. On the Y-axis, the resident set size (RSS) is shown. Point 310 is plotted to show the dilithium signature with the proposed defense mechanism (varying N) as the memory overhead of the proposed mechanism. Point 320 is plotted to show N multiplied by the RSS of the default dilithium signature as the baseline memory overhead. It is clear that the proposed mechanism achieves a much lower memory overhead. When N=5, the baseline protection incurs a memory overhead of about 500%, while the proposed mechanism incurs only 100% memory overhead.

[0053] The proposed mechanism recognizes the importance of preparing for the post-quantum era and ensuring the security of digital communications and systems. As quantum computing continues to advance, there is an increasing need to develop and implement PQC algorithms that can protect sensitive data and ensure the integrity of digital transactions.

[0054] Background information about the crystal-dilithium signature algorithm can be found, for example, in the following document: "Crystal-Dilithium Algorithm Specification and Supporting Document (Version 3.1)" by Shi Bai et al. (February 8, 2021), which is used as the basis for the variable terminology used in this document.

[0055] The pseudocode shown in Figure 4 of the Crystal-Dilithium Algorithm Specification and Support Document (Version 3.1) by Shi Bai et al. defines the deterministic and randomized versions of dilithium. Line 12 in the signature algorithm distinguishes between the deterministic and randomized versions. In the deterministic dilithium, the p in line 12 is pseudo-randomly generated based on the input message. In the randomized dilithium, the p in line 12 is randomly generated.

[0056] Based on this pseudocode, the dilithium public and secret keys are determined.

[0057] Public key: ρ,t1

[0058] Secret key: ρ, K, tr, s1, s2, t0. Disclosing s1 will destroy dilithium.

[0059] Next, the threat model is discussed. Row hammer is an error attack without physical access. The attacker can inject errors, but his ability is greatly constrained because the attacker can only trigger errors on buffers with physical page backup by flipping bits in DRAM. For example, it is impossible to make the value in the register wrong. Once an error is triggered in DRAM, it may take 64ms (refresh interval) for the upper-level software system to observe the error.

[0060] Islam et al.'s "Signature Correction Attack on the Dilithium Signature Scheme" performed a hammer attack on randomized dilithium to retrieve some bits of the secret key, and increased the security guarantee of dilithium from 2 128 Down to 2 81 . In this paper, randomized dilithium is targeted and the row hammer threat model is used. The paper assumes that the secret key s1 is stored as a long-term buffer, backed up by a physical page that is vulnerable to the row hammer attack. The attack works by flipping random bits in the secret key s1. Assuming that one bit is flipped in s1, the flipped s1 is denoted as s′1. Observe line 19 z=y+cs1 in the signature algorithm. If a random one-bit error is triggered in s1→s′1, the signature will be z′=y+cs′1. The erroneous z′ cannot be verified, but it is possible to modify z′ using the signature correction algorithm so that the attacker knows one bit of s1. The reason is that the difference Δs1 between s1 and s′1 is unknown, but can be guessed. The total possibility of Δs1 is equal to the total number of coefficients in s1 multiplied by 2, corresponding to bit flips from 0→1 and 1→0. The attacker guesses each possible Δs1, cancels cΔs1 in z′, and finally verifies zz′-cΔs1. If z′-cΔs1 is verified, then Δs1 is the correct guess. The attacker knows the position i of the flipped bit from the position of Δs1, and knows that the original value of s1 at i is 1 if Δs1 is 1→0, and the original value is 0 if Δs1 is 0→1. The attack recovers one bit in s1 by triggering a bit flip in DRAM. To recover all bits, it needs to flip every bit in s1, which means that every bit in the physical page backup s1 must be flippable. This assumption is not realistic and limits the attack.

[0061] Linking the proposed concept or the preceding or following context (e.g. Figure 1a to Figure 1b ) to mention more details and aspects of the concept and method for protecting crystal-dilithium from hammer attack. The concept and method for protecting crystal-dilithium from hammer attack may include one or more additional optional features corresponding to one or more aspects of the proposed concept or one or more examples described above or below.

[0062] In the following, some examples of the proposed concept are given:

[0063] An example (e.g., Example 1) relates to an apparatus (10) for determining the integrity of a generated cryptographic signature, the apparatus comprising a memory circuit (16), machine-readable instructions, and a processor circuit (14), the processor circuit being configured to execute the machine-readable instructions to: before generating the cryptographic signature, generate redundancy information for at least one cryptographic secret used to generate the cryptographic signature, generate the cryptographic signature using the at least one cryptographic secret, after generating the cryptographic signature, compare the redundancy information and the at least one cryptographic secret to determine whether the redundancy information matches the at least one cryptographic secret, and use the cryptographic signature if the redundancy information matches the at least one cryptographic secret.

[0064] Another example (e.g., Example 2) relates to the previous example (e.g., Example 1) or any other example, and also includes the processor circuit executing the machine-readable instructions to determine a manipulation of the at least one cryptographic secret or of the redundancy information if the redundancy information fails to match the at least one cryptographic secret, and discarding the cryptographic signature if the manipulation is determined.

[0065] Another example (eg, Example 3) relates to the previous example (eg, Example 2) or any other example, further comprising determining that the manipulation is based on electrical interactions between adjacent memory cells of the memory circuit due to repeated accesses to the memory cells.

[0066] Another example (e.g., Example 4) relates to the previous example (e.g., one of Examples 1 to 3) or any other example, and also includes that the cryptographic signature is generated according to a quantum-safe cryptographic signature algorithm.

[0067] Another example (eg, Example 5) relates to the previous example (eg, one of Examples 1 to 4) or any other example, further including that the cryptographic signature is generated according to a crystal-dilithium cryptographic signature algorithm.

[0068] Another example (eg, Example 6) relates to the previous example (eg, Example 5) or any other example, further comprising the at least one cryptographic secret comprising at least one of cryptographic parameters s1,A,μ,ρ of the Crystal-Dilithium cryptographic signature algorithm.

[0069] Another example (eg, Example 7) relates to the previous example (eg, one of Examples 1 to 6) or any other example, further comprising the redundancy information comprising at least one redundant copy of at least a portion of the at least one cryptographic secret.

[0070] Another example (eg, Example 8) relates to the previous example (eg, Example 7) or any other example, further comprising the redundancy information comprising at least three redundant copies of at least a portion of the at least one cryptographic secret.

[0071] Another example (e.g., Example 9) relates to the previous example (e.g., one of Examples 7 or 8) or any other example, and also includes the processor circuit executing the machine-readable instructions to: determine the number of redundant copies by testing a memory circuit used to store the at least one cryptographic secret.

[0072] Another example (e.g., Example 10) relates to the previous example (e.g., Example 9) or any other example, and also includes the processor circuit being used to execute the machine-readable instructions to: test the memory circuit by repeatedly accessing memory cells located near the target cell to determine the amount of work required to flip at least one bit stored in the target cell.

[0073] Another example (e.g., Example 11) relates to the previous example (e.g., one of Examples 7 to 10) or any other example, and also includes the at least one cryptographic secret including at least one short-term cryptographic parameter and at least one long-term cryptographic parameter, wherein the processor circuit is used to execute the machine-readable instructions to: generate a greater number of redundant copies for the at least one long-term cryptographic parameter than the at least one short-term cryptographic parameter.

[0074] Another example (eg, Example 12) relates to the previous example (eg, Example 11) or any other example, further comprising the processor circuit executing the machine-readable instructions to forgo generating a redundant copy for the at least one short-term cryptographic parameter.

[0075] Another example (eg, Example 13) relates to the previous example (eg, one of Examples 1 to 6) or any other example, further including that the redundancy information includes a hash of the at least one cryptographic secret.

[0076] Another example (eg, Example 14) relates to the previous example (eg, Example 13) or any other example, further comprising the processor circuit being used to execute the machine-readable instructions to: generate the hash using a cryptographic hash function.

[0077] Another example (e.g., Example 15) relates to the previous example (e.g., one of Examples 13 or 14) or any other example, and also includes the processor circuit being used to execute the machine-readable instructions to: regenerate the hash based on the at least one cryptographic secret after generating the cryptographic signature, and compare the hash and the regenerated hash.

[0078] Another example (e.g., Example 16) relates to the previous example (e.g., one of Examples 1 to 15) or any other example, and also includes the at least one cryptographic secret including at least one short-term cryptographic parameter and at least one long-term cryptographic parameter, wherein the processor circuit is used to execute the machine-readable instructions to forgo generating redundant information for the at least one short-term cryptographic parameter.

[0079] An example (e.g., Example 17) relates to an apparatus (10) for determining the integrity of a generated cryptographic signature, the apparatus comprising a processor circuit (14) configured to, before generating the cryptographic signature, generate redundancy information for at least one cryptographic secret used to generate the cryptographic signature, generate the cryptographic signature using the at least one cryptographic secret, and after generating the cryptographic signature, compare the redundancy information and the at least one cryptographic secret to determine whether the redundancy information matches the at least one cryptographic secret, and use the cryptographic signature if the redundancy information matches the at least one cryptographic secret.

[0080] An example (e.g., Example 18) relates to an apparatus (10) for determining the integrity of a generated cryptographic signature, the apparatus comprising means (14) for processing, before generating the cryptographic signature, generating redundancy information for at least one cryptographic secret used to generate the cryptographic signature, generating the cryptographic signature using the at least one cryptographic secret, after generating the cryptographic signature, comparing the redundancy information and the at least one cryptographic secret to determine whether the redundancy information matches the at least one cryptographic secret, and using the cryptographic signature if the redundancy information matches the at least one cryptographic secret.

[0081] Another example (e.g., Example 19) relates to a computer system (100) or a mobile device (100) comprising an apparatus (10) or a device (10) according to one of Examples 1 to 18 (or according to any other example).

[0082] An example (e.g., Example 20) relates to a method for determining the integrity of a generated cryptographic signature, the method comprising, before generating the cryptographic signature, generating (110) redundancy information for at least one cryptographic secret used to generate the cryptographic signature, generating (120) the cryptographic signature using the at least one cryptographic secret, and after generating the cryptographic signature, comparing (130) the redundancy information and the at least one cryptographic secret to determine whether the redundancy information matches the at least one cryptographic secret, and if the redundancy information matches the at least one cryptographic secret, using (150) the cryptographic signature.

[0083] Another example (e.g., Example 21) relates to the previous example (e.g., Example 20) or any other example, and also includes the method comprising, if the redundancy information fails to match the at least one cryptographic secret, determining (140) a manipulation of the at least one cryptographic secret or of the redundancy information, and if the manipulation is determined, discarding (155) the cryptographic signature.

[0084] Another example (eg, Example 22) relates to the previous example (eg, Example 21) or any other example, further comprising determining that the manipulation is based on electrical interactions between adjacent memory cells of the memory circuit due to repeated accesses to the memory cells.

[0085] Another example (e.g., Example 23) relates to the previous example (e.g., one of Examples 20 to 22) or any other example, and also includes that the cryptographic signature is generated according to a quantum-safe cryptographic signature algorithm.

[0086] Another example (e.g., Example 24) relates to the previous example (e.g., one of Examples 20 to 23) or any other example, further including that the cryptographic signature is generated according to a crystal-dilithium cryptographic signature algorithm.

[0087] Another example (e.g., Example 25) relates to the previous example (e.g., Example 24) or any other example, and also includes that the at least one cryptographic secret includes at least one of the cryptographic parameters s1,A,μ,ρ of the Crystal-Dilithium cryptographic signature algorithm.

[0088] Another example (e.g., Example 26) relates to the previous example (e.g., one of Examples 20 to 25) or any other example, and also includes that the redundancy information includes at least one redundant copy of at least a portion of the at least one cryptographic secret.

[0089] Another example (e.g., Example 27) relates to the previous example (e.g., Example 26) or any other example, and also includes that the redundancy information includes at least three redundant copies of at least a portion of the at least one cryptographic secret.

[0090] Another example (e.g., Example 28) relates to a previous example (e.g., one of Examples 26 or 27) or any other example, and also includes the method comprising determining (112) the number of redundant copies by testing (114) a memory circuit used to store the at least one cryptographic secret.

[0091] Another example (e.g., Example 29) relates to the previous example (e.g., Example 28) or any other example, and also includes the method including testing (114) the memory circuit by repeatedly accessing memory cells located near the target cell to determine the amount of work required to flip at least one bit stored in the target cell.

[0092] Another example (e.g., Example 30) relates to the previous example (e.g., one of Examples 26 to 29) or any other example, and also includes the at least one cryptographic secret including at least one short-term cryptographic parameter and at least one long-term cryptographic parameter, wherein the method includes generating (116) a greater number of redundant copies of the at least one long-term cryptographic parameter than the at least one short-term cryptographic parameter.

[0093] Another example (eg, Example 31) relates to the previous example (eg, Example 30) or any other example, further comprising forgoing generating (116) a redundant copy for the at least one short-term cryptographic parameter.

[0094] Another example (eg, Example 32) relates to the previous example (eg, one of Examples 20 to 25) or any other example, further including that the redundancy information includes a hash of the at least one cryptographic secret.

[0095] Another example (eg, Example 33) relates to the previous example (eg, Example 32) or any other example, and also includes that the method includes generating (118a) the hash using a cryptographic hash function.

[0096] Another example (e.g., Example 34) relates to the previous example (e.g., one of Examples 32 or 33) or any other example, and also includes the method including regenerating (118b) the hash based on the at least one cryptographic secret after generating the cryptographic signature, and comparing the hash and the regenerated hash.

[0097] Another example (e.g., Example 35) relates to the previous example (e.g., one of Examples 20 to 34) or any other example, and also includes the at least one cryptographic secret including at least one short-term cryptographic parameter and at least one long-term cryptographic parameter, wherein generating redundant information is abandoned for the at least one short-term cryptographic parameter.

[0098] Another example (eg, Example 36) involves a computer system (100) or a mobile device (100) to perform a method according to one of Examples 20 to 35 (or according to any other example).

[0099] Another example (e.g., Example 37) relates to a non-transitory computer-readable medium comprising program code that, when executed on a processor, a computer, or a programmable hardware component, causes the processor, the computer, or the programmable hardware component to perform a method as described in one of Examples 20 to 35 (or according to any other example).

[0100] Another example (eg, Example 38) relates to a non-transitory machine-readable storage medium comprising program code that, when executed, causes a machine to perform a method as described in one of Examples 20 to 35 (or according to any other example).

[0101] Another example (eg, Example 39) relates to a computer program having a program code for performing a method as described in one of Examples 20 to 35 when the computer program is executed on a computer, a processor or a programmable hardware component.

[0102] Another example (e.g., Example 40) relates to a machine-readable storage device comprising machine-readable instructions that, when executed, implement a method as claimed in any pending claim or shown in any example or implement an apparatus as claimed in any pending claim or shown in any example.

[0103] The aspects and features described herein in connection with a specific one of the previous examples may also be combined with one or more other examples to replace the same or similar features of the other examples or to additionally introduce features into the other examples.

[0104] Examples may also be or may relate to a (computer) program including program code to perform one or more of the above methods when the program is executed on a computer, a processor or other programmable hardware component. Thus, the steps, operations or processes of the different methods described above may also be performed by a programmed computer, a processor or other programmable hardware component. Examples may also cover program storage devices, such as digital data storage media, which are machine-readable, processor-readable or computer-readable and encode and / or contain machine-executable, processor-executable or computer-executable programs and instructions. Program storage devices may include or may be, for example, digital storage devices, magnetic storage media such as disks and tapes, hard drives, or optically readable digital data storage media. Other examples may also include a computer, a processor, a control unit, a (field) programmable logic array ((field) programmable logic array, (F) PLA), a (field) programmable gate array ((field) programmable gate array, (F) PGA), a graphics processor unit (GPU), an application-specific integrated circuit (ASIC), an integrated circuit (IC), or a system-on-a-chip (SoC) system programmed to perform the steps of the above method.

[0105] It is also understood that the disclosure of several steps, processes, operations or functions disclosed in the specification or claims should not be interpreted as implying that these operations must comply with the described order, unless explicitly stated in individual cases or necessary for technical reasons. Therefore, the previous description does not limit the performance of several steps or functions to a certain order. In addition, in other examples, a single step, function, process or operation may include and / or be decomposed into several sub-steps, sub-functions, sub-processes or sub-operations.

[0106] If aspects have been described in connection with a device or system, these aspects should also be understood as descriptions of the corresponding methods. For example, blocks, devices, or functional aspects of the device or system may correspond to features of the corresponding methods, such as method steps. Therefore, aspects described in connection with a method should also be understood as descriptions of corresponding blocks, corresponding elements, attributes, or functional features of the corresponding device or corresponding system.

[0107] As used herein, the term "module" refers to logic that can be implemented in a hardware component or device, software or firmware running on a processing unit, or a combination of these to perform one or more operations consistent with the present disclosure. Software and firmware can be embodied as instructions and / or data stored on a non-transitory computer-readable storage medium. As used herein, the term "circuit" can include, alone or in any combination, non-programmable (hard-wired) circuits, programmable circuits (e.g., processing units), state machine circuits, and / or firmware that stores instructions that can be executed by programmable circuits. The modules described herein can be collectively or individually embodied as circuits that form part of a computing system. Thus, any module can be implemented as a circuit. A computing system that is referred to as being programmed to perform a method can be programmed to perform the method via software, hardware, firmware, or a combination thereof.

[0108] Any disclosed method (or a portion thereof) may be implemented as computer-executable instructions or a computer program product. Such instructions may cause a computing system or one or more processing units capable of executing computer-executable instructions to perform any disclosed method. As used herein, the term "computer" refers to any computing system or device described or mentioned herein. Thus, the term "computer-executable instructions" refers to instructions that can be executed by any computing system or device described or mentioned herein.

[0109] Computer executable instructions may be, for example, part of an operating system of a computing system, an application stored locally on a computing system, or a remote application accessible to a computing system (e.g., accessed via a web browser). Any of the methods described herein may be performed by computer executable instructions, which are executed by a single computing system or by one or more networked computing systems operating in a network environment. Computer executable instructions and updates to computer executable instructions may be downloaded from a remote server to a computing system.

[0110] In addition, it is to be understood that the implementation of the disclosed technology is not limited to any specific computer language or program. For example, the disclosed technology can be implemented by software written in C++, C#, Java, Perl, Python, JavaScript, Adobe Flash, C#, assembly language, or any other programming language. Similarly, the disclosed technology is not limited to any particular computer system or any particular type of hardware.

[0111] In addition, any software-based examples (e.g., including computer-executable instructions for causing a computer to perform any disclosed method) can be uploaded, downloaded, or remotely accessed via appropriate communication means, including, for example, the Internet, the World Wide Web, an intranet, cables (including optical cables), magnetic communications, electromagnetic communications (including RF, microwave, ultrasonic, and infrared communications), electronic communications, or other such communications means.

[0112] The disclosed methods, apparatuses, and systems should not be construed as limiting in any way. Instead, the disclosure is directed to all novel and non-obvious features and aspects of the various disclosed examples, either alone or in various combinations and sub-combinations with each other. The disclosed methods, apparatuses, and systems are not limited to any particular aspect or feature or combination thereof, and the disclosed examples do not require that any one or more specific advantages must exist or that any one or more specific problems must be solved.

[0113] The theories of operation, scientific principles or other theoretical descriptions proposed herein when referring to the devices or methods of the present disclosure are provided for better understanding and are not intended to be limiting in scope. The devices and methods in the appended claims are not limited to those devices and methods that operate in the manner described by such theories of operation.

[0114] The attached claims are hereby incorporated into the detailed description, where each claim may stand alone as a separate example. It should also be noted that although in the claims, a dependent claim refers to a specific combination with one or more other claims, other examples may also include a combination of the dependent claim with the subject matter of any other dependent or independent claim. Such combinations are explicitly proposed here, unless it is stated in an individual case that a specific combination is not intended. In addition, features of a claim should also be included for any other independent claim, even if the claim is not directly defined as dependent on the other independent claim.

Claims

1. An apparatus for determining the integrity of a generated cryptographic signature, the apparatus comprising a memory circuit, machine-readable instructions, and a processor circuit, the processor circuit being configured to execute the machine-readable instructions to: Prior to generating the cryptographic signature, generating redundant information of at least one cryptographic secret used to generate the cryptographic signature; generating said cryptographic signature using said at least one cryptographic secret; After generating the cryptographic signature, comparing the redundancy information and the at least one cryptographic secret to determine whether the redundancy information matches the at least one cryptographic secret; and If the redundancy information matches the at least one cryptographic secret, the cryptographic signature is used.

2. The device according to claim 1, wherein: The processor circuit is to execute the machine-readable instructions to: determine a manipulation of the at least one cryptographic secret or of the redundancy information if the redundancy information fails to match the at least one cryptographic secret, and discard the cryptographic signature if a manipulation is determined.

3. The device according to claim 2, wherein: The determination of the manipulation is based on electrical interactions between adjacent memory cells of the memory circuit, the electrical interactions being caused by repeated accesses to the memory cells.

4. The device according to claim 1, wherein: The cryptographic signature is generated according to a quantum-safe cryptographic signature algorithm.

5. The device according to claim 1, wherein: The cryptographic signature is generated according to the crystal-dilithium cryptographic signature algorithm.

6. The device according to claim 5, wherein: The at least one cryptographic secret comprises at least one of the cryptographic parameters s1,A,μ,ρ of the crystal-dilithium cryptographic signature algorithm.

7. The device according to claim 1, wherein: The redundancy information includes at least one redundant copy of at least a portion of the at least one cryptographic secret.

8. The device according to claim 7, wherein: The redundancy information includes at least three redundant copies of at least a portion of the at least one cryptographic secret.

9. The device according to claim 7, wherein: The processor circuit is to execute the machine-readable instructions to determine the number of redundant copies by testing memory circuitry used to store the at least one cryptographic secret.

10. The device according to claim 9, wherein: The processor circuit is to execute the machine-readable instructions to test the memory circuit by repeatedly accessing memory cells located near a target cell to determine an amount of work required to flip at least one bit stored in the target cell.

11. The device according to claim 7, wherein: The at least one cryptographic secret includes at least one short-term cryptographic parameter and at least one long-term cryptographic parameter, wherein the processor circuit is configured to execute the machine-readable instructions to generate a greater number of redundant copies for the at least one long-term cryptographic parameter than for the at least one short-term cryptographic parameter.

12. The device according to claim 11, wherein The processor circuit is configured to execute the machine-readable instructions to forgo generating a redundant copy for the at least one short-term cryptographic parameter.

13. The device according to claim 1, wherein: The redundancy information includes a hash of the at least one cryptographic secret.

14. The device according to claim 13, wherein: The processor circuit is to execute the machine-readable instructions to generate the hash using a cryptographic hash function.

15. The device according to claim 13, wherein: The processor circuit is to execute the machine-readable instructions to: regenerate the hash based on the at least one cryptographic secret after generating the cryptographic signature, and compare the hash to the regenerated hash.

16. The device according to claim 1, wherein The at least one cryptographic secret includes at least one short-term cryptographic parameter and at least one long-term cryptographic parameter, wherein the processor circuit is configured to execute the machine-readable instructions to forgo generating redundant information for the at least one short-term cryptographic parameter.

17. A method for determining the integrity of a generated cryptographic signature, the method comprising: Prior to generating the cryptographic signature, generating redundant information of at least one cryptographic secret used to generate the cryptographic signature; generating said cryptographic signature using said at least one cryptographic secret; After generating the cryptographic signature, comparing the redundancy information and the at least one cryptographic secret to determine whether the redundancy information matches the at least one cryptographic secret; and If the redundancy information matches the at least one cryptographic secret, the cryptographic signature is used.

18. The method according to claim 17, wherein: The method comprises determining a manipulation of the at least one cryptographic secret or of the redundancy information if the redundancy information fails to match the at least one cryptographic secret, and discarding the cryptographic signature if a manipulation is determined.

19. The method according to claim 18, wherein: The determination of the manipulation is based on electrical interactions between adjacent memory cells of the memory circuit, the electrical interactions being caused by repeated accesses to the memory cells.

20. The method according to claim 17, wherein: The cryptographic signature is generated according to a quantum-safe cryptographic signature algorithm.

21. The method according to claim 17, wherein: The cryptographic signature is generated according to the crystal-dilithium cryptographic signature algorithm.

22. The method according to claim 17, wherein: The at least one cryptographic secret comprises at least one of the cryptographic parameters s1,A,μ,ρ of the Crystal-Dilithium cryptographic signature algorithm.

23. The method according to claim 17, wherein: The redundancy information includes at least one redundant copy of at least a portion of the at least one cryptographic secret.

24. The method of claim 17, further comprising: The number of redundant copies is determined by testing a memory circuit used to store the at least one cryptographic secret.

25. A non-transitory computer readable medium comprising a program code, which, when executed on a processor, a computer or a programmable hardware component, causes the processor, the computer or the programmable hardware component to perform the method according to any one of claims 17 to 24.

Images