Generation of matrices

Abstract

The invention relates to matrix generation. The present specification relates to a method implemented by an electronic device for verification of an implemented matrix of a data encoding algorithm, comprising, for generating a matrix, using a first function and a second function, the verification method comprising verifying using a last portion of output data of the first function.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATION(S)

[0002] This application claims the benefit of priority to French patent application No. FR2311368, filed on October 20, 2023, entitled “Génération d'une matrice”, which is incorporated herein by reference to the maximum extent permitted by law. Technical Field

[0003] The present disclosure relates generally to electronic systems and devices, and more particularly to the security of such systems and devices. More particularly, the present disclosure relates to data ciphering methods and verification of their implementation. Background Art

[0004] Different techniques are currently used to protect secret and / or critical data. Data encoding is one of them and involves applying one or more encryption algorithms to data such as critical data. Many encryption algorithms use data matrices and / or polynomials.

[0005] In some cases, these matrices are generated regularly, such as every time a data encoding method is implemented. The generation of these matrices may then need to be verified.

[0006] It would be desirable to be able to at least partially improve certain aspects of verification and / or error detection methods for implementations of data encoding methods. Summary of the invention

[0007] There are methods for encoding data using properly validated encryption matrices.

[0008] There are methods for encoding data using cryptographic algorithms based on lattices using appropriately validated encryption matrices.

[0009] There are methods for encoding data using an algorithm known as "Kyber" using a properly validated encryption matrix.

[0010] There is a method for encoding data using an algorithm known as "CRYSTALS-Dilithium" using a properly validated encryption matrix.

[0011] Embodiments overcome all or part of the disadvantages of known data encoding methods.

[0012] The embodiments overcome all or part of the disadvantages of known data signing methods.

[0013] Embodiments overcome all or part of the disadvantages of known methods for verifying matrices used in data encoding methods.

[0014] Embodiments overcome all or part of the disadvantages of known methods for verifying matrices used in digital signature methods.

[0015] An embodiment provides a method of verifying a matrix used for a digital signature using data generated during the generation of such a matrix.

[0016] An embodiment provides a method of verifying a matrix used for a data signature using intermediate data generated during the generation of such a matrix.

[0017] An embodiment provides a method for verifying a matrix used in an implementation of a data encoding algorithm implemented by an electronic device, comprising: using a first function and a second function to generate the matrix, and the verification method includes using the last part of the output data of the first function for verification.

[0018] Another embodiment provides an electronic device suitable for implementing a method for verifying a matrix used in the implementation of a data encoding algorithm, comprising: in order to generate the matrix, using a first function and a second function, the verification method includes using the last part of the output data of the first function for verification.

[0019] According to an embodiment, the first function is a pseudo-random data generating function.

[0020] According to an embodiment, the first function comprises a third cryptographic hash function.

[0021] According to an embodiment, the third cryptographic hash function is a Keccak function.

[0022] According to an embodiment, the second function is a function based on a pseudo-random data generating polynomial.

[0023] According to an embodiment, the data encoding algorithm is a lattice-based cryptographic algorithm.

[0024] According to an embodiment, the data encoding algorithm is an algorithm known as "Kyber".

[0025] According to an embodiment, said matrix is ​​the matrix A of said algorithm known as "Kyber".

[0026] According to an embodiment, the matrix is ​​a context vector of the algorithm known as "Kyber".

[0027] According to an embodiment, the data encoding algorithm is an algorithm known as "CRYSTALS-Dilithium".

[0028] Another embodiment provides a data encoding method suitable for implementing the data encoding algorithm, including the verification method described previously.

[0029] Another embodiment provides a computer program product adapted to implement the previously described verification method.

[0030] According to an embodiment, the computer program product is adapted to implement the encoding method described previously. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The foregoing features and advantages, as well as other features and advantages, will be described in detail in the remainder of the disclosure of specific embodiments given by way of illustration and not limitation, with reference to the accompanying drawings, in which:

[0032] Figure 1 A block diagram schematically shows a method suitable for implementing Figures 2 to 4 An embodiment of an electronic device of an embodiment of;

[0033] Figure 2 The implementation mode of the data encoding method is schematically shown in the form of a block diagram;

[0034] Figure 3 Shows the generation Figure 2 an implementation mode of a method of the matrix of methods and an implementation mode of such generated verification method; and

[0035] Figure 4 Shows Figure 3 The implementation of the function of the method. DETAILED DESCRIPTION

[0036] Similar features in the various figures are denoted by similar reference numerals. In particular, common structural and / or functional features among the various embodiments may have the same reference numerals and may be arranged in the same structure, dimensions and material properties.

[0037] For clarity, only those steps and elements that are useful for understanding the embodiments are shown and described in detail.

[0038] Unless otherwise specified, when referring to two elements being connected together, this means a direct connection without any intermediate elements except conductors, and when referring to two elements being coupled together, this means the two elements may be connected or they may be coupled via one or more other elements.

[0039] In the following description, when referring to terms that define absolute positions, such as terms "front", "back", "top", "bottom", "left", "right", etc., or relative positions, such as terms "above", "below", "up", "lower", etc., or terms that define directions, such as "horizontal", "vertical", etc., unless otherwise specified, they all refer to the orientation of the drawing.

[0040] Unless otherwise indicated, the expressions "about", "approximately", "substantially" and "approximately" mean plus or minus 10%, preferably plus or minus 5%.

[0041] The embodiments described below relate to the verification of an implementation of a data encoding method and more particularly to the verification of the correct generation of matrices for implementing an encoding algorithm for such a data encoding method.

[0042] The matrices used by data encoding algorithms, such as matrices used by lattice-based cryptographic algorithms, may be matrices of very large size, which are difficult to store. Therefore, it is usually decided to generate these matrices when using these matrices. In some cases, this generation uses one or more pseudo-random data elements and one or more non-random data elements, such as, for example, metrological data, so it should be verified that the generated matrix is ​​conformable. The embodiments described in detail below relate to the implementation of the verification of matrices generated by using a generator function based on a polynomial of pseudo-random data and a generator function of pseudo-random data. The focus of these embodiments is to use a portion of the output data of the pseudo-random data generator function to perform this verification.

[0043] These embodiments apply more particularly to matrices of the coding algorithm known as “CRYSTALS-Dilithium” or known as “Kyber”.

[0044] Figure 1 is very schematically shown a method suitable for carrying out the following Figures 2 to 4 A block diagram of an example architecture of an electronic device 100 depicting an implementation mode of a matrix authentication method.

[0045] The electronic device 100 comprises a processor 101 (CPU) adapted to implement different processing operations on data stored in the memory and / or transferred by other circuits of the device 100. According to an embodiment, the processor 101 is adapted to implement a data encoding method using a verification method according to an embodiment.

[0046] The electronic device 100 further comprises different types of memory 102 (MEM), including for example non-volatile memory, volatile memory and / or ROM. Each memory 102 is adapted to store different types of data.

[0047] The electronic device 100 further comprises a secure element 103 (SE), for example, adapted to process critical and / or secret data. The secure element 103 may comprise its own processor(s), its own memory(s), etc. According to an embodiment, the secure element 103 is adapted to implement a data encoding method using an authentication method according to an embodiment.

[0048] The electronic device 100 may further comprise an interface circuit 104 (IN / OUT) adapted to send and / or receive data originating from outside the device 100. The interface circuit 104 may also be adapted to implement data display, for example, a display screen.

[0049] The electronic device 100 further comprises different circuits 105 (FCT1) and 106 (FCT2) adapted to perform different functions. As an example, the circuits 105 and 106 may comprise measurement circuits, data conversion circuits or the like.

[0050] The electronic device 100 also includes one or more data buses 107 suitable for transmitting data between its different components.

[0051] Figure 2 The mode of implementation of the data encoding method 200 (CYPHER) is shown very schematically in the form of a block diagram.

[0052] The data encoding method 200 or the encoding method 200 enables data to be encoded or may enable data to be signed.

[0053] The encoding method 200 includes an implementation of a cryptographic algorithm 201 (CRYPTO). According to an embodiment, the cryptographic algorithm 201 is a lattice-based cryptographic algorithm, such as, for example, an algorithm known as "Kyber" or an algorithm known as "CRYSTALS-Dilithium". According to a preferred embodiment, the cryptographic algorithm 201 is an algorithm known as "Kyber".

[0054] For implementation, the encryption algorithm 201 comprises the use of at least one matrix M generated by a matrix generation method 202 (GEN M), which also forms part of the encoding method 200. The generation method 202 takes as input at least one seed data element. The generation method may use one or more generation algorithms and one or more generation functions to generate the matrix M. According to a variant, the generation method 202 may form part of the encryption algorithm 201.

[0055] The encoding method 200 further comprises an embodiment of a verification method 203 (CHECKSUM) implementing the generation of said at least one matrix M via a verification function. For this purpose, the verification method uses the data CheckSum_Data supplied by the generation function 202. Figure 3 and Figure 4 Describes the properties of the data CheckSum_Data.

[0056] According to a preferred embodiment, when the encryption algorithm is the algorithm known as "Kyber", the generation method 202 is adapted to provide:

[0057] a common matrix A enabling the implementation of the algorithm; and

[0058] A vector SecretData representing the secret data used by this algorithm.

[0059] The matrix A and the vector SecretData are both obtained by implementing the generation method 202. Therefore, the verification function 203 is suitable for verifying the generation of the matrix A and the vector SecretData. According to a specific example, the vector SecretData may include four vectors s, e, r and e2 representing secret data, and their sizes are all about 256 coefficients, and the size of each coefficient is 12 bits.

[0060] The encoding method 200 is suitable for Figure 1 The described device 100 type is implemented by an electronic device, for example by its processor 101 or its security element 103, or by a more complex electronic device such as a computer. The same applies to the algorithm 201, the generation method 202 and the verification method 203. According to an embodiment, the encoding method 200, the algorithm 201, the generation method 202 and the verification method 203 can all be implemented by a computer program product.

[0061] Figure 3 Shows about Figure 2 The implementation mode of the generation method 300 of the method 202 type described and the Figure 2 An implementation mode of a verification method 350 (CHECKSUM) of the verification method 203 type is described.

[0062] In the preferred example described previously, the encryption algorithm is the algorithm known as "Kyber" and the matrix to be generated is:

[0063] a common matrix A enabling the implementation of the algorithm; and

[0064] A vector SecretData representing the secret data used by this algorithm.

[0065] The generation method 300 is used to generate coefficients m[i][j] of a matrix M including n rows and p columns one by one, where i is an integer in the range of 1 to n and j is an integer in the range of 1 to p. The matrix M may correspond to the matrix A or to a vector SecretData, such as the vectors s, e, r and e2 described previously. The generation method 300 enables the following mathematical equation to be realized:

[0066] in:

[0067] Parse is a function that generates a polynomial of known degree based on one or more pseudo-random data elements;

[0068] XOF is a function that generates one or more pseudo-random data elements; and

[0069] is about Figure 2 The seed data element described corresponds to the seed data element.

[0070] In other words, the generation of the matrix M follows the following steps.

[0071] In step 301 ( , i, j), providing seed data elements and index values ​​i and j. According to a specific example, the data element is a 32-byte data element, ie, comprises 256 bits, and indexes i and j are 1-byte data, ie, comprise 8 bits.

[0072] At step 302 (XOF) following step 301, a function XOF generating one or more pseudo-random data is applied to the data , i and j. According to an embodiment, the pseudo-random data transmitted at the output of the function XOF has a variable size. According to an example, the function XOF is a sponge-type function enabling the creation of a hash function. Figure 4 A detailed example of a function of the function XOF type is described.

[0073] At step 303 (Parse) following step 302, a function Parse for generating a polynomial of known degree based on pseudo-random data is applied to the pseudo-random data element(s) provided by the function XOF. Since the pseudo-random output data element(s) of the function XOF have a variable size, the function Parse is adapted to take as input a data element of variable size to deliver as output a polynomial of known degree. There are a plurality of functions that enable the implementation of the function Parse, two known functions being the function Parse and CBD. According to the example, the function Parse is the function selected by injection.

[0074] The output polynomials of the function Parse constitute the elements of the matrix. Then, just repeat steps 301 to 303 as many times as necessary to obtain the complete matrix M.

[0075] According to an embodiment, the generation of the matrix A and the generation of the vector SecretData may use different functions Parse, different functions XOF and different seed data elements separately. .

[0076] Therefore, according to an embodiment, the element mA[i][j] of the matrix A is obtained by implementing the following mathematical equation:

[0077]

[0078] in:

[0079] ParseA is a function that generates a polynomial of known degree based on one or more pseudo-random data elements;

[0080] XOFA is a function that generates one or more pseudo-random data elements; and

[0081] is about Figure 2 The seed data element described corresponds to the seed data element.

[0082] Therefore, according to an embodiment, the element mSD[i][j] of the vector SecretData is obtained by implementing the following mathematical equation:

[0083]

[0084] in:

[0085] ParseSD is a function that generates a polynomial of known degree based on one or more pseudo-random data elements;

[0086] XOFSD is a function that generates one or more pseudo-random data elements;

[0087] Seed is to adjust the seed data element according to the desired output vector Function of

[0088] is the matrix A and about Figure 2 The seed data element described corresponds to the seed data element; and

[0089] In this case, the index i is a random number.

[0090] According to an embodiment, a verification method 350 associated with the generation method 300 is as follows. The method 350 implements a verification function Checksum, which is, for example, a function verified by an addition or checksum function. The function Checksum enables verification that the matrix provided by the generation method 300 is consistent. For this purpose, the function Checksum takes as input data a portion of the output data of the function XOF.

[0091] More particularly, and according to an embodiment, the function Checksum takes as input the last bits of the output data elements constituting the function XOF, also referred to as the last part of the output data elements of the function XOF. These last bits depend on all previous operations, in particular on the seed data element .

[0092] According to an embodiment, in the preferred case where the encoding algorithm is the algorithm known as “Kyber” and the generated elements are the vector SecretData, then the last bits used by the function Checksum are the data bits of the output of the function XOF that were not used by the function Parse.

[0093] Figure 4 Shows about Figure 3 The function described is a function 400 of type XOF.

[0094] Function 400 is a sponge-type function that enables the construction of a cryptographic hash function. Figure 3 As described, function 400 converts the previously described data , i and j as inputs, and outputs a pseudo-random data element Z. To operate, function 400 also receives as input a data element 401 to be hashed consisting of a data element r and a data element c. The size of data element r is the same as the size of output data element Z. The size of data element c depends on the security level.

[0095] The function comprises two operating phases, a first absorption phase 402 followed by a second extrusion phase 403 .

[0096] During the ingestion phase 402, function 404(f) is continuously applied to data elements 401 while periodically incorporating data , i and j. According to an embodiment, function 404 is a cryptographic hash function, such as function Keccak. More specifically, data element r can be obtained by using the previously described function Seed, the result of which is passed as input to function 404. The data element r added to data element c is also referred to as a "state" in the literature. According to an example, data , i and j are incorporated into the data element r just before applying each function 404 via the XOR function. According to an embodiment, during stage 402, the function 404 is applied one to multiple times.

[0097] During the extrusion phase 403, function 404(f) is applied successively to data element 401. According to an embodiment, function 404 is applied approximately 4 times during phase 403. Output data element Z is equal to the combination of the output data of function 404 corresponding to the application of function 404 to the data element r generated by said function Seed.

[0098] Various embodiments and variations have been described. Those skilled in the art will appreciate that certain features of these various embodiments and variations may be combined, and those skilled in the art will recognize other variations.

[0099] Finally, based on the functional indications given above, the actual implementation of the described embodiments and variants is within the capabilities of a person skilled in the art.

[0100] A verification method (203; 350) for a matrix (M; A, e, s) implemented by an electronic device (100, 101, 103) for an implementation of a data encoding algorithm (201) is summarized as comprising: in order to generate the matrix (M; A, e, s), using a first function (XOF) and a second function (Parse), the verification method (350) comprising using the last part of the output data of the first function (XOF) for verification.

[0101] An electronic device (100, 101, 103) suitable for implementing a verification method (203; 350) of a matrix (M; A, e, s) for the implementation of a data cryptographic algorithm (201) is summarized as comprising: in order to generate the matrix (M; A, e, s), using a first function (XOF) and a second function (Parse), the verification method (350) comprising using the last part of the output data of the first function (XOF) for verification.

[0102] The first function (XOF) is a pseudo-random data generating function.

[0103] The first function (XOF) includes a third cryptographic hash function (404).

[0104] The third cryptographic hash function (404) is a Keccak function.

[0105] The second function (Parse) is a function based on a pseudo-random data generator polynomial.

[0106] The data encoding algorithm (201) is a lattice-based cryptographic algorithm.

[0107] The data encoding algorithm (201) is the "Kyber" algorithm.

[0108] The matrix (A) is the matrix A of the “Kyber” algorithm.

[0109] The matrix (s, e) is the context vector of the “Kyber” algorithm.

[0110] The data encoding algorithm (201) is the "CRYSTALS-Dilithium" algorithm.

[0111] A data encoding method (200) suitable for implementing the data encoding algorithm (201) is summarized as comprising a verification method (203; 350) according to any one of claims 1, 3 to 11.

[0112] A computer program product suitable for implementing a verification method (203; 350).

[0113] A computer program product suitable for implementing the encoding method (200).

[0114] The various embodiments described above can be combined to provide further embodiments. Aspects of the embodiments can be modified, if necessary, to employ concepts of the various patents, applications, and publications to provide yet further embodiments.

[0115] In light of the above detailed description, these and other changes can be made to the embodiments. In general, in the appended claims, the terms used should not be interpreted as limiting the claims to the specific embodiments disclosed in the specification and claims, but should be interpreted to include all possible embodiments and the full range of equivalents to which these claims are entitled. Therefore, the claims are not limited by the disclosure.

Claims

1. A method comprising: A matrix for implementing a data encoding algorithm is generated in an electronic device, the generated matrix comprising: Provide seed data elements; generating, using a first function, a first pseudo-random data element using a seed data element; and generating, using a second function, a plurality of polynomials of known degree based on the first pseudo-random data element; and Using the verification function, the final portion of the output data of the first function is used to verify that the matrix is ​​consistent.

2. The method according to claim 1, wherein: The first function is a sponge-type function.

3. The method according to claim 2, wherein: The first function includes a third cryptographic hash function.

4. The method according to claim 3, wherein: A third cryptographic hash function is the Keccak function.

5. The method according to claim 1, wherein: The second function takes as input data elements of variable size and produces as output a plurality of polynomials of known degree.

6. The method according to claim 1, wherein: The data encoding algorithm is a lattice-based cryptographic algorithm.

7. The method according to claim 6, wherein: The data encoding algorithm is the "Kyber" algorithm.

8. The method according to claim 7, wherein: Matrix is ​​the matrix A of the "Kyber" algorithm.

9. The method according to claim 7, wherein: The matrix is ​​the context vector for the Kyber algorithm.

10. The method according to claim 6, wherein: The data encoding algorithm is the "CRYSTALS-Dilithium" algorithm.

11. The method according to claim 1, wherein: The last portion of the output data of the first function includes a second pseudo-random data element that is not used by the second function.

12. A method comprising: Generate a matrix for the data encoding algorithm, the generated matrix includes: providing a seed data element and a plurality of index values; generating, using a first sponge-type function, a first pseudo-random data element using a seed data element and a plurality of index values; generating, using a second function, a plurality of polynomials of known degree based on the first pseudo-random data element; and forming an element of a matrix using each of the plurality of polynomials; and Using the validation function, the matrix is ​​verified to be consistent using the last part of the output data of the first sponge-like function.

13. The method according to claim 12, wherein: A seed data element is a 32-byte data element containing 256 bits.

14. The method according to claim 13, wherein: The plurality of index values ​​includes a first index value and a second index value, the first index value being a 1-byte data element containing 8 bits, and the second index value being a 1-byte data element containing 8 bits.

15. The method according to claim 12, wherein: The second function takes as input data elements of variable size and produces as output a plurality of polynomials of known degree.

16. The method according to claim 12, wherein: The second function is an injection selection function.

17. A method comprising: Generate a matrix for the data encoding algorithm, the generated matrix includes: providing a seed data element and a plurality of index values; Generating a first pseudo-random data element using a seed data element and a plurality of index values ​​using a first sponge-type function, wherein generating the first pseudo-random data element comprises: receiving a first data element to be hashed; During the ingestion phase, applying a cryptographic hash function to the data element to be hashed; and During the extrusion phase, output data elements are generated; generating a plurality of polynomials of known degree based on the first pseudo-random data element using a second function; and An element of a matrix is ​​formed using each of the plurality of polynomials.

18. The method according to claim 17, wherein: The cryptographic hash function is the Keccak function.

19. The method according to claim 17, wherein: The cryptographic hash function is applied four times during the extrusion phase.

20. The method of claim 17, further comprising: forming a data element to be hashed from a first data element and a second data element, the first data element having the same size as the output data element and generated by a seed function; as well as Prior to applying the cryptographic hash function, the seed data element and the plurality of indexes are merged into the first data element using an XOR function.

Images