LOW MEMORY KEY GENERATION FOR classical MCELINE

Abstract

A method for more efficiently utilizing limited computing resources in an embedded computing device is presented.

Description

Technical Field

[0001] This invention relates to a method and a system. Specifically, but not exclusively, this invention relates to a computer-implemented method for generating cryptographic keys. Background Technology

[0002] The classic McEliece cryptosystem is a code-based post-quantum key encapsulation (KEM) mechanism. This cryptosystem is generally considered to be resistant to attacks from quantum computers.

[0003] The requirement for devices with restricted access to RAM to generate their own public or private keys is becoming increasingly stringent. The computational requirements for key generation often conflict with restricted access to RAM.

[0004] Various aspects and implementation methods were conceived with the foregoing in mind. Summary of the Invention

[0005] All aspects involve generating cryptographic keys. Cryptographic keys can be generated using the McEliece cryptographic key generation method. These aspects can be combined with a key encapsulation mechanism (KEM).

[0006] From a first perspective, a computer-implemented method for generating a public key can be provided. The public key can be generated according to the classic McEliece cryptosystem. The public key may include a matrix with multiple rows and columns. The number of rows and columns can be determined based on the security characteristics of the cryptosystem. The method can be implemented by processing resources. The processing resources can be secure computing resources, such as a trusted execution environment. The processing resources can be hosted within a computing device. The processing resources can reside within an embedded computing device.

[0007] The method may include receiving a request for a public key. The request may be received from a host computing resource that hosts the processing resources. The request may be in response to a request from a user.

[0008] The method can generate a first key generation matrix in response to receiving the request. The generation of elements of the first key generation matrix can be done 'temporarily,' that is, independently of other elements in the matrix and without interrupting the rest of the method. Elements can be generated based on a random or pseudo-random seed. In other words, the first key generation matrix can be generated in a first stage of the key generation process, and the second key generation matrix can be generated in a second stage.

[0009] The method may generate a second key generation matrix based on a first key generation matrix, since the elements of the first key generation matrix are used to generate the second key generation matrix. This may mean that the elements of the first key generation matrix form a portion of the second generation matrix, or alternatively, optionally, or additionally, the elements of the first key generation matrix are processed to generate the second key generation matrix. This may include setting the second key generation matrix to be equal to a portion of the first key generation matrix, wherein "partial" can be understood as not referring to the complete first key generation matrix. This may additionally, alternatively, or optionally include setting a portion of the second key generation matrix to be equal to the first key generation matrix. The second key generation matrix may partially comprise an identity matrix. The method may include generating a portion of the inverse of the second key generation matrix, wherein the inverse portion of the second key generation matrix is ​​not equal to the full inverse of the second key generation matrix. The inverse portion may include one or more rows or columns of the inverse of the second key generation matrix. The method may also include applying a process to make the second key generation matrix invertible if the second key generation matrix is ​​irreversible.

[0010] The method may include generating a portion of a public key based on a portion of the inverse of a second key generation matrix and a portion of a first key generation matrix. The public key may depend on at least one of one or more rows of the inverse of the second key generation matrix and / or one or more rows of the first key generation matrix. The portion of the public key may include one or more rows of a matrix used to define the public key.

[0011] The method according to the first aspect enables the generation of keys using less memory resources on the processing resources. This makes it possible to generate keys on devices with low memory resources (e.g., embedded computing devices with a small amount of RAM).

[0012] Optionally, the inverse of the second key generation matrix is ​​not stored because a portion of the matrix smaller than the full matrix is ​​stored (instead of the full matrix), and the full matrix is ​​not stored.

[0013] Optionally, the inverse portion of the second key generation matrix is ​​stored in random access memory.

[0014] Optionally, the generation of the inverse portion of the second key generation matrix can be repeated until all portions of the second key generation matrix have been used to generate the corresponding portions of the public key. That is, the generation portion of the inverse is used to generate the corresponding portions of the public key. In other words, for example, the first generation portion of the inverse corresponds to the first portion of the public key, and the second generation portion of the inverse (which is different from the first portion of the inverse) corresponds to the second portion of the public key (which is different from the first portion of the public key). The generation of the inverse portion can then be repeated until the complete public key is generated.

[0015] Optionally, the portion of the inverse of the second key generation matrix is ​​a row of the inverse of the second key generation matrix. The portion of the public key based on the portion of the second key generation matrix can be a row of the public key.

[0016] Optionally, the portion of the inverse of the second key generation matrix may be multiple rows of the inverse of the second key generation matrix, and the portion of the public key based on the portion of the second key generation matrix may be multiple rows of the public key.

[0017] Optionally, the first key generation matrix can be generated without interrupting the method. Optionally, the elements of the first key generation matrix can be generated based on a random or pseudo-random seed.

[0018] Optionally, the public key portion may be generated based on the product of the inverse portion of the second key generation matrix and the first key generation matrix.

[0019] Optionally, the processing resource can be an embedded computing device. That is, the processing resource can be a computer performing a specific task within a larger machine. Embedded computing devices can access memory, but access rights may be limited.

[0020] Optionally, a request for the public key may be received from a host computing device hosting the embedded computing device. Optionally, a request for the public key may be received from any computing device that communicates directly (i.e., via a direct connection) or indirectly (i.e., where the request is handled by various other message processing or routing entities) with the embedded computing device. Optionally, a request for the public key may be received from another embedded computing device communicating with the embedded computing device. The host computing device may be a computing device that communicates with the embedded computing device using any suitable telecommunications medium.

[0021] Optionally, the second key generation matrix is ​​equal to the elements in the first mt rows and the first mt columns of the first key generation matrix. The quantity mt is the product of factors m and t, where:

[0022] ;

[0023] Where t is a parameter affecting the security characteristics of the McEliece cryptosystem; and

[0024] Where q is the size of the finite field.

[0025] Optionally, the part that generates the inverse of the second key generation matrix includes (wherein) and all elements of T in In the following steps, where all elements of D are integers:

[0026] a) Initialize the permutation vector D of mt elements to integers 0, 1, 2...mt-1

[0027] b) Set matrix T∈ Initialize to the identity matrix;

[0028] c) Loop 1: Iteratively, for c=0 until mt-1:

[0029] d) Generate the second key generation matrix S∈ The elements of column c from c to mt-1 are used as vector S. c ∈ Element c is stored in mt-1;

[0030] e) The vector S c Elements 0 to c-1 are set to 0;

[0031] f) Apply the permutations stored in D to S c elements

[0032] g) multiplied by T .

[0033] h) If The element c≠1

[0034] i) Find The next element j that is 1

[0035] j) Replacement element c and element j

[0036] k) Replacement element c and element j

[0037] l) Swap row c and row j of T.

[0038] m) Swap columns c and j of T.

[0039] End judgment

[0040] n) Loop 2: For d=c+1 up to mt-1

[0041] o) If The element d==1

[0042] p) Calculate the bitwise XOR of row d and row c of T, and store the result in row d of T.

[0043] End judgment

[0044] End of loop 2

[0045] q) Discard row c of T

[0046] End loop 1

[0047] r) Reverse the permutation vector D to D -1

[0048] s) The reversed permutation D -1 The column applied to T.

[0049] Optionally, the aforementioned portion of the public key may be provided to the requesting entity.

[0050] Optionally, portions of the public key can be generated repeatedly until the complete public key is provided.

[0051] Optionally, the first key generation matrix and the second key generation matrix may include elements of a second-order finite field.

[0052] It may also provide a non-transitory computer-readable storage medium, system, and processing resources configured to provide the method according to the first aspect. Attached Figure Description

[0053] The embodiments will now be described by way of example only and with reference to the following figures, in which:

[0054] Figure 1 This illustrates the process of generating a cryptographic key according to an embodiment;

[0055] Figure 2 The diagram illustrates processing resources configured to generate keys according to an embodiment;

[0056] Figure 3 The process of showing the inverse of the generating matrix is ​​illustrated.

[0057] Figure 4 This schematically illustrates how memory is allocated during the reversal in the minimum case.

[0058] Figure 5 This illustrates a first application of column transposition to reduce memory usage during Gaussian elimination on a matrix;

[0059] Figure 6 This illustrates a second application of column permutations to force the generation of the desired row of the inverse matrix;

[0060] Figure 7 This schematically illustrates how memory is allocated during the reversal in the maximum case.

[0061] Figure 8 This illustrates how the expected number of rows to be generated affects memory requirements; and

[0062] Figure 9 A hardware implementation scheme according to an embodiment is shown. Detailed Implementation

[0063] For clarity and completeness, the classical method of McEliece key generation is now described to help illustrate the main benefits of the embodiments. In this cryptosystem, the public key is a systematic form of a parity matrix of Goppa codes. The most memory-intensive operation is the computation of the systematic form of the parity matrix, the result of which is the public key.

[0064] Public key generation is described in Algorithm 1. It should be noted that throughout this document, the same parameter conventions as in the classic McEliece specification are used: m, t, mt, n, and q. Furthermore, it is assumed that element 0 is the first element of the vector, and that row 0 and column 0 are the first row and first column of the matrix, respectively.

[0065] Algorithm 1 :

[0066] and Different elements in

[0067] Output: PubK, with elements in matrix

[0068] 1. Calculation On matrix Among them, for and ,

[0069] 2. m position The columns are formed

[0070] 3. Simplify H' to the systematic form [I | PubK], where I is The identity matrix. If this fails, return ⊥.

[0071] 4. Return to PubK.

[0072] PubK is a public key generated based on the McEliece cryptosystem.

[0073] Generally, classical McEliece is a code-based post-quantum key encapsulation (KEM) mechanism. However, due to the limited RAM of embedded computing devices, it is difficult to deploy key generation based on the McEliece method on embedded computing devices. Specifically, a major obstacle is that classical McEliece cryptosystems have public keys with sizes between 261 kB and 1358 kB (depending on the parameter set). For such memory-constrained embedded devices, which may have a maximum RAM capacity of less than 100 kB, it is difficult to perform operations with such high memory usage.

[0074] There are two main standard methods for implementing key generation. The first method stores a large matrix, between 335 kB and 1704 kB (depending on the parameter set), entirely in RAM and systematizes this large matrix to derive the entire public key at once. Due to the matrix size, this method is not suitable for embedded devices. The second method instead stores only a portion of the matrix (74 kB to 346 kB) in RAM, reverses this portion, and then uses this inversion to generate the public key column by column (which can then be streamed). While this method significantly reduces the peak RAM capacity from 335 kB to 74 kB, it remains infeasible for most embedded devices, especially for larger parameter sets.

[0075] One approach to solving the key generation memory problem is described in Algorithm 2 below.

[0076] Algorithm 2:

[0077]

[0078] Output: PubK, generated from columns with elements in matrix

[0079] 1. Form a square matrix S using the first mt columns of H'. .

[0080] 2. Reverse S to obtain

[0081] 3. For c = mt up to n-1

[0082] 3.1. Calculation H' c = PubK c ,in It is column H', and PubK c It is a column of the systematized result PubK.

[0083] Algorithm 2 uses the inverse of the computed matrix S to determine the columns of the public key. This method requires generating and storing the full inverse of S, which still consumes a considerable amount of RAM, making it unsuitable for deployment on computing devices with limited available RAM.

[0084] Now for reference Figure 1 as well as Figure 2 The processing resource 200 shown describes a memory-efficient key generation method according to an embodiment. Key generation is illustrated with reference to the example of the classic McEliece cryptosystem.

[0085] In step S100, a request to generate a public key according to the classic McEliece cryptosystem is received at processing resource 200. This request can be received from a user of the computing device hosting the processing resource or any other type of computing device. Processing resource 200 can be an embedded computing device. Embedded computing devices have limited access to random access memory (RAM), which necessitates the use of more efficient key generation methods for embedded computing devices.

[0086] In step S102, the request from step S100 is provided to the key generation module 202.

[0087] The key generation module 202 is configured to generate a matrix H'. H' is calculated based on the private key, which consists of two parts: t degrees. The first irreducible polynomial g in the equation, and the polynomial g derived from the first irreducible polynomial g in The different elements in the composition are supported by the supporting items. The polynomial and support terms are generated based on a random seed. The private key is first used to construct the polynomial with... A matrix of t multiplied by n elements Each element can be computed as a specific Specific power and in The product of the inverses of the polynomial g being evaluated. That is, it can be generated independently. The element, independent of other elements. This is achieved by expanding the number of rows to mt and changing the field to... ,Will The transformation results in a matrix H'. Now, subvectors of H' of size m can be generated independently. For the remainder, matrix H' is referred to as temporarily generated. This means that the elements of H' can be generated from a set of m elements. This generation depends only on the private key (and not on any other set of m elements) and has low computational cost. Therefore, there is no need to store H', as its elements can be temporarily generated.

[0088] This is step S104. However, alternatively or additionally, any submatrix or element of matrix H' or H' may be stored in a storage device and retrieved to perform step S104. The storage device may be local to processing resource 200. Alternatively or additionally, any submatrix or element of matrix H' or H' may be stored or computed outside the device and then sent to the device in whole or in part.

[0089] Then the iteration process is initialized with a counter r initialized to zero. This is step S106. Next, the matrix... Implicitly initialize and set the first mt columns of H', where the set It has The set of square matrices with mt columns and mt rows of elements in H'. This is step S108. Implicit initialization means that the matrix is ​​set to the values ​​of H', even if these values ​​may not currently be stored or available.

[0090] In step S110, column r of matrix S is swapped with column mt-1 of matrix S. This can be implicitly achieved by swapping the indices used for memory or generation requests.

[0091] Then the key generation module 202 accesses the row computation routine 210 and executes steps S300 to S320 and S114 to obtain the row r of the public key. Now refer to Figure 3 This is described below. In step S300, matrix S (including the swapped columns) is used as input to row computation routine 210. However, matrix S does not need to be fully provided at the start of row computation routine 210. Since matrix S is implicitly initialized to matrix H', the elements of said matrix can be generated independently (temporarily) as needed during row computation routine 210. Assume that matrix S provided at this stage has its columns implicitly swapped based on S110.

[0092] In step S302, the line computation routine 210 initializes the permutation vector D with mt integers as D = (0, 1, 2…mt-1). In step S304, T… Initialize to identity matrix T is used for storage. The inverse part and intermediate calculations.

[0093] Next, for c=0 up to mt-1:

[0094] Row computation routine 210 generates elements c to mt-1 of column c of matrix S and sets these elements as a vector. The element c is stored in mt-1. This is step S306. The line calculation routine then stores the vector... The elements 0 to c-1 are set to 0. This is step S308.

[0095] In step S310, row calculation routine 210 applies the permutation stored in D to S. c The elements. Applying the permutation stored in D means adjusting according to the index stored in D. of The order of elements. In step S312, the line calculation routine executes the calculation T. .vector The first c elements will be equal to zero.

[0096] The calculation routine 210 then proceeds to... And T performs one iteration of Gaussian elimination. Gaussian elimination works column by column, where for each column, a pivot element is used to set all other elements in that column to zero through basic row operations. One iteration of Gaussian elimination here refers to using a pivot element to "zero" a column. This is step S314. Gaussian elimination is modified relative to the standard method and includes the following steps:

[0097] if The element c ≠ 1:

[0098] Find the vector The next element j that is equal to 1.

[0099] swap element c and element j

[0100] swap element c and element j

[0101] Swap rows c and j of T

[0102] Swap columns c and j of T

[0103] For d = c+1 up to mt-1, that is, m multiplied by t

[0104] if The element d == 1

[0105] Calculate the bitwise XOR of row d and row c of T, and store the result in row d of T.

[0106] In step S316, row computation routine 210 discards (i.e., sets it to zero and therefore generates no memory overhead) row c of T. The output of step S316 is T and Both are modified versions.

[0107] For c=0 up to mt-1, repeat steps S306 to S316.

[0108] In step S318, row computation routine 210 reverses the permutation stored in D.

[0109] Reversing the permutation involves assigning indices to each element of the permutation vector and then sorting the original vector. The indices are swapped. The vector containing the swapped indices is in reverse permutation. In step S320, row calculation routine 210 applies the reversed permutation to the columns of T.

[0110] Steps S300 to S320 generate matrix T and return it to key generation module 202. Then, the last row of T can be extracted (this row equals...). (r).

[0111] Steps S300 to S320 describe a method for partially reversing a matrix, which has lower memory requirements than fully reversing a matrix. The result of steps S300 to S320 is the last row of the inverse of the matrix to be reversed. In the previous method, the complete inverse matrix S needed to be stored in memory. This still requires a typical memory requirement of 74 kB (in the example of mceliece348864). The method described in steps S300 to S320 uses a reduced memory of 18 kB. In summary, this method computes only the bottom row of the inverse at a time and uses this bottom row to generate the portion of the public key as a row chunk. That is, the method computes one or more bottom rows of the inverse at a time and uses this to generate the corresponding portion of the public key as a chunk, which is one or more rows.

[0112] The low-memory inversion method of the present invention described above assumes that, given a matrix S, each element of the matrix can be temporarily generated. This is achieved in the classic McEliece method by evaluating a polynomial at a specific point, as described above. Furthermore, the initial goal is to compute the last row of the inversion of this matrix while minimizing the peak RAM capacity.

[0113] It should be clarified that, in the method detailed in steps S300 to S320, we assume that:

[0114] 1. A column of a matrix has no memory overhead if it has a 1 on the diagonal of the matrix and zero for all other elements.

[0115] 2. Whenever a row of the matrix is ​​set to all zeros, that row is "discarded" without any memory overhead.

[0116] 3. The first application of column transposition (the column transposition in step S314) occurs implicitly and has no computational overhead. That is, the column transposition is recorded in the permutation vector; however, the transposition has no direct effect on T because the column to which the transposition is applied does not contain the relevant data (except for the 1s on the diagonal) at the time of the transposition.

[0117] Therefore, even though T is a matrix with mt rows and mt columns, not all elements of matrix T are in use, and its memory usage is not mt*mt bits. As will be shown later, the peak memory usage of matrix T is either mt*(mt / 2) bits or mt / 2*(mt / 2) bits, depending on performance requirements.

[0118] In step S112, the last row of T is stored, that is, the entire T is not stored.

[0119] In step S114, the key generation module 202 performs calculations. ,in It is a systematic parity check matrix The line r, and This is the last line of T. Take elements mt through n-1 from H to obtain the public key PubK. Therefore, it can be seen from Extract public key The last row of T. The last row of T is always used for multiplication to generate the public key because the transposition in step S110 always forces the last row of matrix T to be equal to the inverse row r of S.

[0120] Repeat steps S108 to S114 until the counter reaches the value mt-1, and this makes matrix H r The rows of T can be generated individually. That is, the mt rows of T are generated individually, and this happens without storing the entire matrix T.

[0121] The corresponding rows of the public key can then be provided to the requesting entity row by row. That is, the public key is provided row by row, not as a whole. This means that T does not need to be stored as a whole matrix and is only used to generate the public key row by row.

[0122] The above steps can be modified to generate multiple rows simultaneously, and then provide these multiple rows as a row group to the requesting entity. This is achieved by modifying S316. Assume k is the expected number of inverse rows we want to generate as part of a single call to row computation routine 210. Once c = mt - k, that is, once k iterations remain to be computed, S316 no longer occurs. In other words, once the number of columns remaining to be processed is the same as the expected number of inverse rows, rows of T are no longer discarded.

[0123] Components of the public key, either individual rows or groups of rows, can be streamed to the requesting entity until the full number of rows, or mt rows, has been provided. The public key is provided when the full number of rows has been provided.

[0124] This means that embedded computing devices with limited RAM can be used to generate public keys.

[0125] First, the matrix S is processed column by column, which minimizes the peak memory usage for this part. The vectors described above... The relevant subvectors of the columns of S are iteratively set as they are processed. However, this means we must reproduce the steps of the previous iterations for later columns (this is accomplished by steps S310 and S312). Furthermore, the complete matrix T is not stored; only a portion of it is stored. In the standard implementation, this matrix is ​​initialized with an identity matrix of size mt x mt and then fully transformed during the algorithm. Instead, this invention stores only the portion of the inverse intermediate values ​​that are strictly necessary for the computation of the bottom rows of matrix T. We observed that this does indeed help to significantly reduce peak memory requirements, such as... Figure 4 The diagram illustrates how memory usage evolves during the computation of the last row of matrix T. In this example, the minimum peak memory usage is 18 kB (using mceliece348864), which is a factor of 4 reduction compared to the best existing method.

[0126] Our improved Gaussian elimination method also reduces the storage requirements associated with computations of the rows of matrix T. That is, instead of simply swapping rows, columns with the same index are also swapped. In this way, 1s above the diagonal are moved back to the diagonal, which helps minimize the portion of the inverse that needs to be kept in memory. This is in Figure 5 The right side is shown. However, to ensure correctness, this column swap needs to be recorded and applied to each subsequent column being processed. These swaps are stored in a permutation vector of mt elements (e.g., where each element has at most 11 bits, depending on the parameter set), which adds a negligible increase to peak memory. The inverse of the permutation vector also needs to be applied to the resulting row of the inverse, as shown in step S320.

[0127] Third, using the procedures described in steps S100 to S114, it is possible to generate the last row of the inverse, which can be used to generate the last row of the public key, as shown above. To generate the other rows of the public key, the remaining rows of the inverse need to be calculated one by one. This is achieved by repeating the low-memory reversal method described above, but the columns of the original matrix are shuffled beforehand. This occurs in step S110. For example, by swapping the last two columns of the original matrix S to the modified matrix S', the algorithm described above will generate the inverse... The second to last row is calculated to form the last row of matrix T. By repeating this swapping with other columns, iterative generation can be achieved in a low-memory manner. All rows. It should be noted that the original matrix S is never stored at any time; instead, the matrix is ​​generated column-by-column in a temporary manner because, as mentioned earlier, H' can be generated temporarily, and S is a submatrix of H'. Therefore, the transposition is not done explicitly on the matrix, but only by generating indices through the transposition. Figure 6An example of this principle is provided. In other words, the computation of total inverse requires mt iterations of the outer loop, i.e., steps S300 to S320, which means that S mt iterations must be generated during the full algorithm.

[0128] The above example focuses on a simple case of generating one row at a time. It is also possible to implement the described embodiment by generating multiple rows. That is, the key generation module 202 generates k inverse rows at a time, uses these k rows to generate k rows of the public key, provides the k rows of the public key to the requesting entity, and then repeats the process for the next k inverse rows until the complete public key has been computed and streamed.

[0129] The method of this invention can be easily adapted to generate multiple inverse bottom rows at once. For this purpose, only a portion of the inverse intermediate values, i.e., the portion required to calculate the target bottom row, is retained in memory. Figure 7 The examples in the text illustrate how this affects memory storage. Figure 7 This shows an example of generating k=mt / 2 rows at this point, which is half of the inverse. Figure 7 This shows that at most half the memory used to compute S in the previous method is required. As k increases, the number of regenerations required for S decreases. For the case of k=mt / 2, ​​only two regenerations of S are needed.

[0130] If steps S100 to S114 encounter an invertible matrix, the method is compatible with the method provided by the classical McEliece cryptosystem, which uses two different methods, called systematic and semi-systematic, to solve the problem. In the systematic method, once it is clear that H' is not invertible, key generation restarts. This process is repeated until an invertible matrix is ​​found, which occurs on average after 3.4 attempts. The method of the present invention is directly compatible with this strategy and does not require modification of the method of the present invention. The difference is that the present invention checks the invertibility of S instead of H', however this is equivalent (if S is not invertible, then H' is also not invertible). The only requirement is to add anomalous behavior if the matrix S is not invertible. For the latter (semi-system), classical McEliece actually expands the size of S by additional columns. If Gaussian elimination encounters an inversion problem (i.e., if there are 0s on the diagonal, then there are no rows with valid 1s to swap), Gaussian elimination swaps the columns with one of the appropriate additional columns. In this way, the probability of encountering an invertible S becomes negligible. It should be noted that these additional column swaps are recorded in the secret key variable c. i This can be extended to also allow for semi-system key generation strategies. In fact, once an embodiment of the invention encounters a reversal problem, the same column swapping behavior is adapted, and the swapping is stored in c. i The process continues normally.

[0131] In the following text, the memory and runtime complexity of existing techniques will be compared with those mentioned above. Figure 1 The methods described are compared. It should be noted that this comparison is performed at the algorithm level, as specific values ​​strongly depend on the actual implementation type. Specifically, memory and runtime requirements for other parts of key generation unaffected by the methods of this invention are ignored, as these requirements are constant across all methods.

[0132] The standard method for storing the complete matrix H (denoted as Standard 1) requires mt × n bits of RAM. The optimized standard method based on the inverse (denoted as Standard 2) requires storing the complete inverse -mt × mt bits. (See reference) Figure 1 The method shown can be instantiated with a varying number of rows k during each outer loop iteration. k is limited to the number of rows generated by a single call to the row computation routine 210.

[0133] It has been found that the minimum peak memory is reached for k=mt / 4, and further reducing k does not improve the peak memory. That is, when generating the inverse mt / 4 rows at a time, the memory used never exceeds 18 kB (for the mceliece348864 parameter set). However, the row computation routine needs to be called 4 times. Generating fewer than mt / 4 rows at a time still results in 18 kB of memory usage. Therefore, this is the minimum peak memory reached when setting k=mt / 4. 18 kB is not the total memory usage of the algorithm, but the maximum usage at any given time. Therefore, to generate the full key, the memory usage will never exceed 18 kB. We consider k=mt / 4 to be the optimal case for minimizing memory. Furthermore, we consider another extreme case, k=mt / 2, ​​which trades memory for better runtime performance. The resulting comparisons are provided in the table below. It is worth noting that the method of this invention significantly reduces memory requirements.

[0134] In both standard methods, S is generated and processed only once. This is taken as a baseline, and the method of the present invention is compared with the number of regenerations / processes of S. This number depends on the number of rows generated in each iteration of the outer loop (steps S110 to S114), which also affects peak memory requirements. Specifically, ceil(mt / k) regeneration / processing of S is required, where ceil() denotes the vertex function. This will result in 4 regenerations for k=mt / 4 and 2 regenerations for k=mt / 2. This relationship is described in... Figure 8 It is obvious that reducing memory by less than (mt*mt) / 4 is impossible, and further reductions in k would result in a significant increase in runtime. In the best case, memory is reduced by a factor of 4 in exchange for a comparable runtime.

[0135] The memory complexity is reported in terms of the size of the intermediate values ​​stored in matrix T. Additionally, vectors also need to be stored. And D. For simplicity, these are not considered in the table above, as the additional memory requirements for these two vectors are small (1 kB to 2.5 kB, depending on the parameter set).

[0136] The most direct embodiment of the method of the present invention is as a Switch program that performs the aforementioned steps. This can be implemented on readily available devices. Peak memory usage is significantly reduced, which expands the range of devices that can be used for practical deployment.

[0137] This may introduce some runtime overhead. To offset this, one can... Figure 9 The processing resource 200 of the present invention is instantiated in the hardware / software co-design shown, wherein the computationally expensive steps of regenerating S are implemented as dedicated hardware blocks.

[0138] Regenerating S involves generating the leftmost mt columns of H', where each m bit of the column has the following form:

[0139] Where j is the number of columns, i is the number of rows, and g is... The first irreducible multi-top form in the equation.

[0140] This involves three operations: evaluating the polynomial g at some α, inverting the result, and applying field multiplication. The first two operations are performed once per column. Therefore, it can be computed once, stored, and then reused across all regenerations with a memory overhead of m×mt. The value. However, domain multiplication must be performed for each regeneration. Figure 9 An example hardware setup is shown to achieve this.

[0141] In this example, six domain multipliers are used. The estimated gate count for the GF(12) multipliers is 500 gates. The entire system is expected to have an estimated gate count of 5k gates or less. Using this system, neglecting any I / O latency, the generation of S is expected to take <20k cycles. Considering the worst-case scenario where S needs to be regenerated mt times, the result is approximately 15M cycles. For a system timed at a low frequency of 100 MHz, the process of regenerating S mt times will take less than one second. If connected to a software-implemented system, this will make the regeneration overhead negligible.

[0142] In summary, the above embodiments describe a novel solution for generating public keys in blocks during key generation operations, with a significantly lower peak RAM usage than that generated by the standard methods described above. This will allow the classic McEliece cryptosystem to be implemented on constrained embedded devices.

[0143] It should be noted that the aspects and embodiments mentioned above illustrate this disclosure but do not limit it, and those skilled in the art will be able to devise many alternative embodiments without departing from the scope of this disclosure as defined by the appended claims. Any reference numerals placed in parentheses in the claims should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps other than those listed in any claim or the entire specification. In this specification, "comprises" means "includes" or "consists of," and "comprising" means "including" or "consisting of." A singular reference to an element does not exclude a plural reference to such an element, and vice versa. This disclosure can be implemented by means of hardware comprising several disparate elements and by means of a suitably programmed computer. In an apparatus claim listing several components, several of these components may be embodied by the same item of hardware. The fact that certain measures are recited in different appendix claims alone does not imply that combinations of these measures cannot be used to gain an advantage.

Claims

1. A computer-implemented method for generating public keys, characterized in that, The public key comprises a matrix, wherein the number of rows and columns of the matrix is ​​associated with security requirements, and wherein the method is implemented by processing resources, the method comprising: Receive requests for the public key; In response to receiving the request, a first key generation matrix is ​​generated; Generate a second key generation matrix based on the first key generation matrix; Generate a portion of the inverse of the second key generation matrix, wherein the portion of the inverse of the second key generation matrix is ​​not equal to the full inverse of the second key generation matrix; The public key is generated based on a portion of the second key generation matrix.

2. The method according to claim 1, characterized in that, The inverse of the second key generation matrix is ​​not fully stored, wherein only a portion of the inverse of the second key generation matrix is ​​stored.

3. The method according to claim 1 or claim 2, characterized in that, The generation of the inverse portion of the second key generation matrix is ​​repeated until all portions of the second key generation matrix have been used to generate the corresponding portions of the public key.

4. The method according to any one of claims 1 to 3, characterized in that, The portion of the inverse of the second key generation matrix is ​​the row of the inverse of the second key generation matrix, and the portion of the public key based on the portion of the second key generation matrix is ​​the row of the public key.

5. The method according to any one of claims 1 to 3, characterized in that, The portion of the inverse of the second key generation matrix is ​​a plurality of rows of the inverse of the second key generation matrix, and the portion of the public key based on the portion of the second key generation matrix is ​​a plurality of rows of the public key.

6. The method according to any one of the preceding claims, characterized in that, The first key generation matrix is ​​generated temporarily without interrupting the method or based on a random or pseudo-random seed.

7. The method according to any one of the preceding claims, characterized in that, The public key is generated by multiplying the inverse of the second key generation matrix with the first key generation matrix.

8. The method according to any one of the preceding claims, characterized in that, The second key generation matrix is ​​a square matrix equal to the elements in the first mt rows and the first mt columns of the first key generation matrix.

9. A system, characterized in that, Configured to implement the method according to claims 1 to 12.

10. A method for processing resources, characterized in that, It includes a processor and a memory, the memory including executable instructions that, when executed by the processor, cause the processor to perform the method according to claims 1 to 8.

Images