Integrity protection

Abstract

A solution is provided for generating a bit sequence based on a seed value, wherein a generator is used to generate a first set of bits based on the seed value, wherein the generator is used to generate a second set of bits, wherein the second set of bits is based on the first set of bits or on a section of the first set of bits, and wherein the bit sequence comprises the first set of bits and the second set of bits.

Description

[0001] The lattice-based cryptographic schemes Kyber [ABD+21] and Dilithium [LDK] + 21], both of which are selected by NIST for standardization purposes, use a large random matrix → A. This matrix → A is specific to each key pair, is defined during key generation, and is included in both the public and private keys. This applies to both Kyber and Dilithium.

[0002] To account for the limited storage space, only a section of the matrix is ​​used. → A stored: A random seed value ρ is generated and stored as part of both the public and private keys. The matrix →A is then deterministically (re)created from this seed value ρ whenever necessary. More precisely, the seed value ρ is used to feed into a pseudorandom number generator (PRNG) to generate a random bit sequence, which is then subjected to a sampling algorithm that derives values ​​according to the desired output format, i.e., coefficients within a range [0, q - 1]. Kyber and Dilithium use SHAKE as their PRNG.

[0003] Since the starting value ρ is public (i.e., part of the public key), the newly created matrix must →Matrix A may not be secure against side-channel attacks. However, the problem remains that an attack could introduce errors into matrix A, necessitating measures to ensure that matrix A is constructed correctly. Another problem addressed here is finding an efficient approach to provide means for verifying the integrity of long bit strings.

[0004] This is solved according to the features of the independent claims. Further embodiments are described in the dependent claims.

[0005] The examples proposed here can be based on at least one of the following solutions. Combinations of the following functions can be used to achieve a desired result. The features of the method could be combined with any features of the device, equipment, or system, or vice versa.

[0006] A method for generating a bit sequence based on a starting value (also referred to as a "seed") is proposed. - where a generator is used to create an initial set of bits based on the seed value, - wherein the generator is used to produce a second set of bits, wherein the second set of bits is based on the first set of bits or on a section of the first set of bits, - where the bit sequence comprises the first set of bits and the second set of bits.

[0007] This approach allows the integrity of the bit sequence to be verified by recalculating the second set of bits. Such a verification can be used to confirm the integrity of the generator, as it can detect (injected) errors in particular.

[0008] It is noted that the reference "based on X" is not limited exclusively to X, but is meant to be "also based on X," that is, based on X and other inputs, or on X and intermediate results. For example, the first set of bits is based on the initial value, where the first set of bits can be determined in sections of bits, with each subsequent section of bits also based on the initial value and (e.g., all) previous sections of bits. Accordingly, the second set of bits is based on the first set of bits (i.e., all its sections) and the initial value.

[0009] It should also be noted that the generator is often referred to as a random number generator or pseudorandom number generator. In the context used here, it is not crucial whether the randomness of the generated numbers is true randomness, pseudorandomness, or even based on deterministically calculated numbers. The generated numbers may, in particular, appear at least partially arbitrary. In this respect, there are no specific requirements regarding the degree of entropy.

[0010] Advantageously, the approach described herein can be used when the bit sequence, which may in particular be at least partially random, is generated or regenerated from an arbitrary starting value.

[0011] The starting value can comprise several bits, whereas the bit sequence can comprise (significantly) more bits than the starting value.

[0012] The bits can be generated in successive processing steps, with each subsequent step based on the result of the previous step. For example, the second set of bits can be generated in (at least) one subsequent step based on the first set of bits. Alternatively, the second set of bits can be based on a portion of the first set of bits resulting from previous steps, while the remaining portion of the first set of bits and the second set of bits are the result of the most recent (last) processing step.

[0013] According to one embodiment, the generator operates in cycles, with each cycle depending on the previous cycle and using a function f.

[0014] Thus, the generator can operate as a state machine comprising multiple cycles (i.e., processing steps), with each cycle based on the computation of the previous cycle. The initial value is processed in an absorption phase. The first set of bits and the second set of bits are determined in a squeezing phase of a cryptographic sponge construction.

[0015] According to the invention, the generator is a pseudorandom number generator (PRNG) that uses an absorption phase that absorbs the seed value and a squeezing phase that determines the first set of bits and the second set of bits.

[0016] According to one embodiment, SHAKE is used as the PRNG.

[0017] According to one embodiment, the second set of bits consists of checksum bits for verifying the bit sequence.

[0018] Thus, the checksum bits can be used to verify the integrity of the generator. This verification can take place, for example, during decapsulation (in the case of Kyber) or during signing (in the case of Dilithium).

[0019] According to one embodiment, the bit sequence is verified by recalculating the second set of bits based on the initial value and comparing this recalculated second set of bits with the checksum bits.

[0020] According to one embodiment, the second set of bits is calculated during key generation and stored together with the key.

[0021] According to one embodiment, the method is used in the context of a grid-based cryptography method.

[0022] According to one embodiment, the bit sequence is determined to create a matrix for a key pair, which is used particularly in Kyber or Dilithium.

[0023] According to one embodiment, the method is carried out at least partially on one of the following: - a safety device, - a secure cloud, - a secure service, - an integrated circuit, - a hardware security module, - a Trusted Platform module, - a crypto unit, - an FPGA, - a processing unit, - a control system, - a smartcard.

[0024] Furthermore, a device for generating a bit sequence based on a start value is proposed, wherein the device is configured to perform the following steps: - Generating an initial set of bits based on the seed value, - Generating a second set of bits, wherein the second set of bits is based on the first set of bits or on a section of the first set of bits, the bit sequence comprising the first set of bits and the second set of bits.

[0025] The device can be any processing unit for performing such steps or utilize such a unit. This device can comprise at least one, and in particular several, means configured to perform the steps of the method described herein. The means can be logically or physically separate; in particular, several logically separate means could be combined in at least one physical unit. The processing unit can comprise at least one processor and / or microcontroller (MCU).

[0026] According to one embodiment, the device is one of the following or includes at least one of the following: - a safety device, - a secure cloud, - a secure service, - an integrated circuit, - a hardware security module, - a Trusted Platform module, - a crypto unit, - an FPGA, - a processing unit, - a control system, - a smartcard.

[0027] Furthermore, a computer program product is provided which can be loaded into a memory of a digital processing device and includes software code sections for carrying out the steps of the procedure described herein.

[0028] Examples of implementation are illustrated and explained with reference to the drawings. The drawings serve to illustrate the basic principle, so only aspects necessary for understanding the basic principle are shown. The drawings are not to scale. In the drawings, the same reference symbols denote the same features. Fig. Figure 1 shows a schematic diagram of the states of a Sponge construction used in SHAKE. Fig. Figure 2 shows a schematic diagram visualizing an exemplary embodiment for determining additional check bits. Fig. Figure 3 shows an example diagram that visualizes the steps for verifying the integrity of a long bit string. Fig. Figure 4 shows an exemplary arrangement of a processing device comprising a CPU, RAM, non-volatile memory, crypto module, analog module, input / output interface, and hardware random number generator. Fig. Figure 5 shows an alternative arrangement with a hardware security module (HSM).

[0029] The solutions described herein enable a cost-effective approach to detecting faulty injections during matrix creation. →A. In particular, the correct execution of the PRNG is ensured by converting the start value ρ into a long pseudorandom bit sequence. This allows the PRNG to be executed on an unprotected device, e.g., an accelerator.

[0030] This is achieved by using the PRNG to generate more output bits than necessary. These additional output bits are then used as a checksum (i.e., checksum bits) to verify the correct calculation of the (total) PRNG output.

[0031] As an option, the checksum bits can be calculated during key generation and stored with the secret key. During a secret key operation (i.e., decapsulation in the case of Kyber or signing in the case of Dilithium), the checksum is then recalculated and compared with these previously stored checksum bits.

[0032] The error detection capabilities of this approach depend on the PRNG used and the position of the parity bits. As mentioned, Kyber and Dilithium use SHAKE as their PRNG: SHAKE is an extensible output function belonging to the SHA-3 algorithm family. SHAKE is described in FIPS PUB 202 [Nat15]. It is a cryptographic sponge construction, meaning that an absorption phase is followed by a squeezing phase.

[0033] Fig. Figure 1 shows a schematic diagram of the states of a sponge construction of SHAKE according to [Nat15]. The input N is initially padded to a multiple of the block length r. Each of these blocks is XORed with a portion of the state. After each XOR of a block, a function f is applied to the respective state, resulting in a stepwise absorption of the input N based on the operations of previous blocks. After all the input N has been absorbed, an output Z of length d is extracted into blocks, with the function f being applied after each block extraction of r bits.

[0034] To generate matrix A (in Kyber or Dilithium), the input N is set to the initial value ρ. The output Z is fed into a sampling algorithm that converts the random bits into samples of the desired distribution. The required output length d is not known a priori. Instead, block extraction is performed during the squeezing phase as long as the required number d of output bits is generated.

[0035] In other words, during the squeezing phase, a number of r bits are generated with each application of the function f. This can continue until a sufficient number of bits are available.

[0036] The parameter c is a security parameter: the larger the parameter c is, the higher the security level.

[0037] According to one example, SHA-3 / SHAKE uses states that each have a fixed size of 1600 bits, i.e. r+c=1600 bits.

[0038] The actual values ​​of r and c can depend on the specific application. The parameter r is also referred to as "rate" and the parameter c as "capacity".

[0039] The examples described herein propose the determination of additional check bits Y using the PRNG, which are then used for error detection.

[0040] Fig. Figure 2 shows an example of determining and using e additional check bits Y: After all the bits required for the output Z have been determined, the function f is called (at least) one more time according to the current (last) state, resulting in an additional block of e check bits Y. Using the check bits Y allows errors to be detected with a high probability; that is, errors within the function f are detected with a probability of only 2 -e not recognized.

[0041] The parity bits Y are determined within a block 201, which is compared to the one in Fig. The example shown in point 1 is added.

[0042] This process can be performed first during key generation, and then the check bits Y could be stored as part of the private key. When operating with secret keys, the process can be repeated, and the check bits Y can be compared with the previously stored values.

[0043] In Kyber and Dilithium, each matrix entry is a polynomial. Each of these polynomials is generated using a separate call to SHAKE, e.g., in the form SHAKE(ρ, matrix index).

[0044] Therefore, separate check bits may need to be stored for each such call to SHAKE.

[0045] Fig. Figure 3 shows an example diagram visualizing the steps for verifying the integrity of a long bit string. A seed value is input in step 301, which allows a generator to create multiple bits A based on this seed value (e.g., in several steps of an absorption phase followed by a squeezing phase). Next, in step 302, the bits B can be determined using one of the following approaches: 1) The bits B are determined in a subsequent step (i.e., function call f). Thus, the bits B are based on all previous bits, in particular the previously generated bits A. 2) The bits B are taken from the last function call, which also contributed to the remaining bits A. Therefore, this current function call resulted in more bits than are needed for the bits A. Some or all of these excess bits can be used as bits B. 3) A first section of the bits B is determined according to approach 2) and a second section of the bits B according to approach 1), i.e. in a subsequent function call f. This can be useful if more bits than the first section of the bits are required.

[0046] In step 305, the bits B are stored. This can be done together with the bits A or without the bits A.

[0047] In step 303, bits A* are generated based on the seed value, and in step 304, bits B* are generated. These generation steps 303 and 304 function similarly to steps 301 and 302. All steps 301 to 304 are preferably performed on a single generator and / or can use the same generation algorithm.

[0048] In step 306, the stored bits B and the bits B* are compared. If they are identical, the integrity check of the generator is successful (step 307); otherwise, the check is unsuccessful (step 308).

[0049] It is noted that bits B and bits B* can also be referred to as check bits.

[0050] It is further noted that the term "Bits X are based on" Bits Y can encompass an iterative use of a function, where each (intermediate) function call utilizes the output of the previous function call. Therefore, Bits X can be considered (direct or indirect) input for deriving Bits Y in multiple steps, with each step (e.g., function call) potentially providing a portion of Bits Y.

[0051] In the example of Fig. 2. The bits Z are "squeezed out" (expressed) from the input bits N by repeatedly applying the function f. The output of each function call is used as input for the subsequent function call. Therefore, the bits Z are based on the input N and all intermediate results of the function calls. Consequently, the check bits Y (according to) Fig. 2) both on the input N and on the bits Z. Further examples and embodiments

[0052] A generic approach to integrity protection involves performing multiple calculations of the same operation. For example, a particular operation might be executed twice, and the output is checked for equivalence. The solution presented here can be used accordingly in this context. The parity bits of the two operations can be tested.

[0053] Another option is to define the check bits Y from unused bits, i.e., bits of the last block that extend beyond the pure output Z. This may lead to an even more favorable solution, but certain errors from the last squeezing phase might go undetected. This can be particularly true if SHAKE is used as a PRNG.

[0054] The approach presented here is not aimed at recreating the matrix → A is limited. Instead, this solution can be applicable if random data is (newly) generated from a seed value. Such a seed value can, in particular, be known in advance and optionally be constant.

[0055] Both Kyber and Dilithium, for example, use key pair generation based on a (secret) random seed value. However, the remaining steps of key pair generation, including the regeneration of the entire private key, are then executed deterministically and depend (only) on this initial seed value.

[0056] In scenarios with limited memory for storing private keys, one approach could be to store only the secret seed used for key generation and reuse this seed when needed to regenerate the (private) key. Such (re)generation involves running the PRNG (SHAKE) with a fixed secret seed, as described in the solution presented herein.

[0057] Fig. Figure 4 shows a processing device 500 comprising a CPU 501, a RAM 502, a non-volatile memory 503 (NVM), a crypto module 504, an analog module 506, an input / output interface 507 and a hardware random number generator 512.

[0058] In this example, the CPU 501 has access to at least one crypto module 504 via a common bus 505, to which each crypto module 504 is coupled. Each crypto module 504 can, in particular, comprise one or more crypto cores to perform specific cryptographic operations. Examples of crypto cores are: - an AES kernel 509, - a SHA 510 core, - an ECC 511 core, and - a lattice-based crypto kernel 508.

[0059] The CPU 501, the hardware random number generator 512, the NVM 503, the crypto module 504, the RAM 502, and the input / output interface 507 are connected to the bus 505. The input / output interface 507 may have a connection to other devices, which may be similar to the processing device 500.

[0060] The 504 crypto module may or may not be equipped with hardware-based security features.

[0061] The 505 bus itself can be masked or plain. Instructions for processing the steps described herein can be stored in the 503 NVM and processed by the 501 CPU. The processed data can be stored in the 503 NVM or in the 502 RAM. Supporting functions can be provided by the 504 crypto modules (e.g., extending the pseudorandom data range).

[0062] Steps of the procedure described herein can be performed exclusively or at least partially on the crypto module 504, e.g. on the lattice-based crypto kernel 508.

[0063] The processing device 500 can be a chip card powered by direct electrical contact or via an electromagnetic field. The processing device 500 can be a fixed circuit or based on reconfigurable hardware (e.g., a field-programmable gate array (FPGA)). The processing device 500 can be coupled with a personal computer, a microcontroller, an FPGA, or a smartphone.

[0064] The solution described herein can be used by a customer who wishes to provide a secure implementation of lattice-based cryptography on a smart card or other secure element.

[0065] Fig.Figure 5 shows another example of a processing device 600. The processing device 600 comprises a hardware security module 601, a non-volatile memory (NVM) 608, a random access memory (RAM) 609, an interface 610 for communication with other devices, and an application processor 607 coupled to the hardware security module (HSM) 601, the RAM 609, the NVM 608, and the interface 610.

[0066] The HSM 601 comprises a controller 602, a hardware random number generator (HRNG) 606, and at least one crypto module 603. The crypto module 603 includes, for example, an AES core 604 and a grid-based crypto (LBC) core 605.

[0067] According to one embodiment, the HSM 601 and the application processor 607 can be manufactured on the same physical chip with tight coupling. The HSM 601 provides cryptographic services and secure key storage, while the application processor can perform computationally intensive tasks (e.g., image recognition, communication, motor control). The HSM 601 can be accessed only via a defined interface and can be considered independent of the rest of the system in such a way that a security breach of the application processor 607 has only a limited impact on the security of the HSM 601. The HSM 601 can perform all or a subset of the tasks described with respect to the processing device 600 by using the controller 602, the LBC 605 (supported, for example, by an AES 604), and the HRNG 606.It can execute the procedures described herein (at least partially) either controlled by an internal controller or as a CMOS circuit. Furthermore, the 607 application processor can also execute the procedures described herein (at least partially, e.g., in conjunction with the 601 HSM).

[0068] The processing device 600 with this application processor 607 and HSM 601 can be used as a central communication gateway or (electrical) motor control device in cars or other vehicles.

[0069] In one or more examples, the functions described herein can be implemented, at least partially, in hardware, for example, in specific hardware components or a processor. More generally, the techniques can be implemented in hardware, processors, software, firmware, or any combination thereof. When implemented in software, the functions can be stored on a computer-readable medium or transmitted as one or more instructions or codes and executed by a hardware-based processing unit. Computer-readable media can include computer-readable storage media, which correspond to a tangible medium such as data storage media, or communication media, which include any media that facilitate the transmission of a computer program from one location to another, for example, according to a communication protocol.In this way, computer-readable media can generally correspond to (1) tangible, non-volatile, computer-readable storage media, or (2) a communication medium, such as a signal or carrier wave. Data storage media can be any available media that one or more computers or one or more processors can access to retrieve instructions, code, and / or data structures for implementing the techniques described in this disclosure. A computer program product can include a computer-readable medium.

[0070] Such computer-readable storage media can include, by way of example and without limitation, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, flash memory, or any other medium that can be used to store desired program code in the form of instructions or data structures that a computer can access. Furthermore, any connection is referred to as a computer-readable medium, i.e., a computer-readable transmission medium.For example, if instructions from a website, server, or other remote source are transmitted via coaxial cable, fiber optic cable, twisted-pair cable, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted-pair cable, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave are included in the definition of the medium. However, it is understood that computer-readable storage media and data storage media do not include connections, carrier waves, signals, or other temporary media, but instead refer to non-volatile, tangible storage media."Disk" and "disc," as used here, include CDs, laserdiscs, optical discs, DVDs, floppy disks, and Blu-ray discs, with floppy disks typically reproducing data magnetically, while discs reproduce data optically using lasers. Combinations of the above should also be included in the scope of computer-readable media.

[0071] Instructions can be executed by one or more processors, such as one or more central processing units (CPUs), digital signal processors (DSPs), general-purpose microprocessors, application-specific integrated circuits (ASICs), field-programmable logic arrays (FPGAs), or other equivalent integrated or discrete logic circuits. Accordingly, the term "processor," as used herein, can refer to any of the structures mentioned above or any other structure suitable for implementing the techniques described herein. Furthermore, some aspects of the functionality described herein may be provided in dedicated hardware and / or software modules configured for encoding and decoding, or may be integrated into a combined codec. Alternatively, the techniques could be implemented entirely in one or more circuits or logic elements.

[0072] The techniques of this disclosure can be implemented in a variety of devices or apparatuses, including a wireless handheld device, an integrated circuit (IC), or a set of ICs (e.g., a chipset). This disclosure describes various components, modules, or units to highlight functional aspects of devices configured to perform the disclosed techniques, but these do not necessarily require implementation by different hardware units. Rather, as described above, different units can be combined in a single hardware unit or provided by a collection of interoperable hardware units, including one or more processors as described above, in conjunction with suitable software and / or firmware.

[0073] Although various exemplary embodiments of the invention have been disclosed, it is obvious to those skilled in the field that various changes and modifications can be made which achieve some of the advantages of the invention without departing from the concept and scope of the invention. It is also obvious to those skilled in the field that other components performing the same functions can be appropriately substituted. It should be noted that features described with reference to a particular figure can be combined with features of other figures, even if this is not explicitly stated. Furthermore, the methods of the invention can be achieved either in all software implementations using the appropriate processor instructions or in hybrid implementations that utilize a combination of hardware logic and software logic to achieve the same results.Such modifications of the inventive concept are intended to be covered by the attached claims. Bibliography [ABD + 21 Roberto Avanzi, Joppe Bos, Léo Ducas, Eike Kiltz, Tancrède Lepoint, Vadim Lyubashevsky, John M. Schank, Peter Schwabe, Gregor Seiler and Damien Stehlé. CRYSTALS-Kyber: Algorithm specification and supporting documentation (version 3.02). Submission to the NIST Post-Quantum Cryptography Standardization Project [NIS16], 2021. Document: https: / / pq-crystals.org / kyber / data / kyber-specification-round3-20210804.pdf. Website: https: / / pq-crystals.org / kyber. [LDK +21] Vadim Lyubashevsky, Léo Ducas, Eike Kiltz, Tancrède Lepoint, Peter Schwabe, Gregor Seiler, und Damien Stehlé. CRYSTALS- Dilithium: Algorithm specification and supporting documentation (version 3.1). Submission to the NIST Post-Quantum Cryptography Standardization Project [NIS16], 2021. Dokument: https: / / pq-crystals.org / dilithium / data / dilithium-specification-round3-20210208.pdf. Website: https: / / pqcrystals.org / dilithium. [Nat15] National Institute of Standards and Technology. FIPS 202, SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions, 2015. Verfügbar unter: https: / / nvlpubs.nist.gov / nistpubs / FIPS / NIST.FIPS.202.pdf. [NIS16] NIST Computer Security Division. Post-Quantum Cryptography Standardization, 2016. Website: https: / / csrc.nist.gov / Projects / Post-Quantum-Cryptography.

Claims

[1] Method for generating a bit sequence based on a starting value, - wherein a generator is used to generate a first set of bits based on the seed value, - wherein the generator is used to generate a second set of bits, the second set of bits being based on the first set of bits or on a portion of the first set of bits, - wherein the bit sequence comprises the first set of bits and the second set of bits, - where the generator is a pseudorandom number generator, PRNG, which uses an absorption phase that absorbs the seed and a squeezing phase that determines the first set of bits and the second set of bits. [2] The method of claim 1, wherein the generator operates in cycles, each cycle depending on the previous cycle and using a function f. [3] A method according to any preceding claim, wherein SHAKE is used as the PRNG. [4] A method according to any one of the preceding claims, wherein the second set of bits are checksum bits for verifying the bit sequence. [5] A method according to claim 4, wherein the bit sequence is checked by recalculating the second set of bits based on the starting value and comparing this recalculated second set of bits with the checksum bits. [6] A method according to any one of the preceding claims, wherein the second set of bits is calculated during key generation and stored together with the key. [7] A method according to any one of the preceding claims, wherein the method is used in the context of a lattice-based cryptography method. [8] Method according to one of the preceding claims, wherein the bit sequence is determined to create a matrix for a key pair, which is used in particular in Kyber or Dilithium. [9] Method according to one of the preceding claims, wherein the method is carried out at least partly on one of the following: - a safety device, - a secure cloud, - a secure service, - an integrated circuit, - a hardware security module, - a Trusted Platform module, - a crypto unit, - an FPGA, - a processing unit, - a control system, - a smart card. [10] Apparatus for generating a bit sequence based on a starting value, the apparatus being arranged to carry out the following steps: - Generating a first set of bits based on the starting value, - generating a second set of bits, the second set of bits being based on the first set of bits or on a portion of the first set of bits, the bit sequence comprising the first set of bits and the second set of bits, - wherein the device is a pseudorandom number generator, PRNG, which uses an absorption phase that absorbs the seed value and a squeezing phase that determines the first set of bits and the second set of bits. [11] The device according to claim 10, wherein the device is one of the following or comprises at least one of the following: - a safety device, - a secure cloud, - a secure service, - an integrated circuit, - a hardware security module, - a Trusted Platform module, - a crypto unit, - an FPGA, - a processing unit, - a control system, - a smart card. [12] A computer program product which is directly loadable into a memory of a digital processing device and comprises software code sections for performing the steps of the method according to any one of claims 1 to 9.

Images