A secure multiplication method between a sparse polynomial and a dense polynomial in a cryptographic algorithm, associated electronic device and computer program.

Abstract

A safe multiplication method in between a sparse polynomial and a dense polynomial of the form where is such that =- characterized in that is of the form where is between 0 and such that = , and is a coefficient such that ,- and in that it comprises for all from 0 to: a. the initialization (E4) of an intermediate result polynomial; b. the initialization (E12) of other intermediate polynomials such that for all from 0 to ; c. polynomial multiplication steps (E22) performing for all from 0 to , , having the value of the index of the step concerned; d. the updating (E34) of by adding the other intermediate polynomials. Figure for the abbreviation: Fig. 2.

Description

Title of the invention: Method for secure multiplication between a sparse polynomial and a dense polynomial in a cryptographic algorithm, associated electronic device and computer program.

[0001]

[0002]

[0003]

[0004]

[0005]

[0006]

[0007]

[0008]

[0009] The invention relates to the field of computer cryptography. It relates more particularly to a method for secure multiplication between a sparse polynomial and a dense polynomial in a cryptographic algorithm. The invention also relates to an associated electronic device and computer program. As is known, a cryptographic algorithm can be used to encrypt, decrypt, sign or verify the signature of data. Such a cryptographic algorithm is, for example, an asymmetric key cryptographic algorithm implemented by an electronic device, typically an RSA algorithm or an elliptic curve algorithm implemented by the chip of a smart card. However, the emergence of quantum computers makes these cryptographic algorithms insecure. It is therefore desirable to use suitable cryptographic algorithms to guarantee security against an attacker with a quantum computer. These algorithms are called post-quantum cryptographic algorithms. Some post-quantum polynomial-based cryptographic algorithms have been proposed in a competition organized by the National Institute of Standards and Technology (NIST), including algorithms for public-key encryption schemes. It is necessary to protect the implementation of these post-quantum polynomial-based cryptographic algorithms against covert channel attacks, also known as side-channel attacks. But current solutions rely on polynomial manipulations which place too much strain on the electronic device. To overcome this drawback, the present invention proposes, according to a first aspect, a method of secure multiplication between a sparse polynomial / and a dense polynomial 8 in a quotient ring formed by dividing a ring of polynomials with an indeterminate X and with coefficients in a finite field K, by the ideal generated by a polynomial X" -c^n and c are unnuanced natural integers, - the method being implemented in a cryptographic algorithm by an electronic device, - the dense polynomial 8 being of the form »( / <) where is a non-zero natural integer and for all k ranging from 0 to d, g® is an intermediate masking polynomial of index k such that with for all i ranging from 0 to n - 1, a coefficient of ^i=Q\S} 'A ) 1 rank i of the intermediate masking polynomial of index k, - the method being characterized in that the sparse polynomial / is of the form (f- Xs' j oa For all i ranging from 0 to si is an integer between 0 and n - 1 such that si = ^J) n' Ct s> is a non-zero coefficient clc ranS S' such that j.' , x^' _ || yC / ). x^ ), with ” a ​​non-zero natural integer strictly less than n, V a non-zero natural integer, and for all j ranging from 0 to ¢, 5W an additive part of index j of rank si and yld a multiplicative part of the coefficient / Sj, - and in that the method comprises for all k ranging from 0 to d; a. the initialization of an intermediate result polynomial of index k^) such that t(k) xi with for all i ranging from 0 to n - 1, a coefficient of rank i of the intermediate result polynomial of index k; b. the initialization of w + 1 other intermediate polynomials having respective double indices ranging from k, 0 to k, w such that for all i ranging from 0 to seen ■> with l^k ' other intermediate polynomial having for double index k, i; c. the implementation of (1 polynomial multiplication steps having respective indices ranging from 1 to each polynomial multiplication step performing a calculation defined as follows: for all i ranging from 0 to w, ^.i) — . x^ ■> J having for value the index of the step concerned; d. updating the intermediate result polynomial of index k by adding to said intermediate result polynomial of index k, the w+ 1 other intermediate polynomials having respective double indices ranging from k, 0 to k, W.

[0010] Other advantageous and non-limiting characteristics of the method according to the invention, taken individually or in all technically possible combinations, are the following: - the method further comprises a renewal step between two polynomial multiplication steps having different indices, each renewal step renewing the other intermediate polynomials such that for all i ranging from 0 to H remains unchanged' - é has the value 1 and for each non-zero coefficient of the sparse polynomial, at most one multiplicative part of the non-zero coefficient concerned has a value other than 1, or 6 is a natural integer strictly greater than 1 and for each non-zero coefficient of the sparse polynomial, at least a multiplicative part of the non-zero coefficient concerned is generated randomly or pseudo-randomly; - the cryptographic algorithm is an algorithm of a post-quantum public key encryption scheme, for example one of the Hamming Quasi-Cyclic algorithm, the Bit Flipping Key Encapsulation algorithm, and the Number Theory Research Unit algorithm; - for any k ranging from 0 to d, the initialization of the intermediate result polynomial of index k includes the initialization of all the coefficients of said intermediate result polynomial of index k such that, for any i ranging from 0 to n - 1, yd; - the method comprises, after implementing the d + 1 steps of updating an intermediate result polynomial, a step of calculating a final result polynomial? as follows: t _ yd Jk); - for any k ranging from 0 to d, the initialization of the intermediate result polynomial of index k includes the initialization of all the coefficients of said intermediate result polynomial of index k, and the calculation of a reference polynomial r as follows: r _ with for any k ranging from 0 to d, the intermediate result polynomial of index k as initialized during the initialization step of the intermediate result polynomial of index k; - the method comprises, after implementing the d + 1 steps of updating an intermediate result polynomial, a step of calculating a final result polynomial1 as follows • _ / yd t(k) j „ . 1 \ ^k=d

[0011] According to a second aspect, the invention proposes a computer program comprising instructions executable by a processor and adapted to implement a secure multiplication method as defined previously, when these instructions are executed by the processor.

[0012] This program may use any programming language, and be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0013] At least a portion of the methods of the invention may be computer-implemented. Accordingly, the present invention may take the form of an all-hardware embodiment, an all-software embodiment (including firmware, resident software, microcode, etc.), or an embodiment combining software and hardware aspects, all of which may be collectively referred to herein as a "module."

[0014] According to a third aspect, the invention proposes an electronic device for secure multiplication between a sparse polynomial / and a dense polynomial 8 in a quotient ring formed by dividing a ring of polynomials with an indeterminate X and coefficients in a finite field K, by the ideal generated by a polynomial Xn - c where n and c are unnullified natural numbers, - the dense polynomial 8 being of the form yd where d is a non-zero natural integer and for all k ranging from 0 to d, is an intermediate masking polynomial of index k such that »4 / \ with for all i ranging from 0 to n - 1, g(k) a coefficient of rank i of the intermediate masking polynomial of index k, - the electronic device being characterized in that the sparse polynomial f is of the where for all i ranging from 0 to w, 4 is an integer between 0 and n - 1 such that = and fSi is a non-zero coefficient of rank si such that y- _ || with H' a non-zero natural integer strictly less than n, cl a non-zero natural integer, and for all j ranging from 0 to an additive part of index j of the rank st and yiùunc multiplicative part of the coefficient f Sj, - and in that the electronic device comprises, for any k ranging from 0 to d; a. an initialization module of an intermediate result polynomial of index k^ configured to initialize the intermediate result polynomial of index k such that K 4 ) with for all / ranging from 0 to n - 1, a coefficient of rank i of the intermediate result polynomial of index k; b. an initialization module of 1 other intermediate polynomials configured to initialize w + 1 other intermediate polynomials having respective double indices ranging from k, Q to k, w such that for all i ranging from 0 to U' ~ ' with ' other intermediate polynomial having for double index k, i; c. a polynomial multiplication module configured to implement Q polynomial multiplication steps having respective indices ranging from 1 at each polynomial multiplication step performing a calculation defined as follows: for all i ranging from 0 to w, _ ^kJ). X» . , J having the value of the index of the step concerned; d. an update module of the intermediate result polynomial of index k configured to update the intermediate result polynomial of index k by adding to said intermediate result polynomial of index k, the vv + 1 other intermediate polynomials having respective double indices ranging from k, 0 to k, w.

[0015] This electronic device can be configured to implement each of the embodiment possibilities envisaged for the secure multiplication method as defined previously.

[0016] Of course, the various features, variants and embodiments of the invention may be combined with each other in various combinations to the extent that they are not incompatible or mutually exclusive.

[0017] Other characteristics and advantages of the present invention will emerge from the description given below, with reference to the appended figures which illustrate exemplary embodiments thereof which are not in any limiting nature.

[0018] In the figures:

[0019] [Fig. 1] schematically represents a preferred embodiment of an electronic device for implementing a method according to the invention;

[0020] [Fig.2] illustrates in the form of a flowchart the main steps of a secure multiplication method according to the invention;

[0021] [Fig.3] illustrates in the form of a flowchart the main steps of another secure multiplication method according to the invention.

[0022] Unless otherwise indicated, elements common or similar to several figures bear the same reference signs and have identical or similar characteristics, so that these common elements are generally not described again for the sake of simplicity.

[0023] In the context of the present description, the qualifiers “first”, “second”, “third”, “fourth” and “fifth” are only indicative to distinguish elements which they qualify, but do not imply an order between them.

[0024] [Fig.l] schematically represents an electronic device 2 comprising a processor 4 (for example a microprocessor), a storage block 6, a RAM 8 and a communication block 10.

[0025] The RAM 8 and the storage block 6 are each linked to the processor 4 so that the processor 4 can read or write data in the storage block 6 and / or the RAM 8.

[0026] The storage block 6 stores computer program instructions, some of which are designed to implement a secure multiplication method as described with reference to [Fig.2] or [Fig.3], when these instructions are executed by the processor 4.

[0027] The storage block 6 is for example a hard disk or a non-volatile memory, possibly rewritable, for example of the EEPROM type (for "Electrically Erasable and Programmable Read-Only Memory" according to the commonly used English term).

[0028] The RAM 8 can for its part store at least some of the elements (in particular intermediate result polynomials and / or other intermediate polynomials as described with reference to [Fig.2] or [Fig.3]) manipulated during the various processing operations carried out during one of the methods described below.

[0029] In the remainder of the description, any one of the storage block 6 and the RAM 8 is called memory.

[0030] The electronic device 2 also comprises several modules (not shown).

[0031] Typically, the electronic device 2 comprises for any k ranging from 0 to d, with d being a non-zero natural integer, a module for initializing an intermediate result polynomial of index k, a module for initializing w + 1 other intermediate polynomials, with u a non-zero natural integer strictly less than n and n a non-zero natural integer, a polynomial multiplication module and a module for updating the intermediate result polynomial of index k.

[0032] The electronic device 2 may further comprise a renewal module and / or a module for calculating a final result polynomial.

[0033] These modules can in practice be implemented by a combination of hardware elements and software elements.

[0034] Each module has a functionality described in the method according to the invention and described below with reference to [Fig.2] or [Fig.3]. Thus, for each module, the electronic device 2 stores, for example, software instructions executable by the processor 4 of the electronic device 2 in order to use a hardware element (for example a communication interface or a memory) and thus implement the functionality offered by the module.

[0035] According to one possible embodiment, the computer program instructions stored in the storage block 6 have for example been received (typically from a remote computer) during an operating phase of the electronic device 2 prior to the method described with reference to [Fig.2] or [Fig.3].

[0036] The communication block 10 is connected to the processor 4 so as to allow the processor 4 to receive data from another electronic device (not shown) and / or to transmit data to another electronic device (not shown). In certain embodiments, the processor 4 can thus receive data m from the other electronic device and / or transmit other data, for example computer program instructions.

[0037] The electronic device 2 can take many forms (not shown).

[0038] According to a first example, the electronic device is a smart card, such as an identity card, a bank card or a universal integrated circuit card (also known as a UICC card for “Universal Integrated Circuit Card” in English terminology).

[0039] According to a second example, the electronic device is a secure element, such as a secure microcontroller which is integrated into another electronic device, typically a communication terminal or a car.

[0040] According to other examples, the electronic device is a USB key, or an identity document, such as an electronic passport.

[0041] [Fig.2] illustrates in the form of a flowchart the main steps of a secure multiplication method according to the invention.

[0042] More precisely, the method of figure 2 aims to implement a secure multiplication between a sparse polynomial f and a dense polynomial S in a quotient ring formed by dividing a ring of polynomials with an indeterminate X and coefficients in a finite field K, by the ideal generated by a polynomial Xn - c where n and c are unnuanced natural integers.

[0043] K represents a finite field, that is, a set equipped with four operations: addition, subtraction, multiplication and division. A common example of finite fields is the integers modulo a prime number.

[0044] The ring of polynomials with an indeterminate X and coefficients in a finite field K is designated K [ X ]. It consists of all polynomials with coefficients belonging to the finite field K. The elements, that is to say the polynomials, of A'[A ] are expressions of the form a0 + a^X ... + am.[Xm~l + amXm, where m is a non-zero natural integer and for any integer i between 0 and m , ai belongs to the finite field K.

[0045] The ideal generated by the polynomial Xn - c in the ring of polynomials K[X] is designated (Xn -c}. The ideal (Xn -c} is the set of all polynomials of K[X] which can be obtained by multiplying Xn - c by any polynomial of K[X] •

[0046] Af[X] / (Xnc) represents the quotient ring obtained by dividing the polynomial ring X[X| by the ideal (Xn -c} . In other words, the quotient ring X[X] / (X"-c) is the set of all equivalence classes of polynomials in K [ X ], where two polynomials are considered equivalent if their difference lies in the ideal (Xn - c ).

[0047] The quotient ring K[X] / (Xn -c) therefore represents the ring of polynomials modulo the polynomial Xn - c-

[0048] A sparse polynomial is a polynomial containing very few unharmed monomials. For example, in the HQC (Hamming Quasi-Cyclic) cryptographic algorithm, a sparse polynomial has 66 unharmed monomials when ,l is 17669, 100 unharmed monomials when n is 35851, or 131 unharmed monomials when n is 57637.

[0049] A dense polynomial is a polynomial that is not sparse or a polynomial containing an indeterminate number of non-zero monomials.

[0050] A polynomial can be represented by a vector, also called a dense representation, each component of which corresponds to a coefficient of said polynomial.

[0051] Typically, a polynomial a belonging to the quotient ring X[X] / (Xn-c), is of the form + a,X... + a ,X” 1 ' ct Can be represented by a vector ( a; )

[0052] The polynomial a is composed of monomials «.y, with for all / ranging from 0 to n -1, ai a coefficient of rank i, the coefficient of rank i being associated with the indeterminate X power i of the polynomial.

[0053] A sparse polynomial can advantageously be represented by a list of pairs, also called sparse representation, each pair being composed of a coefficient and a power, said power being the degree of the monomial of the sparse polynomial, associated with the coefficient.

[0054] The dense polynomial S is of the form where is a non-zero natural integer and for all k ranging from 0 to d, g® is an intermediate masking polynomial of index k such that gdKyn-l / j \ with for all i ranging from 0 to n - 1, g(k) a coefficient of rank i of the intermediate masking polynomial of index k. The sparse polynomial f is of the form y . where for all i ranging from 0 to w, si is an integer between 0 and n -1 such that ^ / ) ct is a coefficient non-zero of rank if such that y . — || with W a natural integer not zero strictly less than n, Q a non-zero natural integer, and for all j ranging from 0 to ¢, $y) an additive part of index j of rank s> and y0) a multiplicative part of the coefficient

[0055] The method is implemented in a cryptographic algorithm by an electronic device, typically the electronic device 2 described with reference to [Fig.l].

[0056] The cryptographic algorithm may be an algorithm of a post-quantum public key encryption scheme, for example one of the Hamming Quasi-Cyclic algorithm, the Bit Flipping Key Encapsulation algorithm, and the Number Theory Research Unit algorithm.

[0057] The method thus allows the implementation of these algorithms in a device having limited memory and computing resources, typically in a secure element.

[0058] This method is implemented in the quotient ring. Thus the result of each polynomial operation implemented on one or more polynomials and / or monomials is in the quotient ring.

[0059] This method is implemented here by the electronic device 2 due to the execution computer program instructions stored in storage block 6 as shown above.

[0060] Preferably, ca for value 1 and for each non-zero coefficient of the sparse polynomial f, at most one multiplicative part of the non-zero coefficient concerned has a value other than 1, or c is a natural integer strictly greater than 1 and for each non-zero coefficient of the sparse polynomial / , at least one multiplicative part of the non-zero coefficient concerned is generated randomly or pseudo-randomly.

[0061] Preferably, when c is 1 and the non-null coefficients of the sparse polynomial / are public, which is the case when the cryptographic algorithm is one of the Hamming Quasi-Cyclic algorithm, the Bit Flipping Key Encapsulation algorithm, and the Number Theory Research Unit algorithm, for each non-zero coefficient of the sparse polynomial f, at most one multiplicative part of the non-zero coefficient concerned has a value other than 1.

[0062] The method thus makes it possible to further limit calculation times.

[0063] When c is a natural integer strictly greater than 1, it is preferable that the non-null coefficients of the sparse polynomial f are not public so as not to obtain information on the non-uniformity of the additive maskings. In this case, it is necessary to mask each non-null coefficient of the sparse polynomial, and thus for each non-null coefficient of the sparse polynomial, at least a multiplicative part of the non-null coefficient concerned is generated randomly or pseudo-randomly.

[0064] According to a first index initialization step (step E2), the processor 4 initializes an integer & to the value 0.

[0065] The method then comprises a step of initializing an intermediate result polynomial (step E4) during which the processor 4 initializes an intermediate result polynomial of index k, such that with for all i ranging from 0 to "- 1, a coefficient of rank i of the intermediate result polynomial of index k.

[0066] / U is a polynomial of the quotient ring K [X ] / ( Xn - c ) .

[0067] The step of initializing an intermediate result polynomial of index k is typically implemented by the module for initializing an intermediate result polynomial of index k of the electronic device 2.

[0068] The processor 4 then determines, in a first test step (step E6), whether the integer ka reaches the value d.

[0069] If not, the integer k is incremented by 1 in a first incrementation step (step E8) and the method loops to the step of initializing an intermediate result polynomial (step E4) to perform a next round.

[0070] During the method, the step of initializing an intermediate result polynomial (step E4) is thus executed for all k ranging from 0 to d. The method initializes so d + 1 polynomials intermediate result

[0071] During the implementation of a step of initializing an intermediate result polynomial (step E4) the processor 4 initializes an intermediate result polynomial of index k, such that with for all i ranging from 0 to n- 1, a co efficient of rank i of the intermediate result polynomial of index k.

[0072] According to a first example of implementation, the initialization of the intermediate result polynomial of index k comprises the initialization of all the coefficients of said intermediate result polynomial of index k such that, for all i ranging from 0 to n -1, Vd Ak)_o.

[0073] Typically, each coefficient of the intermediate result polynomial of index k is initialized with the value 0 or coefficients of the intermediate result polynomial of index k are initialized with non-zero values ​​such that: for all i ranging from 0 to n -1, / A)=o-

[0074] The calculation of a final result polynomial from the intermediate result polynomial (The calculation of the final result polynomial will be described later with step E40) is thus simplified. The method thus makes it possible to further limit the memory space consumed.

[0075] According to a second implementation example, the first iteration of the intermediate result polynomial initialization step comprises the initialization of all the coefficients of the intermediate result polynomial of index k associated with said iteration, then the initialization of a reference polynomial} as follows: r — and each of the other iterations of the intermediate result polynomial initialization step comprises the initialization of all the coefficients of the intermediate result polynomial of index k associated with the iteration concerned then the updating of the reference polynomial r as follows: r — r +

[0076] The reference polynomial ! is a polynomial of the quotient ring K[X] / (Xn - c) .

[0077] The initialization of the intermediate result polynomial is thus simplified. The method thus makes it possible to further limit calculation times.

[0078] Thus, when the step of initializing an intermediate result polynomial (step E4) is according to the first implementation example, for any k ranging from 0 to d, the initialization of the intermediate result polynomial of index k comprises the initialization of all the coefficients of said intermediate result polynomial of index k such that, for any i ranging from 0 to n -1, yd Jk) _ p.

[0079] When the step of initializing an intermediate result polynomial (step E4) is according to the second implementation example, for any k ranging from 0 to d, the initialization (step E4) of the intermediate result polynomial of index k comprises the initialization of all the coefficients of said intermediate result polynomial of index k. and the calculation of a reference polynomial r as follows: _ Jk), with for all k ranging from 0 to d, the intermediate result polynomial of index k as initialized during the initialization step of the intermediate result polynomial of index k.

[0080] If the answer is yes at the first test step (step E6), the method continues with a second index initialization step (step E10), during which the processor 4 resets the integer k to the value 0.

[0081] The method then comprises a step of initializing w + 1 other intermediate polynomials (step E12) during which the processor 4 initializes w + 1 other intermediate polynomials having respective double indices ranging from k, 0 to k, vv such that for all i ranging from 0 to w with the other polynomial in intermediate having double index k, i.

[0082] Every other intermediate polynomial is a polynomial of the quotient ring K[X]j {Xn-c} •

[0083] The step of initializing w + 1 other intermediate polynomials is typically implemented by the module for initializing w + 1 other intermediate polynomials of the electronic device 2.

[0084] The processor 4 then determines, in a second test step (step E14), whether the integer ka reaches the value d.

[0085] If not, the integer k is incremented by 1 in a second incrementation step (step E16) and the method loops to the initialization step of w + 1 other intermediate polynomials (step E12) to perform a next round.

[0086] During the method, the step of initializing H'+ 1 other intermediate polynomials (step El2) is thus executed for all k ranging from 0 to d. The method thus initializes (¢ / +1) x (w + 1) other intermediate polynomials ... ... ,u^d-wk

[0087] If the answer is yes at the second test step (step E14), the method continues with a third index initialization step (step E18), during which the processor 4 resets an integer j to the value 1.

[0088] The method then comprises a fourth index initialization step (step E20), during which the processor 4 resets the integer k to the value 0.

[0089] The method then comprises a renewal step (step E28) during which the processor 4 renews the ( ¢7 +1) x (w+1) other intermediate polynomials such that for all i ranging from 0 to H', ^kj) remains unchanged.

[0090] During this renewal step (step E28), for any i ranging from 0 to the processor 4 modifies the value of several coefficients among the coefficients of the d + 1 other intermediate polynomials ..., while ensuring that remains unchanged, that is, while ensuring that the sum of the d + 1 other intermediate polynomials ..., u(remains unchanged.

[0091] For any i ranging from 0 to the result of the sum of the d + 1 other intermediate polynomials ..., at the end of the d + 1 initialization steps of H'+ 1 other intermediate polynomials (steps E12), is therefore identical to the result of the sum of the d + 1 other intermediate polynomials at the end of the renewal step vellement (step E28). However, several coefficients among the coefficients of the d + 1 other intermediate polynomials t / W).., have been changed by the renewal step (step E28).

[0092] The method then comprises a polynomial multiplication step (step E22) of index j, i.e. having the integer j as index, during which the processor 4 performs a calculation defined as follows: for all i ranging from 0 to w, l / W = ​​. yü). .

[0093] The polynomial multiplication step is typically implemented by the polynomial multiplication module of the electronic device 2.

[0094] The processor 4 then determines, in a fourth test step (step E24), whether the integer ka reaches the value d.

[0095] If not, the integer k is incremented by 1 in a fourth incrementation step (step E26) and the method loops to the polynomial multiplication step (step E22) to perform a next round.

[0096] During the method, the polynomial multiplication step (step E22) of index j, that is to say having the integer j as index, is thus executed for all k ranging from 0 to d. With the polynomial multiplication steps (step E22) of index j, the method thus calculates for all i ranging from 0 to w and for all k ranging from 0 to d; i / kA = i / kt). ' ■

[0097] If yes in the fourth test step (step E24), the processor 4 then determines, in a third test step (step E30), whether the integer ja reaches the value

[0098] If not, the integer j is incremented by 1 in a third incrementation step (step E32) and the method loops to the fourth index initialization step (step E20) to perform a next round.

[0099] Thus, for any k ranging from 0 to d, the method implements 4 polynomial multiplication steps (step E22) having respective indices ranging from 1 to each polynomial multiplication step performing a calculation defined as follows: for any i ranging from 0 to w, ^kj] — , j having the value of the index of the step concerned.

[0100] Furthermore, the method thus comprises a renewal step between two polynomial multiplication steps having different indices, each renewal step velment renewing the other intermediate polynomials such that for all i going from 0 to w, yf u(kj) remains unchanged.

[0101] For any i ranging from 0 to the result of the sum of the d + 1 other intermediate polynomials ..., at the end of the d + 1 executions of the polynomial multiplication step (step E22) of index j, is therefore identical to the result of the sum of the d + 1 other intermediate polynomials, u(^) at the end of the renewal step (step E28) which follows said d. + 1 executions of the polynomial multiplication step (step E22) of index j. However, several coefficients among the coefficients of the d + 1 other intermediate polynomials ifd),, have been changed by the renewal step (step E28).

[0102] If the answer is yes at the third test step (step E30), the method continues with a fifth index initialization step (step E32), during which the processor 4 resets the integer k to the value 0.

[0103] The method then comprises a step of updating the intermediate result polynomial (step E34) of index k during which the processor 4 updates the intermediate result polynomial of index k by adding to said intermediate result polynomial of index k, the w + 1 other intermediate polynomials having respective double indices ranging from 0 to k, w.

[0104] In other words, processor 4 performs the following calculation: ^k) _ Vw u(k,i)-

[0105] The step of updating the intermediate result polynomial of index k is typically implemented by the module for updating the intermediate result polynomial of index k of the electronic device 2.

[0106] The processor 4 then determines, in a fifth test step (step E36), whether the integer ka reaches the value d.

[0107] If not, the integer k is incremented by 1 in a fifth incrementation step (step E38) and the method loops to the step of updating the intermediate result polynomial (step E34).

[0108] Thus the method implements d + 1 steps of updating the intermediate result polynomial and performs the following calculations: ^k) _ y" j / kJ), for all k ranging from 0 to d.

[0109] If yes at the fifth test step (step E36), the method continues with a step (step E40) of calculating a final result polynomial f.

[0110] When the step of initializing an intermediate result polynomial (step E4) is according to the first implementation example described above for this step, the processor 4 calculates, during the step of calculating a final result polynomial f, the final result polynomial' as follows: f _ yd Jk). 1 ~ ^k=o'

[0111] Thus, when the initialization step of an intermediate result polynomial (step E4) is according to the first implementation example described above for this step, the method comprises after the implementation of the d + 1 steps of updating an intermediate result polynomial (steps E34), a step of calculating a final result polynomial * as follows: . _ y J Jk).

[0112] When the step of initializing an intermediate result polynomial (step E4) is according to the second implementation example described above for this step, the processor 4 calculates, during the step of calculating a final result polynomial, the final result polynomial1 as follows: f _ / y"' Ak} \ _ r.

[0113] Thus, when the step of initializing an intermediate result polynomial (step E4) is according to the second implementation example described above for this step, the method comprises, after the implementation of the d + 1 steps of updating an intermediate result polynomial (steps E34), a step of calculating a final result polynomial ' as follows: t _ ( yrf Ak} \ r.

[0114] The final result polynomial1 has the value / ■ g.

[0115] The final result polynomialz is a polynomial of the quotient ring K [ X ] / ( X" - c ) •

[0116] The step of calculating a final result polynomial? is typically implemented by the module for calculating a polynomial final result of the electronic device 2.

[0117] The method uses an additive masking of the ranks if of the sparse polynomial / . This masking is made possible by the use of the quotient ring K[ X] / (Xn-c) ■

[0118] The method only implements (d + 1) x (q + 1) x ( w + 1 ) X n multiplications in the finite field K.

[0119] The process is thus secure and makes it possible to limit calculation times and the memory space consumed.

[0120] Those skilled in the art will understand that the step of calculating a final result polynomial; may be omitted, for example when the result of the multiplication of the sparse polynomial / by the dense polynomial & must be used in at least one other calculation. Indeed, in this case it may be advantageous to use the d + 1 intermediate result polynomials to perform the other calculation. The d + 1 intermediate result polynomials constitute additive parts of the result of the multiplication of the sparse polynomial / by the dense polynomial S, that is to say a masked form of said result of the multiplication of the sparse polynomial / by the dense polynomial 8- The use of the result of the secure multiplication method between the sparse polynomial f and the dense polynomial S, for the other calculation, is thus secure.

[0121] When the step (step E40) of calculating a final result polynomial1 is omitted, in the affirmative at the fifth test step (step E36), the method ends.

[0122] The renewal step (step E28) can be omitted.

[0123] However, the renewal step (step E28) makes it possible to reinforce the security of the method when da has a value strictly greater than 1. The method is secure against an attacker who could observe up to d intermediate values.

[0124] Each iteration of the renewal step prevents an attacker who could observe up to d intermediate values, from finding the value of a coefficient of the sparse polynomial by combining intermediate values ​​observed during a polynomial multiplication that precedes the relevant iteration of the renewal step and a polynomial multiplication that follows said relevant iteration of the renewal step (typically during the polynomial multiplication of the last iteration of the initialization step of w + 1 other intermediate polynomials and the polynomial multiplication of the first iteration of the polynomial multiplication step, or during the polynomial multiplication of at least one iteration of a polynomial multiplication step of index j and the polynomial multiplication of at least one iteration of a polynomial multiplication step of index j + 1).

[0125] It will also be noted that an iteration (not shown) of the renewal step (step E28) can be implemented after the last iteration of the polynomial multiplication step (i.e. after the last iteration of the polynomial multiplication step of index q in the method described above). The security of the method is thus reinforced, in particular if the d + 1 intermediate result polynomials are used to perform the other calculation.

[0126] Preferably, when d is 1, the method does not include a renewal step.

[0127] Indeed, da has the value 1 when it is considered that an attacker can only observe one intermediate value. In this case, the attacker cannot combine a plurality of intermediate values.

[0128] The absence of a renewal step therefore does not degrade the safety of the process.

[0129] In the absence of a renewal step, the electronic device 2 can put into work together the d + 1 iterations: - initialization of an intermediate result polynomial, - initialization of w + 1 other intermediate polynomials, - implementation of polynomial multiplication steps, and - updating of the intermediate result polynomial, which further limits the memory space consumed.

[0130] The secure multiplication method described with reference to [Fig.2] comprises 5 loops.

[0131] A first loop consists of the initialization step of an intermediate result polynomial (step E4), the first test step (step E6) and the first incrementation step (step E8).

[0132] A second loop consists of the initialization step of w + 1 other intermediate polynomials (step El2), the second test step (step El4) and the second incrementation step (step El6).

[0133] A third loop consists of the fourth index initialization step (step E20), a fourth loop, the renewal step (step E28), the third test step (step E30) and the third incrementation step (step E32).

[0134] The fourth loop consists of the polynomial multiplication step (step E22), the fourth test step (step E24) and the fourth incrementation step (step E26).

[0135] A fifth loop consists of the step of updating the intermediate result polynomial (step E34), the fifth test step (step E36) and the fifth incrementation step (step E38).

[0136] The same integer k is used as the turn index for the first loop, the second loop, the fourth loop and the fifth loop. Those skilled in the art will understand that they can use a different integer as the turn index for each of these loops.

[0137] Furthermore, for each loop, the secure multiplication method described with reference to [Fig.2], executes the turns of the loop concerned with an index which increments at each turn of said loop. Those skilled in the art will understand that the index of a loop can be managed differently as long as all the values ​​of the index are traversed by executing the turns of said loop.

[0138] Typically, regarding the first loop, the method may be adapted to perform the d + 1 iterations of the step of initializing an intermediate result polynomial (step E4) in a different order, each iteration using a different value of the integer k, between 0 and d. For example, the person skilled in the art may initialize the integer k with the value of d in the first index initialization step (step E2), replace the first incrementation step (step E8) with a decrementation step that decrements k by 1, and determine in the first test step (step E6), whether the integer ka reaches the value 0.

[0139] The method can be adapted in a similar manner for each of the other loops.

[0140] [Fig.3] illustrates in the form of a flowchart the main steps of another secure multiplication method according to the invention. This other method implements together the d + 1 iterations: - initialization of an intermediate result polynomial - initialization of w + 1 other intermediate polynomials, - implementation of ? polynomial multiplication steps, and - updating of the intermediate result polynomial, which further limits the memory space consumed.

[0141] Like the method described with reference to Figure 2, the method of Figure 3 aims to implement a secure multiplication between a sparse polynomial / and a dense polynomial 8 in a quotient ring formed by dividing a ring of polynomials with an indeterminate X and coefficients in a finite field K, by the ideal generated by a polynomial Xn -c Qun and c are unnuanced natural integers.

[0142] The dense polynomial 8 is of the form where is a non-zero natural integer and for all k ranging from 0 to d, is an intermediate masking polynomial of index k such that j with for all î ranging from 0 to n - 1, a coefficient of rank i of the intermediate masking polynomial of index k. The sparse polynomial f is of the form ^7" X*' j °ù For all i ranging from 0 to w, is an integer between 0 and n - 1 such that s' = and fSj is a coefficient ^ / =0 i non-zero rank rO , with w a natural integer not zero strictly less than n, a non-zero natural integer, and for all j ranging from 0 to ck an additive part of index j of rank S; and yO a multiplicative part of co efficient fS;.

[0143] The method is implemented in a cryptographic algorithm by an electronic device, typically the electronic device 2 described with reference to [Fig.l].

[0144] The cryptographic algorithm may be an algorithm of a post-quantum public key encryption scheme, for example one of the Hamming Quasi-Cyclic algorithm, the Bit Flipping Key Encapsulation algorithm, and the Number Theory Research Unit algorithm.

[0145] The method thus allows the implementation of these algorithms in a device having limited memory and computing resources, typically in a secure element.

[0146] This method is implemented in the quotient ring. Thus the result of each polynomial operation implemented on one or more polynomials and / or monomials is in the quotient ring.

[0147] This method is implemented here by the electronic device 2 due to the execution of the computer program instructions stored in the storage block 6 as indicated above.

[0148] Preferably, ca for value 1 and for each non-zero coefficient of the sparse polynomial / , at most one multiplicative part of the non-zero coefficient concerned has a value different from 1, or c is a natural integer strictly greater than 1 and for each co non-zero efficient of the sparse polynomial / , at least a multiplicative part of the non-zero coefficient concerned is generated randomly or pseudo-randomly.

[0149] Preferably, when c is 1 and the non-null coefficients of the sparse polynomial f are public, which is the case when the cryptographic algorithm is one of the Hamming Quasi-Cyclic algorithm, the Bit Flipping Key Encapsulation algorithm, and the Number Theory Research Unit algorithm, for each non-zero coefficient of the sparse polynomial f, at most one multiplicative part of the non-zero coefficient concerned has a value other than 1

[0150] The method thus makes it possible to further limit calculation times.

[0151] When c is a natural integer strictly greater than 1, it is preferable that the non-null coefficients of the sparse polynomial f are not public so as not to obtain information on the non-uniformity of the additive maskings. In this case, it is necessary to mask each non-null coefficient of the sparse polynomial, and thus for each non-null coefficient of the sparse polynomial, at least a multiplicative part of the non-null coefficient concerned is generated randomly or pseudo-randomly.

[0152] According to a first index initialization step (step E2), the processor 4 initializes an integer k to the value 0.

[0153] The method then comprises a step of initializing an intermediate result polynomial (step E4) identical to that described with reference to [Fig.2].

[0154] The method then comprises a step of initializing w+ 1 other intermediate polynomials (step E12) identical to that described with reference to FIG. 2, during which the processor 4 initializes w+ 1 other intermediate polynomials having respective double indices ranging from k, 0 to k, w

[0155] The method then comprises a third index initialization step (step E18) identical to that described with reference to [Fig.2].

[0156] The method then comprises a polynomial multiplication step (step E22) of index j identical to that described with reference to [Fig.2].

[0157] The processor 4 then determines, in a third test step (step E30), whether the integer ja reaches the value ¢.

[0158] If not, the integer J is incremented by 1 in a first other incrementation step (step E50) and the method loops to the polynomial multiplication step (step E22) to perform a next round.

[0159] Thus the method implements polynomial multiplication steps (step E22) having respective indices ranging from 1 to each polynomial multiplication step performing a calculation defined as follows: for all i ranging from 0 to w, ^kj) — ^k,i). ^0). , j having the value of the index of the step concerned.

[0160] If yes at the third test step (step E30), the method continues with a step of updating the intermediate result polynomial (step E34) of index k during which the processor 4 updates the intermediate result polynomial of index k by adding to said intermediate result polynomial of index k, the w + 1 other intermediate polynomials having respective double indices ranging from k, 0 to k, w.

[0161] In other words, processor 4 performs the following calculation: ^lc) _ Vw

[0162] The step of updating the intermediate result polynomial of index k is typically implemented by the module for updating the intermediate result polynomial of index k of the electronic device 2.

[0163] The processor 4 then determines, in a fifth test step (step E36), whether the integer ka reaches the value d.

[0164] If not, the integer k is incremented by 1 in a second other incrementation step (step E52) and the method loops to the step of initializing an intermediate result polynomial (step E4) to perform a next round.

[0165] During the method, the step of initializing an intermediate result polynomial (step E4) is thus executed for all k ranging from 0 to d. The method therefore initializes d + 1 intermediate result polynomials _ Each result polynomial is a polynomial of the quotient ring K[ X] / (Xn-c) ■

[0166] Thus, when the step of initializing an intermediate result polynomial (step E4) is according to the first implementation example, for all k ranging from 0 to d, the initialization of the intermediate result polynomial of index k comprises the initialization of all the coefficients of said intermediate result polynomial of index k such that, for all ; ranging from 0 to « -1, yd _ p.

[0167] When the step of initializing an intermediate result polynomial (step E4) is according to the second implementation example, for any k ranging from 0 to d, the initialization (step E4) of the intermediate result polynomial of index k comprises the initialization of all the coefficients of said intermediate result polynomial of index k, and the calculation of a reference polynomial r as follows: _ yd Jk), with for any k ranging from 0 to d, the intermediate result polynomial of index k as initialized during the step of initializing the intermediate result polynomial of index k.

[0168] During the method, the step of initializing w+ 1 other intermediate polynomials (step E12) is also executed for all k ranging from 0 to d. The method thus initializes ( d + 1) X 1) other intermediate polynomials ..., ... ... , id 4”). Each other intermediate polynomial is a polynomial of the quotient ring A[X] / (Xn -c) ■

[0169] Furthermore, each polynomial multiplication step (step E22) of index j, j ranging from 1 to q, is executed for all k ranging from 0 to d. With the multiplication steps po lynomial (step E22) of index j, the method thus calculates for all / ranging from 0 to w and for all k ranging from 0 to d;

[0170] Finally, the method implements d+ 1 steps of updating the intermediate result polynomial (step E34) and performs the following calculations: JA) _ (kî), for all k 1 ^i=Qu ranging from 0 to d.

[0171] If yes at the fifth test step (step E36), the method continues with a step (step E40) of calculating a final result polynomial identical to that described with reference to [Fig.2].

[0172] The method uses an additive masking of the ranks if of the sparse polynomial f. This masking is made possible by the use of the quotient ring K[ X ] / (Xn -c) ■

[0173] The method only implements (d + 1) X (g + 1) x ( w + 1 ) X n multiplications in the finite field K.

[0174] The method is thus secure and makes it possible to limit calculation times and the memory space consumed.

[0175] Those skilled in the art will understand that the step of calculating a final result polynomial f can be omitted, for example when the result of the multiplication of the sparse polynomial f by the dense polynomial S must be used in at least one other calculation. Indeed, in this case it may be advantageous to use the d + 1 intermediate result polynomials to perform the other calculation. The d + \ intermediate result polynomials constitute additive parts of the result of the multiplication of the sparse polynomial f by the dense polynomial 8, that is to say a masked form of said result of the multiplication of the sparse polynomial / by the dense polynomial 8. The use of the result of the secure multiplication method between the sparse polynomial f and the dense polynomial 8, for the other calculation, is thus secure.

[0176] Advantageously, according to a third implementation example, the first iteration of the step of initializing an intermediate result polynomial (step E4) can initialize all the coefficients of the intermediate result polynomial of index k with the value 0, k having the value 0, then each other iteration of the step of initializing an intermediate result polynomial (step E4) can initialize the intermediate result polynomial of index k as follows: / U = k having the value determined by the implementation of the second other incrementation step (step E52) which precedes the iteration concerned of the step of initializing an intermediate result polynomial. In this case, the step (step E40) of calculating a final result polynomial (can be omitted, ^d) having the value f • g.

[0177] When the step (step E40) of calculating a final result polynomial1 is omitted, in the affirmative at the fifth test step (step E36), the method ends.

[0178] A first loop consists of the initialization step of a result polynomial intermediate (step E4), the initialization step of H'+ 1 other intermediate polynomials (step E12), the third index initialization step (step E18), a second loop, the update step of the intermediate result polynomial (step E34), the fifth test step (step E36) and the second other incrementation step (step E52).

[0179] The second loop consists of the polynomial multiplication step (step E22), the third test step (step E30) and the first other incrementation step (step E50).

[0180] For each loop, the secure multiplication method described with reference to [Fig.3], executes the turns of the loop concerned with an index which is incremented at each turn of said loop. Those skilled in the art will understand that the index of a loop can be managed differently as long as all the values ​​of the index are traversed by executing the turns of said loop.

[0181] Typically, regarding the second loop the method can be adapted to do the Q iterations of the polynomial multiplication step (step E22) in a different order, each iteration using a different value of the integer j, between 1 and For example, the person skilled in the art can initialize the integer j with the value of <7 in the third index initialization step (step E18), replace the first other incrementation step (step E50) with another decrementing step which decrements j by 1, and determine in the third test step (step E30), whether the integer ja reaches the value 1.

[0182] The method can be adapted in a similar manner for the first loop.

Claims

1. Claims A method of secure multiplication between a sparse polynomial f and a dense polynomial S in a quotient ring formed by dividing a ring of polynomials with an indeterminate A' and coefficients in a finite field K, by the ideal generated by a polynomial X'! - c where n and c are unnuanced natural integers, - the method being implemented in a cryptographic algorithm by an electronic device (2), - the dense polynomial S being of the form where d is an integer non-zero natural and for all k ranging from 0 to d, gd) is an intermediate masking polynomial of index k such that av“P°ur all i ranging from 0 to n - 1, gk) a coefficient of rank i of the intermediate masking polynomial of index k, - the method being characterized in that the sparse polynomial / is of the form y . x^ j °ù For all i ranging from 0 to H', si is an integer between 0 and n - 1 such that s> = mod IT Ct ^Si is a non-zero coefficient of rank st such that _ | | y < / ), j, avec H? un entier non-zero natural number strictly less than n, (1 a non-zero natural number, and for all j ranging from 0 to ¢, an additive part of index j of the rank si and y. < / )une partie multiplicative du coefficient / ï;, - and in that the method comprises for all k ranging from 0 to d; a. the initialization (E4) of an intermediate result polynomial of index k^ such that ( with for all i ranging from 0 to n - 1, a co efficient of rank i of the intermediate result polynomial of index k; b. the initialization (E12) of w+ 1 other intermediate polynomials having respective double indices ranging from k, 0 to k. H' such that for all i ranging from 0 to ^kj) — . yÇ°). , with the other polynomial in intermediate having double index k, i; c. the implementation of ? polynomial multiplication steps (E22) having respective indices ranging from 1 to *?, each polynomial multiplication step performing a calculation defined as follows: for all i ranging from 0 to w, ^kj) — ^kj). . x^ , j having the value of the index of the step concerned; d. updating (E34) the intermediate result polynomial of index k by adding to said intermediate result polynomial of index k, the w + 1 other intermediate polynomials having respective double indices ranging from k, 0 to k, w.

2. Secure multiplication method according to the preceding claim, the method further comprising a step (E28) of renewal between two polynomial multiplication steps (E22) having different indices, each renewal step (E28) renewing the other intermediate polynomials such that for all » ranging from 0 to w, remains unchanged.

3. Secure multiplication method according to any one of the preceding claims, in which ca for value 1 and for each non-zero coefficient of the sparse polynomial, at most one multiplicative part of the non-zero coefficient concerned has a value other than 1, or in which c is a natural integer strictly greater than 1 and for each non-zero coefficient of the sparse polynomial, at least one multiplicative part of the non-zero coefficient concerned is generated randomly or pseudo-randomly.

4. A secure multiplication method according to any preceding claim, wherein the cryptographic algorithm is an algorithm of a post-quantum public key encryption scheme, for example one of the Hamming Quasi-Cyclic algorithm, the Bit Flipping Key Encapsulation algorithm, and the Number Theory Research Unit algorithm.

5. Secure multiplication method according to any one of the preceding claims, in which for any k ranging from 0 to d, the initialization (E4) of the intermediate result polynomial of index k comprises the initialization of all the coefficients of said intermediate result polynomial of index k such that, for any i ranging from 0 to n -1, v1 ^=o-*-“k=O >

6. Secure multiplication method according to the preceding claim, the method comprising after the implementation of the J + 1 steps (E34) of updating an intermediate result polynomial, a step (E40) of calculating a final result polynomial as follows: t æ) . 1 - ^-7. - <r

7. A secure multiplication method according to any one of the claims- dications 1 to 4, wherein for any k ranging from 0 to d, the initialization (E4) of the intermediate result polynomial of index k comprises the initialization of all the coefficients of said intermediate result polynomial of index k, and the calculation of a reference polynomial} as follows: r _ with for any k ranging from 0 to d, the intermediate result polynomial of index k as initialized during the initialization step of the intermediate result polynomial of index k.

8. Secure multiplication method according to the preceding claim, the method comprising after the implementation of the d + 1 steps (E34) of updating an intermediate result polynomial, a step (E40) of calculating a final result polynomial' as follows: tt(k) \ r. 1 \ ^k^r J '

9. Computer program comprising instructions executable by a processor and adapted to implement a secure multiplication method according to any one of the preceding claims, when these instructions are executed by the processor.

10. Electronic device (2) for secure multiplication between a sparse polynomial f and a dense polynomial S in a quotient ring formed by dividing a ring of polynomials with an indeterminate value X and coefficients in a finite field K, by the ideal generated by a polynomial X" - c °where n and c are non-nuisance natural integers, - the dense polynomial S being of the form ^k) where d is a non-zero natural integer and for all k ranging from 0 to d, is an intermediate masking polynomial of index k such that yA with for all i ranging from 0 to n - 1, a coefficient of rank i of the intermediate masking polynomial of index k, - the electronic device being characterized in that the sparse polynomial / is of the form where for all i ranging from 0 to w, si is an integer between 0 and n -1 such that si = n, and fSi is a non-zero coefficient of rank si such that y _ _ |j| yCO.y#'j, with H a non-zero natural integer strictly less than a non-zero natural integer, and for all j ranging from 0 to an additive part of index j of the rank sr and yOlunc multiplicative part of the coefficient - and in that the electronic device comprises, for all k ranging from 0. to d ; a. an initialization module of an intermediate result polynomial of index k^) configured to initialize the intermediate result polynomial of index k such that y / j with for all i ranging from 0 to n - 1, fd) a coefficient of rank i of the intermediate result polynomial of index k; b. an initialization module of w + 1 other intermediate polynomials configured to initialize w + 1 other intermediate polynomials having respective double indices ranging from k, 0 to k, w such that for all i ranging from 0 to w _ g(k). , with the other polynomial in intermediate having double index k, i; c. a polynomial multiplication module configured to implement polynomial multiplication steps having respective indices ranging from 1 to each polynomial multiplication step performing a calculation defined as follows: for all i ranging from 0 to w, ■> J having the value of the step index concerned; d. an update module of the intermediate result polynomial of index k configured to update the intermediate result polynomial of index k by adding to said intermediate result polynomial of index k, the w + 1 other intermediate polynomials having respective double indices ranging from k, 0 to k, w.

Images