Matrix generation

Abstract

Matrix Generation This description relates to a verification method (203), implemented by an electronic device, for a matrix (M) used to implement a data encryption algorithm (201), comprising, for the generation of said matrix (M), the use of a first function and a second function, said verification method comprising a verification using a final portion of the output data of said first function. Figure for the abstract: Fig. 2

Description

Title of the invention: Generation of a matrix Technical field

[0001] The present description relates generally to electronic systems and devices, and more particularly to the security of these systems and devices. The present description relates, more specifically, to data encryption methods, and to the verification of their implementations. Prior art

[0002] Various techniques for securing secret and / or sensitive data are used nowadays. Data encryption is one of them, and consists of applying one or more cryptographic algorithms to data, such as sensitive data. Many cryptographic algorithms use data matrices and / or polynomials.

[0003] In some cases, these matrices are generated periodically, for example each time a data encryption method is implemented. It may then be necessary to verify the generation of these matrices.

[0004] It would be desirable to be able to improve at least in part certain aspects of the methods of verification and / or error detection in the implementation of data encryption methods. Summary of the invention

[0005] There is a need for data encryption methods employing cryptographic matrices that have been duly verified.

[0006] There is a need for data encryption methods using lattice-based cryptography algorithms employing cryptographic matrices that have been duly verified.

[0007] There is a need for data encryption methods using algorithms known as "Kyber" employing cryptographic matrices that have been duly verified.

[0008] There is a need for data encryption methods using algorithms known as "CRYSTALS-Dilithium" using cryptographic matrices that have been duly verified.

[0009] One embodiment overcomes all or part of the drawbacks of known data encryption methods.

[0010] One embodiment overcomes all or part of the drawbacks of known data signature methods.

[0011] One embodiment overcomes all or part of the drawbacks of the verification methods- fication of a matrix used for a known data encryption process.

[0012] One embodiment overcomes all or part of the drawbacks of the methods for verifying a matrix used for a known data signature method.

[0013] One embodiment provides a method for verifying a matrix used for data signature using data generated during the generation of such a matrix.

[0014] One embodiment provides a method for verifying a matrix used for data signature using intermediate data generated during the generation of such a matrix.

[0015] One embodiment provides a method of verifying, implemented by an electronic device, a matrix used for implementing a data encryption algorithm comprising, for generating said matrix, the use of a first function and a second function, said verification method comprising a verification using a final part of the output data of said first function.

[0016] Another embodiment provides an electronic device adapted to implement a method for verifying a matrix used for implementing a data encryption algorithm comprising, for the generation of said matrix, the use of a first function and a second function, said verification method comprising a verification using a final part of the output data of said first function.

[0017] According to one embodiment, the first function is a pseudo-random data generation function.

[0018] According to one embodiment, the first function comprises a third cryptographic hash function.

[0019] According to one embodiment, the third cryptographic hash function is the Keccak function.

[0020] According to one embodiment, said second function is a function for generating polynomials from pseudo-random data.

[0021] According to one embodiment, the data encryption algorithm is a cryptography algorithm based on Euclidean space networks.

[0022] According to one embodiment, the data encryption algorithm is the algorithm known under the name "Kyber".

[0023] According to one embodiment, said matrix is ​​the matrix A of said algorithm known under the name "Kyber".

[0024] According to one embodiment, said matrix is ​​a context vector of said algorithm known under the name "Kyber".

[0025] According to one embodiment, the data encryption algorithm is the algorithm known as "CRYSTALS-Dilithium".

[0026] Another embodiment provides a data encryption method adapted to implement said data encryption algorithm, comprising the verification method described previously.

[0027] Another embodiment provides a computer program product adapted to implement the verification method described above.

[0028] According to one embodiment, the computer program product is adapted to implement the encryption method described previously. Brief description of the drawings

[0029] These characteristics and advantages, as well as others, will be explained in detail in the following description of particular embodiments given without limitation in relation to the attached figures among which:

[0030] [Fig.l] represents, very schematically and in the form of blocks, an embodiment of an electronic device adapted to implement the embodiments of figures 2 to 4;

[0031] [Fig.2] represents, very schematically and in the form of blocks, a mode of implementation of a data encryption method;

[0032] [Fig. 3] represents an embodiment of a method for generating a matrix of the method of [Fig. 2] and an embodiment of the method for verifying this generation; and

[0033] [Fig.4] represents the implementation of a function of the method of [Fig.3]. Description of the embodiments

[0034] The same elements have been designated by the same references in the different figures. In particular, the structural and / or functional elements common to the different embodiments may have the same references and may have identical structural, dimensional and material properties.

[0035] For the sake of clarity, only the steps and elements useful for understanding the described embodiments have been shown and are detailed.

[0036] Unless otherwise specified, when referring to two elements connected to each other, this means directly connected without intermediate elements other than conductors, and when referring to two elements connected (in English "coupled") to each other, this means that these two elements can be connected or be connected by means of one or more other elements.

[0037] In the following description, when referring to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "upper", "lower", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., it is made reference unless otherwise specified to the orientation of the figures.

[0038] Unless otherwise specified, the expressions "about", "approximately", "substantially", and "of the order of" mean to within 10%, preferably to within 5%.

[0039] The embodiments described below relate to the verification of the implementation of a data encryption method, and more particularly the verification of the correct generation of a matrix used to implement an encryption algorithm used for this data encryption method.

[0040] The matrices used by data encryption algorithms, such as those of cryptography algorithms based on Euclidean space lattices (Lattices-based cryptography), can be matrices of substantial sizes which are difficult to store. It is therefore often decided to generate these matrices at the time of their use. In certain cases, this generation uses one or more pseudo-random data and one or more non-random data, such as, for example, counter data, and it is therefore appropriate to verify that the generated matrix is ​​compliant. The embodiments described below in detail concern the implementation of a verification of a matrix generated by using a function for generating polynomials from pseudo-random data and a function for generating pseudo-random data.The key point of these embodiments is to use a part of the output data of the pseudo-random data generation function to perform this verification.

[0041] These embodiments apply more particularly to matrices of encryption algorithms known under the name "CRYSTALS-Dilithium", or known under the name "Kyber".

[0042] [Fig.l] is a block diagram representing, very schematically, an architecture of an example of an electronic device 100 adapted to execute the mode of implementation of the matrix verification method described below in relation to FIGS. 2 to 4.

[0043] The electronic device 100 comprises a processor 101 (CPU) adapted to implement different processing of data stored in memories and / or provided by other circuits of the device 100. According to one embodiment, the processor 101 is adapted to implement a data encryption method using a verification method according to one embodiment.

[0044] The electronic device 100 further comprises different types of memories 102 (MEM), including, for example, a non-volatile memory, a volatile memory 103, and / or a read-only memory 104. Each memory 102 is adapted to store different types of data.

[0045] The electronic device 100 further comprises, for example, a secure element 103 (SE) adapted to process sensitive and / or secret data. The secure element 103 may include its own processor(s), its own memory(s), etc. According to one embodiment, the secure element 101 is adapted to implement a data encryption method using a verification method according to one embodiment.

[0046] The electronic device 100 may further comprise interface circuits 104 (IO / OUT) adapted to send and / or receive data originating from outside the device 100. The interface circuits 104 may further be adapted to implement a data display, for example, a display screen.

[0047] The electronic device 100 further comprises different circuits 105 (FCT1) and 106 (FCT2) adapted to perform different functions. For example, the circuits 105 and 106 may comprise measurement circuits, data conversion circuits, etc.

[0048] The electronic device 100 further comprises one or more data buses 107 adapted to transfer data between its different components.

[0049] [Fig.2] represents, very schematically and in the form of blocks, a mode of implementation of a data encryption method 200 (CYPHER).

[0050] The data encryption method 200, or encryption method 200, makes it possible to encrypt data, or can make it possible to sign data.

[0051] The encryption method 200 comprises the implementation of a cryptography algorithm 201 (CRYPTO). According to one embodiment, the cryptography algorithm 201 is a cryptography algorithm based on Euclidean space lattices (Lattices-based cryptography), such as, for example, the algorithm known as "Kyber" or the algorithm known as "CRYSTALS-Dilithium". According to a preferred embodiment, the cryptography algorithm 201 is the algorithm known as "Kyber".

[0052] To be implemented, the cryptography algorithm 201 comprises the use of at least one matrix M generated by a matrix generation method 202 (GEN M) also forming part of the encryption method 200. The generation method 201 takes, as input, at least one seed generation data. The generation method may use one or more generation algorithms and one or more generation functions to generate the matrix M. According to a variant, the generation method 202 may be part of the cryptography algorithm 201.

[0053] The encryption method 200 further comprises the implementation of an embodiment of a verification method 203 (CHECKSUM) of the generation of said at least one matrix M, by means of a verification function. For this, the verification method uses CheckSum_Data data provided by the generation function 202. The nature of the CheckSum_Data data is described in relation to FIGS. 3 and 4.

[0054] According to the preferred embodiment, when the cryptography algorithm is the algorithm known under the name "Kyber", the generation method 202 is adapted to provide: - a public matrix A allowing the algorithm to be implemented; and - SecretData vectors representing secret data used by the algorithm.

[0055] The matrix A and the SecretData vectors are all obtained by implementing the generation method 202. Thus, the verification function 203 is adapted to verify the generation of the matrix A and the SecretData vectors. According to a particular example, the SecretData vectors may comprise four vectors s, e, r and e2 representing secret data, and all having a size of the order of 256 coefficients each having a size of 12 bits.

[0056] The encryption method 200 is suitable for being implemented by an electronic device of the type of device 100 described in relation to [Fig.l], such as by its processor 101 or its secure element 103, or by a more complex electronic device such as a computer. The same is true for the algorithm 201, the generation method 202 and the verification method 203. According to one embodiment, the encryption method 200, the algorithm 201, the generation method 202 and the verification method 203 can all be implemented by computer program products.

[0057] [Fig. 3] represents an embodiment of a generation method 300 of the type of method 202 described in relation to [Fig. 2] and an embodiment of a verification method 350 (CHECKSUM) of the type of verification method 203 described in relation to [Fig. 2].

[0058] In the preferred example described above, the cryptography algorithm is the algorithm known as "Kyber", and the matrices to be generated are: - a public matrix A allowing the algorithm to be implemented; and - SecretData vectors representing secret data used by the algorithm.

[0059] The generation method 300 is used to generate one by one the coefficients m[i][j] of a matrix M comprising n rows and p columns, i being an integer between 1 and n, and j being an integer between 1 and p. The matrix M can correspond to the matrix A or to the SecretData vectors, such as the vectors s, e, r and e2 described previously. The generation method 300 makes it possible to implement the following mathematical equation: [Math 1] m[i][j]=ParsdXOF(p, i, j)) in which: - Parse is a function for generating polynomials of known degree from one or more pseudo-random data; - XOF is a function for generating one or more pseudo-random data; and - P is a generation data corresponding to the seed data described in relation to [Fig.2].

[0060] In other words, the generation of the matrix M follows the following steps.

[0061] At a step 301 (P,i,j), the generation data P and index values ​​i and j are provided. According to a particular example, the data P is a 32-byte data item, or 256 bits, and the indices i and j are 1-byte data item, or 8 bits.

[0062] In a step 302 (XOF), following step 301, the XOF function for generating one or more pseudo-random data is applied to the data P, i and j. According to one embodiment, the pseudo-random data provided at the output of the XOF function are of variable size. According to one example, the XOF function is a sponge-type function making it possible to create a hash function. A detailed example of a function of the type of the XOF function is described in relation to [Fig.4]

[0063] In a step 303 (Parse), following step 302, the Parse function for generating polynomials of known degree from pseudo-random is applied to the pseudo-random data provided by the XOF function. Since the pseudo-random data output from the XOF function are of variable size, the Parse function is adapted to take as input a data of variable size to provide as output the polynomial of known degree. There are several functions for implementing the Parse function, two known functions are the Parse and CBD functions. According to one example, the Parse function is an injection selection function.

[0064] The output polynomial of the Parse function forms an element of the matrix. It is then sufficient to repeat steps 301 to 303 as many times as necessary to have the complete matrix M.

[0065] According to one embodiment, the generation of the matrix A, and the generation of the SecretData vectors can each individually use a different Parse function, a different XOF function, and a different generation data P.

[0066] Thus, according to one embodiment, the elements mA[i][j] of the matrix A are obtained by implementing the following mathematical equation: [Math 2] mA [ i ] [ j ] = ParseA(XO FA ( pA, i, j)) in which: - ParseA is a function for generating polynomials of known degree from one or more pseudo-random data; - XOFA is a function for generating one or more pseudorandom data; and - pA is a generation data corresponding to the seed data described in relation with [Fig.2].

[0067] Thus, according to one embodiment, the elements mSD[i][j] of the SecretData vectors are obtained by implementing the following mathematical equation: [Math 3] mSD [ i ] [ j ] = ParseSD(XOF SD ( Seed^pA, i, j) ) ) in which: - ParseSD is a function for generating polynomials of known degree from one or more pseudo-random data; - XOFSD is a function for generating one or more pseudo-random data; -Seed is a function for adapting the generation data pA according to the desired output vector; - pSD is a generation data of the matrix A corresponding to the seed data described in relation to [Fig.2]; - in this case, the index i is a nonce.

[0068] According to one embodiment, the verification method 350 associated with the generation method 300 is as follows. This method 350 implements a Checksum verification function, which is, for example, a verification function by addition or checksum function. The Checksum function makes it possible to verify that the matrix provided by the generation method 300 is compliant. For this, the Checksum function takes, as input data, a part of the output data of the XOF function.

[0069] More particularly, and according to one embodiment, the Checksum function takes as input the last bits of data making up the output data of the XOF function, also called the final part of the output data of the XOF function. These last bits are dependent on all the previous operations, and in particular on the generation data P.

[0070] According to one embodiment, in the preferred case where the encryption algorithm is that known under the name "Kyber", and the generated elements are the SecretData vectors, then the last bits used by the Checksum function are the data bits of the output of the XOF function which are not used by the Parse function.

[0071] [Fig.4] represents a function 400 of the type of the XOF function described in relation to [Fig.3].

[0072] Function 400 is a sponge function for constructing cryptographic hash functions. As described in relation to FIG. 3, function 400 takes as input the data P, i, and j described previously, and provides as output a pseudo-random data Z. To operate, function 400 furthermore receives as input a data to be hashed 401 composed of a data r and a data c. The data r is of the same size as the output data Z. The data ca has a size which depends on the required security level.

[0073] The function comprises two operating phases, a first absorption phase 402 followed by a second spinning phase 403.

[0074] During the absorption phase 402, a function 404 (f) is successively applied to the data 401, while periodically incorporating the data P, i, and j. According to one embodiment, the function 404 is a cryptographic hash function, such as the Keccak function. More particularly, the data r can be obtained using the Seed function described previously, the result of which is provided as input to the function 404. The data r, summed with the data c, is also called "state" in the literature. According to one example, the data P, i, and j are incorporated only into the data r before the application of each function 404 via an EXCLUSIVE OR (XOR) function. According to one embodiment, the function 404 is applied between one and several times during the phase 402.

[0075] During the spin phase 403, the function 404 (f) is applied successively to the data 401. According to one embodiment, the function 404 is applied of the order of 4 times during the phase 403. The output data Z is equal to the combination of the output data of the functions 404 corresponding to the application of the function 404 to the data r, generated by said Seed function.

[0076] Various embodiments and variations have been described. Those skilled in the art will understand that certain features of these various embodiments and variations could be combined, and other variations will occur to those skilled in the art.

[0077] Finally, the practical implementation of the embodiments and variants described is within the reach of those skilled in the art from the functional indications given above.

Claims

Claims

1. A method of verifying (203; 350), implemented by an electronic device (100, 101, 103), a matrix (M; A, e, s) used for implementing a data encryption algorithm (201) comprising, for generating said matrix (M; A, e, s), the use of a first function (XOF) and a second function (Parse), said verification method (350) comprising a verification using a final part of the output data of said first function (XOF).

2. Electronic device (100, 101, 103) adapted to implement a verification method (203; 350) of a matrix (M; A, e, s) used for the implementation of a data encryption algorithm (201) comprising, for the generation of said matrix (M; A, e, s), the use of a first function (XOF) and a second function (Parse), said verification method (350) comprising a verification using a final part of the output data of said first function (XOF).

3. A method according to claim 1, or a device according to claim 2, wherein the first function (XOF) is a pseudo-random data generation function.

4. The method or device of claim 3, wherein the first function (XOF) comprises a third cryptographic hash function (404).

5. The method or device of claim 4, wherein the third cryptographic hash function (404) is the Keccak function.

6. Method according to any one of claims 1, 3 to 5, or device according to any one of claims 2 to 5, wherein said second function (Parse) is a function for generating polynomials from pseudo-random data.

7. A method according to any one of claims 1, 3 to 6, or a device according to any one of claims 2 to 6, wherein the data encryption algorithm (201) is a cryptography algorithm based on Euclidean space lattices.

8. Method or device according to claim 7, in which the data encryption algorithm (201) is the "Kyber" algorithm.

9. A method or device according to claim 8, wherein said matrix (A) is the matrix A of the said "Kyber" algorithm.

10. Method or device according to claim 8, wherein said matrix (s, e) is a context vector of said "Kyber" algorithm.

11. Method or device according to claim 7, wherein the data encryption algorithm (201) is the "CRYSTALS-Dilithium" algorithm.

12. Data encryption method (200) adapted to implement a data encryption algorithm (201), comprising the verification method (203; 350) according to any one of claims 1, 3 to 11

13. 11. Computer program product adapted to the execution of the steps of the verification method (203; 350) according to any one of claims 1, 3 to 11, when said program is executed on a computer.

14. Computer program product adapted to execute the steps of the encryption method (200) according to claim 12, when said program is executed on a computer.

Images