Generation of a uniformly random vector

Abstract

Generation of a uniformly random vector The present description relates to a method for generating, adapted to be executed by an electronic device, a first uniformly random vector (Y) comprising n first elements (y0, …, yn-1), n ​​being an integer equal to or greater than two, comprising the following steps: - generating a second uniformly random vector (A) comprising n second elements (a0, …, an-1); - generating m third elements (r), m being an integer equal to or greater than one; - generating m third uniformly random vectors (B), comprising 1 third element and n-1 second element, and each having third elements (b0, …, bn-1) different from the second elements at the same position in the second uniformly random vector (A) and the other third uniformly random vectors (B);- the calculation of said first elements (y0, …, yn-1) by applying an unmasking function to said second elements and to said m third elements. Figure for the abstract: Fig. 3;

Description

Title of the invention: Generation of a uniformly random vector Technical field

[0001] The present description relates generally to electronic devices and systems and, more particularly, to the security of such devices and systems. The present description relates more particularly to cryptographic methods and their implementation. Prior art

[0002] Nowadays, various techniques are used to authenticate and / or guarantee the integrity of secret and / or sensitive data. Among these, digital signatures consist of the application of one or more cryptographic algorithms to data, such as sensitive data. Many cryptographic algorithms, and, more particularly, many asymmetric cryptographic algorithms, use uniformly random data.

[0003] In some cases, this data is generated periodically, for example each time a data signing process is implemented. It may be necessary to secure the generation of this uniformly random data.

[0004] It is desirable to be able to at least partially improve certain aspects of the generation of uniformly random data. Summary of the invention

[0005] There is a need for a more robust method of generating uniformly random data and, more particularly, a uniformly random vector.

[0006] There is a need for a method of generating uniformly random data and, more particularly, a uniformly random vector, which are secure against single fault injection attacks and multiple fault injection attacks.

[0007] There is a need for an electronic device capable of performing such a generation method.

[0008] One embodiment overcomes all or part of the drawbacks of known methods for generating uniformly random data and, more particularly, of known methods for generating a uniformly random vector.

[0009] One embodiment provides a method for generating uniformly random data and, more particularly, a uniformly random vector.

[0010] One embodiment provides an electronic device capable of performing such a generation method.

[0011] One embodiment provides a method for generating, suitable for execution by an electronic device, a first uniformly random vector comprising n first elements, n being an integer equal to or greater than two, each first element being included in a finite set T, comprising the following steps: - the generation of a second uniformly random vector comprising n second elements; - the generation of m third elements, m being an integer equal to or greater than one; - generating m third uniformly random vectors, ordered from zero to m-1, wherein the third uniformly random vector of rank k, k being an integer between zero and m-1, comprises k third elements and nk second elements, each third uniformly random vector having third elements different from the second elements at the same position as the second uniformly random vector and the other third uniformly random vectors; - calculating said first elements by applying an unmasking function to said second elements and to said m third elements.

[0012] Another embodiment provides an electronic device that can implement a method of generating a first uniformly random vector comprising n first elements, n being an integer equal to or greater than two, each first element being included in a finite set T, comprising the following steps: - the generation of a second uniformly random vector comprising n second elements; - the generation of m third elements, m being an integer equal to or greater than one; - generating m third uniformly random vectors, ordered from zero to m-1, wherein the third uniformly random vector of rank k, k being an integer between zero and m-1, comprises k third elements and nk second elements, each third uniformly random vector having third elements different from the second elements at the same position as the second uniformly random vector and the other third uniformly random vectors; - calculating said first elements by applying an unmasking function to said second elements and to said m third elements.

[0013] According to one embodiment, the step of generating said third uniformly random vector of rank k comprises the following steps: - the use of the first n elements; - the shift of said first n elements by at least k ranks; - the replacement of at least k elements among the first elements by k elements among the third elements.

[0014] According to one embodiment, each first, second and third element is chosen from a finite set.

[0015] According to one embodiment, said first vector is a commitment vector of the Dilithium algorithm.

[0016] Another embodiment provides a method of executing a cryptographic algorithm comprising said generation method described above.

[0017] According to one embodiment, said cryptographic algorithm is a signature method.

[0018] According to one embodiment, said cryptographic algorithm is the Dilithium algorithm. Brief description of the drawings

[0019] These characteristics and advantages, as well as others, will be explained in detail in the following description of particular embodiments given without limitation in relation to the attached figures among which:

[0020] [Fig.l] represents, schematically and in block form, an embodiment of an electronic device configured to execute the methods of Figures 3 and 5;

[0021] [Fig.2] represents, schematically and in the form of blocks, a masking function and an unmasking function;

[0022] [Fig.3] represents, in the form of blocks, an embodiment of a method for generating a uniformly random vector;

[0023] [Fig.4] represents, in block form, a fault injection attack during the embodiment of [Fig.3];

[0024] [Fig.5] represents, in block form, another embodiment of a method for generating a uniformly random vector; and

[0025] [Fig.6] represents, in block form, a fault injection attack during the embodiment of [Fig.5]. Description of the embodiments

[0026] The same elements have been designated by the same references in the different figures. In particular, the structural and / or functional elements common to the different embodiments may have the same references and may have identical structural, dimensional and material properties.

[0027] For the sake of clarity, only the steps and elements useful for understanding the embodiments described have been shown and are detailed. In particular, cryptographic algorithms using the embodiments described below do not are not detailed below. These implementations will be obvious to those skilled in the art based on the following description.

[0028] Unless otherwise specified, when referring to two elements connected to each other, this means directly connected without intermediate elements other than conductors, and when referring to two elements connected (in English "coupled") to each other, this means that these two elements can be connected or be connected by means of one or more other elements.

[0029] In the following description, when reference is made to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "upper", "lower", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., reference is made unless otherwise specified to the orientation of the figures.

[0030] Unless otherwise specified, the expressions "about", "approximately", "substantially", and "of the order of" mean to within 10%, preferably to within 5%.

[0031] The embodiments described above relate to the generation of uniformly random data and, more particularly, to the generation of a uniformly random vector. Such data or vector may be used during the execution of a cryptographic algorithm, such as a signature algorithm. In addition, the embodiments described above relate to a generation method and the electronic device executing it which is resistant to attacks by injection of a single fault or multiple faults.

[0032] However, the embodiments described above are particularly suitable for generating uniformly random vectors that are used by a cryptographic algorithm such as any signature algorithm that is not deterministic, for example the Dilithium algorithm, the ECDSA algorithm or the qTESLA algorithm.

[0033] [Fig.l] represents, very schematically and in the form of blocks, an electronic device 100 which can implement the method of generating a uniformly random vector described in relation to figures 3 to 6.

[0034] The device 100 is an electronic device adapted to process data and, more particularly, to execute an algorithm using uniformly random data and to generate such uniformly random data. For example, the device 100 may execute a cryptographic algorithm.

[0035] The device 100 comprises a processor 101 (CPU) that can process data. According to one example, the device 100 may comprise a plurality of processors, each adapted to process different types of data. According to a particular example, the device 100 may comprise at least one processor that is adapted to execute an algorithm using uniformly random data and for generating such uniformly random data.

[0036] The device 100 further comprises one or more memories 102 (MEM) in which data, for example critical data, is stored. According to one example, the device 100 comprises a plurality of types of memories, such as a ROM, a RAM, a volatile memory and / or a non-volatile memory. According to a particular example, the device 100 may comprise one or more memories that are approved by the processor 101 and that have secure access to the processor 101. According to one embodiment, the device 100 comprises one or more external memories or unapproved memories that do not have secure access to the processor 101.

[0037] The device 100 further comprises one or more secure elements 103 (SE) adapted to process critical and / or secret data. The secure element 103 may comprise its own processor(s), its own memory(s), etc. According to one example, the one or more secure elements 103 may execute an algorithm using uniformly random data and generate uniformly random data.

[0038] The device 100 further and optionally comprises one or more input / output circuits 104 (I / O) allowing the device 100 to transmit and / or receive data and / or energy with one or more external electronic devices.

[0039] The device 100 further comprises one or more circuits 105 (FCT1) and 106 (FCT2) implementing one or more functionalities of the device 100. According to one example, the circuits 105 and 106 may comprise specific data processing circuits, such as signature generation circuits, or circuits for implementing measurements, such as sensors. According to one example, the circuits 105 and 106 may execute an algorithm using uniformly random data and generate uniformly random data.

[0040] The device 100 further comprises one or more communication buses 107 allowing all the circuits of the device 100 to communicate. In [Fig.l], a single bus 107 connecting the processor 101, the memory(ies) 102, the secure element 103 and the circuits 104 to 106 is shown, but, in practice, the device 100 comprises a plurality of communication buses connecting these different elements.

[0041] [Fig.2] comprises two views (A) and (B) each representing, very schematically and in block form, a masking function 201 and an unmasking function 202, respectively.

[0042] The masking function 201 (MASK) takes at least two types of input: data X and 1 masks Mo, ..., Mu, 1 being an integer greater than or equal to one (1), and provides masked data MASK(X, Mo, ..., Mu). The data X, the masks Mo, Mu and the masked data MASK(X, Mo, ..., Mu) are of the same nature, such as a vector comprising the same number of elements. The masking function 201 is designed to provide masked data MASK(X, Mo, ... Mu) which are statistically independent of the data X and which are statistically independent of the masks Mo, ... Mu.

[0043] The unmasking function 202 (UNMASK) takes at least two types of inputs: masked data Z and 1 masks Mo, ... Mu, and provides unmasked data UNMASK(Z, Mo, ... Mu) are of the same nature, such as a vector comprising the same number of elements. The unmasking function 202 is designed so that for fixed masks Mo, ... Mu the composition of the masking and unmasking functions acts as the identity function. In other words, unmasking the masked value (X, Mo, ... Mu) with the masks Mo, ... Mu restores the data X.

[0044] Furthermore, the unmasking function 202 can be used to generate uniformly random data and, in particular, a uniformly random vector. In this description, uniformly random data refers to data obtained by a method selecting an element from the set such that any element has the same probability of being obtained. In addition, a uniformly uniform vector is a vector obtained by a method that independently selects its elements as uniformly random data.

[0045] If the masked data Z and / or the masks Mo, ... Mu have been demonstrated to be uniformly random and are independent of each other, then the unmasked data UNMASK(Z, Mo, ... Mu) are also uniformly random. Thus, choosing 1+1 uniformly random data and applying the unmasking function 202 to them is a way to generate other uniformly random data. This property is used in the embodiments described in relation to Figures 3 to 6.

[0046] The masking mechanism is well known and practical examples of this mechanism are Boolean masking and arithmetic masking. Other types of masking mechanisms are obvious to those skilled in the art.

[0047] [Fig. 3] is a block diagram representing a first embodiment of a method 300 for generating a uniformly random vector Y.

[0048] The uniformly random vector Y comprises n elements y0, ..., yn _ b each element y0, ..., yn _ i coming from a finite set T. n is an integer greater than or equal to two. Thus, the vector Y can be considered as an element of the finite set Tn.

[0049] According to one example, the vector Y may be a commitment vector of the Dilithium algorithm.

[0050] In a first step 301 (Gen A), a uniformly random vector A from the finite set Tn is generated. The vector A comprises n elements ao, ..., an. i . In other words, in step 301, n uniformly random elements a0, ..., an . i from the set T are generated and are used to form the uniformly random vector A. According to one embodiment, the elements a0, ..., an _ i are all independent of each other.

[0051] At a step 302 (Gen r), which follows step 301, another uniformly random element r from the set T is generated. According to one embodiment, the element r is independent of each element a0, ..., an. b

[0052] At a step 303 (Gen B), which follows step 302, a uniformly random vector B from the finite set Tn is constructed using the element r and only n-1 elements from the elements a0, ..., an. b. The vector B comprises n elements b0, ..., bn . b

[0053] The vector B is obtained by shifting the elements a0, ..., an _ i and replacing one of these elements with an element r. According to one embodiment, all the elements common to the vectors A and B have a different place.

[0054] According to a preferred embodiment, the vector B is obtained by shifting the position of the elements a0, ..., an. i by at least one rank, then replacing one of these elements with the element r. According to a practical example, the vector B can be given by the following mathematical formula:

[0055] [Math.l] B=(bQ, ..., b^-ir,

[0056] In this case, the vector B is obtained by shifting the position of the elements a0, ..., an _ i by one rank, then replacing the element an. i by the element r.

[0057] Each element b; of the vector B is independent of the element a; of the vector A.

[0058] In a step 304 (Y=UNMASK(A,B)), which follows step 303, the uniformly random vector Y is generated using the vectors A and B, and the unmasking function 202 described in relation to [Fig.2], in which 1 is equal to one (1). Each element yi of the vector Y is given by the following mathematical formula:

[0059] [Math.2] y.^VNMASK^b^

[0060] The elements a; and b; are independent and uniformly random, so the element y; is also uniformly random. Since the elements y0, ..., yn. i are independent and uniformly random, Y is a uniformly random vector.

[0061] A first advantage of this generation method is that this method is robust against single fault injection attacks. This advantage is described in more detail in relation to [Fig.4].

[0062] A second advantage of this generation method is that it uses the generation of only n+1 uniformly random elements, using the unmasking function 202. A naive solution based on the unmasking function 202 that is robust to a single fault injection would require 2*n uniformly random elements.

[0063] [Fig.4] represents a block diagram illustrating a single fault injection attack during the process of generating [Fig.3].

[0064] A fault injection attack is a class of physical attacks that can be carried out against a device, such as the device 100 of [Fig. 1], in order to modify the way in which the device operates. These types of attacks are primarily used for harmful purposes such as extracting sensitive data. During a single fault injection attack, an individual can modify the value of a piece of data and, more particularly, can modify the value of several bits constituting that piece of data. During a multiple fault injection attack, an individual can modify the value of several pieces of data and, more particularly, can force the value of several bits constituting those several pieces of data.

[0065] With respect to the generation method 300 of [Fig. 3], a single fault injection attack may occur during any step of the method. In other words, a fault 401 (FAULT) may be injected at any step of the method 300.

[0066] Regarding the generation method 300 of [Fig.3], a single fault injection attack can modify the value of the vector A. This means that an element a; of the vector A has been replaced by another element t which is not uniformly random. Thus, the vector A is given by the following mathematical formula:

[0067] [Math.3] A = (a(>

[0068] Such a fault can be injected at any step of the method 300. When this fault is injected before 303, the vector B can optionally be generated using the element t. However, as previously indicated, all the elements that are common to the vectors A and B are in different places. Thus, each element y0, ..., yn. i of the vector Y is given by the result of applying the unmasking function 202 to a uniformly random element and to another independent element that is not necessarily uniformly random. The vector It therefore always includes only uniformly random and independent elements.

[0069] According to the practical example of the preferred embodiment described above, the vector B is given by the following mathematical formula:

[0070] [Math.4] ...,buA)^r, a^ = (r, ...,

[0071] The element t is put in place of the element bi+i of the vector B. The element yi+i is given by the result of applying the unmasking function 202 to the element bi+i = t and the uniformly random element a_(i+l). Thus, the element yi+i is also uniformly random and the attack by injecting a single fault has no exploitable result.

[0072] When a single fault injection attack modifies the value of vector B, this means that the element bj of vector B, i.e. the element r or an element of vector A used to generate vector B has been replaced by the other element t which is not uniformly random.

[0073] According to the practical example of the preferred embodiment described above, the vector B is given by the following mathematical formula:

[0074] [Math.5] ^=(^0 ---^-1)=(^ «O ---««J

[0075] In this case, only vector B is impacted by the fault injection. Vector A is always uniformly random. Thus, vector Y is also uniformly random and the attack by injecting a single fault has no exploitable result.

[0076] Furthermore, a fault could be injected to directly modify the vector Y, for example if it is injected during step 304. However, the person skilled in the art knows that such an attack can be avoided, for example by using any computational operation on the vector Y implemented in a hidden manner using only the vectors A and B.

[0077] [Fig.5] is a block diagram which represents a second embodiment of a method for generating 500 the uniformly random vector Y.

[0078] The generation method 500 is similar to the generation method 300 described in detail in relation to [Fig. 3]. The elements common to the methods 300 and 500 will not be detailed again in the following, only their differences being highlighted.

[0079] As previously indicated, the uniformly random vector Y comprises n elements y0, ..., yn _ i, each element y0, ..., yn _ i coming from the finite element T.

[0080] At an initial step 501 (Gen A), the uniformly random vector A comprising n elements ao, ..., an. i is generated. According to one embodiment, the elements ao, ..., an. i are all independent of each other.

[0081] At an initial step 502 (Gen r0, ..., rm _ i), which follows step 501, m uniformly random elements r0, ..., rm . i from the set T are generated, m is an integer equal to or greater than one (1). According to one embodiment, the elements r0, ..., rm _ i are each independent of each other and of each element of the elements a0, ..., an -1.

[0082] At a step 503 (Gen Bo, ..., Bm J, which follows step 502, m uniformly random vectors Bo, ..., Bm i from the finite set Tn are constructed using the elements r0, ..., rm _ i and the elements a0, ..., an. b Each vector Bk comprises n elements bk>0, ..., bk, n. bk being an integer between zero and m-1.

[0083] More particularly, the uniformly random vector Bk of rank k comprises k elements among the elements r0, ..., rm . i and nk elements among the elements a0, ..., an. i, and each vector Bo, ..., Bm _ i has its elements arranged in a different order. More specifically, at each position, all the elements of the vectors A, Bo, ..., Bm i are different.

[0084] Thus, at each position, the elements of the vectors A, Bo, ..., Bm i are uniformly random and independent of each other.

[0085] According to a preferred embodiment, the vector Bk of rank k is obtained by shifting the position of the elements a0, ..., an. k by at least k ranks, then replacing one of these elements of k elements with the elements r0, ..., rm _ b According to a practical example, the vector Bk can be given by the following mathematical formula:

[0086] [Math.6] ® — ^n-1) “ Ûo- ••'dk-i?

[0087] In this case, the vector Bk is obtained by shifting the position of the elements - a0, ..., an. i by k ranks, and replacing the element an.k to an.i by an element r0, ..., rk _ b

[0088] At a step 504 (Y=UNMASK(A, Bo, ..., Bm 0), which follows step 503, the uniformly random vector Y is generated using vectors A and Bo, ..., Bm . i and the unmasking function 202 described in relation to [Fig.2], in which 1 is equal to m. Thus, each element y; is given by the following mathematical formula:

[0089] [Math.7] yi = UNMASK (ab b04, ..., u)

[0090] The elements ai? bg^, ..., bm.|j are independent of each other and uniformly random, so the element y; is also uniformly random. Since the elements y0, .yn. i are independent and uniformly random, Y is a uniformly random vector.

[0091] [Fig.6] comprises three views (A), (B) and (C) which each represent a block diagram representing a multi-fault injection attack during the generation process 500 of [Fig.5].

[0092] As previously indicated, fault injection attacks are a class of physical attacks that can be carried out against a device. During a multiple fault injection attack, an individual can modify the value of multiple data and, more particularly, can modify the value of multiple bits constituting said multiple data. A fault injection attack is considered in which m faults are injected.

[0093] Regarding the generation method 300, an attack by injection of several faults can modify the value of the vector AA and / or the vector Bo, ..., Bm b

[0094] When a multiple fault injection attack only modifies the value of vector A, this means that m elements a; of vector A have been replaced by m other elements t0, ..., tm_i which are not uniformly random. Such faults can be injected at any step of method 500. When this fault is injected before 503, vectors Bo, ..., Bm. i can possibly be generated using some of the m elements t0, ..., tm_i. However, as previously indicated, all elements that are common to vectors A and Bo, ..., Bm i have a different place. Thus, each element y0, ..., yn. i of vector Y is given by the result of applying unmasking function 202 to a uniformly random element and m other elements that are not necessarily uniform. Thus, vector Y always comprises only uniformly random and independent elements.

[0095] According to a preferred embodiment, when m faults are injected during the generation method 500, at most m elements among r0, ..., rk, a0, ..., an_i of the vectors Bk are modified. At each position, as the (m+1) elements of the vectors A and Bo , ..., Bm i are different and chosen from r0, ..., rk, a0, ..., an.b there must be at least one element which is not modified by the faults and is always uniformly random. Thus, each element y0, ..., yn. i of the vector Y obtained as a result of applying the unmasking function 202 to independent elements of which at least one is uniformly random, is always uniformly random. Therefore, the vector Y that includes only uniformly random elements is always uniformly random.

[0096] When a multiple fault injection attack only modifies the value of the vectors Bo, ..., Bm b this means that the elements bOi, ..., bm H of the vectors Bo, .. Bm . i have been replaced by other elements to, ..., tm_i which are not uniformly random. In this case, only the vectors Bo, ..., Bm i are impacted by the fault injection. The vector A is always uniformly random. Thus, the vector Y is always uniformly random and the multiple fault injection attack has no exploitable result.

[0097] When a multiple fault injection attack directly modifies the value of vector A and the value of vectors Bo, ..., Bm b this means that m elements among the elements a; of vector A and the elements bOi, ..., bm H of vectors Bo, ..., Bm i have been replaced by m other elements t0, ..., tm i which are not uniformly random. However, as previously stated, at each position, since the (m+1) elements of the vectors A, Bo,... Bm i are different and chosen from r0, ..., rk, a0, ..., an b there must be at least one element which is not modified by faults and is always uniformly random. Thus, each element yO, ..., yn-1 of the vector Y obtained as a result of applying the unmasking function 202 to independent elements of which at least one is uniformly random, is always uniformly random. Therefore, the vector Y which comprises only uniformly random elements is always uniformly random.

[0098] Furthermore, faults could be injected to directly modify a vector Y, for example, if it is injected during step 504. However, the person skilled in the art knows that such an attack can be avoided, for example by using any computational operation on the vector Y implemented in a hidden manner using only the vectors A and Bo, ..., Bm b

[0099] Various embodiments and variations have been described. Those skilled in the art will understand that certain features of these various embodiments and variations could be combined, and other variations will occur to those skilled in the art.

[0100] Finally, the practical implementation of the embodiments and variants described is within the reach of those skilled in the art from the functional indications given above.

Claims

Claims

1. A method for generating, adapted to be executed by an electronic device, a first uniformly random vector (Y) comprising n first elements (yO, ..., yn-1), n ​​being an integer equal to or greater than two, each first element being included in a finite set T, comprising the following steps: - generating a second uniformly random vector (A) comprising n second elements (aO, ..., an-1); - generating m third elements (r; rO, ..., rm-1), m being an integer equal to or greater than one; - generating m third uniformly random vectors (B; BO, ..., Bm-1), ordered from zero to m-1, wherein the third uniformly random vector (Bk) of rank k, k being an integer between zero and m-1, comprises k third elements and nk second elements, each third uniformly random vector (B; BO, ..., Bm-1) having third elements (bO, ..., bn-1; biO, ..., bin-1) different from the second elements at the same position in the second uniformly random vector (A) and the other third uniformly random vectors (B; BO, ..., Bm-1); - calculating said first elements (yO, ..., yn-1) by applying an unmasking function to said second elements (aO, ..., an-1) and to said m third elements. (bO, ..., bn-1; biO, ..., bin-1).

2. The method of claim 1, wherein the step of generating said third uniformly random vector (B; Bk) of rank k comprises the following steps: - using the first n elements (aO, ..., an-1); - shifting said first n elements by at least k ranks; - replacing at least k elements among the first elements with k elements (aO, ..., an-1) among the third elements (rO, ..., rm-l).

3. A method according to claim 1 or 2, wherein each first, second and third element is selected from a finite set.

4. A method according to any one of claims 1 to 3, wherein said first vector is a commitment vector of the Dilithium algorithm.

5. A method of executing a cryptographic algorithm comprising said generation method according to any one of claims 1 to 4

6. The method of claim 5, wherein said cryptographic algorithm is a signature method.

7. A method according to claim 5 or 6, wherein said cryptographic algorithm is the Dilithium algorithm.

8. Electronic device adapted to carry out a method for generating a first uniformly random vector (Y) comprising n first elements (yO, ..yn-1), n ​​being an integer equal to or greater than two, each first element being included in a finite set T, comprising the following steps: - generating a second uniformly random vector (A) comprising n second elements (aO, an-1); - generating m third elements (r; rO, ..rm-1), m being an integer equal to or greater than one; - generating m third uniformly random vectors (B; BO, ..Bm-1), ordered from zero to m-1, in which the third uniformly random vector (Bk) of rank k, k being an integer between zero and m-1, comprises k third elements and nk second elements, each third uniformly random vector (B; BO, ..., Bm-1) having third elements (bO, ..., bn-1; biO, ..., bin-1) different from the second elements at the same position in the second uniformly random vector (A) and the other third uniformly random vectors (B; BO, ..., Bm-1); - calculating said first elements (yO, ..., yn-1) by applying an unmasking function to said second elements (aO, ..., an-1) and to said m third elements. (bO, ..., bn-1; biO, ..., bin-1).

9. Device according to claim 8, wherein the step of generating said third uniformly random vector (B; Bk) of rank k comprises the following steps: - using the first n elements (aO, ..., an-1); - shifting said first n elements by at least k ranks; - replacing at least k elements among the first elements by k elements (aO, ..., an-1) among the third elements (rO, ..., rm-l).

10. A device according to claim 8 or 9, wherein each first, second and third element is selected from a finite set.

Images