Zero-secure comparison method, associated electronic device and computer program.

Abstract

A zero-safe comparison method for a masked input data in the form of a first set of n first parts of a modular additive masking, n being an integer strictly greater than 1, and the method comprising the following steps: - Determination (E2) of a second set of intermediate data from the first parts, - Determination (E4) of a third set of third parts of a Boolean masking of the result of the comparison from the intermediate data, the method being characterized in that the second set has a partition into a first subset and a second subset such that a first result obtained by combining zero-exclusive ORs and intermediate data from the first subset is equal to a second result obtained by combining zero-exclusive ORs and intermediate data from the second subset, when and only when the input data is 0. Figure for the abstract: Fig. 2.

Description

Title of the invention: Zero-secure comparison method, associated electronic device and computer program.

[0001] The invention relates to the field of computer cryptography. More particularly, it relates to a zero-secure comparison method. The invention also relates to an associated electronic device and computer program.

[0002] As is known, a cryptographic algorithm can be used to encrypt, decrypt, sign, or verify the signature of data. Such a cryptographic algorithm is, for example, an asymmetric-key cryptographic algorithm implemented by an electronic device, typically an RSA algorithm, or an elliptic curve algorithm implemented by the chip of a smart card.

[0003] The emergence of quantum computers makes these cryptographic algorithms insecure.

[0004] It is therefore desirable to use suitable cryptographic algorithms to guarantee security against an attacker with a quantum computer. These cryptographic algorithms are called post-quantum cryptographic algorithms.

[0005] In cryptographic algorithms, many procedures require testing whether a given variable is equal to zero or not.

[0006] Cryptographic algorithms may require testing one or more data points to verify whether they are equal to zero or not.

[0007] When a zero comparison deals with secret data and the result of the test must remain secret, masking must be used to secure the implementations against side-channel attacks.

[0008] Several methods of comparing to zero of an input data masked in the form of a first set of first parts of a modular additive masking of modulus q exist.

[0009] However, the result of the comparison is generally an unmasked output data which is 1 if the input data has a value of 0, and 0 if the input data has a value other than 0. These processes are therefore vulnerable to side-channel analysis.

[0010] The document “Jean-Sébastien Coron, François Gérard, Simon Montoya, and Rina Zeitoun, High-order polynomial comparison and masking lattice-based encryption. IACR Trans. on Cryptography Hardware And Embedded Systems, DOI: 10.46586, 2023(1):153-192, 2023” describes a zero-comparison method for masked input data in the form of a first set of primes of a additive modular masking of modulus q, the result of said comparison being in masked form.

[0011] However, this process puts a lot of strain on the electronic device. Furthermore, this process is limited to a modulus q which is a prime number.

[0012] To overcome these drawbacks, the present invention proposes, according to a first aspect, a zero-safe comparison method for masked input data in the form of a first set of n first parts of a modular additive masking, n being an integer strictly greater than 1, the method being implemented by an electronic device and comprising the following steps: - Determining a second set of n intermediate data from the first n parts, - Determining a third set of third parts of a Boolean masking of a comparison result from the intermediate data, the method being characterized in that the step of determining a second set of n intermediate data from the first n parts,determines a second set of n intermediate data having a partition into a first subset and a second subset such that a first result obtained by combining with zero-exclusive or operations and the intermediate data of the first subset, is equal to a second result obtained by combining with zero-exclusive or operations and the intermediate data of the second subset, when and only when the input data is 0.

[0013] Other advantageous and non-limiting features of the process according to the invention, taken individually or in all technically possible combinations, are as follows: - the modular additive masking has a non-zero modulus q; - the first result is equal to a sum modulo the modulo q of the first parts of a third subset, and the second result is equal to a sum modulo the modulo q of the opposites of the first parts of a fourth subset; - the third subset and the fourth subset are a partition of the first set; - na for value 2, the intermediate data of the first subset is a first part, and the intermediate data of the second subset is the opposite modulo the modulo q of a first part distinct from the first part of the first subset; - n is strictly greater than 2, the intermediate data of the first subset is a Boolean masking of a partial input data, the first parts of the third subset are a modular additive masking of modulus q of the partial input data, and the intermediate data of the second subset are a boolean masking of another partial input data, the opposites modulo the modulo q of the first parts of the fourth subset being a modular additive masking of modulo q of the other partial input data; - the step of determining a second set of n intermediate data from the first n parts includes the determination of the third subset and the fourth subset, the determination of the intermediate data of the first subset by applying an algorithm for converting a modular additive masking into a boolean masking to the first parts of the third subset, and the determination of the intermediate data of the second subset by applying an algorithm for converting a modular additive masking into a boolean masking to the opposites modulo the modulo q of the first parts of the fourth subset; - the first subset and the second subset have a cardinality difference less than or equal to 1; - the step of determining the third set treats all the intermediate data of the second set as second parts of a boolean masking; - each intermediate data point has a size of k bits and a rank i between 1 and n, k being strictly greater than 1; - each third part has a size of 1 bit and a rank i between 1 and n; - the determination of the third set of third parts includes implementing an initialization of one third part of the third set to 1 and the other third parts of said third set to 0, then updating an intermediate data item of the same rank as the third part initialized to 1, with the 1's complement of said intermediate data item of the same rank, then implementing k sub-steps of updating the third parts of the third set, said sub-steps of updating having respective indices from 0 to k-1, each sub-step performing a calculation defined as follows: A uj - oa / uu W ; : with SecAnd one bh bnl SecAndll, bl? bj, yJ ...,yJ secure implementation of the boolean operator and, yj the bit of rank j of the intermediate data of rank i, bj the third part of rank i, j having the value of the index of the substep concerned; - the secure implementation of the boolean operation and, in the substep at index j, updates third parties such as: A with ® the exclusive OR operation and A the Boolean AND operator; - the process is implemented in a cryptographic algorithm; - the cryptographic algorithm is one of the following algorithms: the Hamming Quasi-Cyclic algorithm, the FrodoKEM algorithm, and the Crystals-Kyber algorithm.

[0014] According to a second aspect, the invention proposes a computer program comprising instructions executable by a processor and adapted to implement a zero-safe comparison method as defined above, when these instructions are executed by the processor.

[0015] This program may use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0016] At least part of the methods according to the invention can be implemented by computer. Consequently, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment (comprising firmware, resident software, microcode, etc.) or an embodiment combining software and hardware aspects which can all be collectively referred to herein as a "block".

[0017] According to a third aspect, the invention provides an electronic device capable of implementing a zero-safe comparison of masked input data in the form of a first set of n first parts of a modular additive masking, n being an integer strictly greater than 1, the electronic device comprising: - a block for determining a second set of n intermediate data, configured to determine a second set of n intermediate data from the first n parts, - a third set of third parts determination block configured to determine a third set of third parts of a boolean masking of a comparison result from the intermediate data, the electronic device being characterized in that the second set of n intermediate data determination block is configured to determine a second set of n intermediate data having a partition into a first subset and a second subset such that a first result obtained by combination with zero-exclusive or operations and the intermediate data of the first subset, is equal to a second result obtained by combination with zero-exclusive or operations and the intermediate data of the second subset, when and only when the input data is 0.

[0018] This electronic device can be configured to implement each of the embodiments envisaged for the secure zero comparison process as defined above.

[0019] Of course, the different features, variants and embodiments of the invention can be combined with each other in various ways insofar as they are not incompatible or mutually exclusive.

[0020] Other features and advantages of the present invention will become apparent from the description given below, with reference to the attached figures which illustrate examples of embodiment without any limiting character.

[0021] In the figures:

[0022] [Fig. 1] schematically represents a preferred embodiment of an electronic device according to the invention;

[0023] [Fig.2] illustrates in the form of a flowchart the main steps of a secure comparison to zero according to a first embodiment of the invention;

[0024] [Fig.3] illustrates in the form of a flowchart the main steps of a secure comparison to zero according to a second embodiment of the invention.

[0025] Unless otherwise indicated, common or similar elements in several figures bear the same reference signs and have identical or similar characteristics, so that these common elements are generally not described again for the sake of simplicity.

[0026] In the context of this description, the qualifiers "first", "second", "third", "fourth" are only indicative to distinguish the elements they qualify, but do not imply any order between them.

[0027] Fig. 1 schematically represents an electronic device 2 comprising a processor 4 (for example a microprocessor), a storage unit 6, a random access memory 8 and a communication unit 10.

[0028] The RAM 8 and the storage entity 6 are each linked to the processor 4 so that the processor 4 can read or write data in the storage entity 6 and / or the RAM 8.

[0029] The memory entity 6 stores computer program instructions, some of which are designed to implement a process as described with reference to one of Figures 2 and 3, when these instructions are executed by the processor 4.

[0030] The storage entity 6 is for example a hard disk or a non-volatile memory, possibly rewritable, for example of the EEPROM type (for "Electrically Erasable and Programmable Read-Only Memory" according to the commonly used Anglo-Saxon term).

[0031] The RAM 8 can store at least some of the elements (first parts, intermediate data and / or third parts as described with reference to at least one of Figures 2 and 3) manipulated during the various processing carried out during one of the processes described below.

[0032] In the following description, memory refers to any one of the storage entity 6 and the random access memory 8.

[0033] The electronic device 2 also comprises several blocks (not shown).

[0034] Typically, the electronic device 2 includes a block for determining a second set of n intermediate data and a block for determining a third set of third parts.

[0035] The electronic device 2 may further include a cryptographic block.

[0036] Each block has a functionality described in one of the methods according to the invention and described below with reference to Figures 2 and 3. Thus, for each block, the electronic device 2 stores, for example, software instructions executable by the processor 4 of the electronic device 2 in order to use a hardware element (for example, a communication entity or a memory) and thus implement the functionality offered by the block.

[0037] According to one possible embodiment, the computer program instructions stored in the storage entity 6 were, for example, received (typically from a remote computer) during an operating phase of the electronic device 2 prior to the processes described with reference to Figures 2 and 3.

[0038] The communication entity 10 is connected to the processor 4 in such a way as to allow the processor 4 to receive data from another electronic device (not shown) and / or to transmit data to another electronic device (not shown). In some embodiments, the processor 4 can thus receive data L from the other electronic device, for example, computer program instructions and / or an input message, and / or transmit an output message. An input message is, for example, a message that the electronic device 2 must sign using a cryptographic key, the signature comprising a zero-secure comparison of data using a method as described with reference to [Fig. 2] or 3. An output message is, for example, the result of said signature.

[0039] The electronic device 2 can take many forms (not shown).

[0040] According to a first example, the electronic device is a smart card, such as an identity card, a bank card or a universal integrated circuit card (also known as a UICC card for "Universal Integrated Circuit Card" in Anglo-Saxon terminology).

[0041] In this case, the communication entity 10 comprises, for example, contacts flush with one side of the smart card. Alternatively, the communication entity 10 could be implemented by a contactless communication block. Generally, the communication entity 10 can be a wired or wireless communication block with another electronic device.

[0042] According to a second example, the electronic device is a secure element, such as a secure microcontroller, which is integrated into another electronic device, typically a communication terminal or a car.

[0043] According to other examples, the electronic device is a USB key, a mobile phone, a personal computer, a server or an identity document, such as an electronic passport.

[0044] As will be seen later, the electronic device 2 is configured to perform a zero-secure comparison of masked input data in the form of a first set of n first parts of a modular additive masking, typically of modulus q. The electronic device 2 can further be configured to implement a cryptographic algorithm comprising at least one zero-secure comparison according to a method of the invention, for example as described with reference to [Fig.2] or [Fig.3].

[0045] Typically, the cryptographic algorithm is implemented by the cryptographic block of the electronic device 2.

[0046] According to an example of modular additive masking, a quantity A is additively masked modulo a module B into n parts if it is given in the form of n quantities Ab ... , An such that the following equation is satisfied: At + An = A mod B. In this example, the quantity A is said to be masked in the form of n parts Ab ... , An of a modular additive masking of module B, and the parts Ab ... , An are said to be a modular additive masking of module B of the quantity A.

[0047] According to an example of Boolean masking, a quantity A is masked in the form of n quantities Ab..., An such that the following equation is satisfied: A = An - A, where © is the exclusive OR operation. In this example, the quantity A is said to be masked in the form of n parts Ab..., An of a Boolean masking, and the parts Ab..., An are said to be a Boolean masking of the quantity A.

[0048] Figure 2 illustrates in flowchart form the main steps of a zero-safe comparison according to a first embodiment of the invention. More specifically, Figure 2 illustrates the main steps of a zero-safe comparison of masked input data in the form of a first set of n first parts of a modular additive masking of modulo 9, where n is an integer strictly greater than 1.

[0049] The modulus q is a non-zero integer. In this embodiment of the invention, the integer na has the value 2.

[0050] Typically, we ax = ( xi + x2) mod q with x the input data, and x2 the first parts of the first set.

[0051] The secure comparison to zero is implemented here by the electronic device 2 due to the execution of the computer program instructions stored in the storage entity 6 as indicated above.

[0052] The method can be implemented in a cryptographic algorithm.

[0053] The method thus allows the implementation of this cryptographic algorithm in a device with limited computing resources, typically in a secure element, a smart card, a USB key or an identity document.

[0054] The cryptographic algorithm may be one of the following algorithms: the Quasi-Cyclic Hamming algorithm, the FrodoKEM algorithm, and the Crystals-Kyber algorithm.

[0055] The method is particularly advantageous for those algorithms which require many safe comparisons with zero.

[0056] According to a step (step E2) of determining a second set of n intermediate data, the processor 4 determines a second set of n intermediate data from the first n parts, the second set of n intermediate data having a partition into a first subset and a second subset such that a first result obtained by combining with operations exclusive of zero and the intermediate data of the first subset, is equal to a second result obtained by combining with operations exclusive of zero and the intermediate data of the second subset, when and only when the input data is 0, that is to say if and only if the input data is 0.

[0057] Typically, processor 4 determines the intermediate data of the first subset as being a first part and the intermediate data of the second subset as being the opposite modulo 4 of a first part distinct from the first part of the first subset, that is, of a first part of the first set, distinct from the first part of the first subset. For example, processor 4 determines an intermediate data of the first subset and an intermediate data Yz of the second subset as follows: y - Xj mod q and y2 = -x2 mod q.

[0058] The first subset and the second subset are such that: - the first result is equal to a sum modulo the modulo q of the first parts of a third subset, and - the second result is equal to a sum modulo the modulus q of the opposites of the first parts of a fourth subset, - the third subset and the fourth subset being a partition of the first set. the first subset is

[0059] In this example, the first set is the second set is 1, the second subset is L 1, the third v2J The subset is |x J, the fourth subset is the first result has the value 0® y = y, the second result has the value 0® y2 = y, the sum modulo the modulo q of the first parts of the third subset has the value x 1 mod q, and the sum modulo the modulo q of the opposites of the first parts of the fourth subset has the value -x2 mod q. Thus, the result of the combination by exclusive OR of the first result and the second result has the value 0 if the input data is 0 and a non-zero value if the input data has a value other than 0.

[0060] Indeed, the equality x = 0 is equivalent to the equality (xj + x2) mod q = 0 because x = (X| + x2) mod q.

[0061] Now, the equality 0 = (x{ + x2) mod q is equivalent to the equality Xj mod q = -x2 mod q, that is to say to the equality 0® y ( = 0® y2 and to the equalities ( mod = g ety ®y = 0- 1 "2

[0062] It should be noted that it is not necessary to calculate the first result or to calculate the second result to determine a second set of n intermediate data having a partition into a first subset and a second subset with one or more of the following characteristics: - the first result obtained by combining operations exclusive of zero and intermediate data from the first subset is equal to a second result obtained by combining operations exclusive of zero and intermediate data from the second subset when and only when the input data is 0, - the first result obtained by combining zero-exclusive OR operations and intermediate data from the first subset is equal to a sum modulo the modulo q of the first parts of the third subset, - the second result obtained by combining with operations exclusive of zero and intermediate data from the second subset, is equal to a sum modulo the modulo q of the opposites of the first parts of the fourth subset.

[0063] The step of determining a second set of n intermediate data (step E2) is typically implemented by the block for determining a second set of n intermediate data of the electronic device 2.

[0064] The process then includes a step (step E4) of determining a third set of third parts of a boolean masking of a result of the comparison from the intermediate data.

[0065] Typically, the third set determination step treats all intermediate data from the second set as second parts of a Boolean masking.

[0066] The determination of the third set of third parts from the intermediate data can be done according to techniques known to a person skilled in the art, for example according to a first technique described in Annexes Cl and C3 of the document “Jean-Sébastien Coron, François Gérard, Simon Montoya, and Rina Zeitoun, High-order polynomial comparison and masking lattice-based encryption. IACR Trans. On Cryptographie Hardware And Embedded Systems, DOI:10.46586, 2023(1):153-192, 2023”.

[0067] In this example, each intermediate data point has a size of k bits and a rank i between 1 and n, k being strictly greater than 1. Each third part has a size of one bit and a rank i between 1 and n.

[0068] The determination of the third set of third parts includes implementing an initialization (substep SE2) of one third part of the third set to 1 and the other third parts of said third set to 0, then updating an intermediate data item (substep SE4) of the same rank as the third part initialized to 1, with the 1's complement of said intermediate data item of the same rank, then implementing k substeps (the k substeps are illustrated as a group bearing the reference SE6) of updating the third parts of the third set, said update substeps having respective indices from 0 to k-1, each substep performing a calculation defined as follows: A s \ - oa A, u W i ; Y) with Sec And one [b], ..., b n J SecAnd^L^b h ..., bn^yJ, . ...yJJ] secure implementation of the boolean operator and, yl the bit of rank j of the intermediate data of rank i, A the third part of rank i, j having the value of the index of the sub-step concerned.

[0069] Furthermore, the secure implementation of the boolean operation and, from the substep at index j, updates third parties such as: (B-1 b- = ( b ) A f vÛ with ® the exclusive or operation and A 1' boolean and.

[0070] The secure implementation of the boolean operation can be carried out according to techniques known to those skilled in the art, for example according to the technique described in Annex Cl of the document "Jean-Sébastien Coron, François Gérard, Simon Montoya, and Rina Zeitoun, High-order polynomial comparison and masking lattice-based encryption. IACR Trans. on Cryptography Hardware And Embedded Systems, DOI:10.46586, 2023(1):153-192, 2023".

[0071] In another example, the determination of the third set of third parties from the intermediate data can be done according to a second technique which is described in Annex C4 of the document “Jean-Sébastien Coron, François Gérard, Simon Montoya, and Rina Zeitoun, High-order polynomial comparison and masking lattice-based encryption. IACR Trans. on Cryptographie Hardware And Embedded Systems, DOI:10.46586, 2023(1):153-192, 2023”.

[0072] The process is therefore particularly advantageous because it does not require any conversion from modular additive masking to boolean masking.

[0073] The method is particularly advantageous because it allows a secure zero comparison of the input data without converting the modular additive masking of the input data into a Boolean masking of said input data.

[0074] The first subset and the second subset have a cardinality difference less than or equal to 1. In other words, the difference between the cardinality of the first subset and the cardinality of the second subset is less than or equal to 1. It will be noted in fact that in this embodiment described with reference to [Fig.2], the cardinality of the first subset is equal to the cardinality of the second subset.

[0075] The step of determining the third set can treat all the intermediate data of the second set as parts of the same boolean masking even though said intermediate data are not.

[0076] This is made possible by the step of determining a second set of n intermediate data as described above because the result of the combination by exclusive or of the first result and the second result, has the value 0 if the input data is 0. and a non-zero value if the input data has a value other than 0.

[0077] In other words, this is permitted by the characteristic of the second set determined during the process, that is to say by the fact that the second set of n intermediate data has a partition into a first subset and a second subset such that a first result obtained by combination with operations exclusive of zero and the intermediate data of the first subset, is equal to a second result obtained by combination with operations exclusive of zero and the intermediate data of the second subset, when and only when the input data is 0, that is to say if and only if the input data is 0.

[0078] The second set determined during the process also has the characteristic that its partition into the first subset and the second subset is such that: - the first result is equal to a sum modulo the modulo q of the first parts of the third subset, and - the second result is equal to a sum modulo the modulo q of the opposites of the first parts of the fourth subset.

[0079] The method is also advantageous because it allows the use of any modulus q, that is to say a modulus q which is not a prime number.

[0080] The step of determining a third set of third parts of a boolean masking of a comparison result (step E4) is typically implemented by the block for determining a third set of third parts of the electronic device 2.

[0081] Figure 3 illustrates in flowchart form the main steps of a zero-safe comparison according to a second embodiment of the invention. More specifically, Figure 3 illustrates the main steps of a zero-safe comparison of masked input data in the form of a first set of n first parts of a modular additive masking of modulo 9, where n is an integer strictly greater than 1.

[0082] The modulus q is a non-zero integer. In this embodiment of the invention, the integer n is strictly greater than 2.

[0083] Typically, we ax = ( Xj + ... + xn) mod q with x the input data, xi,... ,xn the first n parts of the first set.

[0084] The secure comparison to zero is implemented here by the electronic device 2 due to the execution of the computer program instructions stored in the storage entity 6 as indicated above.

[0085] The method can be implemented in a cryptographic algorithm.

[0086] The method thus allows the implementation of this cryptographic algorithm in a device with limited computing resources, typically in a secure element, a smart card, a USB key or an identity document.

[0087] The cryptographic algorithm may be one of the following algorithms: the Hamming Quasi-Cyclic algorithm, the FrodoKEM algorithm, and the Crystals-Kyber algorithm.

[0088] The method is particularly advantageous for those algorithms which require many safe comparisons with zero.

[0089] According to a step (step E12) of determining a second set of n intermediate data, the processor 4 determines a second set of n intermediate data from the first n parts, the second set of n intermediate data having a partition into a first subset and a second subset such that a first result obtained by combining with operations exclusive of zero and the intermediate data of the first subset, is equal to a second result obtained by combining with operations exclusive of zero and the intermediate data of the second subset, when and only when the input data is 0, that is to say if and only if the input data is 0.

[0090] Typically, processor 4 determines: - the intermediate data of the first subset as a Boolean masking of a partial input data, the first parts of a third subset being a modular additive masking of modulus q of the partial input data, and - the intermediate data of the second subset as being a Boolean masking of another partial input data, the opposites modulo the modulo q of the first parts of a fourth subset being a modular additive masking of modulo q of the other partial input data, - the third subset and the fourth subset being a partition of the first set.

[0091] The first subset and the second subset are such that: - the first result is equal to a sum modulo the modulo q of the first parts of a third subset, and - the second result is equal to a sum modulo the modulo q of opposites of the first parts of a fourth subset. For example, the processor 4 determines m intermediate data Yf • • • ' Ym such that y ... ym= (X]+...+xm) mod q and nm intermediate data ym+f •••' Yn such that / \ _ j , m being an integer between 1 and n-1. y, ... y = (-x - ...-x n modq' F Jm+Î v m+1 n / n

[0092] In this example, the first set is x^|, the second set is ( 1, the first subset is f 1, the second sub- set is f ], the third subset is [vv 1, r m+1 ' m the fourth subset is [ xm+1, ..., xn}, the first result has for value 0®v © v = V ©y , the second result has the value J ' J rn J ] ' ' ' J m 0©y ... © y = y ... © y , the sum modulo the modulo q of the first parts of the third subset has the value (x + + xj mod q' ct 'a sum modulo the modulo q of the opposites of the first parts of the fourth subset, has the value (_x _Jmodq-

[0093] According to one implementation, processor 4 can determine the third subset by selecting m first parts of the first set, where m is an integer between 1 and n-1. Processor 4 can then determine the fourth subset by selecting nm first parts of the first set, said nm first parts being distinct from the m parts previously selected to determine the third subset.

[0094] Other implementations are possible to determine the third subset and the fourth subset.

[0095] Thus, according to a first alternative implementation, the processor 4 can determine the third subset and the fourth subset by selecting one or more first part(s) of the first set in turn for the third subset and the fourth subset, the first part selected or the first parts selected at a given turn being distinct from the first part selected or the first parts selected at previous turns.

[0096] According to a second alternative implementation, the processor 4 associates at least a first part of the first set, in a random or pseudo-random manner, with the third subset or the fourth subset.

[0097] After determining the third subset, the processor can then determine the intermediate data of the first subset by applying a conversion algorithm from modular additive masking to boolean masking to the first parts of the third subset.

[0098] After determining the fourth subset, the processor can also determine the intermediate data of the second subset by applying a conversion algorithm from modular additive masking to Boolean masking to the opposites modulo the modulo q of the first parts of the fourth subset. Typically, for the example described above, the processor can determine the intermediate data of the second subset by applying a conversion algorithm from modular additive masking to Boolean masking to -xm+1 mod q, ..., -xn mod q.

[0099] The conversion of a modular additive masking into a boolean masking can be done using a known algorithm, for example as described in the document “Jean-Sébastien Coron, Johann GroBschâdl, and Praveen Kumar Vadnala, Secure conversion between boolean and arithmetic masking of any order. In Proceedings of CHES 2014, pages 188-205, 2014”, or as described in the document “Jean-Sébastien Coron, François Gérard, Simon Montoya, and Rina Zeitoun, High-order table-based conversion algorithms and masking lattice-based encryption. IACR Trans. Cryptogr. Hardw. Embed. Syst., 2022(2):1-40, 2022”.

[0100] Thus, the result of the combination by exclusive or of the first result and the second result, has the value 0 if the input data is 0 and a non-zero value if the input data has a value other than 0.

[0101] Indeed, the equality x - 0 is equivalent to the equality (x1 + ... + xn) mod q = 0 because x= (xf+ ... +xn) mod q.

[0102] Now, the equality 0 = ( x1 + ... + xn) mod q is equivalent to the equality (*i + ... + xm) = -(xm+1+ ... + xn)mod q = (-xm+!- ... -xfl)mod q' that is to say to the equality 0®v V =0®v V and therefore to the equality J1 ' m - m+l "* (y, ... y I® y , ... y )= 0' V 1 ■ m / v m+l - IV

[0103] It should be noted that it is not necessary to calculate the first result or to calculate the second result to determine a second set of n intermediate data having a partition into a first subset and a second subset with one or more of the following characteristics: - the first result obtained by combining operations exclusive of zero and intermediate data from the first subset is equal to a second result obtained by combining operations exclusive of zero and intermediate data from the second subset when and only when the input data is 0, - the first result obtained by combining zero-exclusive OR operations and intermediate data from the first subset is equal to a sum modulo the modulo q of the first parts of the third subset, - the second result obtained by combining with operations exclusive of zero and intermediate data from the second subset is equal to a sum modulo the modulo q of the opposites of the first parts of the fourth subset.

[0104] The step of determining a second set of n intermediate data (step E12) is typically implemented by the block for determining a second set of n intermediate data of the electronic device 2.

[0105] The process then includes a step (step E4) of determining a third set of third parts of a boolean masking of the result of the comparison from the intermediate data, identical to that described with reference to [Fig.2].

[0106] The method is thus advantageous because it allows a zero-safe comparison of the input data without converting the modular additive masking of the input data into a Boolean masking of said input data. On the contrary, the method converts the modular additive masking of modulus q of one partial input data, or of another partial input data, into a Boolean masking of said partial input data, or into a Boolean masking of said other partial input data.

[0107] The partial input data, respectively the other partial input data, is masked in the form of a number of parts strictly less than n. Typically, the partial input data is masked in the form of m parts and the other partial input data is masked in the form of nm parts.

[0108]

[0109]

[0110] [YES]

[0112]

[0113]

[0114]

[0115]

[0116]

[0117]

[0118]

[0119] The mask conversions of the partial input data and the other partial input data are therefore less computationally intensive in the electronic device than a mask conversion of the input data. According to techniques known to those skilled in the art, conversion algorithms from modular additive masking to boolean masking generally have quadratic asymptotic complexity. Typically the complexity of converting modular additive masking of modulo q of the input data into a boolean masking of said input data is C lo°Jq) n2 with C Un coe®c^ent of complexity. The complexity of converting the modular additive masking of modulus q of the partial input data into a Boolean masking of said partial input data is C 1OS (a) ni2 aveC m 'C car^na^ of the first subset and the third sub-•* / together. The complexity of converting modular additive masking of modulo q from the other partial input data in a Boolean masking of said other data partial entry is C -Iog2(q)-p2 with p the cardinality of the second subset and of the fourth subset. On an = m + p and therefore C- log2(q) n2> C -log^q) -m2+ C log2(q) - p2. Preferably, the first subset and the second subset have cardinalities whose difference is less than or equal to 1. In other words, preferably the difference between the cardinality of the first subset and the cardinality of the second subset is less than or equal to 1. Even more advantageously, when n is even, the cardinality of the first subset is equal to the cardinality of the second subset. The computational resource economy of the electronic device is thus optimal. Typically, when m = p, we have C log2(q) -m 2 + C -log2(q) -p 2 = (y) -log2(q) n 2 - With the mask conversion techniques known to the person skilled in the art, the mask conversions of the partial input data and the other partial input data are thus twice as computationally efficient for the electronic device as a mask conversion of the input data. The step of determining the third set can treat all intermediate data from the second set as parts of the same Boolean masking even though said intermediate data are not.

[0120] This is made possible by the step of determining a second set of n intermediate data as described above because the result of the exclusive OR combination of the first result and the second result has a value of 0 if the input data is 0 and a non-zero value if the input data has a value other than 0.

[0121] In other words, this is permitted by the characteristic of the second set determined during the process, that is to say by the fact that the second set of n intermediate data has a partition into a first subset and a second subset such that a first result obtained by combination with zero-exclusive or operations and the intermediate data of the first subset, is equal to a second result obtained by combination with zero-exclusive or operations and the intermediate data of the second subset, when and only when the input data is 0, that is to say if and only if the input data is 0.

[0122] The second set determined during the process also has the characteristic that its partition into the first subset and the second subset is such that: - the first result is equal to a sum modulo the modulo q of the first parts of the third subset, and - the second result is equal to a sum modulo the modulo q of the opposites of the first parts of the fourth subset.

[0123] The method is also advantageous because it allows the use of any modulus q, that is to say a modulus q which is not a prime number.

Claims

Demands

1. A zero-safe method for comparing masked input data in the form of a first set of n first parts of a modular additive masking, n being an integer strictly greater than 1, the method being implemented by an electronic device (2) and the method comprising the following steps: - Determination (E2, E12) of a second set of n intermediate data from the n first parts, - Determination (E4) of a third set of third parts of a Boolean masking of a comparison result from the intermediate data, the method being characterized in that the step of determining a second set of n intermediate data from the n first parts,determines a second set of n intermediate data having a partition into a first subset and a second subset such that a first result obtained by combining with zero-exclusive or operations and the intermediate data of the first subset, is equal to a second result obtained by combining with zero-exclusive or operations and the intermediate data of the second subset, when and only when the input data is 0.

2. A zero-secure comparison method according to the preceding claim wherein: - the modular additive masking has a non-zero modulus q, - the first result is equal to a sum modulo the modulus q of the first parts of a third subset, and - the second result is equal to a sum modulo the modulus q of the opposites of the first parts of a fourth subset, - the third and fourth subsets being a partition of the first set.

3. A zero-safe comparison method according to any one of the preceding claims, wherein: - na has a value of 2, - the intermediate data of the first subset is a first part, and - the intermediate data of the second subset is the opposite modulo the modulo q of a first part distinct from the first part of the first subset.

4. A zero-safe comparison method according to claim 2, wherein: - n is strictly greater than 2, - the intermediate data of the first subset are a Boolean masking of a partial input data, the first parts of the third subset being a modular additive masking of modulo q of the partial input data, and - the intermediate data of the second subset are a Boolean masking of another partial input data, the opposites modulo the modulo q of the first parts of the fourth subset being a modular additive masking of modulo q of the other partial input data.

5. A zero-secure comparison method according to claim 2 or 4, wherein the step of determining a second set of n intermediate data from the first n parts comprises: - determining the third subset and the fourth subset, - determining the intermediate data of the first subset by applying an algorithm for converting modular additive masking into Boolean masking to the first parts of the third subset, and - determining the intermediate data of the second subset by applying an algorithm for converting modular additive masking into Boolean masking to the opposites modulo the modulo q of the first parts of the fourth subset.

6. A zero-safe comparison method according to any one of the preceding claims, wherein the first subset and the second subset have a cardinal difference less than or equal to 1.

7. A zero-secure comparison method according to any one of the preceding claims wherein the third set determination step treats all intermediate data from the second set as second parts of a Boolean mask.

8. A zero-secure comparison method according to any one of the preceding claims, wherein: - each intermediate data point has a size of k bits and a rank i from 1 to n, k being strictly greater than 1, - each third part has a size of 1 bit and a rank i from 1 to n, - the determination of the third set of third parts comprises implementing an initialization (SE2) of a third part of the third set to 1 and of the other third parts of said third set to 0, then updating an intermediate data point (SE4) of the same rank as the third part initialized to 1, with the 1's complement of said intermediate data point of the same rank, then implementing (SE6) k substeps of updating the third parts of the third set, said substeps of updating having respective indices from 0 to k-1,each substep performing a calculation defined as follows: (bh bn) *- SecAnd(l,(b15 b^yJ, ..., y^ )) with SecAnd a safe implementation of the boolean operator and, y' the bit of rank j of the intermediate data of rank i, b; the third part of rank i, j having the value of the index of the substep concerned.,

9. A zero-secure comparison method according to the preceding claim wherein the secure implementation of the boolean operation and, of the substep indexed j, updates third parties such as: ( (J)" jb- ) A j with ® the exclusive or operation and A the boolean operator and.

10. A zero-secure comparison method according to any one of the preceding claims, the method being implemented in a cryptographic algorithm.

11. A zero-secure comparison method according to the preceding claim, wherein the cryptographic algorithm is an algorithm among the Quasi-Cyclic Hamming algorithm, the FrodoKEM algorithm and the Crystals-Kyber algorithm.

12. A computer program comprising instructions executable by a processor and adapted to implement a process according to one any of the preceding claims, when these instructions are executed by the processor.

13. An electronic device (2) capable of implementing a zero-safe comparison of masked input data in the form of a first set of n first parts of a modular additive masking, n being an integer strictly greater than 1, the electronic device comprising: - a block for determining a second set of n intermediate data configured to determine a second set of n intermediate data from the first n parts, - a block for determining a third set of third parts configured to determine a third set of third parts of a Boolean masking of a result of the comparison from the intermediate data,the electronic device being characterized in that the block for determining a second set of n intermediate data is configured to determine a second set of n intermediate data having a partition into a first subset and a second subset such that a first result obtained by combining with zero-exclusive or operations and the intermediate data of the first subset, is equal to a second result obtained by combining with zero-exclusive or operations and the intermediate data of the second subset, when and only when the input data is 0.

Images