A secure, discrete sampling method based on input data, associated electronic device and computer program.

Abstract

A secure sampling method from an input and an array of ordered thresholds, comprising: a) searching (E4) for an interval comprising the input by traversing a perfect binary tree comprising a root node, internal nodes and leaves, - each node having a key equal to another threshold of another array, the other thresholds defining a multiset including another multiset defined by the thresholds, - each leaf being a semi-open interval defined by a distinct pair of other successive thresholds of the other array, - each internal node of the same depth, respectively each leaf, having an increment among two different values ​​for the depth concerned, internal nodes, respectively leaves, attached to the same other node having different increment values,etb) the determination (E6) of a sampling result by accumulating the increments of the internal nodes and the leaf of the tree traversed during the search. Figure for the abstract: Fig. 2.

Description

Title of the invention: Secure discrete sampling method from input data, associated electronic device and computer program.

[0001] The invention relates to the field of computer cryptography. More particularly, it relates to a secure discrete sampling method based on input data and a table of decision thresholds. The invention also relates to an associated electronic device and computer program.

[0002] As is known, a cryptographic algorithm can be used to encrypt, decrypt, sign, or verify the signature of data. Such a cryptographic algorithm is, for example, an asymmetric-key cryptographic algorithm implemented by an electronic device, typically an RSA algorithm, or an elliptic curve algorithm implemented by the chip of a smart card.

[0003] The emergence of quantum computers makes these cryptographic algorithms insecure.

[0004] Cryptographic algorithms adapted to guarantee security against an attacker with a quantum computer can be used. These cryptographic algorithms are called post-quantum cryptographic algorithms.

[0005] In cryptographic algorithms, particularly in post-quantum cryptographic algorithms, many procedures require sampling one or more data points from at least one table of decision thresholds.

[0006] When discrete sampling deals with secret data, masking can be used to secure implementations against side-channel attacks.

[0007] Several discrete sampling methods exist based on input data and a table of decision thresholds.

[0008] The document “François Gérard and Mélissa Rossi. An Efficient and Provable Masked Implementation of qTESLA. Cryptology ePrint Archive, Paper 2019 / 606, 2019” describes, in particular with algorithm 9, a discrete sampling method from a masked input data and a table of decision thresholds for its implementation in a post-quantum cryptographic algorithm qTESLA.

[0009] However, these processes put a lot of strain on the electronic device.

[0010] To overcome these drawbacks, the present invention proposes, according to a first aspect, a secure discrete sampling method based on input data and a first table of ordered first decision thresholds, the method being put implemented by an electronic device, and the process being characterized in that it comprises the following steps: a) Searching for an auxiliary decision interval including the input data, by traversing a perfect binary search tree from a root node to a leaf, the tree comprising the root node, a plurality of internal nodes and a plurality of leaves, - each node having a key equal to a second decision threshold distinct from a second array of ordered second decision thresholds, the second decision thresholds of the second array defining a first multiset of decision elements including a second multiset of decision elements defined by the first decision thresholds of the first array, - the tree having a distinct node for each second decision threshold, - each leaf being an auxiliary semi-open decision interval defined by a distinct pair of successive second decision thresholds from the second table, - each internal node at the same depth having an increment from the same set of two different values ​​associated with the depth concerned, internal nodes attached to the same other node having increments of different values, and - each leaf of the tree having an increment from the same other set of two different values ​​such that leaves attached to the same node have increments of different values, and b) determination of a sampling result by accumulating the increments of the internal nodes and the leaf of the tree traversed during the search.

[0011] The input data can be masked input data or unmasked input data, i.e. in plain text.

[0012] Other advantageous and non-limiting features of the process according to the invention, taken individually or in all technically possible combinations, are as follows: - the first table has a first number of first decision thresholds different from a power of 2; - the second table has a second number of second decision thresholds strictly greater than the first number; - the input data belongs to a finite set of input elements; - the second multiset differs from the first multiset only by at least one multiplicity of a decision element, each decision element of said at least one multiplicity having a value greater than or equal to, or strictly less than, all the input elements of said finite set; - for each node traversed, a boolean result is determined by comparing the input data with the key of the node traversed in question; - the accumulation of increments is by bitwise operations from said boolean results; - for each internal node traversed, the key of the internal node traversed in question is determined by bitwise operations from a boolean result of comparing the input data with the key of another node; - a plurality of keys of the tree is stored in an ordered manner in at least one memory location of the electronic device; - for each internal node traversed, the key of the internal node traversed in question is loaded by masked dichotomy from said at least one memory location of the electronic device; - the process further includes a step of determining an output data by selecting, from the sampling result, an output sample from a third table of output samples; - the process is implemented in a cryptographic algorithm; - the cryptographic algorithm is one of the following algorithms: Hawk, FrodoKEM, Falcon, and qTesla.

[0013] According to a second aspect, the invention proposes a computer program comprising instructions executable by a processor and adapted to implement a secure discrete sampling method as defined above, when these instructions are executed by the processor.

[0014] This program may use any programming language, and be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0015] At least part of the methods according to the invention can be implemented by computer. Consequently, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment (comprising firmware, resident software, microcode, etc.) or an embodiment combining software and hardware aspects which can all be collectively referred to herein as a "block".

[0016] According to a third aspect, the invention provides an electronic device capable of implementing secure discrete sampling from an input data point and a first array of ordered first decision thresholds, the electronic device comprising: - a search block configured to search an auxiliary decision interval comprising the input data, by traversing a binary perfect search tree from a root node to a leaf, the tree comprising the root node, a plurality of internal nodes and a plurality of leaves, each node having a key equal to a second decision threshold distinct from a second array of ordered second decision thresholds, the second decision thresholds of the second array defining a first multiset of decision elements including a second multiset of decision elements defined by the first decision thresholds of the first array, the tree having a distinct node for each second decision threshold, each leaf being a semi-open auxiliary decision interval defined by a distinct pair of successive second thresholds of the second array, each internal node of the same depth having an increment from the same set of two different values ​​associated with the depth concerned, internal nodes attached to the same other node having increments of different values,and each leaf of the tree having an increment among the same other set of two different values ​​such that leaves attached to the same other node have increments of different values, and - a block for determining a sampling result, configured to determine a sampling result by accumulating the increments of the internal nodes and the leaf of the tree traversed during the search.

[0017] This electronic device can be configured to implement each of the embodiment possibilities envisaged for the secure discrete sampling process as defined above.

[0018] Of course, the different features, variants and embodiments of the invention can be combined with each other in various ways insofar as they are not incompatible or mutually exclusive.

[0019] Other features and advantages of the present invention will become apparent from the description given below, with reference to the attached figures which illustrate examples of embodiment without any limiting character.

[0020] In the figures:

[0021] [Fig. 1] schematically represents a preferred embodiment of an electronic device according to the invention;

[0022] [Fig.2] illustrates in the form of a flowchart the main steps of a secure discrete sampling process from an input data according to the invention;

[0023] [Fig.3] illustrates an example of a perfect binary search tree.

[0024] Unless otherwise indicated, common or similar elements in several figures bear the same reference signs and have identical or similar characteristics, so that these common elements are generally not described again for the sake of simplicity.

[0025] In the context of this description, the qualifiers "first", "second" and "third" are only indicative to distinguish the elements they qualify, but do not imply any order between them.

[0026] Fig. 1 schematically represents an electronic device 2 comprising a processor 4 (for example a microprocessor), a storage unit 6, a random access memory 8 and a communication unit 10.

[0027] The RAM 8 and the storage entity 6 are each linked to the processor 4 so that the processor 4 can read or write data in the storage entity 6 and / or the RAM 8.

[0028] The memory entity 6 stores computer program instructions, some of which are designed to implement a process as described with reference to one of Figures 2 and 3, when these instructions are executed by the processor 4.

[0029] The storage entity 6 is for example a hard disk or a non-volatile memory, possibly rewritable, for example of the EEPROM type (for "Electrically Erasable and Programmable Read-Only Memory" according to the commonly used Anglo-Saxon term).

[0030] The RAM 8 can store at least some of the elements (for example an accumulator, a key or several keys, a sampling result, a Boolean result or several Boolean results as described with reference to at least one of Figures 2 and 3) manipulated during the various processing carried out during one of the processes described below.

[0031] In the following description, memory refers to any one of the storage entity 6 and the random access memory 8.

[0032] The electronic device 2 also comprises several blocks (not shown).

[0033] Typically, the electronic device 2 comprises a search block and a determination block.

[0034] The electronic device 2 may further include an initialization block, an output block and / or a cryptographic block.

[0035] Each block has a functionality described in one of the methods according to the invention and described below with reference to Figures 2 and 3. Thus, for each block, the electronic device 2 stores, for example, software instructions executable by the processor 4 of the electronic device 2 in order to use a hardware element (for example, a communication entity or a memory) and thus implement the functionality offered by the block.

[0036] According to one possible embodiment, the computer program instructions stored in the storage entity 6 were, for example, received (typically from a remote computer) during an operating phase of the electronic device 2 prior to the processes described with reference to Figures 2 and 3.

[0037] The communication entity 10 is connected to the processor 4 in such a way as to allow the processor 4 to receive data from another electronic device (not shown) and / or to transmit data to another electronic device (not shown). In some embodiments, the processor 4 can thus receive data L from the other electronic device, for example, computer program instructions and / or an input message, and / or transmit an output message. An input message is, for example, a message that the electronic device 2 must sign using a cryptographic key, the implementation of the signature comprising secure discrete sampling with a method as described with reference to Figures 2 and 3. An output message is, for example, the result of said signature.

[0038] The electronic device 2 can take many forms (not shown).

[0039] According to a first example, the electronic device is a smart card, such as an identity card, a bank card or a universal integrated circuit card (also known as a UICC card for "Universal Integrated Circuit Card" in Anglo-Saxon terminology).

[0040] In this case, the communication entity 10 comprises, for example, contacts flush with one side of the smart card. Alternatively, the communication entity 10 could be implemented by a contactless communication block. Generally, the communication entity 10 can be a wired or wireless communication block with another electronic entity.

[0041] According to a second example, the electronic device is a secure element, such as a secure microcontroller, which is integrated into another electronic device, typically a communication terminal or a car.

[0042] According to other examples, the electronic device is a USB key, a mobile phone, a personal computer, a server or an identity document, such as an electronic passport.

[0043] As will be seen later, the electronic device 2 is configured to perform secure discrete sampling from an input data point and a first array of ordered first decision thresholds. The electronic device 2 can further be configured to implement a cryptographic algorithm comprising at least one secure discrete sampling method according to a method of the invention, for example as described with reference to [Fig. 2] or [Fig. 3].

[0044] Figure 2 illustrates in the form of a flowchart the main steps of a secure discrete sampling process from an input data according to the invention.

[0045] More specifically, the method in [Fig. 2] aims to implement secure discrete sampling from an input data point and a first array of ordered first decision thresholds. Each pair of successive first decision thresholds in said first array defines a semi-open decision interval. The first array has a first number of first decision thresholds.

[0046] A discrete sampling method is an algorithm or method used to generate samples, i.e., sampling results, from a discrete distribution defined by the first decision thresholds of the first table, more precisely by the respective sizes of the semi-open decision intervals defined by the first decision thresholds of the first table. In other words, it allows the creation of discrete output values, the sampling results, that follow said distribution.

[0047] The discrete distribution is, for example, a discrete Gaussian distribution. In this example, the discrete sampling process makes it possible to create values ​​that follow said Gaussian distribution.

[0048] The first decision thresholds in the first table are also called decision levels. These decision levels determine the intervals within which the input data values ​​are mapped to output values. The size of an interval is the difference between its upper and lower bounds.

[0049] Discrete secure sampling is implemented here by the electronic device 2 due to the execution of computer program instructions stored in the storage entity 6 as indicated above.

[0050] The method can be implemented in a cryptographic algorithm.

[0051] The method thus allows the implementation of this cryptographic algorithm in a device with limited computing resources, typically in a secure element, a smart card, a USB key or an identity document.

[0052] The cryptographic algorithm is typically implemented by the cryptographic block of the electronic device 2.

[0053] The cryptographic algorithm may be one of the following algorithms: Hawk, FrodoKEM, Falcon, and qTesla.

[0054] The method is particularly advantageous for the implementation of these algorithms which require many secure discrete samples and makes it possible to strengthen their resistance to side-channel attacks.

[0055] According to an initialization step (step E2), the processor 4 can initialize a sampling result to a predetermined value.

[0056] The initialization step is typically implemented by the initialization block of the electronic device 2.

[0057] The process then includes a step (step E4) of searching for an auxiliary decision interval comprising the input data, during which the processor 4 searches for an auxiliary decision interval comprising the input data, by traversing a perfect binary search tree from a root node to a leaf.

[0058] A binary tree is a data structure that can be represented as a hierarchy in which each component is called a node or leaf.

[0059] The initial component is called the root node. In a binary tree, each component has two child components at the lower level, usually called left and right, or no child components. From the point of view of these child components, the component from which they originate at the higher level is called the parent component.

[0060] At the highest level, level 0, there is the root node. At the level directly below, there are at most two child components. Continuing down to lower levels, there can be four, then eight, sixteen, etc., that is to say, the sequence of powers of two.

[0061] A component having no wires is called a leaf.

[0062] A component distinct from the root node and the leaves is called an internal node.

[0063] Each internal node is a child component attached to another node, a parent component, which is an internal node or the root node. Similarly, each leaf is a child component attached to another node, a parent component, which is an internal node or the root node.

[0064] The level of a component, in other words, the distance between that component and the root node, is called the depth. For example, the root node has a depth of 0, and the internal child nodes of the root node have a depth of 1. The height of the tree is the maximum depth of a component. The height of a perfect binary search tree is the number of levels in the tree, starting from the root node, i.e., level 0, up to the leaves, i.e., the last level. In other words, it is the length of the longest path from the root node to a leaf. A tree reduced to a single component has a height of 0.

[0065] A perfect binary tree is a binary tree in which all leaves are equidistant from the root node (i.e., at the same depth). It is a tree in which all levels are filled: where all nodes have two children and where all leaves have the same depth.

[0066] In a search tree, a key is a value associated with each node of the tree. This key is used to organize and search the leaves.

[0067] A subtree is a tree that is part of another, larger tree.

[0068] An internal node and its descendants define a subtree.

[0069] In a binary search tree, each internal node has a key such that the keys in the left subtree are less than or equal to the key of the internal node concerned and the keys in the right subtree are greater than or equal to the key of said node concerned.

[0070] Searching a binary tree of a leaf is a recursive process. We start by examining the root node. If the input data is less than or equal to If the key of the root node is greater than or equal to the root node's key, then the desired leaf, that is, the auxiliary interval being sought, is in the left subtree, on which the search is then performed recursively. Similarly, if the input data is strictly greater than the key of the root node, the search continues in the right subtree.

[0071] In the step (step E4) of searching for an auxiliary decision interval, the perfect binary search tree comprises a root node, a plurality of internal nodes and a plurality of leaves: - each node having a key equal to a second decision threshold distinct from a second array of ordered second decision thresholds, the second decision thresholds of the second array defining a first multiset of decision elements including a second multiset of decision elements defined by the first decision thresholds of the first array, - the tree having a distinct node for each second decision threshold, - each leaf being an auxiliary semi-open decision interval defined by a distinct pair of successive second decision thresholds from the second table, - each internal node of the same depth has an increment among the same set of two different values ​​associated with the depth concerned, internal nodes attached to the same other node having increments of different values, - each leaf of the tree having an increment among the same other set of two different values ​​such that leaves attached to the same node have increments of different values.

[0072] The second table has a second number of second decision thresholds.

[0073] A multiset is a set in which each element can appear multiple times. In other words, a multiset is a generalization of the notion of a set, an ordinary set being a multiset in which each element appears at most once.

[0074] The multiplicity of a given element is the number of times that said given element appears in a multiset.

[0075] A multiset B includes a multiset A if for each element of the multiset A, the multiplicity of the element concerned in the multiset A is less than or equal to the multiplicity of said element in the multiset B.

[0076] Thus, each second decision threshold is in the first multiset as a decision element. Furthermore, each first decision threshold is in the second multiset as a decision element, the multiplicity of said decision element in the first multiset being less than or equal to its multiplicity in the second subset.

[0077] The use of such a perfect binary search tree allows discrete sampling of the input data, at constant time with uniformity of branch processing, while limiting the number of comparisons implemented.

[0078] As already described, searching for a leaf in a binary tree is a recursive process. We begin by examining the root node. If the input data is less than or equal to the key of the root node, then the leaf being searched for, that is, the auxiliary interval being sought, is in the left subtree, on which the search is then performed recursively. Similarly, if the input data is strictly greater than the key of the root node, the search continues in the right subtree.

[0079] The step of searching for an auxiliary decision interval is typically implemented by the search block of the electronic device 2.

[0080] Figure 3 illustrates an example of a perfect binary search tree.

[0081] In this example, the tree has a root node NI, six internal nodes NI 1,N12,N111,N112,N121,N122, and eight leaves Fl,... .,F8.

[0082] Each node Nv, where v is the node index, has a key cv and an increment iv. For example, the root node Nia has a key cl and an increment il, and the internal node N121 has a key c 121 and an increment i 121.

[0083] Each node of the illustrated tree [Fig.3] has two sons.

[0084] For example, the internal nodes N11 and N12 are the children of the root node NI, plus Specifically, internal node N1 is the left child of root node N1, and internal node N12 is the right child of root node N1. Internal nodes N11 and N12 are children of internal node N1; more precisely, internal node N11 is the left child of internal node N1, and internal node N12 is the right child of internal node N1. Leaves F1 and F2 are child components of internal node N11, with F1 being the left child component of internal node N11 and F2 being the right child component of internal node N1.

[0085] The illustrated tree [Fig.3] includes subtrees.

[0086] For example, the internal nodes NI 1, NI 11 and NI 12, together with the leaves Fl, F2, F3 and F4, define a subtree, the left subtree of the root node NI.

[0087] According to another example, the internal node N122 and the leaves F7 and F8 define another subtree, the right subtree of the internal node N12.

[0088] The tree illustrated [Fig.3] has a height of 3.

[0089] The internal nodes Nil and N12 have the same depth, 1, i.e. level 1. The internal nodes NUI, N112, N121 and N122 have the same depth, 2, i.e. level 2, which is different from the depth of the internal nodes N11 and N12.

[0090] The method of [Fig. 2] also includes a step (step E6) of determining a sampling result, during which the processor 4 determines a result sampling by accumulation of increments of internal nodes and the leaf of the tree traversed during the search.

[0091] The step of determining a sampling result is typically implemented by the determination block of the electronic device 2.

[0092] For the step of searching for an auxiliary decision interval (step E4) and the step of determining a sampling result (step E6), the processor 4 can: - for each node traversed, determine a Boolean result by comparing the input data with the key of the node traversed in question, and - to accumulate the increments by bitwise operations from said Boolean results.

[0093] A bitwise operation is an exclusive OR operation, an OR operation, an AND operation, a two's complement operation, or a bit shift operation. As described later, a bitwise operation can be implemented in a safe form.

[0094] Typically, the processor 4 determines the sampling result as follows: g _ g + ® with ® T exclusive or operation, e the result sampling, n the height of the perfect binary search tree, the bit shift operation, and bt the boolean results, i being the depth of the relevant traversed node and (w_ 1-f) ) ) being the accumulation of increments.

[0095] Preferably, the addition is done after accumulating all the increments.

[0096] This implementation method is particularly suitable when the second table has few second decision thresholds, typically when the second table has fewer than 32 second decision thresholds.

[0097] According to the first implementation mode, during the step of searching for an auxiliary decision interval (step E4) the processor 4 can determine for each internal node traversed, the key of the internal node traversed concerned by bit-by-bit operations from a boolean result of the comparison of the input data with the key of another node.

[0098] The method is thus particularly resistant to side-channel attacks. The method does not require storing all the keys of the internal nodes in at least one memory location of the electronic device, nor loading keys from said at least one memory location. This implementation is particularly suitable when the second table has few second decision thresholds, typically when the second table has fewer than 32 second decision thresholds.

[0099] Typically, processor 4 determines the key of the relevant traversed internal node by combining, with an exclusive or operation, a predetermined key equal to the smallest key of the nodes of the same depth as the relevant traversed internal node, and a gap.

[0100] The gap has the value of the difference for the exclusive or operation, between the predetermined key and the value of the key associated with the internal node traversed concerned.

[0101] When the node being traversed is an internal node whose parent is the root node, the gap can be calculated from a predetermined value and the Boolean result of comparing the input data with the key of the root node, the predetermined value being the difference for the exclusive or operation, between the value of the keys of the two child nodes of the root node.

[0102] Typically, when the node in question is an internal node whose parent is the root node, processor 4 determines the key of said node in question as follows: ( p ■ with P 'a predetermined value, bü the boolean result of the comparison of the input data with the key of the root node and ci»«» the predetermined key, the gap being P • b0, and the boolean result of the comparison of the input data with the key of the root node having the value 0 if the input data is less than or equal to the key of the root node and 1 if the input data is strictly greater than the key of the root node.

[0103] If we use the notation from Figure 3, we have a = min(cn,c12) and P = ^12®

[0104] When the node being traversed is an internal node whose parent is another internal node, the gap can be calculated from several other predetermined values ​​and the Boolean results of comparisons between the input data and the keys of the nodes already traversed.

[0105] The other predetermined values ​​have the value of the difference between key values ​​of nodes of the same depth and which are at the depth of the node being traversed concerned or of a node already traversed.

[0106] For example, using the notation from Figure 3, if the node being traversed is of depth 2, that is, if the node being traversed is an internal node among nodes NI 11, NI 12, N121 and N122, the processor 4 can calculate the key of said node being traversed as follows: the bit operator a bit et, Pu i,i2i, Pu J.112 and ^111,112.121,122 the other predetermined values, bQ the boolean result of comparing the input data with the key of the root node, b the boolean result of comparing the input data with the key of the traversed node of depth 1, and citmn the predetermined key, the boolean result of comparing the input data with the traversed node of depth 1 having the value 0 if the input data is less than or equal to the key of the traversed node of depth 1 and 1 if the input data is greater than the key of the traversed node of depth 1.

[0107] If we use the notation from [Fig.3], we have: Cbnin - min(Cj] C] 12, c121, C122) - H; 'Pi 11,121 C12i® Cil' ' ^111,112 = C 12® Ci 11 5 -^11,112.121,122=^22^ C121®Cli2® Cnr

[0108] Note that ^111,112,121,122 is obtained by combining with the exclusive OR operation the keys of all the nodes which have the same depth as the node being traversed.

[0109] The gap described above is (Pi 11.121 '^0) ® (^r (^111,112^(^0^111.112,121,122)) )'

[0110] The term} 121 ' ^o) Allows obtaining from cimîn ; the smallest key of the child nodes of the internal node traversed of depth 1. [YES] The term ^b^ (p|H h?® (^0 ' / 'i 11 H2 171 122) ) ) Allows obtaining the key of the traversed node concerned from the smallest key of the child nodes of the traversed internal node of depth 1, ^b^- p^^ h 2 121 12? ) Allowing adapting the calculation according to the traversed internal node of depth 1.

[0112] It should be noted that the key of an internal node traversed at depth y can be obtained by combination with the operation or exclusive of a plurality of 2y products, each product of the plurality being the result of the combination with the operation and a key of a distinct node of depth y and, for each node of depth strictly less than y to be traversed to reach said distinct node of depth y, of another Boolean result of the comparison of the input data with the key of said node of depth strictly less than y to be traversed if the distinct node of depth y is in the right subtree of said node of depth strictly less than y to be traversed, or of the 1's complement of the other Boolean result of the comparison of the input data with the key of the node of depth strictly less than y to be traversed if the distinct node of depth y is in the left subtree of said node of depth strictly less than y to be traversed.

[0113] However, this calculation requires the application of numerous operations and.

[0114] To limit the consumption of computing resources of the electronic device, it is preferable to simplify these calculations using the following properties: for any Boolean b and for any integers a and c, b. a — (bd) ®a and (ba) ® (bc) = b- (d®c)-

[0115] Thus, using the notation of Figure 3, when the node being traversed is an internal node whose parent is the root node, the value of the key of the traversed node concerned can be determined as follows: (è0 • ] ) © (è0 • ), Sq • C] j and ' ci2 each being a product.

[0116] The internal node traversed here has a depth of 1. There is only one node of depth strictly less than 1 to traverse, the root node, to reach the node Nil, or respectively, node N12. Each of the nodes Nil and N12 is a distinct node of depth 1. The other Boolean result of comparing the input data with the key of said node of depth strictly less than 1 to be traversed is b0. The one's complement of the other Boolean result of comparing the input data with the key of said node of depth strictly less than 1 to be traversed is £0.^0 ' 1 is the result of combining with the operation and a key of a distinct node of depth y, the key of the node NI 1 and, for each node of depth strictly less than y to be traversed to reach said distinct node of depth y, here the root node, the 1's complement of the other boolean result of comparing the input data with the key of the node of depth strictly less than y to be traversed, è0, the distinct node of depth y, NI 1, being in the left subtree of said node of depth strictly less than y to be traversed, the root node.bQ ■ c12 is the result of combining with the operation and a key of a distinct node of depth y, the key of node N12 and, for each node of depth strictly less than y to be traversed to reach said distinct node of depth y, here the root node, another boolean result of comparing the input data with the key of the node of depth strictly less than y to be traversed, b0, the distinct node of depth y, N12, being in the right subtree of said node of depth strictly less than y to be traversed, the root node. .

[0117] As mentioned, it is preferable to simplify this calculation by using the property mentioned above: (fe0-cI1)®(ft0-c12) = (Z>0-e„) ©en © (*0-c, 2) = (l>0-(en® c12) ) ©c,, = (p b0) ©

[0118] Processor 4 can therefore advantageously determine the key of the relevant traversed node as previously indicated, that is, as follows: (p'b0) © c\nûn

[0119] Similarly, still using the notation of Figure 3, if the relevant traversed node has a depth of 2, that is, if the node is one of the nodes NI 11, N112, N121 and N122, the value of the key of the relevant traversed node can be determined as follows: {h  ' cni) ® (h• b^ cf !2) © (¼) ' • c121) © (bü• bA • c122), b0 • b{ ■ qn, bQ • q 12, à0 • bA • c121 and bQ • bv c122 being each a product.

[0120] The internal node traversed here has a depth of 2. There are two nodes with a depth strictly less than 2 to traverse: the root node NI and a node with a depth of 1 among the nodes N1 and N12. The other Boolean result of the data comparison The input with the key of said root node to be traversed is b0. The one's complement of the other Boolean result of comparing the input data with the key of said root node to be traversed is

[0121] The other Boolean result of comparing the input data with the key of the node of depth 1 to be traversed is b^. The 1's complement of the other Boolean result of comparing the input data with the key of said node of depth 1 to be traversed is b^.

[0122] As already mentioned, it is preferable to simplify this calculation by using the property mentioned above: (Âj ' ci 11) ® (¼) ■ ■ ct 12) ® (¾ ■ 'ci2i ) ® (¼)- ci22) = (b} • ( ( &0-Cnl • ) ® (¼- C121) ) ) ® (^r ( (*0' 12) ® (^0' c122) ) ) = - ((^o-Ci O® ci h® (èo-q2i)))®(^i - ( 12® (*0^122) )) = (£f ((&u- (cm®C121))® Ci]|))®(ftr ((*0- (C12®C122))®C12.)) = (*r ( (c- hni®^)) )® cm) )® (*0- Lm® <j2i) )® cm®(*r ( (Ar ) ©^512) ) - (&J ■ ((by (cj ii®Cii2®C12i®c122) ) ® C111®CI12) ) ® ( b0- [C] ] [®C121) ) ® C111 = (^i ■ ( (^0' (^111,112,121,122) ) ® ^111,112) ) ® O (Pi 11 121 ) ) ® Clmin

[0123] Processor 4 can therefore advantageously determine the key of the relevant traversed internal node as follows: Clwun® (Pi 11,121 ■ ^o) ® (^r (Pu 1,112® (*0 ' Pu 1,112,121,122 ) ) )'

[0124] According to a second implementation mode, a plurality of keys of the tree is stored in an ordered manner in at least one memory location of the electronic device 2. Typically, an array of keys of the nodes of the perfect binary search tree is stored in a location of the memory entity 6 or of the RAM 8. The keys of the nodes of the perfect binary search tree are ordered in the array.

[0125] According to this second embodiment, during the step of searching for an auxiliary decision interval (step E4) the processor 4 can determine the key of the root node by loading said key of the root node from the memory location of the electronic device 2, typically from the key table of the nodes of the binary search perfect tree stored in a location of the storage entity 6 or of the RAM 8.

[0126] According to this second implementation mode, during the step of searching for an auxiliary decision interval (step E4) the processor 4 can determine for each internal node traversed, the key of the internal node traversed concerned by loading said key of the internal node traversed concerned by masked dichotomy from said at least one memory location of the electronic device.

[0127] The processor 4 can perform the hidden binary loading by loading a pair of data from said at least one memory location of the electronic device, the pair of data consisting of the key of the internal node concerned and a dummy key calculated from each key of at least one other internal node of the same depth as the internal node concerned.

[0128] This implementation method is particularly suitable when the second array has many second decision thresholds, typically when the second array has at least 16 second decision thresholds. Loading by masked binary search is then less computationally intensive on the electronic device than bit-by-bit operations, while also improving resistance to side-channel attacks.

[0129] Loading the data pair prevents an attacker via a side channel from knowing which internal node is being traversed, the loading traversing in said at least one memory location of the electronic device, the key of the internal node being traversed and at least one key of another internal node of the same depth.

[0130] In addition, the masked bisection loading only scans in said at least one memory location of the electronic device, keys of nodes having the same depth as the internal node being scanned concerned, that is to say the key of the internal node being scanned concerned and at least one key of another internal node of the same depth.

[0131] Typically, processor 4 initializes the data pair as follows: (d2) = (z, z), di and d2 being the data of the data pair and z being an initialization value.

[0132] The initialization value z can be, for example, 0. According to another example, advantageous for strengthening the security of the process against side-channel attacks, the initialization value is a value determined by the processor 4 by random draw or by pseudo-random draw.

[0133] The processor 4 can then scan the key of the internal node concerned and at least one key of another internal node of the same depth in said at least one memory location of the electronic device and update the data pair as follows: - dj = dj®t when processor 4 scans the key of the internal node concerned in said at least one memory location, t being said key of the internal node concerned; - d2 = d2®t when processor 4 traverses a key of another internal node of the same depth as the internal node being traversed, in said at least one memory location, t being said key of another internal node of the same depth in said at least one memory location.

[0134] When the initialization value z is non-zero or determined by random draw or by pseudo-random draw, the processor 4 can recover the key of the internal node traversed concerned by combining by the exclusive or operation the data di of the data pair and the initialization data z.

[0135] The method can then include a step (E8) of determining an output data, during which the processor 4 determines an output data by selecting from the sampling result determined during the step of determining a sampling result (step E6), an output sample from a third array of output samples.

[0136] Typically, the electronic device stores a third array having the first number of output samples reduced by 1, the output samples of the third array having respective indices from 0 to the first number reduced by 2, and the device selects the output sample having the sampling result as its index.

[0137] The step of determining an output data is typically implemented by the output block of the electronic device 2.

[0138] According to a first example of implementation, the secure discrete sampling method described with reference to [Fig.2] is a Gaussian sampling of a FrodoKEM-1344 algorithm.

[0139] The input data is an integer between 0 and 32767, that is to say that the input data belongs to a finite set of input elements, the input elements being the integers between 0 and 32767.

[0140] In this example, the first table of first decision thresholds is a table having the following first decision thresholds: [-1, 9142, 23462, 30338, 32361, 32725, 32767]. The first table is an ordered table of first decision thresholds, the first decision thresholds being ordered according to their value, here from the smallest value, -1, to the largest value, 32767.

[0141] The second multiset therefore has the following decision elements: -1, 9142, 23462, 30338, 32361, 32725, 32767. Here, each decision element of the second multiset has a multiplicity of 1.

[0142] The second table of second decision thresholds is a table having the following ordered second decision thresholds: [-1, 9142, 23462, 30338, 32361, 32725, 32767, 32767]. The second table is an ordered table of second decision thresholds, the second decision thresholds being ordered according to their value, here also from the smallest value, -1, to the largest value, 32767. The first multiset has the following decision elements: -1, 9142, 23462, 30338, 32361, 32725, 32767, 32767. Here, the decision element 32767 of the first multiset has a multiplicity of 2, and each of the other decision elements of the first multiset has a multiplicity of 1.

[0143] For a Gaussian sampling of a FrodoKEM-1344 algorithm, the output data determination step (step E8) can be omitted. However, to illustrate this step, we will assume here that the output data determination step is implemented, the third output sample array being an array having the following output samples: [sa, sb, sc, sd, se, sf, sg] with sa, sb, sc, sd, se, sf and sg being integers.

[0144] In this first implementation example, the perfect binary search tree is a tree such as illustrated [Fig.3].

[0145] The root node Nia has a key with the value 32361.

[0146] The internal nodes Nil, N12, NUI, NI 12, N121 and N122 have respectively a key with the value: 23462, 32767, 9142, 30338, 32725 and 32767.

[0147] The internal nodes Nil, N12, NUI, NI 12, N121 and N122 have respectively an increment with the value: 0, 4, 0, 2, 0, 2.

[0148] The internal nodes NI 1, N12 therefore have an increment from the same set of two different values, 0 and 4, associated with the depth of said internal nodes NI 1 and N12. The internal nodes N1 and N12 are attached to the same other node, the root node NI. The increments of the internal nodes N1 and N12 have different values.

[0149] Internal nodes NI 11, NI 12, N121, and N122 have an increment from the same set of two different values, 0 and 2, associated with the depth of said internal nodes N11, N12, N121, and N122, internal nodes attached to the same other node having increments of different values. Internal nodes NI 11 and NI 12 are attached to the same other node, internal node NI 1, and have increments of different values, 0 and 2 respectively. Internal nodes N121 and N122 are attached to the same other node, internal node N12, and also have increments of different values, 0 and 2 respectively.

[0150] The leaves of the tree Fl, F2, F3, F4, F5, F6, F7, F8 are each a semi-open auxiliary decision interval defined by a distinct pair of successive second decision thresholds from the second table, respectively: ]-1 ; 9142], ] 9142 ;23462], ]23462 ;30338], ]30338 ;32361], ]32361 ;32725], ]32725 ;32767], ]32767 ; 32767], ] 32767 ; 32767],

[0151] It should be noted that the other decision intervals of leaves F7 and F8 are atypical, but leaves F7 and F8 will never be traversed. Their presence, particularly that of leaf F8, allows the binary search tree to be perfect and to secure the process against side-channel attacks.

[0152] The leaves of the tree Fl, F2, F3, F4, F5, F6, F7, F8 have respectively an increment with the value: 0, 1,0, 1,0, 1,0, 1.

[0153] Each leaf of the tree therefore has an increment from among the same other set of two different values, 0 and 1, such that leaves attached to the same other node have increments of different values. For example, leaves F1 and F2 are attached to the same other node, the internal node NI 11, and have increments of different values, 0 and 1 respectively. According to another example, leaves F5 and F6 are attached to the same other node, the internal node N121, and also have increments of different values, 0 and 1 respectively.

[0154] According to the first implementation mode, for the step of searching for an auxiliary decision interval (step E4) and the step of determining a sampling result (step E6), the processor 4 implements the following calculations.

[0155] Processor 4 obtains the boolean result b^ from the comparison of the input data with the key of the root node such that b0 has the value 0 if the input data is less than or equal to the key of the root node and 1 if the input data is strictly greater than the key of the root node, the key of the root node having the value 32361.

[0156] Processor 4 then determines the key of the internal node traversed after the root node, that is, the key of a child node of the root node, traversed, as follows: = ( 9305 • Z>0) ® 23462, 9305 being the predetermined value p and 23462 being the predetermined key.

[0157] If the input data is less than or equal to the key of the root node, the internal node traversed after the root node is node NI 1 of the tree as illustrated in Figure 3, and the calculated value of ai is 23462, with b0 having a value of 0. The calculated value of °i is indeed the value of the key of the internal node NIL

[0158] If the input data is strictly greater than the key of the root node, the internal node traversed after the root node is the N12 node of the tree as illustrated in Figure 3 and the calculated value of ai is 32767, having a value of 1. The calculated value of ai is indeed the value of the key of the internal node N12.

[0159] Processor 4 then obtains the Boolean result b{ of the comparison of the input data with the key of the traversed node of depth 1 such that bt has the value 0 if the input data is less than or equal to the key of the traversed node of depth 1 and 1 if the input data is strictly greater than the key of the traversed node of depth 1, the key of the traversed node of depth 1 having the value ak

[0160] Processor 4 then determines the key of the internal node traversed after the traversed node of depth 1, that is to say the key of the traversed node of depth 2, as follows: "2 = 9142® (bQ -23651)® • (21812® (&0-21790) ) ), 9142 being the key predetermined, 23651 being the other predetermined value ^111,121, 21812 being the other predetermined value Pi 11,112 and 21790 being the other predetermined value Pi 11,112.121,122.

[0161] If the internal node traversed after the node traversed at depth 1 is the NI 11 node of the tree as illustrated in Figure 3, the calculated value of °2 is indeed 9142, b0 and b} having the value 0.

[0162] If the internal node traversed after the node traversed of depth is the node NI 12, the calculated value of a2 is indeed 30338, b0 and b{ having respectively the value Oet 1.

[0163] If the internal node traversed after the node traversed of depth is the node N121, the calculated value of a2 is indeed 32725, b0 and bY having respectively the values ​​1 and 0.

[0164] Finally, if the internal node traversed after the node traversed of depth 1 is the node N122, the calculated value of a2 is indeed 32767, b0 and b{ having the value 1.

[0165] The processor 4 then obtains the boolean result b2 of the comparison of the input data with the key of the traversed node of depth 2 such that b2 has the value 0 if the input data is less than or equal to the key of the traversed node of depth 2 and 1 if the input data is strictly greater than the key of the traversed node of depth 2, the key of the traversed node of depth 2 having the value a2.

[0166] Processor 4 then determines the sampling result e as follows: e = (b0^2) © (b} 1) ®bT

[0167] According to the second implementation mode, the key array of the nodes of the perfect binary search tree, stored in a location of memory entity 6 or RAM 8, is an array of the following ordered keys: [9142, 23462, 30338, 32361, 32725, 32767, 32767],

[0168] During the initialization step (step E2), the processor 4 initializes the sampling result e and an accumulator h as follows: e = 0 and h■ = 0.

[0169] During the step of searching for an auxiliary decision interval (step E4) the processor 4 determines the key of the root node by loading said key of the root node from the memory location of the electronic device 2, that is to say by loading the key stored in the middle of the table, that is to say by loading the value 32361.

[0170] Processor 4 then obtains the boolean result b0 of the comparison of the input data with the key of the root node, such that b0 has the value 0 if the input data is less than or equal to the key of the root node and 1 if the input data is greater than the key of the root node, the key of the root node having the value 32361.

[0171] During the step of searching for an auxiliary decision interval (step E4) and the step of determining a sampling result (step E6), the processor 4 implements the following calculations.

[0172] Processor 4 accumulates the increment of the node traversed after the root node by updating the accumulator h as follows: hh ® 2 ) •

[0173] Processor 4 then determines the key of the internal node traversed after the root node by loading a pair of data di and d2.

[0174] To do this, processor 4 initializes the data pair as follows: (dp d2 ) = (z, z), z being an initialization value. Processor 4 traverses all the keys of nodes of depth 1 in the ordered key table, namely the second key and the sixth key of said table, i.e. the values ​​23462 and 32767, and processor 4 assigns respectively to the data diet d2 of the pair, the value equal to the key of the internal node traversed after the root node, and the other traversed value.

[0175] If the input data is less than or equal to the key of the root node, the internal node of depth 1 traversed is the NI 1 node of the tree as illustrated in Figure 3 and the data d^t d2 of the pair have respectively the values ​​z© 23462 and z® 32767 •

[0176] If the input data is strictly greater than the key of the root node, the internal node of depth 1 traversed is the N12 node and the data diet d2 of the couple have respectively the values ​​z® 32767 and z® 23462.

[0177] Processor 4 then retrieves the key of the internal node traversed after the root node by combining, using the exclusive OR operation, the data di of the pair and the initialization data z, that is, as follows: z© dp

[0178] Processor 4 then obtains the Boolean result b[ of the comparison of the input data with the key of the traversed node of depth 1 such that has the value 0 if the input data is less than or equal to the key of the traversed node of depth 1 and 1 if the input data is strictly greater than the key of the traversed node of depth 1, the key of the traversed node of depth 1 having the value z® d>

[0179] Processor 4 then accumulates the increment of the traversed depth node 2 and updates the accumulator h as follows: h = À© (< 1 ) •

[0180] Thus, the processor 4 compares the input data to z© d^ and assigns the Boolean result b} the value 0 when the input data is less than or equal to z® di and the value 1 when the input data is strictly greater than z© dr

[0181] The processor 4 then determines the key of the internal node traversed after the traversed node of depth 1, that is to say the key of the traversed node of depth 2, by loading a pair of data di and d2.

[0182] To do this, processor 4 initializes the data pair as follows: (dp d2 ) = ( z, z ), where z is an initial value. The initial value z can have here a different value than that used for loading the key of the traversed node of depth 1. Processor 4 traverses all the keys of depth 2 nodes in the ordered key table, namely the first key, the third key, the fifth key and the seventh key of said table, that is to say the values ​​9142, 30338, 32725 and 32767, and processor 4 assigns respectively to the data diet d2 of the pair, the traversed value equal to the key of the internal depth 2 traversed node, and the other traversed values.

[0183] If the internal depth node traversed is the NI 11 node of the tree as illustrated in Figure 3, the data diet d2 of the couple have respectively the values ​​z® 9142 and z® 30338® 32725® 32767.

[0184] If the internal depth node traversed is the NI 12 node, the d^t d2 data of the couple have respectively the values ​​z® 30338 and z ® 9142® 32725® 32767.

[0185] If the internal depth node 2 traversed is node N121, the data diet d2 of the couple have respectively the values ​​z® 32725 and z® 9142® 30338® 32767.

[0186] Finally, the internal depth 2 node traversed is node N122, the data diet d2 of the couple have respectively the values ​​z® 32767 and z® 9142® 30338® 32725-

[0187] The assignment of the other traversed values ​​is done in this example by combination with the exclusive or operation of the data d2 of the couple and the other traversed value to be assigned.

[0188] Processor 4 then retrieves the key of the internal node traversed after the node traversed at depth 1, by combining, using the exclusive OR operation, the data di of the data pair and the initialization data z, that is, as follows: z® dv

[0189] Processor 4 then obtains the Boolean result b2 of the comparison of the input data with the key of the node traversed at depth 2, such that b2 has the value 0 if the input data is less than or equal to the key of the node traversed at depth 2 and 1 if the input data is strictly greater than the key of the node traversed at depth 2, the key of the node traversed at depth 2 having the value z® dv

[0190] Processor 4 then accumulates the increment of the traversed sheet by updating the accumulator h as follows: h — h® h2-

[0191] Processor 4 determines the sampling result as follows; ee + h.

[0192] According to a first example, when the value of the input data is 11112, the process initializes the sampling result to 0 during the sampling result initialization step, and then traverses the internal nodes Nil, NUI and the leaf F2 during the search step (step E4).

[0193] The process accumulates the increments of the internal nodes and the leaf of the tree traversed, i.e. 0, 0 and 1, and thus obtains 1 as the sampling result.

[0194] The process can then determine the output data, during the output data determination step, as having the value sb by selecting the output sample with index 1 from the third table.

[0195] According to a second example, when the value of the input data is 32767, the process initializes the sampling result to 0 during the sampling result initialization step, and then traverses the internal nodes N12, N121 and the leaf F6 during the search step (step E4).

[0196] The process accumulates the increments of the internal nodes and the leaf of the tree traversed, i.e. 4, 0 and 1, and obtains 5 as a sampling result.

[0197] The process can then determine the output data, during the output data determination step, as having the value sf by selecting the output sample with index 5 from the third table.

[0198] According to a second implementation example, the secure discrete sampling method described with reference to [Fig.2] is again a Gaussian sampling of a FrodoKEM-1344 algorithm and the input data is an integer between 0 and 32767, that is to say that the input data belongs to a finite set of input elements, the input elements being the integers between 0 and 32767.

[0199] In this example, the first array of first decision thresholds is again an array with the following ordered first decision thresholds: [-1, 9142, 23462, 30338, 32361, 32725, 32767]. The first array is an ordered array of first decision thresholds, the first decision thresholds being ordered according to their value, here from the smallest value, -1, to the largest value, 32767. The second multiset has the following decision elements: -1, 9142, 23462, 30338, 32361, 32725, 32767. Here, each decision element of the second multiset has a multiplicity of 1.

[0200] However, the second table of second decision thresholds is a table having the following ordered second decision thresholds: [-1, -1, 9142, 23462, 30338, 32361, 32725, 32767]. The second table is an ordered table of second decision thresholds, the second decision thresholds being ordered according to their value, here from the smallest value, -1, to the largest value, 32767. The first multiset has the following decision elements: -1, -1, 9142, 23462, 30338, 32361, 32725, 32767. Here, the decision element -1 of the first multiset has a multiplicity of 2, and each of the other decision elements of the first multiset has a multiplicity of 1.

[0201] As already mentioned, for Gaussian sampling of a FrodoKEM-1344 algorithm, the step of determining an output data point (step E8) can be omitted. The FrodoKEM-1344 algorithm can directly use the sampling result obtained with the secure discrete sampling method according to the invention. However, to illustrate this step, we will assume here that the determination step of an output data is implemented, the third array of output samples being an array having the following output samples: [sa, sb, sc, sd, se, sf, sg] with sa, sb, sc, sd, se, sf and sg relative integers.

[0202] In this second implementation example, the perfect binary search tree is a tree as illustrated [Fig.3].

[0203] The root node Nia has a key with the value 30338.

[0204] The internal nodes Nil, N12, NUI, NI 12, N121 and N122 have respectively a key with the value: 9142, 32725, -1, 23462, 32361 and 32767.

[0205] As with the first implementation example, the internal nodes NI 1, N12, NUI, Nil2, N121 and NI22 have respectively an increment with the value: 0, 4, 0, 2, 0, 2.

[0206] The leaves of the tree Fl, F2, F3, F4, F5, F6, F7, F8 are each a semi-open auxiliary decision interval defined by a distinct pair of successive second decision thresholds from the second table, respectively: ]-1 ; -1],]-1 ; 9142], ] 9142 ;23462], ]23462 ;30338], ]30338 ;32361], ]32361 ;32725], ]32725 ;32767], ]32767 ; 32767 ].

[0207] It should be noted that the auxiliary decision intervals of leaves Fl and F8 are atypical, but leaves Fl and F8 will never be traversed. Their presence, particularly that of leaf Fl, allows the binary search tree to be perfect and to secure the process against side-channel attacks.

[0208] The leaves of the tree Fl, F2, F3, F4, F5, F6, F7, F8 have respectively an increment with the value: 0, 1,0, 1,0, 1,0, 1.

[0209] In this second example of implementation, the process initializes the sampling result to -1 during the initialization step (step E2).

[0210] For the step of searching for an auxiliary decision interval (step E4) and the step of determining a sampling result (step E6), processor 4 performs the following operations.

[0211] According to the first implementation mode, for the step of searching for an auxiliary decision interval (step E4) and the step of determining a sampling result (step E6), the processor 4 implements the following calculations.

[0212] Processor 4 obtains the boolean result b0 from the comparison of the input data with the key of the root node such that b0 has the value 0 if the input data is less than or equal to the key of the root node and 1 if the input data is strictly greater than the key of the root node, the key of the root node having the value 30338.

[0213] Processor 4 then determines the key of the internal node traversed after the root node, i.e. a child node of the root node, traversed, as follows: "1 = ( 23651 • &0)® 9142,23651 being the predetermined value p and 9142 being the predetermined key.

[0214] If the input data is less than or equal to the key of the root node, the internal node traversed after the root node is the NI 1 node of the tree as illustrated in Figure 3 and the calculated value of is 9142, bQ having a value of 0. The calculated value of ai is indeed the value of the key of the internal node Nil.

[0215] If the input data is strictly greater than the key of the root node, the internal node traversed after the root node is the N12 node of the tree as illustrated in Figure 3 and the calculated value of ai is 32725, b0 having the value 1. The calculated value of ai is indeed the value of the key of the internal node N12.

[0216] Processor 4 then obtains the Boolean result bt from the comparison of the input data with the key of the traversed node of depth 1 such that bt has the value 0 if the input data is less than or equal to the key of the traversed node of depth 1 and 1 if the input data is strictly greater than the key of the traversed node of depth 1, the key of the traversed node of depth 1 having the value ak

[0217] Processor 4 then determines the key of the internal node traversed after the traversed node of depth 1, that is to say the key of the traversed node of depth 2, as follows: «2=-l® (bQ --32362)© (bv (-23463® (b0--23089) )),-1 being the predetermined key, -32362 being the other predetermined value Pi 11,121, -23463 being the other predetermined value P111.112 and -23089 being the other predetermined value P 111,112,121,122.

[0218] It should be noted that, depending on the architecture of processor 4, the other predetermined values ​​may have equivalent positive values. For example, if processor 4 has a 16-bit architecture, the other predetermined value Pi 11,121 may be 33174, the other predetermined value Pu 1,112 may be 42073, and the other predetermined value Piu, 112,121,122 may be 42447.

[0219] The same applies to the predetermined key. For example, if processor 4 has a 16-bit architecture, the predetermined key may be 65535.

[0220] If the internal node traversed after the node traversed at depth 1 is the NI 11 node of the tree as illustrated in Figure 3, the calculated value of a2 is indeed -1, bQ and bi having the value 0.

[0221] If the internal node traversed after the node traversed of depth 1 is the node NI 12, the calculated value of a2 is indeed 23462, #0 and b{ having respectively the value Oet 1.

[0222] If the internal node traversed after the node traversed of depth 1 is the node N121, the calculated value of a2 is indeed 32361, and b^ having respectively the values ​​1 and 0.

[0223] Finally, if the internal node traversed after the node traversed of depth 1 is the node N122, the calculated value of a2 is indeed 32767, b0 and b} having the value 1.

[0224] The processor 4 then obtains the boolean result b2 of the comparison of the input data with the key of the traversed node of depth 2 such that b2 has the value 0 if the input data is less than or equal to the key of the traversed node of depth 2 and 1 if the input data is strictly greater than the key of the traversed node of depth 2, the key of the traversed node of depth 2 having the value a2.

[0225] Processor 4 then determines the sampling result e as follows: e = -1+((^2)0(^1)0^)-

[0226] According to the second implementation mode, the key array of the nodes of the perfect binary search tree, stored in a location of memory entity 6 or RAM 8, is an array of the following ordered keys: [-1, 9142, 23462, 30338, 32361, 32725, 32767],

[0227] During the initialization step (step E2), the processor 4 initializes the sampling result e and an accumulator as follows: e = -1 and h = 0, h being the accumulator.

[0228] During the step of searching for an auxiliary decision interval (step E4) the processor 4 determines the key of the root node by loading said key of the root node from the memory location of the electronic device 2, i.e. by loading the key stored in the middle of the table, i.e. by loading the value 30338.

[0229] Processor 4 then obtains the boolean result b0 of the comparison of the input data with the key of the root node, such that b0 has the value 0 if the input data is less than or equal to the key of the root node and 1 if the input data is strictly greater than the key of the root node, the key of the root node having the value 30338.

[0230] During the step of searching for an auxiliary decision interval (step E4) and the step of determining a sampling result (step E6), the processor 4 implements the following calculations.

[0231] Processor 4 accumulates the increment of the node traversed after the root node by updating the accumulator h as follows: h - h 0 ( bQ •< 2) •

[0232] Processor 4 then determines the key of the internal node traversed after the root node by loading a pair of data di and d2.

[0233] To do this, processor 4 initializes the data pair as follows: (dl,d2) = (z, z), where z is an initialization value. Processor 4 traverses all node keys of depth 1 in the ordered key array, namely the second key and sixth key of said table, that is to say the values ​​9142 and 32725, and processor 4 assigns respectively to the data di and d2 of the pair, the value equal to the key of the internal node traversed after the root node, and the other value traversed.

[0234] If the input data is less than or equal to the key of the root node, the internal node of depth 1 traversed is the NI 1 node of the tree as illustrated in Figure 3 and the data di and d2 of the pair have values ​​of z® 9142 and z® 32765 respectively.

[0235] If the input data is strictly greater than the key of the root node, the internal node of depth 1 traversed is the N12 node and the di and d2 data of the couple have respectively the values ​​z® 32765 and z® 9142.

[0236] Processor 4 then retrieves the key of the internal node traversed after the root node by combining, using the exclusive OR operation, the data di of the pair and the initialization data z, that is, as follows: z® dY

[0237] Processor 4 then obtains the Boolean result b} from the comparison of the input data with the key of the traversed node of depth 1 such that br has the value 0 if the input data is less than or equal to the key of the traversed node of depth 1 and 1 if the input data is strictly greater than the key of the traversed node of depth 1, the key of the traversed node of depth 1 having the value z® dY

[0238] Processor 4 then accumulates the increment of the traversed node of depth 2 and updates the accumulator h as follows: hh® (b^ V)-

[0239] Thus, processor 4 compares the input data z® dl and assigns the Boolean result b} the value 0 when the input data is less than or equal to z® d^ and the value 1 when the input data is strictly greater than z® dY

[0240] The processor 4 then determines the key of the internal node traversed after the traversed node of depth 1, that is to say the key of the traversed node of depth 2, by loading a pair of data di and d2.

[0241] To do this, processor 4 initializes the data pair as follows: (dY d2) = ( z, z), where z is an initialization value. The initialization value z can have a different value here than the one used for loading the key of the traversed node of depth 1. Processor 4 traverses all the keys of nodes of depth 2 in the ordered key table, namely the first key, the third key, the fifth key and the seventh key of said table, that is to say the values ​​-1, 23462, 32361 and 32767, and processor 4 assigns respectively to the data diet d2 of the pair, the traversed value equal to the key of the internal node of depth 2 traversed, and the other traversed values.

[0242] If the internal node of depth 2 traversed is the NI 11 node of the tree as illustrated in Figure 3, the data d^t d2 of the couple have respectively the values ​​z® -1 and z ® 23462® 32361® 32767.

[0243] If the internal depth node 2 traversed is the NI 12 node, the data diet d2 of the couple have respectively the values ​​z® 23462 and z® -1® 32361® 32767.

[0244] If the internal depth node traversed is node N121, the data diet d2 of the couple have respectively the values ​​z® 32361 and z® -1® 23462® 32767.

[0245] Finally, the internal depth node traversed is node N122, the data d^t d2 of the couple have respectively the values ​​z® 32767 and z® -1® 23462® 32361.

[0246] The assignment of the other values ​​traversed is done here by combination with the exclusive or operation of the data d2 of the pair and the other value traversed to be assigned.

[0247] The processor 4 then finds the key of the internal node traversed after the node traversed at depth 1 by combining, using the exclusive OR operation, the data di of the pair and with the initialization data z, that is, as follows: z® dv

[0248] Processor 4 then obtains the Boolean result b2 from the comparison of the input data with the key of the traversed node of depth 2, such that b2 has the value 0 if the input data is less than or equal to the key of the traversed node of depth 2, and 1 if the input data is strictly greater than the key of the traversed node of depth 2, the key of the traversed node of depth 2 having the value z® dy

[0249] Processor 4 then accumulates the increment of the traversed sheet by updating the accumulator h as follows: h — h®b2-

[0250] Processor 4 determines the sampling result as follows .ee + h.

[0251] According to a first example, when the value of the input data is 11112, the process initializes the sampling result to -1 during the sampling result initialization step, and then traverses the internal nodes Nil, NI 12 and the leaf F3 during the search step (step E4).

[0252] The process accumulates the increments of the internal nodes and the leaf of the tree traversed, i.e. 0, 2 and 0, and thus obtains 1 as the sampling result.

[0253] The process can then determine the output data, during the output data determination step, as having the value sb by selecting the output sample with index 1 from the third table.

[0254] According to a second example, when the value of the input data is 32767, the process initializes the sampling result to -1 during the sampling result initialization step, and then traverses the internal nodes N12, N122 and the leaf F7 during the search step (step E4).

[0255] The process accumulates the increments of the internal nodes and the leaf of the tree traversed, i.e. 4, 2 and 0, and thus obtains 5 as a sampling result.

[0256] The process can then determine the output data, during the output data determination step, as having the value sf by selecting the output sample with index 5 from the third table.

[0257] According to a third example, when the value of the input data is 0, the process initializes the sampling result to -1 during the sampling result initialization step, and then traverses the internal nodes Nil, NUI and the leaf F2 during the search step (step E4).

[0258] The process accumulates the increments of the internal nodes and the leaf of the tree traversed, i.e. 0, 0 and 1, and therefore obtains 0 as a sampling result.

[0259] The process can then determine the output data, during the output data determination step, as having the value sa by selecting the output sample with index 0 from the third table.

[0260] The invention can be implemented for first and second tables of other sizes and use a perfect tree having a different height.

[0261] According to a first example, the first table and the second table can have the same size when the size of the first table, that is to say when the first table has a number, called the first number, of first decision thresholds which is a power of 2. In this case, the second table can be the first table.

[0262] According to a second example, for a Gaussian sampling of a FroKEM-976 algorithm, the first table can have 12 first decision thresholds and the second table can have 16 second decision thresholds, the first table and the second table being respectively: [-1, 5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767] and [-1, 5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767, 32767, 32768, 32768, 32768]. In this second example, the perfect binary search tree has a height of 4.

[0263] When the first table has a first number of first decision thresholds different from a power of 2, the second table has a second number of second decision thresholds strictly greater than the first number.

[0264] The second table of second decision thresholds allows the use of a perfect binary tree even though the input data is sampled from a number of first decision thresholds, the first number being not a power of 2. The second number is a power of two. Thus, each distinct pair of successive second decision thresholds in the second table defines an auxiliary decision interval of a leaf of the perfect binary tree.

[0265] In the first implementation example, each decision element of the second multiset has a multiplicity of 1, decision element 32767 of the first multiset has a multiplicity of 2, and each of the other decision elements of the The first multiset has a multiplicity of 1. The input data belongs to a finite set of input elements, the input elements being the integers between 0 and 32767.

[0266] The second multiset differs from the first multiset only by at least one multiplicity of a decision element, here the multiplicity of 32767, each decision element of said at least one multiplicity, here 32767, having a value greater than or equal to all the input elements of said finite set.

[0267] The method is thus advantageous because it does not require a correction of the sampling result, conditioned on the value of the input data, even though the second table has a second number of second decision thresholds strictly greater than the first number of first decision thresholds. Furthermore, the search step (step E4) can include, for each internal node traversed, loading the key of the relevant internal node from at least one memory location of the electronic device using a blind binary search.

[0268] Similarly, in the second implementation example, each decision element of the second multiset has a multiplicity of 1, the decision element -1 of the first multiset has a multiplicity of 2, and each of the other decision elements of the first multiset has a multiplicity of 1. The input data belongs to a finite set of input elements, the input elements being the integers from 0 to 32767.

[0269] The second multiset differs from the first multiset only by at least one multiplicity of a decision element, here the multiplicity of -1, each decision element of said at least one multiplicity, here -1, having a value strictly less than all the input elements of said finite set.

[0270] The method is also advantageous here because it does not require a correction of the sampling result, conditioned on the value of the input data, even though the second table has a second number of second decision thresholds strictly greater than the first number of first decision thresholds. Furthermore, here too the search step (step E4) can include, for each internal node traversed, loading the key of the relevant internal node from at least one memory location of the electronic device using a masked binary search.

[0271] As mentioned above, for a Gaussian sampling of a FrodoKEM-976 algorithm, the first table can have 12 first decision thresholds and the second table can have 16 second decision thresholds, the first table and the second table being respectively: [-1, 5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767] and [-1, 5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767, 32767, 32768, 32768, 32768],

[0272] In this case, each decision element of the second multiset has a multiplicity of 1, the decision element 32767 of the first multiset has a multiplicity of 2, the decision element 32768 of the first multiset has a multiplicity of 3 and each of the other decision elements of the first multiset has a multiplicity of 1. The input data typically belongs to a finite set of input elements, the input elements being the integers between 0 and 32767.

[0273] The second multiset is then distinguished from the first multiset only by at least one multiplicity of a decision element, here the multiplicity of 32767 and the multiplicity of 32768, each decision element of said at least one multiplicity, here 32767 and 32768, having a value greater than or equal to all the input elements of said finite set.

[0274] The description given above with reference to the attached figures mentions decision intervals and auxiliary decision intervals which are open on the left and closed on the right.

[0275] The description given above with reference to the attached figures also mentions that the search in the binary tree examines a node and then continues in the left subtree if the input data is less than or equal to the key of the node examined, or in the right subtree if the input data is strictly greater than the key of the node examined.

[0276] The electronic device and the secure discrete sampling method described above with reference to the attached figures can however be adapted for decision intervals and auxiliary decision intervals which are open on the right and closed on the left.

[0277] The search in the binary tree is then modified to examine a node and then to continue in the left subtree if the input data is strictly less than the key of the node being examined, or in the right subtree if the input data is greater than or equal to the key of the node being examined.

[0278] A person skilled in the art will understand that the initialization step (step E2) can be omitted, for example when the sampling result is initialized to 0, as illustrated above for the first implementation example according to the first implementation mode.

[0279] Similarly, the step of determining an output data (step E8) can be omitted, for example when the process is implemented in a cryptographic algorithm that directly uses the sampling result.

[0280] A person skilled in the art will further understand that steps in this process can be carried out concurrently, for example as described for the first and second modes of implementation.

[0281] The method and the electronic device can be adapted for input data belonging to a finite set in which each input element is negative or zero, or to a finite set of input elements comprising at least one negative input element and at least one positive input element. For example, the electronic device 2 can store the sign of the input data and then update the input data with the absolute value of said input data, typically upstream of the implementation of the method described above. The electronic device 2 can then apply the stored sign to the sampling result determined during the step of determining a sampling result (step E6).

[0282] The method, or rather the electronic device, according to the invention, is also particularly advantageous because it can be easily adapted for masked input data.

[0283] For this purpose, secure additions, secure comparisons and secure operations can be used with the usual techniques of masking and manipulating masked data.

[0284] Implementations of a secure addition, a secure comparison, and a secure AND operation are known to those skilled in the art. The paper "Pierre-Augustin Berthet, Justine Paillet and Cédric Tavemier; Masked Computation of the Floor Function and Its Application to the FALCON Signature, Cryptology ePrint Archive, Paper 2024 / 709, 2024" describes, in particular with algorithm 10, a secure comparison that can be used.

[0285] The document “Gilles Barthe, Sonia Belaïd, Thomas Espitau, Pierre-Alain Fouque, Benjamin Grégoire, Melissa Rossi, and Mehdi Tibouchi; Masking the GLP Lattice-Based Signature Scheme at Any Order, Cryptology ePrint Archive, Paper 2018 / 381, 2018” describes in particular with algorithm 9, a secure addition operation which can be used for example when the sampling result is in the form of components of a boolean masking, with algorithm 11, a secure operation, and with algorithm 14, the refreshing of the mask on a data, which can be used.

[0286] When the sampling result is in the form of components of an arithmetic masking, safe addition consists of making unsafe additions, each unsafe addition being on a separate component of the masked data.

Claims

Demands

1. A secure discrete sampling method from an input data point and a first array of ordered first decision thresholds, the method being implemented by an electronic device (2), and the method being characterized in that it comprises the following steps: a) Searching (E4) for an auxiliary decision interval comprising the input data, by traversing a binary perfect search tree from a root node to a leaf, the tree comprising the root node, a plurality of internal nodes and a plurality of leaves, - each node having a key equal to a second distinct decision threshold from a second array of ordered second decision thresholds, the second decision thresholds of the second array defining a first multiset of decision elements including a second multiset of decision elements defined by the first decision thresholds of the first array,- the tree having a distinct node for each second decision threshold, - each leaf being a semi-open auxiliary decision interval defined by a distinct pair of successive second decision thresholds from the second table, - each internal node of the same depth having an increment from the same set of two different values ​​associated with the depth concerned, internal nodes attached to the same other node having increments of different values, and - each leaf of the tree having an increment from the same other set of two different values ​​such that leaves attached to the same node have increments of different values, and b) determination (E6) of a sampling result by accumulating the increments of the internal nodes and the leaf of the tree traversed during the search.

2. A secure discrete sampling method according to the preceding claim wherein - the first table has a first number of first decision thresholds different from a power of 2, and - the second table has a second number of second decision thresholds strictly greater than the first number.

3. A secure discrete sampling method according to the preceding claim wherein: - the input data belongs to a finite set of input elements, and - The second multiset differs from the first multiset only by at least one multiplicity of a decision element, each decision element of said at least one multiplicity having a value greater than or equal to, or strictly less than, all the input elements of said finite set.

4. A secure discrete sampling method according to any one of the preceding claims, wherein: - for each node traversed, a Boolean result is determined by comparing the input data with the key of the node traversed concerned, and - the accumulation of increments is by bit-by-bit operations from said Boolean results.

5. A secure discrete sampling method according to any one of the preceding claims, wherein for each traversed internal node, the key of the relevant traversed internal node is determined by bit-by-bit operations from a Boolean result of comparing the input data with the key of another node.

6. A secure discrete sampling method according to any one of claims 1 to 4, wherein: - A plurality of keys of the tree is stored in an ordered manner in at least one memory location of the electronic device, and - for each internal node traversed, the key of the relevant internal node traversed is loaded by masked bisection from said at least one memory location of the electronic device.

7. A secure discrete sampling method according to any one of the preceding claims further comprising a step (E8) of determining an output data by selecting, from the sampling result, an output sample from a third table of output samples.

8. A secure discrete sampling method according to any one of the preceding claims, the method being implemented in a cryptographic algorithm.

9. A secure discrete sampling method according to the preceding claim, wherein the cryptographic algorithm is an algorithm among the Hawk algorithm, the FrodoKEM algorithm, the Falcon algorithm and the qTesla algorithm.

10. A computer program comprising instructions executable by a processor and adapted to implement a method according to any one of the preceding claims, when these instructions are executed by the processor.

11. An electronic device (2) capable of implementing secure discrete sampling from an input data point and a first array of ordered first decision thresholds, the electronic device comprising: - a search block configured to search for an auxiliary decision interval comprising the input data point, by traversing a binary perfect search tree from a root node to a leaf, the tree comprising the root node, a plurality of internal nodes and a plurality of leaves, each node having a key equal to a second distinct decision threshold from a second array of ordered second decision thresholds, the second decision thresholds of the second array defining a first multiset of decision elements including a second multiset of decision elements defined by the first decision thresholds of the first array, the tree having a distinct node for each second decision threshold,each leaf being a semi-open auxiliary decision interval defined by a distinct pair of successive second thresholds from the second table, each internal node of the same depth having an increment from the same set of two different values ​​associated with the depth concerned, internal nodes attached to the same other node having increments of different values, and each leaf of the tree having an increment from the same other set of two different values ​​such that leaves attached to the same node have increments of different values, and - a block for determining a sampling result, configured to determine a sampling result by accumulating the increments of the internal nodes and the leaf of the tree traversed during the search.

Images