Centered binomial distribution operation

Abstract

Centered Binomial Distribution Operation The present description relates to a method (400) for implementing a CBD operation taking as input two first binary data (Beta1, Beta2) and providing as output a list of second data bits (ai, bi), comprising the following steps:- a step A (401) of extracting a first half of bits from the first binary data;- a step B (402) of extracting a second half of bits from the first binary data;- a step C (403) of adding and masking the data (x1, x2) from steps A and B to obtain fifth data (x'), and sixth data (y');- a step D (404) of extracting and masking the second data (ai);- a step E (405) of extracting and masking second data (bi), in which the order of implementation of steps A, B, C, D and E is managed by software. Figure for the abridged version: Fig. 4

Description

Title of the invention: Centered binomial distribution operation technical field

[0001] This description relates generally to electronic systems and devices, and more particularly to the security of these electronic systems and devices and the information they handle. More specifically, this description relates to the implementation of encryption or decryption algorithms and to the implementation of centered binomial distribution operations of encryption or decryption algorithms. Previous technique

[0002] Various techniques for securing secret and / or sensitive data are used today. Data encryption is one of them, and consists of applying one or more cryptographic algorithms to data, such as sensitive data. Many cryptographic algorithms use data matrices and / or polynomials.

[0003] The generation of these polynomials is often done during the implementation of these algorithms, and can use centered binomial distribution (CBD) operations.

[0004] It would be desirable to be able to improve, at least in part, certain aspects of the implementation, by electronic systems and devices, of encryption or decryption algorithms, and more particularly the implementation of centered binomial distribution operations used by these algorithms. Summary of the invention

[0005] There is a need for more secure and reliable implementations of cryptographic algorithms for encryption and / or decryption.

[0006] There is a need for more secure and reliable implementations of centered binomial distribution operations of these algorithms.

[0007] There is a need for implementations of centered binomial distribution operations including masking steps.

[0008] An embodiment overcomes all or part of the drawbacks of known implementations of encryption or decryption algorithms.

[0009] An embodiment overcomes all or part of the disadvantages of known implementations of centered binomial distribution operations.

[0010] One embodiment provides a method for implementing a centered binomial distribution operation taking as input at least two initial data binary and providing as output a list of second bits of data, comprising the following steps: - a step A of extraction of third data corresponding to a first half of bits of the first binary data, this step A being implemented in hardware; - a step B of extraction of fourth data corresponding to a second half of bits, different from the first half, of the first binary data, this step B being implemented in hardware; - a step C of adding and masking the third data to obtain fifth data, and of the fourth data to obtain sixth data, this step C being implemented in hardware; - a step D of extraction and masking of the second data from the fifth data, this step D being implemented in hardware; and - a step E of extraction and masking of the second data from the sixth data, this step E being implemented in hardware, in which the order of implementation of steps A, B, C, D and E is managed in software.

[0011] Another embodiment provides a device comprising circuits adapted to implement one or more steps of a method for implementing a centered binomial distribution operation taking as input at least two first binary data and providing as output a list of second data bits, comprising the following steps: - a step A of extraction of third data corresponding to a first half of bits of the first binary data, this step A being implemented in hardware; - a step B of extraction of fourth data corresponding to a second half of bits, different from the first half, of the first binary data, this step B being implemented in hardware; - a step C of adding and masking the third data to obtain fifth data, and of the fourth data to obtain sixth data, this step C being implemented in hardware; - a step D of extraction and masking of the second data from the fifth data, this step D being implemented in hardware; and - a step E of extraction and masking of the second data from the sixth data, this step E being implemented in hardware, in which the order of implementation of steps A, B, C, D and E is managed in software.

[0012] According to one embodiment, the first half of the bits of the first binary data corresponds to a first group of bits comprising two bits out of four bits of the first binary data, and the second half of bits of the first binary data corresponds to a first group of bits comprising two other bits out of four bits of the first binary data.

[0013] According to one embodiment, during step C, the following mathematical equation is implemented to obtain said fifth data: [Math 1] (xl 2i xor x2 2i ) + (xl 2i+1 xor x2 2 / +1 ) + r^ in which: - xor represents the logical XOR operation; - + represents the arithmetic operation of addition; - x'i represents the bit of rank i of said fifth data; - xli represents the bit of rank i of said third data extracted from a first of said at least two first data; - x2i represents the bit at position i of said third data extracted from a second of said at least two first data; and - ri represents the bit of rank i of a seventh masking data.

[0014] According to one embodiment, during step C, the following mathematical equation is implemented to obtain said sixth data: [Math 2] y'.= (yl xor y2' ) + (yl xor y2' J+r Qj - J i 2i J 2i J t*7 2i+l 17 21+1 / 21 in which: - xor represents the logical XOR operation; - + represents the arithmetic operation of addition; - y'i represents the bit of rank i of said sixth data; - yli represents the bit at position i of said fourth data extracted from said first of said at least two first data; and - y2i represents the bit of rank i of said fourth data extracted from said second of said at least two first data.

[0015] According to one embodiment, step D includes extracting at least two bits from said fifth data and masking them using at least twelve bits from a second masking data.

[0016] According to one embodiment, step E includes extracting at least two bits from said sixth data and masking them using at least twelve bits from said second masking data.

[0017] According to one embodiment, said at least two first binary data each comprise at least one thousand twenty-four bits.

[0018] According to one embodiment, said centered binomial distribution operation taking as input at least three initial binary data.

[0019] According to one embodiment, the order of implementation of steps A and B is indifferent, and The order in which steps D and E are implemented is irrelevant.

[0020] Another embodiment provides a method for implementing a centered binomial distribution operation taking as input a first binary data bit and providing as output a list of second data bits, comprising the hardware implementation of a single step including the implementation of: - of a step A of adding in place the bits of the first binary data; - a step B of subtracting data bits obtained in step A; and - a step C of extracting two by two the coefficients of the concatenation of the data bits obtained in step B.

[0021] Another embodiment provides for a device comprising circuits adapted to implement one or more steps of a process for implementing a centered binomial distribution operation taking as input a first binary data and providing as output a list of second data bits, including the hardware implementation of a single step including the implementation of: - a step A of adding in place the bits of the first binary data; - a step B of subtracting data bits obtained in step A; and - a step C of extracting two by two the coefficients of the concatenation of the data bits obtained in step B.

[0022] Another embodiment provides a method for implementing an encryption or decryption algorithm comprising the method described above.

[0023] Another embodiment provides for a device for implementing an encryption or decryption algorithm comprising the device described above.

[0024] According to one embodiment, said encryption or decryption algorithm is the algorithm called ML-KEM. Brief description of the drawings

[0025] These features and advantages, as well as others, will be described in detail in the following description of particular embodiments, given by way of non-limiting example, in relation to the accompanying figures, among which:

[0026] [Fig.1] represents an embodiment of an electronic device;

[0027] Figure 2 represents an example of the implementation of a method for generating a encryption and / or decryption key;

[0028] [Fig.3] represents an example of the implementation of a method for encrypting an encryption key and / or decrypting;

[0029] [Fig.4] represents a method of implementing a secure centered binomial distribution operation;

[0030] [Fig.5] represents another illustration of the implementation method of [Fig.4];

[0031] Figure 6 represents the implementation of a step in the implementation method of the [Fig.4];

[0032] [Fig.7] represents the implementation of another step in the implementation method of [Fig.4];

[0033] [Fig.8] represents the implementation of another step in the implementation method of [Fig.4];

[0034] [Fig. 9] represents the implementation of another step in the implementation method of [Fig. 4]; and

[0035] [Fig. 10] represents a method of implementing a centered binomial distribution operation. Description of the implementation methods

[0036] The same elements have been designated by the same reference numerals in the different figures. In particular, the structural and / or functional elements common to the different embodiments may have the same reference numerals and may have identical structural, dimensional and material properties.

[0037] For the sake of clarity, only the steps and elements useful for understanding the described embodiments have been shown and are detailed. Unless otherwise specified, when reference is made to two interconnected elements, this means directly connected without any intermediate elements other than conductors, and when reference is made to two coupled elements, this means that these two elements can be connected or linked via one or more other elements.

[0038] In the following description, when reference is made to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "superior", "inferior", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., reference is made, unless otherwise specified, to the orientation of the figures.

[0039] Furthermore, in the following description, data, or data bits, is referred to as binary data, that is to say, data expressed as a bit or a set of bits.

[0040] The embodiments described below relate to the implementation of a centered binomial distribution operation, and for example, its use in an encryption or decryption algorithm. A centered binomial distribution (CBD) operation is a mathematical operation that generates coefficients that can be used as polynomial coefficients, for example, in a data encryption or decryption algorithm. The embodiments described below relate more specifically to a method for implementing such an operation and the device adapted for this implementation. A first embodiment, described with reference to Figures 4 to 9, consists of a secure implementation of this operation, for which only five instructions are used, each implemented in software or hardware.A second embodiment, described in relation to [Fig. 10], consists of a less secure implementation of this operation, for which only one instruction is used, and is implemented in software or hardware.

[0041] Furthermore, the embodiments described below are particularly well-suited to the implementation of encryption or decryption algorithms such as the ML-KEM algorithm in a secure processor. This ML-KEM (Module-Lattice-based Key-Encapsulation Mechanism) algorithm is a key or data encapsulation mechanism based on modular computations on lattices. Moreover, this algorithm is described in detail in the NIST FIPS 203 standard. In particular, these embodiments can be used for improving existing processors and creating new ones, and for enhancing the protection of these processors.

[0042] Furthermore, the embodiments described above are particularly suitable for use in any type of industrial market where the use of a centered binomial distribution operation is necessary. More specifically, an implementation of such an operation may be intended to: - the automotive industry, for example in the field of automotive electrification or in the field of advanced driver assistance systems (ADAS); - the industrial industry, for example in the field of green energy, in the field of infrastructure electrification, the Internet of Things (IoT) and Smart Homes, where electricity and energy consumption and data exchange are key elements; - the personal electronics industry, for example in the field of mobile telephony and the Internet of Things (IoT), the field of broadband interfaces, and also the banking and electronic payments sectors; and - the communications equipment, computer and peripherals industry, for example in the field of infrastructure and data centers, and in the field of low Earth Orbit (LEO) satellites.

[0043] Fig. 1 is a block diagram representing, very summarily, an architecture of an example of an electronic device 100 adapted to implement centered binomial distribution operations, for example in the case of implementing an encryption or decryption algorithm.

[0044] According to one example, the electronic device 100 includes a processor 101 (CPU) adapted to implement various processing of data stored in memories and / or provided by other circuits of the device 100. According to one embodiment, the processor 101 is adapted to implement a centered binomial distribution operation, and for example an encryption or decryption algorithm using such an operation.

[0045] According to one example, the electronic device 100 further comprises different types of memory 102 (MEM), including, for example, non-volatile memory, volatile memory, and / or read-only memory. Each memory 102 can be adapted to store different types of data.

[0046] In one example, the electronic device 100 further comprises, for example, a secure element 103 (SE) adapted to handle sensitive and / or secret data. The secure element 103 may include its own processor(s), its own memory(ies), etc. In one embodiment, the secure element 103 is adapted to implement a centered binomial distribution operation, and, for example, an encryption or decryption algorithm using such an operation.

[0047] According to one example, the electronic device 100 may further include interface circuits 104 (IN / OUT) adapted to send and / or receive data from outside the device 100. The interface circuits 104 may further be adapted to implement a data display, for example, a display screen.

[0048] According to one example, the electronic device 100 further comprises various circuits 105 (FCT1) and 106 (FCT2) adapted to perform different functions. By way of example, the circuits 105 and 106 may include measurement circuits, data conversion circuits, etc. According to one embodiment, the circuits 105 and 106 may include a circuit adapted to implement a centered binomial distribution operation, and, for example, an encryption or decryption algorithm using such an operation.

[0049] According to one example, the electronic device 100 further comprises one or more data buses 107 adapted to transfer data between its different components.

[0050] According to a particular example, the electronic device 100 is adapted to implement computer programs, and in particular a computer program enabling the implementation of all or part of the implementation of a centered binomial distribution operation, and for example an encryption or decryption algorithm using such an operation.

[0051] More specifically, the electronic device 100 is adapted to implement at least one computer program product comprising program code instructions recorded on a medium usable in a computer, including computer-readable programming means for implementing a centered binomial distribution operation, and for example an encryption or decryption algorithm using such an operation.

[0052] In addition, the electronic device 100 includes, among all the circuits described above, one or more circuits adapted to implement one or more steps in carrying out the implementation of a centered binomial distribution operation.

[0053] Fig. 2 is a block diagram illustrating the implementation of an algorithm for generating a data encryption or decryption key using a centered binomial distribution function.

[0054] According to one example, Algorithm 200 is based on lattice-based cryptography. According to a preferred example, Algorithm 200 is part of the data encapsulation mechanism called ML-KEM described previously.

[0055] According to one example, the algorithm 200 is adapted to receive as input a data d200 allowing to generate, as output, an encryption or decryption key t200.

[0056] According to one example, the algorithm 200 includes the implementation of a hash function 201 (G) adapted to receive the data d200 and to provide, as output, a data rho200 and a data sigma200.

[0057] According to one example, algorithm 200 includes implementations of functions 202 (XOF) and 203 (Sample). Function 202 is adapted to receive the data rho200 and to provide, as output, data to function 203. Function 203 provides, as output, data A200. According to one example, function 202 is a hash function whose output size can be variable (XOF, eXtendable Output Function). According to another example, function 203 is a sampling function that provides a polynomial matrix from the result of function 202.

[0058] According to one example, algorithm 200 comprises implementations of functions 204 (PRF) and 205 (CBD). Function 204 is adapted to receive the data sigma200 and to provide, as output, data to function 205. Function 205 provides, as output, data e200. According to one example, function 204 is a function for generating pseudo-random data. According to one embodiment, function 205 is a centered binomial distribution function which can be implemented using the embodiments described in relation to figures 4 to 9.

[0059] According to one example, algorithm 200 includes implementations of functions 206 (NTT) and 207 (+). Function 206 is adapted to receive the data e200 and to provide, as output, data to function 207. Function 207 provides, as output, the data t200 corresponding to a part of the encryption or decryption key which, concatenated with the data rho200, forms the encryption or decryption key. According to one example, function 206 is a discrete Fourier transform function on a polynomial ring. According to one embodiment, function 207 is a polynomial sum function.

[0060] According to one example, algorithm 200 comprises implementations of functions 208 (PRF) and 209 (CBD). Function 208 is adapted to receive the data sigma200 and to provide, as output, data to function 209. Function 209 provides, as output, data s200. According to one example, function 208 is identical to function 204. According to one embodiment, function 209 is a centered binomial distribution function like function 205.

[0061] According to one example, algorithm 200 comprises implementations of functions 210 (NTT) and 211 ( ). Function 210 is adapted to receive the data s200 and to provide, as output, a data s201 to function 211. The data s201 is, for example, a secret part of the encryption and / or decryption key. Function 211 provides, as output, a data dk200 to function 207. According to one example, function 210 is identical to function 206. In one embodiment, function 211 is a polynomial multiplication function providing the data dk200 to function 207.

[0062] Fig. 3 is a block diagram illustrating the implementation of a 300 encryption algorithm or encryption key encapsulation using a centered binomial distribution function.

[0063] According to one example, Algorithm 300 is based on lattice-based cryptography. According to a preferred example, Algorithm 300 is part of the data encapsulation mechanism called ML-KEM.

[0064] According to an example, algorithm 300 is adapted to receive as input: - a t300 data corresponding to a data of the type of the t200 data described in relation to [Fig.2]; - an A300 data type of the A300 data described in relation to [Fig.2]; - an m300 data point corresponding to a message to be encrypted; and - a H(ek)300 data corresponding to a hash data obtained by hashing a public key which can correspond to the concatenation of the t200 and rho200 data described in relation to [Fig.2].

[0065] According to one example, the 300 algorithm is adapted to provide, as output, a c300 data corresponding to the key received as input encrypted, encrypted or encapsulated corresponding to the encapsulation of the encryption of the m300 data.

[0066] According to one example, the algorithm 300 includes the implementation of a hash function 301 (G) adapted to receive the data m300 and to provide, as output, a data r300 and a data K300.

[0067] According to one example, the algorithm 300 includes the implementation of a decoding function 302 (Dec) and a function 303 (Decompress) which, applied successively to the data m300, provide, as output, a data dec300.

[0068] According to one example, algorithm 300 comprises implementations of functions 304 (PRF) and 305 (CBD). Function 304 is adapted to receive the data r300 and to provide, as output, data to function 305. Function 305 provides, as output, data e301. According to one example, function 304 is identical to function 204 described in relation to [Fig. 2]. According to one embodiment, function 305 is a centered binomial distribution function like functions 205 and 209 described in relation to [Fig. 2].

[0069] According to one example, the algorithm 300 includes the implementation of a function 306 (+) adapted to receive, as input, the data e301.

[0070] According to one example, algorithm 300 comprises implementations of functions 307 (PRF) and 308 (CBD). Function 307 is adapted to receive the data r300 and to provide, as output, data to function 308. Function 308 provides, as output, data r301. According to one example, function 307 is identical to function 204 described in relation to [Fig. 2]. According to one embodiment, function 308 is a centered binomial distribution function like functions 205 and 209 described in relation to [Fig. 2].

[0071] According to one example, algorithm 300 comprises implementations of functions 309 (NTT), 310 (x), and 311 (NTT1). Function 309 is adapted to receive the data r301 and to provide, as output, data to function 310. Function 310 provides, as output, data to function 311. Function 311 is adapted to provide data to function 306. Function 310 also takes, as input, the data A300. According to one example, function 311 is the inverse function of function 309. According to another example, function 309 is identical to function 206 described in relation to [Fig. 2]. According to another example, function 310 is a polynomial multiplication function described in relation to [Fig. 3], as is function 211 described in relation to [Fig. 2].

[0072] According to one example, algorithm 300 includes implementations of functions 312(x) and 313(NTT1). Function 312 is adapted to receive the data t300 and the output data of function 309, and to provide, as output, data to function 313. According For example, function 312 is a polynomial multiplication function. As another example, function 313 is the inverse function of function 309.

[0073] According to one example, algorithm 300 comprises implementations of functions 314 (PRF) and 315 (CBD). Function 314 is adapted to receive the data r300 and to provide, as output, data to function 315. Function 315 provides, as output, data e302. According to one example, function 314 is identical to function 204 described in relation to [Fig. 2]. According to one embodiment, function 315 is a centered binomial distribution function like functions 205 and 209 described in relation to [Fig. 2].

[0074] According to one example, algorithm 300 includes implementations of functions 316 (+) and 317 (+). Function 316 is adapted to receive the data e302 and provide, as output, data to function 317. Function 317 also receives the data dec300 and provides, as output, data v300. According to one example, functions 316 and 317 are polynomial sum functions.

[0075] According to one example, the algorithm 300 includes the implementation of a function 318 (Compress) and a function 319 (Enc) which, applied successively to the data u300 provided by the function 306, allow to provide, as output, a part of the data C300.

[0076] According to one example, the algorithm 300 includes the implementation of a function 320 (Compress) and a function 321 (Enc) which, applied successively to the data v300 provided by the function 317, make it possible to provide, as output, the other part of the data C300.

[0077] Fig. 4 is a block diagram illustrating a first method of implementing a method 400 for implementing a centered binomial distribution (CBD) operation.

[0078] The process 400 is adapted to be implemented by a device of the type of the device 100 described in relation to [Fig. 1]. More particularly, this device comprises material means, such as one or more discrete circuits and / or components, adapted to implement at least one step of this process.

[0079] A centered binomial distribution operation, also called a CBD operation, is a mathematical operation that generates a list of data, for example, a list of coefficients used to generate polynomials in a encryption algorithm, from an input. For example, to be implemented securely, this input can be decomposed into at least two inputs, for example, two or three inputs. For example, there is no theoretical limitation on the number of data points into which the input is decomposed; limitations on this number are rather practical. Indeed, the larger this number, the longer the execution time. The CBD operation is lengthy, and the more complex its implementation (for example, the greater the hardware resources required for its execution), the more demanding the process becomes. It is therefore necessary to find the right compromise between the required level of security and the desired performance. In the example shown in [Fig. 4], process 400 uses as input data decomposed into two data points, Betal and Beta2. As an example, this decomposition is a Boolean decomposition, and applying the XOR function to the data points Betal and Beta2 allows the original input data to be recovered. A further decomposition into additional data points is obvious to someone skilled in the art, given this description.

[0080] Each coefficient f; provided by the CBD operation is obtained through the implementation of the following mathematical operation: [Math 3] 0 = b, in which: - N is an integer representing the number of input data for the CBD operation, in an example N is equal to 255; - i is an integer between zero (0) and N; - a; is a first coefficient obtained from the input data of the CBD operation; and - b; is a second coefficient obtained from the input data of the CBD operation.

[0081] The first coefficient a; is obtained by implementing the following mathematical formula: [Math 4] — ^jj=Q^^^2in+j in which: - j is an integer between zero (0) and n-1, n being equal to two (2) or three (3); - Betak represents the k-rank bit of one of the input data of the CBD operation.

[0082] Similarly, the second coefficient b; is obtained by implementing the following mathematical formula: [Math 5] — Sj=Q-B6tci2in+ii+j

[0083] According to one embodiment, the process 400 enables the implementation of a centered binomial distribution operation using software and hardware. To this end, the implementation of this CBD operation is divided into five (5) distinct steps: - data extraction steps 401 (A-Extract) and 402 (B-Extract); - a 403 (C-Sum) step for adding and masking data; and - steps 404 (D-Extract) and 405 (E-Extract) of data extraction and masking.

[0084] In step 401, data bits xl and x2 are extracted from the input data Betal and Beta2. In the example described here, process 400 takes as input two data values ​​Betal and Beta2. According to one example, each packet of bits is stored in a register. According to a practical example, the data values ​​Betal and Beta2 are each binary words of one thousand twenty-four (1024) bits divided into sixteen (16) packets of sixty-four (64) bits.

[0085] According to one embodiment, the data bits xl are obtained by extracting bits from the input data Betal. More particularly, the data bits xl are obtained by selecting a first half of the bits from the input data Betal. In one example, this first half of bits corresponds to all bit pairs with index 4i + j, where i and j are the integers defined previously.

[0086] According to one embodiment, the data bits x2 are obtained by extracting bits from the input data Beta2. More particularly, the data bits x2 are obtained by selecting a first half of the bits from the input data Beta2. In one example, this first half of bits corresponds to all bit pairs with index 4i + j.

[0087] In the case of the practical example described above, the data bits xl and x2 are binary words of five hundred twelve (512) bits divided into sixteen (16) packets of thirty-two (32) bits.

[0088] According to one embodiment, step 401 is implemented solely in hardware and not in software. The repetition of step 401 can be implemented in software. Software implementation refers to a step implemented using a computer program or software program implemented by a complex electronic circuit, such as a processor, microprocessor, controller, or microcontroller. Hardware implementation refers to a step implemented using a component and / or electronic circuit dedicated to the implementation of that step.

[0089] In the practical example, step 401 can be implemented sequentially by processing only one packet of bits from the input data Beta and Beta2 at a time. In this case, the implementation of step 401 comprises sixteen executions of the same operation.

[0090] In step 402, data bits yl and y2 are extracted from input data Betal and Beta2. Similar to step 401, according to one example, each packet of bits is stored in a register.

[0091] According to one embodiment, the data bits yl are obtained by extracting bits from the input data Betal. More particularly, the data bits yl are obtained by selecting a second half of the bits from the input data Betal, different from the first half of bits used in step 401. According to one example, this second half of bits corresponds to all pairs of bits with index 4i + 2 + j, i and j being the integers defined previously.

[0092] According to one embodiment, the data bits y2 are obtained by extracting bits from the input data Beta2. More particularly, the data bits y2 are obtained by selecting a second half of the bits from the input data Beta2. In one example, this second half of bits corresponds to all pairs of bits with index 4i + 2 + j, where i and j are the integers defined previously.

[0093] In the case of the practical example described above, the data bits yl and y2 are binary words of five hundred twelve (512) bits divided into sixteen (16) packets of thirty-two (32) bits.

[0094] According to one embodiment, step 402 is implemented solely in hardware and not in software. The repetition of step 402 can be implemented in software.

[0095] In the practical example, step 402 can be implemented sequentially by processing only one packet of bits from the input data Beta and Beta2 at a time. In this case, the implementation of step 402 comprises sixteen executions of the same operation.

[0096] A practical illustration of the implementation of steps 401 and 402 is shown in [Fig.6].

[0097] In step 403, data bits x' and y' are obtained by summing and masking the bits of data bits xl, x2 on the one hand, and by summing and masking the bits of data bits yl, y 2 on the other hand.

[0098] More specifically, the data bits x' are obtained by summing the bits of the data bits xl and x2. More precisely, each packet of bits at rank i of the data bits x' is obtained by implementing the following mathematical formula: [Math 6] x]= (xl 2i xor x2 2j ) + (xl^^or x2 2i+1 )+r 2i in which: - xor represents the logical XOR operation; - + represents the arithmetic operation of the sum; and - p represents the bit of rank i of a masking data (ri).

[0099] According to the practical example, each packet x'i of rank i of data bits x' comprises two bits, and step 403 is implemented sixteen (16) times to obtain the complete data bits x'.

[0100] Similarly, the data bits y' are obtained by summing the bits of the data bits yl and y2. More precisely, each packet of bits at rank i of the data bits y' is obtained by implementing the following mathematical formula: [Math 7] y'i = y2 2i ) + (yl 2j+1 xor y2 2i+1 ) +r 21

[0101] According to one embodiment, the masking data r is identical for the data bits x' and y'.

[0102] According to the practical example, each packet y'; of rank i of the data bits y' comprises two bits, and step 403 is implemented sixteen (16) times to obtain the complete data bits y'.

[0103] According to one embodiment, step 403 can be implemented in a dissociated manner to obtain the data bits x' on one side and the data bits y' on the other. The data bits x' are stored in one register and the data bits y' are stored in another register.

[0104] According to one embodiment, step 403 is implemented only in a physical manner and in a single operation.

[0105] A practical illustration of the implementation of step 403 is shown in [Fig.7].

[0106] In step 404, the coefficients a; are extracted and masked from the data bits x'. To do this, each packet of bits x'i of rank i is masked using bits of a masking data r'. According to the practical example, each packet of two (2) bits x'i is masked using, for example, a minimum of twelve (12) masking bits r' to obtain a packet of 16 masked bits. Step 404 is implemented one hundred and twenty-eight (128) times. The set of coefficients a; is then stored in a register.

[0107] According to one embodiment, step 404 is implemented physically. The repetition of step 404 can be implemented using software.

[0108] A practical illustration of the implementation of step 404 is shown in [Fig.8].

[0109] In step 405, the coefficients b; are extracted and masked from the data bits y'. For this purpose, each packet of bits y'i of rank i is masked using the masking data bits r'. According to the practical example, each packet of bits y'; of two (2) bits is masked using, for example, a minimum of twelve (12) masking bits r'. to obtain a packet of 16 masked bits. Step 405 is implemented one hundred and twenty-eight (128) times.

[0110] Furthermore, in step 405, the masked coefficients b; are then reversed to obtain coefficients -b;. The set of coefficients -b; is then stored in a register.

[0111] In one embodiment, the masking data r' is identical for the data bits x' and y'. In another embodiment, the masking data r and r' are preferably different to ensure better security of the CBD operation.

[0112] According to one embodiment, step 405 is implemented physically. The repetition of step 405 can be implemented using software.

[0113] A practical illustration of the implementation of step 405 is shown in [Fig.9].

[0114] According to one embodiment, operations 401 and 402 can be implemented independently of each other, and therefore in any order. In other words, operation 401 can be implemented before, after, or simultaneously with operation 402. According to one embodiment, step 403 can be applied to the data bits xl, x2 and to the data bits yl, y2 independently, and therefore in any order. In other words, step 403 can be applied to the data bits xl, x2 before or after being applied to the data bits yl and y2. According to one embodiment, operations 404 and 405 can be implemented independently of each other, and therefore in any order. In other words, operation 404 can be implemented before, after, or simultaneously with operation 405.

[0115] Put another way, it is therefore possible to carry out steps 401 to 405 in any order provided that these steps yield the coefficients a and b. Thus, according to one example, it is possible to carry out, firstly, steps 401, 403 and 404 to obtain the coefficients a, and then, secondly, steps 402, 403 and 405 to obtain the coefficients b. According to another example, it is possible to interweave operations 401 to 405 to obtain the coefficients a and b.

[0116] According to one embodiment, the order of implementation of steps 401 to 405 may differ from one implementation of the CBD operation to another. According to one embodiment, the order of implementation of steps 401 to 405 may be managed by software.

[0117] Figure 5 represents, very schematically and in block form, the implementation work of a process 450 of implementation of a CBD operation of the same type as process 400 described in relation to [Fig.4].

[0118] Process 450 is another representation of process 400 described in relation to [Fig. 4]. More particularly, this process illustrates in detail the application of the various steps 401 to 405 described in relation to [Fig. 4].

[0119] Process 450 comprises: - a 451a (A-Extract) step of the type of the 401 step described in relation to [Fig.4]; - a 451b (A-Extract) step of the type of the 401 step described in relation to [Fig.4]; - a step 452a (B-Extract) of the type of step 401 described in relation to [Fig.4]; - a step 452b (B-Extract) of the type of step 401 described in relation to [Fig.4]; - a 453a (C-Sum) step of the type of the 403 step described in relation to [Fig.4]; - a 453b (C-Sum) step of the type of the 403 step described in relation to [Fig.4]; and - data extraction and masking steps 454 (D-Extract) and 455 (E-Extract).

[0120] Steps 451a and 451b represent the application of step 401 to each input data point Betal and Beta2. More specifically, step 451a represents the application of step 401 to the data point Betal to obtain the data point xl, and step 451b represents the application of step 401 to the data point Beta2 to obtain the data point x2. Similarly, steps 452a and 452b represent the application of step 402 to each input data point Betal and Beta2. More specifically, step 452a represents the application of step 402 to the data point Betal to obtain the data point yl, and step 452b represents the application of step 402 to the data point Beta2 to obtain the data point y2.

[0121] Steps 453a and 453b represent the application of step 403 to each data bit xl, x2 and yl, y2. More particularly, step 453a represents the application of step 403 to the data bits xl and x2, and to the masking bits r, allowing the data x' to be obtained, and step 453b represents the application of step 403 to the data bits yl and y2, and to the masking bits r, allowing the data y' to be obtained.

[0122] Step 454 represents the application of step 404 to the data bits x' and the masking data r'.

[0123] Step 455 represents the application of step 405 to the data bits y' and to the masking data r'.

[0124] Fig. 6 represents, very schematically and according to the practical example, the implementation of steps 401 and 402 of the process 400 described in relation to Fig. 4.

[0125] In the example in [Fig. 6], the data bits xl and yl are extracted from the input data Betal. To do this, groups of two consecutive bits are formed from the input data Betal. One group of two bits out of every four is extracted to form the data bits xl, and the other groups of two bits are used to form the data bits yl.

[0126] Figure 7 represents, very schematically and according to the practical example, the implementation work of step 403 of process 400 described in relation to [Fig.4].

[0127] In the example in [Fig.7], the data bits xl and x2 are summed and masked using a masking data r, following the formula described in relation to [Fig.4],

[0128] Figure 8 represents, very schematically and according to the practical example, the implementation work of step 404 of process 400 described in relation to [Fig.4].

[0129] In the example in [Fig.8], the coefficients a; are extracted from the data bits x' and are masked using the masking data r'.

[0130] Figure 9 represents, very schematically, the implementation of step 405 of the process 400 described in relation to [Fig.4].

[0131] In the example in [Fig.9], the coefficients -b; are extracted from the data bits y', are masked using the masking data r', and then reversed.

[0132] More specifically, according to the practical example described above, the following mathematical operations can be implemented in steps 404 and 405: [Math 8] has 2i = ((x'^s) and 3)+(r' and OxFFFF) a ■ a 2ï+i = ( (*'>(s + 2)) and 3) +((r'> 16) and OxFFFF) in which: - » represents the right bit shift operation; - s represents an input value equal to a multiple of four; - and represents the logical AND operation; and - OxFFFF is a value whose expression is given in hexadecimal, and [Math 9] b 2i = - ((y'> s) and 3)+(r'and OxFFFF) .b 2i+1 = - ( (y>(s + 2)) and 3) +((r> 16) and OxFFFF) in which: - » represents the right bit shift operation; - s represents an input value equal to a multiple of four; - and represents the logical AND operation; and - OxFFFF is a data whose expression is given in hexadecimal.

[0133] Fig. 10 is a block diagram illustrating a second embodiment of a 900 process for implementing a centered binomial distribution (CBD) operation.

[0134] The process 900 is adapted to implement the CBD operation described in relation to [Fig. 4], but without performing any masking operations. It is therefore possible, in this case, to reduce the process 900 to the implementation of a single step 901 (CBD) which comprises the execution of a single instruction. This instruction takes as input an input data Beta, and provides, as output, the coefficients f, as defined in relation to [Fig. 1].

[0135] In particular, the calculations implemented by the CBD operation can all be implemented from the registers storing the input data Beta.

[0136] In the case of the practical example described above, the beta data bits are binary words of one thousand twenty-four bits (1024) divided into thirty-two (32) packets of thirty-two (32) bits.

[0137] Thus, according to one embodiment, step 901 is implemented by a single step comprising the implementation: - of a step A of adding in place the bits Beta2iet beta2i+i of the input data Beta to obtain data bits corresponding to the bits a; and b; described previously interleaved; - a subtraction step B in place to obtain the data bits £; and - a step C of extracting two by two the coefficients of the concatenation of the data bits f2i+iet f2i.

[0138] According to a practical example, step C is executed 4 times. Furthermore, again according to the practical example, to process all the data bits of the input data Beta, operation 901 is implemented thirty-two (32) times.

[0139] According to one embodiment, step 901 is implemented in software and / or hardware.

[0140] Various embodiments and variations have been described. A person skilled in the art will understand that certain features of these various embodiments and variations could be combined, and other variations will become apparent to a person skilled in the art.

[0141] Finally, the practical implementation of the embodiments and variants described is within the reach of a person skilled in the art, based on the functional indications given above.

Claims

Demands

1. A method (400) for implementing a centered binomial distribution operation taking as input at least two first binary data (Betal, Beta2) and providing as output a list of second data bits (a;> b;), comprising the following steps: - a step A (401) for extracting third data (xl, x2) corresponding to a first half of bits of the first binary data (Betal, Beta2), this step A being implemented in hardware; - a step B (402) for extracting fourth data (yl, y2) corresponding to a second half of bits, different from the first half, of the first binary data (Betal, Beta2), this step B being implemented in hardware; - a step C (403) of adding and masking the third data (xl, x2) to obtain fifth data (x1), and the fourth data (yl, y2) to obtain sixth data (y1), this step C being implemented in hardware;- a step D (404) of extracting and masking the second data (a;) from the fifth data (x1), this step D being implemented in hardware; and - a step E (405) of extracting and masking the second data (b;) from the sixth data (y1), this step E being implemented in hardware, in which the order of implementation of steps A, B, C, D and E is managed in software.

2. A method according to claim 1, wherein the first half of bits of the first binary data (Betal, Beta2) corresponds to a first group of bits comprising two bits out of four bits of the first binary data (Betal, Beta2), and the second half of bits of the first binary data (Betal, Beta2) corresponds to a first group of bits comprising two other bits out of four bits of the first binary data (Betal, Beta2).

3. A method according to claim 1 or 2, wherein, during step C (403), the following mathematical equation is implemented to obtain said fifth data (x1): [Math 10] (xl2ixor x22i) + (xl2i+1xor x22i+1) +r2i where: - xor represents the logical XOR operation; - + represents the arithmetic summation operation; - x'i represents the bit of rank i of said fifth data (x1); - xi; represents the bit of rank i of said third data (xl, x2) extracted from a first of said at least two first data (Betal, Beta2); - x2i represents the bit of rank i of said third data (xl, x2) extracted from a second of said at least two first data (Betal, Beta2); and - q represents the bit of rank i of a seventh masking data (ri).

4. A method according to any one of claims 1 to 3, wherein, during step C (403), the following mathematical equation is implemented to obtain said sixth data (y1): [Math 11] y'r \y\,xor y2^)+(y Wor in which: - xor represents the logical XOR operation; - + represents the arithmetic summation operation; - y'i represents the bit of rank i of said sixth data (y1); - y li represents the bit of rank i of said fourth data (yl, y2) extracted from said first of said at least two first data (Betal, Beta2); and - y2i represents the bit of rank i of said fourth data (yl, y2) extracted from said second of said at least two first data (Betal, Beta2).

5. A method according to any one of claims 1 to 4, wherein step D (404) comprises extracting at least two bits from said fifth data (x1) and masking them using at least twelve bits from a second masking data (r1).

6. A method according to any one of claims 1 to 5, wherein step E (405) comprises extracting at least two bits from said sixth data (y1) and their masking using at least twelve bits of said second masking data (r1).

7. A method according to any one of claims 1 to 6, wherein said at least two first binary data (Betal, Beta2) each comprise at least one thousand twenty-four bits.

8. A method according to any one of claims 1 to 7, wherein said centered binomial distribution operation takes as input at least three initial binary data.

9. A method according to any one of claims 1 to 8, wherein the order of implementation of steps A (401) and B (402) is indifferent, and the order of implementation of steps D (404) and E (405) is indifferent.

10. Device (100) comprising circuits adapted to implement one or more steps of a method for implementing a centered binomial distribution operation taking as input at least two first binary data (Betal, Beta2) and providing as output a list of second data bits (ai5 b;), comprising the following steps: - a step A (401) for extracting third data (xl, x2) corresponding to a first half of bits of the first binary data (Betal, Beta2), this step A being implemented in hardware; - a step B (402) for extracting fourth data (yl, y2) corresponding to a second half of bits, different from the first half, of the first binary data (Betal, Beta2), this step B being implemented in hardware;- a step C (403) of adding and masking the third data (xl, x2) to obtain fifth data (x1), and of the fourth data (yl, y2) to obtain sixth data (y1), this step C being implemented in hardware; - a step D (404) of extracting and masking the second data (a;) from the fifth data (x1), this step D being implemented in hardware; and - a step E (405) of extracting and masking the second data (b;) from the sixth data (y1), this step E being implemented in hardware; in which the order of implementation of steps A, B, C, D and E is managed by software.

11. Method (900) of implementing a centered binomial distribution operation taking as input a first binary data (Beta) and providing as output a list of second data bits (fi), comprising the hardware implementation of a single step (901) comprising the implementation of: - a step A of adding in place the bits of the first binary data (Beta); - a step B of subtracting data bits obtained in step A; and - a step C of extracting two by two the coefficients of the concatenation of the data bits obtained in step B.

12. Device comprising circuits adapted to implement one or more steps of a method (900) for implementing a centered binomial distribution operation taking as input a first binary data (Beta) and providing as output a list of second data bits (f;), comprising the hardware implementation of a single step (901) comprising the implementation of: - a step A of adding in place the bits of the first binary data (Beta); - a step B of subtracting data bits obtained in step A; and - a step C of extracting two by two the coefficients of the concatenation of the data bits obtained in step B.

13. Method of implementing an encryption or decryption algorithm comprising the method according to any one of claims 1 to 9 or 11.

14. Device for implementing an encryption or decryption algorithm comprising the device according to any one of claims 10 or 12.

15. A method according to claim 13, wherein said encryption or decryption algorithm is the algorithm called ML-KEM.

Images