Key pair generation method, device and computer program

Abstract

To provide a key pair generation method of CRYSTALS-Dilithium suitable for a device with comparatively limited hardware resources.SOLUTION: When generating a key pair of CRYSTALS-Dilithium, a key pair generation part 11 of an IC card 1 is configured to: confirm a level set at the IC card 1 at this timing (step S1); generate a random number at a length required for simplifying procedures according to a key generation algorithm of the CRYSTALS-Dilithium at the level confirmed by the key pair generation part 11 (step S2); and replace a symbol value required to start the procedures at the level confirmed by the key pair generation part 11 with the random number, so as to execute the procedures by processing according to the confirmed level (step S3).SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] This application relates to a technology for generating key pairs for Crystals Dilithium, a type of quantum-resistant cryptography. [Background technology]

[0002] The development of quantum computers is progressing. When quantum computers are put into practical use, it will be possible to decrypt currently used public key cryptography at a reasonable cost. For example, when quantum computers capable of applying Shor's algorithm are put into practical use, it will be possible to decrypt the widely used RSA cryptography and elliptic curve cryptography in a short time.

[0003] As a countermeasure, efforts are underway to develop and standardize cryptographic methods that are tamper-resistant against decryption using quantum computers. Cryptographic methods that are tamper-resistant against decryption using quantum computers are called post-quantum cryptography (PQC).

[0004] Considering the spread of the Internet of Things (IoT), it is desirable to be able to implement quantum-post-cryptography in devices with relatively few hardware resources. In particular, smart cards, one of these devices, are used in applications that require high security, so it is extremely important to implement quantum-post-cryptography in smart cards.

[0005] Patent Document 1 discloses an invention for implementing N-True (NTRU), a type of post-quantum cryptography, in a device with relatively few hardware resources. Meanwhile, the National Institute of Standards and Technology has adopted CRYSTALS Dilithium, the specifications of which are set out in Non-Patent Document 1, as the standard for next-generation cryptography. In response to this, it is desirable to be able to implement CRYSTALS Dilithium in devices with relatively few hardware resources.

[0006] One of the problems with implementing Crystals Dilithium on devices with relatively limited hardware resources is the large processing load involved in generating a key pair (private key and public key). The key generation algorithm of Crystals Dilithium uses a hash function that is a deterministic function to generate a key pair. The calculation of the hash function used as a deterministic function is a heavy processing load for devices with relatively limited hardware resources. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] WO2019 / 220900 publication [Non-patent literature]

[0008] [Non-Patent Document 1] CRYSTALS-Dilithium Algorithm Specifications and Supporting Documentation (round3) October 1,2020 Summary of the Invention [Problem to be solved by the invention]

[0009] Therefore, this application provides a Crystals Dilithium key pair generation method suitable for devices with relatively limited hardware resources, a device to which this method is applied, and a computer program to be implemented in this device. [Means for solving the problem]

[0010] The first invention for solving the above-mentioned problems is an invention related to a method for generating a key pair for Crystals Dilithium. The method according to the first invention is a key pair generation method which executes the steps of: a step a) in which a microprocessor confirms a level at which a procedure related to a key generation algorithm for Crystals Dilithium is simplified when generating a key pair for Crystals Dilithium; a step b) in which the microprocessor generates a random number of a length required when simplifying the procedure at the confirmed level; and a step c) in which the microprocessor replaces a symbol value required when starting the procedure at the confirmed level with the random number and executes the procedure by a process corresponding to the confirmed level. In the first invention, it is preferable to set at least the level to a process for generating a symbol value serving as a key element by applying a hash function.

[0011] The second invention for solving the above-mentioned problem relates to a device for generating a Crystals Dilithium key pair. The device according to the second invention is a device including a key pair generation unit which executes, when generating a Crystals Dilithium key pair, a step a of confirming a level at which a procedure related to a Crystals Dilithium key generation algorithm is simplified, a step b of generating a random number of a length required for simplifying the procedure at the confirmed level, and a step c of substituting the random number for a symbol value required for starting the procedure at the confirmed level and executing the procedure by a process according to the confirmed level. In the second invention, it is preferable that the level is at least set to a process of applying a hash function to generate a symbol value serving as a key element.

[0012] The third invention for solving the above-mentioned problems relates to a computer program to be implemented in a device for generating a Crystals Dilithium key pair. The computer program of the third invention causes a microprocessor implemented in the device to execute the following steps when generating a Crystals Dilithium key pair: a step a confirming a level at which a procedure related to a Crystals Dilithium key generation algorithm is simplified; a step b generating a random number of a length required for simplifying the procedure at the confirmed level; and a step c substituting the random number with a symbol value required for starting the procedure at the confirmed level and executing the procedure by a process corresponding to the confirmed level. In the third invention, it is preferable that the level is at least set in a process for applying a hash function to generate a symbol value that is a key element. Effect of the Invention

[0013] In order to make it possible to execute the steps related to the Crystals Dilithium key generation algorithm even on devices with relatively few hardware resources, the present invention simplifies the steps related to the Crystals Dilithium key generation algorithm by eliminating the calculation of a hash function, which is a heavy process. If the steps related to the Crystals Dilithium key generation algorithm can be simplified, the balance between performance and memory can be adjusted according to the level of simplification. [Brief description of the drawings]

[0014] [Figure 1] A diagram illustrating the steps involved in the Crystals Dilithium key generation algorithm. [Diagram 2] FIG. 13 is a diagram showing an example of level settings. [Diagram 3] A block diagram of an IC card. [Figure 4] FIG. 2 is a diagram for explaining a method of generating a key pair. [Diagram 5] FIG. 4 is a diagram for explaining the operation of a key generating unit included in the IC card. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, an embodiment of the present invention disclosed in this application will be described. This embodiment is intended to facilitate understanding of the present invention. The present invention is not limited to this embodiment. Furthermore, unless otherwise specified, the drawings are schematic diagrams drawn to facilitate understanding of the present invention.

[0016] In order to facilitate understanding of the present invention, first, a procedure related to the key generation algorithm of Crystals Dilithium will be briefly described. FIG. 1 is a diagram for explaining the procedure related to the key generation algorithm of Crystals Dilithium. In FIG. 1, the numbers (e.g., "01") written on the left side of the formula are processing numbers. Also, in FIG. 1, ζ (zeta), ρ (roh), σ (sigma), K (Kappa), A, s1, s2, t, t1, t0, tr, pk, and sk are symbols. In this embodiment, variables used in the key generation algorithm of Crystals Dilithium are called symbols, and the values ​​of the symbols are called symbol values. Furthermore, in FIG. 1, l, k, and η (eta) are parameters whose values ​​are determined in advance. Furthermore, {0, 1}^256 means a 256-bit bit string consisting of two elements, 0 and 1. Furthermore, the letter "R" with its superscript and subscript refers to a polynomial ring.

[0017] In this application, the use of the Greek letter "σ" is different from that in the original Crystals Dilithium specification. In the original Crystals Dilithium specification, a Greek letter other than σ is used for the Greek letter sigma in the formula explaining the Crystals Dilithium key generation algorithm. However, the Greek letter sigma used in the Crystals Dilithium specification may not be displayed correctly depending on the application. For this reason, in this embodiment, "σ" is used instead of the Greek letter sigma used in the original Crystals Dilithium specification.

[0018] In the key generation algorithm shown in FIG. 1, the first process is process 01, which generates a 256-bit random number as the symbol value of ζ. The next process is process 02, which applies a hash function to the symbol value of ζ to generate the symbol values ​​of ρ, which is a key element, σ, which is used as a message in the following process, and K, which is also a key element. The next process is process 03, which applies a hash function to the symbol value of σ generated in process 02 to generate the symbol values ​​of s1 and s2, which are used as key elements. The next process is process 04, which generates the symbol value of A from the symbol value of ρ. In this process, the symbol value of ρ is transformed by NTT (Number Theoretic Transform), which is a type of discrete Fourier transform, to generate the symbol value of A, which is a matrix. The next process is process 05, which generates the symbol value of t using the symbol values ​​of A, s1, and s2. The next process is process 06, which applies a Power2Round function to the symbol value of t to generate the symbol values ​​of t1 and t0, which are key elements. The next process is process 07, which applies a CRH function (CHR: Collision Resistant Hash) to the symbol values ​​of ρ and t1 to generate a symbol value of tr, which is a key element. The next process is process 08, which generates a symbol value of pk, which is a public key, and a symbol value of sk, which is a private key. The symbol value of pk, which is a public key, is generated using the symbol value of ρ and the symbol value of t1. Also, the symbol value of sk, which is a private key, is generated using the symbol values ​​of ρ, K, tr, s1, s2, and t0.

[0019] The key generation algorithm of Crystals Dilithium mentioned above uses a hash function (such as SHAKE-256) that is a deterministic function to generate a key pair. Note that a deterministic function is a function that always returns the same output for the same input. SHAKE256, which is a deterministic function, involves complex calculations. For this reason, in devices with relatively few hardware resources, such as IC cards, the calculations of SHAKE256 take a long time, which can cause problems in actual use.

[0020] Therefore, when implementing the Crystals Dilithium key generation algorithm on a device with relatively few hardware resources, such as an IC card, it is necessary to consider the balance between performance and memory. Here, performance refers to the processing speed and efficiency of the program, and memory refers to the amount of memory used by the program.

[0021] Generally, to improve performance, it is necessary to use more memory in order to prioritize processing speed. On the other hand, to save memory, it is necessary to sacrifice processing speed. The balance between performance and memory depends on the hardware resources and purpose of the device that implements the Crystals Dilithium key generation algorithm. Therefore, it is necessary to be able to select the appropriate balance for this device.

[0022] To achieve this, the present invention simplifies the procedures involved in the Crystals Dilithium key generation algorithm by eliminating the calculation of a hash function, allowing the balance between performance and memory to be adjusted depending on the level of simplification.

[0023] Specifically, in the present invention, a level for simplifying the procedure related to the key generation algorithm of Crystals Dilithium is set for the process of applying a hash function to generate a symbol value that is a key element in the procedure related to the key generation algorithm of Crystals Dilithium.The present invention generates a random number of a length required for simplifying this procedure at the confirmed level, replaces the symbol value required for starting this procedure at the confirmed level with a random number, and executes this procedure through a process according to the confirmed level, thereby making it possible to adjust the balance between performance and memory according to the simplification level.

[0024] An example of setting the level will be described. FIG. 2 shows an example of setting the level. As described above, in the present application, a level is set at least to the process of applying a hash function to generate a symbol value that is a key element in the procedure related to the key generation algorithm of Crystals Dilithium. Furthermore, in this embodiment, this level is set to the process executed first in the procedure related to the key generation algorithm of Crystals Dilithium. In FIG. 2, a level with a level value of "1" is described as level 1, a level with a level value of "2" is described as level 2, and a level with a level value of "3" is described as level 3.

[0025] In the procedure related to the Crystals Dilithium key generation algorithm, the first process to be executed is process 01, which generates a 32-byte (256-bit) random number as the symbol value of ζ. In this application, this process 01 is set to level 1. Level 1 is the level at which processes are executed from the beginning of the procedure related to the Crystals Dilithium key generation algorithm.

[0026] In addition, in the key generation algorithm of Crystals Dilithium, the process of applying a hash function to generate a symbol value that is a key element is a process 02 in which a hash function is applied to the symbol value of ζ to generate each of the symbol values ​​of ρ, σ, and K, and a process 03 in which a hash function is applied to the symbol value of σ to generate each of the symbol values ​​of s1 and s2. In this embodiment, level 2 is set for process 02, and level 3 is set for process 03. Note that although the CRH function is used in process 07, the symbol value of tr generated in process 07 is generated from the symbol values ​​of ρ and t1 that are key elements, and therefore the symbol value of tr cannot be replaced with a random number.

[0027] Level 1 is a level where the procedure related to the Crystals Dilithium key generation algorithm starts from the first process, process 01. For this reason, in level 1, the number of calculations of the hash function, which is a heavy load, cannot be reduced. However, the length of the random number required to execute this procedure from process 01 according to level 1 is 32 bytes (256 bits), which is the length of the ζ symbol value generated in process 01. Therefore, level 1 can be said to be a memory-intensive level.

[0028] Level 2 is a level where the procedure related to the Crystals Dilithium key generation algorithm starts from process 02, which generates the symbol values ​​of ρ, σ, and K. When starting this procedure from process 02 according to level 2, the calculation of the hash function for generating the symbol values ​​of ρ, σ, and K can be omitted, so the number of calculations of the hash function, which has a heavy processing load, can be reduced by one. In addition, the length of the random number required to simplify this procedure at level 2 is 96 bytes. This length is the sum of the lengths of the symbol values ​​of ρ, σ, and K. The length of the random number generated when starting this procedure from process 02 according to level 2 is larger than that generated at level 1, but since the number of calculations of the hash function can be reduced by one at level 2, level 2 can be said to be a level that emphasizes balance.

[0029] Level 3 is a level where the procedure related to the Crystals Dilithium key generation algorithm starts from process 03, which generates the symbol values ​​of s1 and s2. When starting this procedure from process 03 according to level 3, the calculation of the hash function for generating the symbol values ​​of s1 and s2 can be omitted. In addition, when starting this procedure from process 03 according to level 3, the calculation of the hash function executed in process 02 before process 03 can be omitted. Therefore, when starting this procedure from process 03 according to level 3, the number of calculations of the hash function, which has a heavy processing load, can be reduced by two. In addition, the length of the random number required to simplify this procedure at level 3 is 3168 bytes. This length is the sum of 96 bytes, which is the sum of the lengths of the symbol values ​​of ρ, σ, and K, and 3072 bytes (1536 bytes x 2), which is the sum of the lengths of the symbol values ​​of s1 and s2. This length is larger than the length of the random numbers generated at levels 1 and 2, but since level 3 reduces the number of hash function calculations by two, level 3 can be considered a performance-oriented level.

[0030] From here, a device to which the present invention is applied will be described. In this application, the device to which the key pair generation method disclosed in this application is applied is an IC card. IC cards include a SIM (Subscriber Identity Module) attached to a smartphone or the like, an embedded SIM, and a USB token. In addition, the key pair generation method disclosed in this application can also be applied to IoT devices.

[0031] Fig. 3 shows a block diagram of the IC card 1. As shown in Fig. 3, the IC card 1 has an IC chip 10. The IC chip 10 includes an interface 101, a microprocessor 100, a RAM 103 (RAM: Random Access Memory), a ROM 102 (ROM: Read Only Memory), and an NVM 104 (NVM: Non-volatile memory). Each of the interface 101, the RAM 103, the ROM 102, and the NVM 104 is connected to the microprocessor 100.

[0032] The microprocessor 100 is a processing circuit that controls the IC chip 10. The RAM 103 is a main storage device of the IC chip 10. The ROM 102 is a non-volatile memory that cannot be electrically rewritten. The NVM 104 is a non-volatile memory that can be electrically rewritten. The interface 101 is a circuit that controls communication with an external device.

[0033] Compared with a general personal computer, the hardware resources of the IC chip 10 mounted on the IC card 1 are scarce. Therefore, when the key generation algorithm of Crystals Dilithium is executed on the IC card 1, it is necessary to adjust the balance between performance and memory according to the hardware resources (the processing power of the microprocessor 100 and the capacity of the RAM 103) of the IC chip 10 mounted on the IC card 1 or the purpose. To achieve this, the IC card 1 according to this embodiment is mounted with a program to which the key pair generation method disclosed in this application is applied. The memory for storing this program is the ROM 102 or the NVM 104. By executing this program, the microprocessor 100 of the IC chip 10 functions as the key pair generation unit 11.

[0034] Fig. 4 is a diagram for explaining a key pair generation method. Fig. 5 is a diagram for explaining the operation of the key pair generation unit 11 included in the IC card 1. With reference to Fig. 4, a key pair generation method applied to the IC card 1 will be explained. With reference to Fig. 5, an operation of the key pair generation unit 11 included in the IC card 1 when the level is set according to the contents shown in Fig. 2 will be explained. The explanations of Figs. 4 and 5 also serve as an explanation of the computer program disclosed in the present application.

[0035] First, a key pair generation method according to the invention disclosed in this application will be described with reference to Fig. 4. When the IC card 1 generates a key pair for Crystals Dilithium, such as for generating an electronic signature, a program using the key pair generation method disclosed in this application is started in the IC card 1, and the microprocessor 100 functions as the key pair generation unit 11.

[0036] When generating a key pair for Crystals Dilithium, the key pair generating unit 11 of the IC card 1 checks the level set in the IC card 1 at this point in time (step S1). This level is a level that simplifies the procedures related to the key generation algorithm of Crystals Dilithium. Information indicating the level to be set in the IC card 1 can be stored in any one of ROM 102, RAM 103, or NVM 104. The process of checking the level is a process of reading the information indicating the level from these memories.

[0037] Next, the key pair generation unit 11 of the IC card 1 generates a random number of a length required to simplify the procedure related to the key generation algorithm of Crystals Dilithium at the level confirmed by the key pair generation unit 11 (step S2). The length of the random number is a value based on the length of the symbol value generated by the process corresponding to the level, the symbol value generated by the previous process, and the length of the symbol value generated by applying the hash function.

[0038] Next, the key pair generation unit 11 of the IC card 1 replaces the symbol value required to start this procedure at the level confirmed by the key pair generation unit 11 with a random number, executes this procedure by processing according to the confirmed level (step S3), and ends the procedure in Fig. 4. Replacing the symbol value with a random number means using a part of the random number as the symbol value. For example, ρ, σ, and K generated in process 02 use 96 bytes of random numbers divided into 32 bytes each. For example, the first 32 bytes are used for ρ, the middle 32 bytes are used for σ, and the last 32 bytes are used for K.

[0039] Next, with reference to Fig. 5, the operation of the key pair generating unit 11 included in the IC card 1 when the level is set as shown in Fig. 2 will be described. As in Fig. 4, when the key pair generating unit 11 of the IC card 1 generates a key pair for Crystals Dilithium, it checks the level set in the IC card 1 at this point (step S10).

[0040] The key pair generation unit 11 of the IC card 1 checks whether the level set in the IC card 1 at this point is level 1 (step S11). If the level set in the IC card 1 is level 1, the key pair generation unit 11 of the IC card 1 executes the Crystals Dilithium key generation algorithm from the first step 01 (step S12) and generates a 32-byte random number to be used as the symbol value of ζ (step S13). Then, the key pair generation unit 11 of the IC card 1 uses the symbol value of ζ to execute the steps from step 02 onwards in order (step S14), and the procedure in FIG. 5 ends.

[0041] If the level set in the IC card 1 at this time is not level 1, the key pair generation unit 11 of the IC card 1 checks whether the level set in the IC card 1 at this time is level 2 (step S15). If the level set in the IC card 1 is level 2, the key pair generation unit 11 of the IC card 1 executes the Crystals Dilithium key generation algorithm from process 02 (step S16) and generates a 96-byte random number to be used to replace the symbol values ​​of ρ, σ, and K (step S17). Then, the key pair generation unit 11 of the IC card 1 replaces the symbol values ​​of ρ, σ, and K with the 96-byte random number, and executes the processes from process 03 onwards in order (step S18), and the procedure of FIG. 5 ends.

[0042] If the level set in the IC card at this time is not level 2, the key pair generation unit 11 of the IC card 1 checks whether the level set in the IC card 1 at this time is level 3 (step S19). If the level set in the IC card 1 is level 3, the key pair generation unit 11 of the IC card 1 executes the Crystals Dilithium key generation algorithm from process 03 (step S20) and generates a 3168-byte random number to be used to replace the symbol values ​​of ρ, σ, K, s1, and s2 (step S21). Then, the key pair generation unit 11 of the IC card 1 replaces the symbol values ​​of ρ, σ, K, s1, and s2 with the 3168-byte random number, and executes the processes from process 04 onwards in order (step S22), and the procedure of FIG. 5 ends.

[0043] If the level set in the IC card at this point is not level 3, the key pair generation unit 11 of the IC card 1 executes exception processing (step S23), and the procedure in Fig. 5 ends. In this exception processing, program code for processing the error, such as sending an error message, is executed.

[0044] In this way, in the IC card 1 of this embodiment, a level that simplifies the procedure related to the Crystals Dilithium key generation algorithm is set for the first process to be executed and the process of applying a hash function to generate a symbol value that is a key element, and by making it possible to start this procedure from the level set in the IC card, it is possible to adjust the balance between performance and memory according to the level set in the IC card.

[0045] In this embodiment, the number of levels set in the IC card 1 is three, but the number of levels is not limited to this. For example, when adjusting the balance between performance and memory according to the hardware resources of the IC chip 10 mounted on the IC card 1, one level according to the hardware resources of the IC chip 10 is set in the IC card. When adjusting the balance between performance and memory according to a purpose, one or a plurality of levels are set in the IC card 1 according to the purpose. The level according to the purpose can be linked to a command to be processed by the IC card 1. Also, a dedicated command for setting the level may be prepared. [Explanation of symbols]

[0046] 1 IC card 100 Microprocessors 11 Key Pair Generation Unit

Claims

1. 1. A method for generating a Crystals Dilithium key pair, comprising: A step a) of checking a level at which the microprocessor simplifies a procedure related to a key generation algorithm of the Crystals Dilithium when generating a key pair of the Crystals Dilithium; b) generating a random number of a length required for simplifying the procedure at the identified level by the microprocessor; a step c of the microprocessor replacing a symbol value required when starting the procedure at the confirmed level with the random number, and executing the procedure through processing according to the confirmed level; A key pair generation method that performs

2. 2. The method of claim 1, wherein at least said level is set for a process of generating a symbol value serving as a key element by applying a hash function.

3. A device for generating a Crystals Dilithium key pair, comprising: A device having a key pair generation unit that performs the following steps when generating a Crystals Dilithium key pair: a step a) of confirming a level at which to simplify a procedure related to a Crystals Dilithium key generation algorithm; a step b) of generating a random number of a length required to simplify the procedure at the confirmed level; and a step c) of replacing a symbol value required to start the procedure at the confirmed level with the random number and executing the procedure through processing corresponding to the confirmed level.

4. 4. The device according to claim 3, wherein the level is set at least for a process of generating a symbol value serving as a key element by applying a hash function.

5. A computer program for implementing in a device for generating a Crystals Dilithium key pair, comprising: The microprocessor implemented in the device When generating a Crystals Dilithium key pair, a step a of identifying a level of simplification of a procedure related to the Crystals Dilithium key generation algorithm; b) generating a random number of a length required to simplify the procedure at the identified level; a step c of substituting the random number for a symbol value required when starting the procedure at the confirmed level, and executing the procedure through processing corresponding to the confirmed level; A computer program that executes the following:

6. 6. The computer program according to claim 5, wherein the level is set at least for a process of generating a symbol value serving as a key element by applying a hash function.

Images