Information processor and information processing method

Abstract

To safely perform a discrete Fourier transform on a plurality of polynomials produced by dividing.SOLUTION: An information processor which converts k pieces of first polynomials obtained by dividing an n-th-order polynomial into k pieces of second polynomials includes: a calculation unit which calculates each second polynomial in the k pieces of second polynomials by adding noise to a value obtained by substituting a predetermined a value obtained by substituting the n-th root of the given value on each first polynomial in the k pieces of first polynomials.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a technique for transforming a polynomial into another polynomial. [Background technology]

[0002] One of the threats to cryptography is a side-channel attack. A side-channel attack is an implementation attack that obtains internal, hidden information by physically observing the hardware. With the spread of IC cards and IoT devices, there are more and more situations where cryptographic devices can be directly touched. To use cryptography safely, measures are needed to prevent important information from being stolen through side-channel attacks.

[0003] A countermeasure called masking implementation is known to counter side channel attacks. The most common masking implementation is defined as SNI (Strong Non-Interference) secure, as disclosed in Non-Patent Document 1. This masking implementation method divides secret information (such as a polynomial) into k pieces, thereby guaranteeing security even if k-1 pieces of information are stolen. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Strong Non-Interference and Type-Directed Higher-Order Masking. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS '16). Association for Computing Machinery, New York, NY, USA, 116-129. https: / / doi.org / 10.1145 / 2976749.2978427 Summary of the Invention [Problem to be solved by the invention]

[0005] The above-mentioned masking implementation is a basic countermeasure against side channel attacks, but from a practical standpoint, it has the problem of slow processing speed. To speed up calculations in masking implementation, there is a method that uses the fast Fourier transform (FFT), which can perform polynomial multiplication quickly. The FFT is a type of discrete Fourier transform.

[0006] However, the conventional technology has a problem in that there is no method for safely performing a discrete Fourier transform on the multiple polynomials that are generated by division.

[0007] The present invention has been made in view of the above points, and has as its object to provide a technique for safely performing a discrete Fourier transform on a plurality of polynomials resulting from division. [Means for solving the problem]

[0008] According to the disclosed technology, there is provided an information processing device that converts k first polynomials obtained by dividing an n-th degree polynomial into k second polynomials, the information processing device comprising: An information processing device is provided that includes a calculation unit that calculates each second polynomial in the k second polynomials by adding noise to a value obtained by substituting an nth root of a predetermined value for each first polynomial in the k first polynomials. [Effects of the Invention]

[0009] According to the disclosed technology, it is possible to safely perform a discrete Fourier transform on the multiple polynomials generated by division. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a configuration diagram of an information processing device 100. FIG. [Figure 2] FIG. 1 is a diagram showing an outline of processing according to the present embodiment. [Figure 3] FIG. 2 is a diagram showing a processing procedure of the information processing device 100. [Figure 4] FIG. 10 is a diagram for explaining a usage example. [Figure 5] FIG. 1 illustrates an example of a hardware configuration of an information processing device 100. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0012] In this embodiment, a technique for safely performing a discrete Fourier transform on a plurality of polynomials obtained by division, which is an operation necessary for masking implementation, will be described. In this embodiment, it is assumed that an FFT is used as the discrete Fourier transform, but the technique according to the present invention can be applied to any discrete Fourier transform other than the FFT.

[0013] (Device configuration example) 1 shows an example of the configuration of an information processing device 100 according to this embodiment. As shown in FIG. 1, the information processing device 100 includes an input unit 110, a calculation unit 120, and an output unit .

[0014] Polynomials to be transformed are input from the input unit 110. The calculation unit 120 performs processing to transform a plurality of polynomials into a plurality of other polynomials by a discrete Fourier transform (specifically, an FFT) that ensures safety by adding noise. The output unit 130 outputs, for example, the transformed polynomials.

[0015] (Processing Overview) In the standardized quantum-resistant cryptography method called FALCON (Fast-Fourier Lattice-based Compact Signature over NTRU), the masking implementation calculation performs an FFT on multiple polynomials obtained by dividing the polynomials. However, a single algebraic transformation such as an FFT is not secure against implementation attacks.

[0016] Therefore, the calculation unit 120 combines an FFT (called a convert function) and a refresh function (a function using random numbers) to realize processing related to a secure masking implementation. That is, by performing a sum calculation in a masked state realized by combining the convert function and the refresh function, the coefficients of the polynomial after conversion can be calculated.

[0017] The same applies to the inverse transformation, and the calculation unit 120 can safely restore the transformed polynomial to a polynomial in the original space by combining an iFFT (inverse fast Fourier transform) as a conversion function with a refresh function.

[0018] More specifically, the FFT as the conversion function according to this embodiment is a polynomial related to x, where x is an n-th root of 1 (ξ n 2j+1 ) and converts it into a polynomial with coefficients that have the values ​​obtained by the calculation. In particular, for this function, FFT(a(x))=(a(ξ n 2j+1 )) j holds and is a homomorphism.

[0019] The refresh function according to this embodiment is a function that converts distributed values ​​into new distributed values ​​so that their sum does not change. For n values, the value before conversion is a i Let the converted value be b i Then, the refresh function can be expressed as follows:

[0020] {a i} n―>{b i} n , where Σ n i=1 a i =Σ n i=1 b i FIG. 2 shows an example of FFT / iFFT conversion when the technology according to this embodiment is applied to FALCON. In FIG. 2, when the polynomial is "Q[x] / (x n +1) d The description that the element is "FALCON" is merely an example of application to FALCON, and the technology according to the present invention is not limited to this.

[0021] "(a j (x)) j " is the j-th polynomial when a(x) is divided into k polynomials, and by transforming this with an FFT combined with a refresh function, the equation on the right can be obtained. A detailed example of the calculation method will be given later.

[0022] In addition, for the transformed expression, iFFT combined with a refresh function is used to calculate "(b j (x)+ε j ·c j (x)) j " is obtained by combining the refresh function (FFT+iFFT) and the "(a j (x)) j " is a polynomial that distributes (conceals) "(a j (x)) j " and "(b j (x)+ε j ·c j (x)) j " is the same as the sum of "

[0023] (Processing Procedure) Fig. 3 is a diagram showing a processing procedure (algorithm) executed by the calculation unit 120. The processing procedure will be described with reference to Fig. 3. Note that, as a more general explanation, the explanation will be given assuming that a discrete Fourier transform is performed. Since the FFT is a method for efficiently performing the discrete Fourier transform, the explanation here also applies to the FFT.

[0024] Here, we divide an n-th degree polynomial a(x) into k n-th degree polynomials, and perform a discrete Fourier transform with noise to obtain k n-th degree polynomials after the transformation, where n and k are integers greater than or equal to 1.

[0025] The i-th polynomial obtained by dividing a(x) into k parts is a i (x). The j-th (j-th) coefficient of the i-th polynomial obtained by the discrete Fourier transform with noise is b i,j In the following example, i Although the nth root of 1 is substituted for (x), this is just one example. Processing may be performed in which an "nth root of a predetermined value" other than the "nth root of 1" is substituted. The predetermined value may be -1.

[0026] As a preliminary step, the calculation unit 120 calculates n×(k−1) random numbers {ε i,j} k-1,n and k-1 permutations σ of {1, ,n} i However, the random number and permutation must satisfy the following formula 1. If the following formula 1 is satisfied, then ε i,j Any noise (random numbers) may be used as

[0027]

number

[0028] The random numbers and permutations may be generated as preparations before the execution of the algorithm, or may be generated each time the algorithm is executed, immediately before adding noise (random numbers). In either case of generating them as preparations or each time, the calculation unit 120 may generate the random numbers and permutations, or the random numbers and permutations may be externally provided to the calculation unit 120 via the input unit 110.

[0029] Here, it is assumed that the calculation unit 120 has stored the random numbers and permutations in a memory or the like as a result of advance preparation. As shown in "Require" in FIG. 3, first, k polynomials a i (x) (i=1~k), and ξ n j (j=1 to n) is input from input unit 110 to calculation unit 120. Hereinafter, the line numbers in FIG.

[0030] In S1 (step 1) to S13, the calculation unit 120 executes the processes of S2 to S12 while incrementing i by 1 from i=1 to k.

[0031] In steps S2 to S6, while i is not equal to k, the calculation unit 120 performs the substitution σ i Using this, the following equation 2 is calculated for each j (j=1 to n).

[0032]

number

[0033] If i and k are equal, in steps S9 to S11, the calculation unit 120 calculates the substitution σ iFor each j (j = 1 to n), calculate the following equation 3. i,j This means that i in is k.

[0034]

number

[0035] From the above calculation, b shown in Equation 2 and Equation 3 i,j When these are added together for i=1 to k, the result of the second term in Equation 2 and Equation 3 becomes 0. This satisfies the condition of Equation 1.

[0036] That is, in Equation 2 and Equation 3, the terms below ε are noise, and are values ​​that do not exist in the original FFT transform. Therefore, in order to maintain validity, when the k divided polynomials are summed, the noise must cancel out and become 0. The above processing is an example of how to make the noise 0; it adds noise using random numbers up to i=k-1, and when i=k, it makes an adjustment by subtracting the noise up to that point.

[0037] The method for reducing noise to 0 when taking the sum of k polynomials is not limited to the above method. For example, a method may be used in which noise is added using random numbers when i is an odd number, and the noise is reduced when i is an even number.

[0038] For the inverse transform (iFFT) of the transform shown in Figure 3, the coefficient b i,j In Figure 3, we use the polynomial i (x) and its a iThis can be achieved by setting the input to (x) as the "reciprocal of (the nth root of 1)" and multiplying the obtained value (the coefficient of the polynomial) by 1 / n.

[0039] (Example of use) The technology according to this embodiment may be used for any purpose, but for example, the technology according to this embodiment can be used for the above-mentioned FALCON.

[0040] Conventional FALCON algorithms use FFT to speed up polynomial multiplication, but they do not offer an SNI-safe masking implementation. By using the technology of this embodiment, however, it is possible to implement masking in a portion of FALCON (the bold-framed area in Figure 4). Note that in FALCON, the nth root of -1 is substituted for the nth root of 1.

[0041] (Example of hardware configuration) The information processing device 100 described in this embodiment can be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0042] That is, the information processing device 100 can be realized by using hardware resources such as a CPU and memory built into a computer to execute a program corresponding to the processing performed by the information processing device 100. The program can be recorded on a computer-readable recording medium (such as a portable memory) and can be saved or distributed. The program can also be provided via a network such as the Internet or email.

[0043] Fig. 5 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 5 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are interconnected via a bus BS. The computer may further include a GPU.

[0044] A program for realizing processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0045] The memory device 1003 reads and stores the program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes functions related to the information processing device 100 in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) or the like according to the program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, etc., and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0046] (Effects of the embodiment) As described above, the technique described in this embodiment makes it possible to safely perform discrete Fourier transform on the multiple polynomials obtained by division.

[0047] More specifically, when this technology is applied to FALCON, it can efficiently bridge the gap between the use of FFT, a high-speed technology, and masking implementation, which enhances security.

[0048] The following additional notes are provided regarding the above-described embodiments.

[0049] <Additional Notes> (Additional note 1) An information processing device that converts k first polynomials obtained by dividing an n-degree polynomial into k second polynomials, a calculation unit that calculates each of the k second polynomials by adding noise to a value obtained by substituting an n-th root of a predetermined value for each of the k first polynomials; An information processing device comprising: (Additional note 2) The noise is based on a value obtained by multiplying a random number by a permuted nth root, which is a value obtained by permuting the nth root of the predetermined value. Item 1. An information processing device according to item 1. (Additional note 3) The sum of k values ​​obtained by multiplying the random number by the n-th root of permutation is 0. Item 2. An information processing device according to claim 2. (Additional note 4) An information processing method executed by an information processing device that converts k first polynomials obtained by dividing an n-degree polynomial into k second polynomials, the method comprising: a step of calculating each second polynomial among the k second polynomials by adding noise to a value obtained by substituting an n-th root of a predetermined value for each first polynomial among the k first polynomials; An information processing method comprising: (Additional note 5) A non-transitory storage medium storing a program for causing a computer to function as the information processing device according to any one of claims 1 to 3.

[0050] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0051] 100 Information processing device 110 Input section 120 Arithmetic section 130 Output section 1000 Drive Device 1001 Recording media 1002 Auxiliary storage 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output Device

Claims

1. 1. An information processing device that converts k first polynomials obtained by dividing an n-degree polynomial into k second polynomials, a calculation unit that calculates each of the k second polynomials by adding noise to a value obtained by substituting an n-th root of a predetermined value for each of the k first polynomials; An information processing device comprising:

2. The noise is based on a value obtained by multiplying a random number by a permuted nth root, which is a value obtained by permuting the nth root of the predetermined value. The information processing device according to claim 1 .

3. The sum of k values ​​obtained by multiplying the random number by the n-th root of permutation is 0. The information processing device according to claim 2 .

4. An information processing method executed by an information processing device that converts k first polynomials obtained by dividing an n-degree polynomial into k second polynomials, the method comprising: a step of calculating each of the k second polynomials by adding noise to a value obtained by substituting an n-th root of a predetermined value for each of the k first polynomials; An information processing method comprising:

Images