Information processor and information processing method

Abstract

To safely calculate a norm of a vector in a state that the vector is divided.SOLUTION: An information processor which calculates a norm of a vector from k pieces divided vectors obtained by dividing the vector includes: a calculation unit which adds noise to at least one of the two divided vectors among the k pieces of divided vectors and calculates the norm by calculating an inner product of the two divided vectors in a state where the noise has been added to calculates the norm.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a technique for calculating the norm of a vector. [Background technology]

[0002] One of the threats to cryptography is a side-channel attack. A side-channel attack is an implementation attack that obtains internal, hidden information by physically observing the hardware. With the spread of IC cards and IoT devices, there are more and more situations where cryptographic devices can be directly touched. To use cryptography safely, measures are needed to prevent important information from being stolen through side-channel attacks.

[0003] A countermeasure called masking implementation is known to counter side channel attacks. The most common masking implementation is defined as SNI (Strong Non-Interference) secure, as disclosed in Non-Patent Document 1. This masking implementation method divides secret information (vectors, polynomials, etc.) into k pieces, and guarantees security even if k-1 pieces of information are stolen. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Strong Non-Interference and Type-Directed Higher-Order Masking. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS '16). Association for Computing Machinery, New York, NY, USA, 116-129. https: / / doi.org / 10.1145 / 2976749.2978427 Summary of the Invention [Problem to be solved by the invention]

[0005] As described above, a basic countermeasure against side channel attacks is masking implementation, which requires calculating the norm of a vector after dividing the vector.

[0006] However, the conventional technology has a problem in that there is no method for safely calculating the norm of a vector after the vector has been divided.

[0007] The present invention has been made in view of the above points, and has an object to provide a technique for safely calculating the norm of a vector after the vector has been divided. [Means for solving the problem]

[0008] According to the disclosed technology, there is provided an information processing device that calculates a norm of a vector from k divided vectors obtained by dividing the vector, the information processing device comprising: a calculation unit that calculates the norm by adding noise to at least one of two divided vectors among the k divided vectors and calculating an inner product of the two divided vectors in a state in which the noise has been added; An information processing device is provided. [Effects of the Invention]

[0009] According to the disclosed technology, it is possible to safely calculate the norm of a vector after the vector has been divided. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a configuration diagram of an information processing device 100. FIG. [Figure 2] FIG. 2 is a diagram showing a processing procedure of the information processing device 100. [Figure 3] FIG. 10 is a diagram for explaining a usage example. [Figure 4] FIG. 1 illustrates an example of a hardware configuration of an information processing device 100. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0012] In this embodiment, by appropriately adding noise using random numbers to the divided vectors, the norm of the vectors can be safely calculated in the divided state. The technology according to this embodiment will be described in detail below.

[0013] (Device configuration example) 1 shows an example of the configuration of an information processing device 100 according to this embodiment. As shown in FIG. 1, the information processing device 100 includes an input unit 110, a calculation unit 120, and an output unit .

[0014] The input unit 110 inputs the divided vector, which is the target of the norm calculation, and passes the input information to the calculation unit 120. The calculation unit 120 safely calculates the norm of the vector while it remains in the divided state. The calculation method will be described in detail later. The output unit 130 outputs the norm calculated by the calculation unit 120.

[0015] (Processing Overview) The processing executed by the calculation unit 120 will now be outlined.

[0016] The state in which vector a is divided into k parts (the set of k divided vectors) is {a i} k It is expressed as a i is the element vector of the set of k divided vectors. a=Σ k i=1 a i where k is an integer equal to or greater than 1.

[0017] The norm ||a|| when vector a is divided into k parts can be calculated using the following formula 1.<x,y> represents the dot product of vector x and vector y.

[0018]

number

[0019] Therefore, in this embodiment, the calculation unit 120 generates random numbers (noise) and adds the random numbers when calculating each inner product, thereby eliminating the dependency and making it impossible to obtain more than k pieces of information.

[0020] (Processing Procedure) Fig. 2 is a diagram showing a processing procedure (algorithm) executed by the calculation unit 120. The processing procedure will be described with reference to Fig. 2. Here, an example will be described in which the norm of vector a is safely calculated while vector a remains divided into k parts.

[0021] As a preliminary step, the calculation unit 120 generates k−1 random number vectors {e i} k-1 Furthermore, the calculation unit 120 generates the k-th random number vector e k e from i=1 to i=k-1 i The sum of (i.e., e k =-Σ k-1 i=1 e i ) from i=1 to i=k. i The sum of these is a 0 vector. k i=1 e i =0.

[0022] The random number vector may be generated as a preparation before the execution of the algorithm, or may be generated each time the algorithm is executed, immediately before adding noise (random numbers). In either case, the random numbers may be generated as a preparation or each time the algorithm is executed, by the calculation unit 120, or may be externally provided to the calculation unit 120 via the input unit 110.

[0023] Here, it is assumed that the calculation unit 120 stores the random numbers in a memory or the like as a preparatory step. First, k vectors a are divided from vector a. i (i=1 to k) is input from input unit 110 to calculation unit 120. Hereinafter, the line numbers in FIG.

[0024] In S1 (step 1), the calculation unit 120 sets N = 0. In S2 to S7, the calculation unit 120 executes the processes of S3 to S5 while incrementing i by 1 from i = 1 to k.

[0025] In S3, the calculation unit 120 calculates a i ´=a i +e i At this point, the noise vector e i This calculation may be performed by generating:

[0026] In S4 and S5, the calculation unit 120 calculates N=N+ for each j from j=1 to k. j ´,a j In S8, the calculation unit 120 calculates N=√N to obtain the calculation result (norm of vector a).

[0027] The above algorithm is an algorithm for calculating the following equation 2.

[0028]

number

[0029] The calculation validity of Equation 2 is shown in Equation 3 below.

[0030]

number

[0031] Also, as mentioned above, e k =-Σ k-1 i=1 e i This is an example of how to remove noise. k i=1 e i = 0, you can add noise in any way. For example, if you need n random numbers, you can generate half the number of random numbers and add e i =-e n-i+1 For example, if i is an odd number, the random number e i Add noise according to the formula, and if i is even, the value e i A method of subtracting the above may be used.

[0032] Also, in the above example, for efficiency reasons, noise is added to only one of the two values ​​used in the dot product calculation, but correctness is maintained even if noise is added to both, so it is also possible to add noise to both.

[0033] (Example of use) The technology according to this embodiment may be used for any purpose, but for example, the technology according to this embodiment can be used for masking implementation of lattice signature FALCON (Fast-Fourier Lattice-based Compact Signature over NTRU), which is a standardized method by the US NIST.

[0034] Conventional FALCON did not have an SNI-secure masking implementation, but by using the technology of this embodiment, it is possible to implement secure masking for a portion of FALCON (the bold-framed area in Figure 3).

[0035] Furthermore, the technology according to this embodiment can be applied to all lattice signatures that base their security on the SIS (Short Integer Solution) problem. That is, in such lattice signatures, norm calculation is generally performed as a criterion for signature verification, and the technology according to this embodiment can be applied thereto.

[0036] (Example of hardware configuration) The information processing device 100 described in this embodiment can be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0037] That is, the information processing device 100 can be realized by using hardware resources such as a CPU and memory built into a computer to execute a program corresponding to the processing performed by the information processing device 100. The program can be recorded on a computer-readable recording medium (such as a portable memory) and can be saved or distributed. The program can also be provided via a network such as the Internet or email.

[0038] Fig. 4 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 4 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are interconnected via a bus BS. The computer may further include a GPU.

[0039] A program for realizing processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0040] The memory device 1003 reads and stores the program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes functions related to the information processing device 100 in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) or the like according to the program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, etc., and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0041] (Effects of the embodiment) As described above, the technology described in this embodiment makes it possible to safely calculate the norm of a vector after the vector has been divided.

[0042] More specifically, when this technology is applied to lattice cryptography, it is expected to improve the security of cryptographic implementation.

[0043] The following additional notes are provided regarding the above-described embodiments.

[0044] <Additional Notes> (Additional note 1) An information processing device that calculates a norm of a vector from k divided vectors obtained by dividing a vector, a calculation unit that calculates the norm by adding noise to at least one of two divided vectors among the k divided vectors and calculating an inner product of the two divided vectors in a state in which the noise has been added; An information processing device comprising: (Additional note 2) The calculation unit calculates the inner products in a state where the noise is added between each of the k divided vectors and each of the k divided vectors, and calculates the root of the sum of the obtained inner products as the norm. Item 1. An information processing device according to item 1. (Additional note 3) The sum of the k noises is a 0 vector. 3. The information processing device according to claim 1 or 2. (Additional note 4) An information processing method executed by an information processing device that calculates a norm of a vector from k divided vectors obtained by dividing a vector, the method comprising: a step of adding noise to at least one of two divided vectors among the k divided vectors, and calculating the inner product of the two divided vectors in a state in which the noise has been added, thereby calculating the norm; An information processing method comprising: (Additional note 5) A non-transitory storage medium storing a program for causing a computer to function as the information processing device according to any one of claims 1 to 3.

[0045] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0046] 100 Information processing device 110 Input section 120 Arithmetic section 130 Output section 1000 Drive Device 1001 Recording media 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output Device

Claims

1. An information processing device that calculates a norm of a vector from k divided vectors obtained by dividing a vector, a calculation unit that calculates the norm by adding noise to at least one of two divided vectors among the k divided vectors and calculating an inner product of the two divided vectors in a state in which the noise has been added; An information processing device comprising:

2. The calculation unit calculates the inner products in a state where the noise is added between each of the k divided vectors and each of the k divided vectors, and calculates the root of the sum of the obtained inner products as the norm. The information processing device according to claim 1 .

3. The sum of the k noises is a zero vector.

3. The information processing device according to claim 1 or 2.

4. An information processing method executed by an information processing device for calculating a norm of a vector from k divided vectors obtained by dividing a vector, the method comprising: a step of adding noise to at least one of two divided vectors among the k divided vectors, and calculating the inner product of the two divided vectors in a state in which the noise has been added, thereby calculating the norm; An information processing method comprising:

Images