Method and apparatus for storing / retrieving a plurality of secret shares

Abstract

A method and apparatus implemented by a computer for storing data corresponding to secret data represented by a plurality of shares are disclosed, each of the plurality of shares having a first number of bits. A plurality of random keys are generated, each random key having a second number of bits less than the first number of bits, and the plurality of random keys being one less than the plurality of shares. For each random key, the generated random key is used as a seed value for a deterministic function that outputs corresponding intermediate data having the first number of bits. A plurality of modulo addition operations are performed to generate working data corresponding to either a modulo addition of the values of the shares having the first number of bits and a modulo addition or inverse modulo addition of the values of the intermediate data corresponding to each of the random keys. Next, the working data and the plurality of random keys are stored. In this way, the data corresponding to the secret data is stored in a compressed format as compared to storing the plurality of shares representing the secret data.

Description

Technical Field

[0001] The present disclosure relates to the storage of secret data such as cryptographic keys. The present disclosure is related to post-quantum cryptographic systems that are implemented in a secure processing environment and utilize masking as a countermeasure against side-channel attacks.

Background Art

[0002] Cryptographic operations involve the use of cryptographic keys. In a symmetric encryption system that uses the same key for message encryption and decryption, it is necessary to prevent the key from being exposed to malicious parties. Similarly, in the case of an asymmetric encryption system that uses a secret key and a public key, it is necessary to prevent the secret key from being exposed to malicious parties. To protect the security of cryptographic keys, it is known to execute cryptographic operations within a secure processing environment having a secure memory and a secure cryptographic processor. An example of such a secure processing environment is a hardware security module.

[0003] Processes executed within a secure processing environment may be vulnerable to side-channel attacks where an attacker learns side-channel information regarding the physical execution of an algorithm. Side-channel information can be derived from many sources such as execution time, electromagnetic radiation, energy consumption, and acoustic emissions. One countermeasure proposed against side-channel attacks is masking, which relies on techniques from the fields of secret sharing and multi-party computation (MPC). As an example, when a

Number

Number

Number

[0004] Cryptographic operations can be performed within a secure processing environment using shares of a cryptographic key instead of the cryptographic key itself. The present disclosure is directed to techniques for securely storing shares of a cryptographic key or other secret data either within or outside a secure processing environment. The problem with storing a cryptographic key represented as multiple shares is that the multiple shares require additional storage compared to the cryptographic key itself. This is particularly a problem when it is desired to store multiple shares in a secure processing environment since the amount of secure memory within a secure processing environment is typically limited.

Summary of the Invention

Means for Solving the Problems

[0005] According to an aspect of the present invention, there is provided a method implemented by a computer for storing secret data represented by a plurality of shares, each of the plurality of shares having a first number of bits. The method includes generating a plurality of random keys, each random key having a second number of bits less than the first number of bits, and the number of random keys being one less than the number of shares. Each random key is used as a seed value for a deterministic function that outputs corresponding intermediate data having the first number of bits. A plurality of modular addition operations including the plurality of shares and the intermediate data associated with each random key are performed to generate working data having the first number of bits and a value corresponding to the inverse modular addition of the value of the intermediate data for each random key with the modular addition of the values of the shares. Next, the working data is stored together with the plurality of random keys. Since the random keys have fewer bits than the shares, the memory requirement is reduced as compared to the memory requirement for storing the plurality of shares.

[0006] According to another aspect of the present invention, there is provided a method implemented by a computer for recovering a plurality of shares corresponding to secret data from stored working data and one or more random keys, each of the plurality of secret shares having a first number of bits, each of the plurality of random keys having a second plurality of bits less than the first number of bits, and the number of one or more random keys being one less than the number of the plurality of secret shares. The method includes determining intermediate data by using a random key as a seed value for a deterministic function that outputs corresponding intermediate data having the first number of bits for one random key or each random key among the one or more random keys. Next, the plurality of secret shares are determined such that the modular addition of the plurality of secret shares corresponds to the modular addition of the working data and the intermediate data corresponding to each of the one or more random keys.

[0007] Examples of the present invention are described by way of example only with reference to the accompanying drawings.

Brief Description of the Drawings

[0008]

Figure 1

Figure 2

Figure 3

Figure 4

[0009] Preamble The specific examples described herein relate to a cryptographic system implemented within a secure processing environment that forms part of a communicatively coupled computing system and securely performs cryptographic operations required by that computing system. For example, the cryptographic system may be provided as a system-on-chip device for inclusion in a larger computing circuit board and / or integrated circuit. The cryptographic system may be implemented in silicon, i.e., either alone (e.g., as an application specific integrated circuit (ASIC)) or as an integrated circuit design manufactured with a larger computing system circuit and / or as a field programmable gate array (FPGA), e.g., in the form of a specific configuration of an FPGA programmed in a suitable hardware description language. In one example, the secure processing environment of the cryptographic module is formed by a hardware security module that provides a trusted processing environment and secure memory. The hardware security module may be tamper-proof and / or tamper-evident, e.g., by using "embedded" hardware, such that attempts to physically access components within the hardware security module are prevented and / or detected.

[0010] An encryption system can be used as a "post-quantum" encryption module or coprocessor, enabling one or more processors of a communicatively coupled computing system to offload complex "post-quantum" encryption operations for fast and secure computations. For example, the encryption system may be configured to implement key establishment and digital signature functions instead of the computing system. The encryption system has a security boundary such that other devices and integrated circuits of the computing system, including the computing system itself, do not have access to the secret data operated on within the encryption system. The encryption system may be configured to autonomously perform post-quantum encryption operations as part of a larger hardware system, such as a larger ASIC or FPGA design.

[0011] The term "post-quantum" is used herein to describe encryption operations and functions that provide protection from attacks by quantum computers. This is a term well known within the field of cryptography. For example, many common public-key algorithms are not post-quantum secure because they can be efficiently broken using a sufficiently powerful quantum computer. These "not quantum-secure" encryption algorithms include those based on the integer factorization problem, the discrete logarithm problem, or the elliptic curve discrete logarithm problem, all of which can be easily solved using Shor's algorithm on a sufficiently powerful quantum computer. Operations and functions that have been demonstrated to be post-quantum secure include those based on one or more of lattice-based cryptography, multivariate cryptography, hash-based cryptography, code-based cryptography, and supersingular elliptic curve isogeny cryptography.

[0012] These example cryptographic systems are suitable for use in a wide variety of computing systems, from Internet servers to embedded devices. In one embodiment, the cryptographic system may be provided as part of a cryptographic system on chip (SoC), enabling many low-cost embedded devices to implement "post-quantum" cryptography and provide "post-quantum" secure systems. For example, functions implemented by a cryptographic arithmetic unit may enable rapid execution of code or lattice-based cryptographic operations by offloading many common low-level binary logic functions such as integer addition, subtraction, and / or multiplication. The cryptographic system may be composed of a set of available functions that may be updated over time or may be pre-programmed. The cryptographic system can quickly compute specific functions by not having to load and interpret individual instructions required by the processor of the coupled computing system. The cryptographic system can be considered a dedicated computing device (i.e., a computer) designed for integration with larger general-purpose computing devices (e.g., for use as a computer within a computer).

[0013] Exemplary Cryptographic System FIG. 1 shows a computing system 1 according to an example. The computer system 1 includes at least one processor 3, an input / output device 5, a main system memory 7, and a removable memory 9 such as a hard disk device. Further, the computing system 1 includes a cryptographic system 11 that provides a secure processing environment in which cryptographic processing operations are executed. In this example, the cryptographic system 11 is embodied within a hardware security module.

[0014] The cryptographic system 11 includes a processor 13, a secure memory 15, and an input / output device 17, enabling communication with the rest of the computer system 1. The secure memory 15 includes a data memory 19, a program memory 21, and a working memory 23. The data memory 19 includes a key store 25 for storing data corresponding to one or more masked cryptographic keys in a compressed format. The program memory 21 stores a packing module 27, an unpacking module 29, a (pseudo) random key generator module 31, a deterministic function module 33, and a cryptographic processing module 35.

[0015] The processor 13 may include a reduced instruction set computer (RISC) processor, such as a RISC-V central processing unit (CPU). The processor 13 may include a 32-bit or 64-bit microprocessor (e.g., an RV32-I / E- / M / C Pluto core, etc.). The processor 13 may include one or more processing cores.

[0016] In this example, the computer system 1 also has access to cloud storage 37 via network communication, e.g., via the Internet.

[0017] The cryptographic processing module 35 of the cryptographic system 11 executes cryptographic processing operations using cryptographic keys. The cryptographic processing operations include a key establishment function having one or more of encryption and decryption, a digital signature function having one or more of digital signature generation and digital signature verification, and a stateful hash-based signature. In this example, the cryptographic system 11 is optimized for not only lattice and code-based cryptography (among other post-quantum approaches) but also "large integer" operations (e.g., operations with large integer values defined by n bits, where n can be, for example, 32 or 64).

[0018] The security of the encryption system 11 is improved by using masked calculations in which secret data (such as a secret key) processed by the computer system 1 is represented within the encryption system 11 by a plurality of secret shares, such that all the secret shares are required to derive information about the secret data. Masked calculations operate on shares of the secret data rather than on the secret data itself, to provide protection from side-channel attacks that attempt to determine the bit pattern of the data being manipulated by the encryption system 11 based on, for example, electromagnetic radiation, fluctuations in power usage, operation timing, or other unintended side channels. The number of secret shares can be configurable or set by the parameters of the encryption system 11 (for example, there may be d secret shares, where d is an integer value). A common value for the number d of secret shares is 2 or 3, but other numbers of shares are possible.

[0019] The encryption system 11 may perform encryption operations using many different encryption keys, and in particular in the case of asymmetric encryption operations, the number of bits of each encryption key can be large. The amount of non-volatile memory within the secure memory 15 may not be sufficient to store a plurality of encryption keys in an uncompressed format, and this problem is exacerbated when the encryption keys are represented by a plurality of shares. The packing module 27 enables a plurality of share objects corresponding to an encryption key to be stored in a compressed format, while the unpacking module 29 enables a plurality of share objects corresponding to an encryption key to be recovered from the stored compressed data. The plurality of recovered shares need not be the same as the plurality of shares prior to compressed storage, since the unpacking module 29 can automatically perform a refresh operation. Such a refresh operation improves protection against side-channel attacks. The (pseudo) random key generator module 31 and the deterministic function module 33 are used during the execution of the packing module 27 and the unpacking module 29, as will be described in more detail below.

[0020] Packing Module The packing module 27 processes a plurality of secret shares corresponding to a cryptographic key to generate compressed data that can be stored in the key store 25 of the cryptographic system 11, or exported to the main system memory 7 or removable memory 9 of the computer system 1, or to the cloud storage 37. In this example, there are d secret shares, where d is any integer greater than 1, each having n bits, and n generally exceeds 1000. In this example, the cryptographic key and the secret shares corresponding to the cryptographic key are numbers modulo q, where q can be a composite number such as 2, 256 that allows byte addition / subtraction, or a prime number such as 3, 9, 257, 3329, 7681, 12289, 65537, or 8380417.

[0021] Figure 2 is a flowchart showing the main operations performed by the packing module 27. As shown, in this example, the packing module uses a (pseudo) random key generator module 31 to generate, at S1, d - 1 random keys. Each of the d - 1 random keys has m bits, where m is smaller than n but large enough (e.g., 128 or 256 bits) to be cryptographically secure.

[0022] Next, the packing module 27 inputs each of the d - 1 random keys as the seed value K of the deterministic function module 37. For each input seed value K, the deterministic function module 37 takes in the seed value K and outputs intermediate data having n bits according to the deterministic function z = f(K) that generates modulo q intermediate data. The deterministic function f(K) may be based on a cryptographic hash function, an extendable output function such as SHAKE128 or SHAKE256, or a block cipher such as AES keyed with K and operating in counter mode, or a stream cipher. The deterministic function f(K) may include a rejection sampler or a similar mechanism to ensure that the output intermediate data is in a modulo q distribution. The deterministic function f(K) may or may not be masked.

[0023] Returning to Figure 2, the packing module 27 then, at S5, performs a series of modulo addition operations on the intermediate data corresponding to the secret shares and the random key in order to generate working data corresponding to the modulo addition of the values of the secret shares and the inverse modulo addition of the intermediate data. To achieve this result, there are many different ways to execute the sequence of modulo addition operations. In this example, the sequence of modulo addition operations is used to avoid starting from the modulo addition of the values of all the secret shares. This is because as a result, the encryption key would be generated, thus causing vulnerability to the direct discovery of the encryption key by side-channel attacks.

[0024] Finally, the packing module 27, at S7, stores the working data and d - 1 random keys as the representation of the encryption key. Since the working data has n bits and each random key has m < n bits, it will be understood that the number of bits required is less than for storing d secret shares. For example, when d = 8, m = 256 bits, and n = 8192 bits, the storage is reduced from 65536 bits to 9984 bits.

[0025] For d = 2, the example of the processing operation in Figure 2 can be represented by the function PackRefresh(S[1], S[2]) as follows. Step 1. K = new random key Step 2. Z = f(K) Step 3. t = S[1] - z (mod q) Step 4. S’ = S[2] + t (mod q) Step 5. return(S’, K)

[0026] Step 1 involves generating a new random key. In step 2, intermediate data z is generated using the deterministic function f(K). Step 3 performs inverse modular addition to subtract the intermediate data z from the first secret share S[1] to generate temporary data t. In step 4, a modular addition operation is performed between the second secret share S[2] and the temporary data t to generate working data S’. Step 5 returns the working data S’ and the random key K. It should be understood that the working data S’ corresponds to the modular addition of the first share S[1] and the second secret share S[2], and the inverse modular addition of the intermediate data z.

[0027] In the more general case where there are any number d of secret shares, the example of the processing operation in Figure 2 can be represented as follows by the function PackRefresh-Long(S[1], S[2], … S[d]): Step 1. S’ = S[1] Step 2.1. for i = 1, 2, … d - 1 do: Step 2.2. (S’, K[i]) = PackRefresh(S’, S[i + 1]) Step 2.3. end do Step 3. return(S’, K[1], K[2] … K[d - 1])

[0028] In this example, S’ represents a working variable that forms the working data at the end of the routine. In step 1, the value of the first share is assigned to the working variable S’. Steps 2.1 to 2.3 iterate the above PackRefresh algorithm using the working variable S’ and the share S[i + 1] as inputs for the remaining shares S[2] to S[d]. With each iteration, the value of the secret share S[i] is added to the working variable, and the intermediate data z[i] corresponding to the random key K[i] is subtracted from the random data. Next, step 3 returns the working data S’ and d - 1 random keys.

[0029] Unpacking Module It should be understood that the stored work data corresponds to the value of the encryption key [[S]], and the intermediate data z corresponding to each random key K is subtracted. The unpacking module 29 generates a set of d secret shares corresponding to the encryption key. As will become clear later, the set of d secret shares generated by the unpacking module 29 is generally not the same as the set of d secret shares used to generate the work data. Therefore, the unpacking module 29 can refresh the set of secret shares compared to the secret shares used to generate the stored work data.

[0030] Figure 3 is a flowchart showing the main operations performed by the unpacking module 29. In S21, the unpacking module 29 retrieves the stored work data and one or more random keys from the memory locations stored by the packing module 27. Next, in S23, the unpacking module 29 determines the random key or the intermediate data corresponding to each random key by using the random key as the seed value of the deterministic function. Next, in S25, the unpacking module determines a plurality of secret shares that satisfy the condition that the modulo addition of the determined plurality of secret shares corresponds to the modulo addition of the work data and the intermediate data corresponding to the random key or each random key.

[0031] It should be understood that when the work data generated by the packing module 27 corresponds to the modulo addition of the values of the first plurality of secret shares and the inverse modulo addition of the random key or the intermediate data corresponding to each random key, the modulo addition of the plurality of secret shares generated by the unpacking module 29 is equal to the modulo addition of the first plurality of secret shares, and thus corresponds to the encryption key.

[0032] When d = 2, the example of the processing operation in Figure 3 can be represented by the function UnPackRefresh(S’,K) as follows: Step 1. t = optional random data having n bits Step 2. S[1]=S’+t (mod q) Step 3. S[2]=f(K)-t (mod q) Step 4. return(S[1],S[2])

[0033] In this example, in Step 1, the refresh data t is randomly generated at will from a uniform random distribution. The refresh data t has n bits, which is the same number of bits as each of the secret shares. In Step 2, the first secret share is set to the modulo addition of the working data S’ and the refresh data t. In Step 3, the second secret share is set to the inverse modulo addition of the intermediate data corresponding to the random key K and the refresh data t. In Step 4, the first and second secret shares are returned.

[0034] By generating new refresh data t each time the function UnPackRefresh(S’,K) is executed, different sets of shares can be generated from the same compressed data. This is an optional feature. Instead, the refresh data can be distributed or set to a fixed value to reduce computational requirements. However, from a security perspective, generating new random refresh data each time the function UnPackRefresh(S’,K) is executed improves security against side-channel attacks.

[0035] In a more general case where there are any number d of secret shares, the example of the processing operation in Figure 2 can be represented as follows by the function UnPackRefresh-Long(S’,K[1],K[2],…K[d-1]): Step 1. v=S’ Step 2.1. for i=1,2,…d-1 do: Step 2.2. (v,S[i])=UnPackRefresh(v,K[i]) Step 2.3. end do Step 3. S[d]=v In step 1, the value of the working variable v is set to the value of the working data S'. Steps 2.1 to 2.3 use the working variable v and the random key K[i] as inputs to iterate the above UnPackRefresh algorithm to generate the updated value of the working variable v and the secret share S[i] corresponding to the random key K[i]. Finally, in step 3, the value of the working variable v after the iteration is assigned to the last secret share S[d].

[0036] Encryption processing module In masked cryptographic calculations, arithmetic can be converted to corresponding masked operations. For example, an unmasked (plain) arithmetic operation between variables X and Y that results in Z: Z = X op Y is converted to a series of arithmetic operations from the shares {X i} and {Y i} to provide the share {Z i}. This example is shown in Figure 4.

[0037] Figure 4 shows an operation 400 performed on two input data variables 410 and 420 (shown as X and Y). Each of the two input variables 410 and 420 is divided into respective sets of data shares 430 and 440. In this example, there are three data shares such that the first input variable 410 is divided into data shares 432, 434, and 436 and the second input variable 420 is divided into data shares 442, 444, and 446. Each of the data shares may include a sequence of bits of the same length as the sequence of bits representing the input variable. In the example of Figure 4, the input variables are divided into data shares using Boolean masking, but different forms of masking may be available as configurable or selectable control parameters. For example, there may be an option to generate data shares using either Boolean masking or arithmetic masking (among others). The cryptographic system may be further configured to convert between different forms of masking for specific operations.

[0038] Data sharing can be used to perform operation 450. Operation 450 is executed as a set of independent operations 452, 454, and 456 that each receive corresponding data shares from two sets of data shares 430 and 440. For example, operation 452 is executed using data shares 432 and 442 as inputs, operation 454 is executed using data shares 434 and 444 as inputs, and operation 456 is executed using data shares 436 and 446 as inputs. Each independent operation 452 - 456 is a repetition of the same arithmetic unit operation. Each of the masked arithmetic operations 452 - 456 (including conversion to the masked form) is designed such that all intermediate variables are statistically independent from the (secret) sum of the shares. Operations 452 - 456 are executed on secret data shares, but the data shares are not "folded" to reform the secret. Thus, the original secret is not "exposed" to side-channel attacks.

[0039] In FIG. 4, after operation 450 is performed on each pair of data shares, the results obtained from each of the individual operations 452, 454, and 456 are provided as respective outputs 462, 464, and 466. The output set of data shares 460 can be reconfigured to provide the result of operation 450 applied to input variables 410 and 420 (i.e., Z = oper(X,Y)). In the example of FIG. 4, the reconfiguration may be performed by XORing the individual data shares (i.e., [Number] ). This may be done, for example, when providing the data as output via a set of bus interfaces 120, or as a final step after operation 450 is completed, and may be performed externally (e.g., by an external computing system), or even only if the data shares are encrypted as described below.

[0040] In certain embodiments (and / or certain configurations), secret information may be maintained as data shares throughout the key life cycle. For example, a secret key may be generated as shares, packed and stored in a compressed format, then unpacked and loaded as shares into memory (e.g., both internal and external memory, with the latter via the cryptographic register 122), and used as shares (e.g., in cryptographic operations). At the end of the key's life, the shares may be zeroed. In certain cases, only secret information is operated on the data shares. In these cases, a set of data shares representing the secret information may be folded together after encryption (e.g., using an encryption and / or encapsulation algorithm implemented by a cryptographic system) because the data is no longer "secret" (i.e., it is protected by encryption). For example, a stream cipher may generate a ciphertext C from a plaintext P and a key stream Z = encrypt(key) by C = P XOR Z, where decryption is performed as P = C XOR Z. If the encryption is implemented in a masked manner, key stream shares Z1, Z2, Z3 may be generated from masked keys (key1, key2, key3). In this case, different ciphertext portions may be encrypted using their respective key stream shares C1 = P1 XOR Z1, C2 = P2 XOR Z2, and C3 = P3 XOR Z3. Following encryption, it is possible to fold the masks without exposing the secret information, i.e., C = C1 XOR C2 XOR C3 here. C may be safely exported in an encrypted form that does not reveal information about P.

[0041] The example of FIG. 4 shows the case of Boolean masking, but in other examples, arithmetic masking may be used instead. In certain cases, arithmetic masking may be used in the form of additive masking to generate data shares. Additive masking is similar to XOR masking but uses integer or modular addition. In certain cases, the shares are calculated as X = (Σ d X i ) mod (q), where q is a small prime number that depends on the algorithm, or q = 2n can be a modulus. As an example, additive masking can be implemented by wrap-around addition modulus 2 16 and may be implemented by. The fixed constant q can vary depending on different cryptographic algorithms. For many cryptographic algorithms, q is of size less than 16 bits or 32 bits, or strictly a power of 2. As an example, the KYBER algorithm uses a q value of 3329, and the SABER algorithm uses a value of 2 13 . The q values of different cryptographic algorithms can be hard-coded within the implementation of the cryptographic arithmetic unit 130. As an example, for the number X = 1238, since X1 + X2 + X3 == 4567 mod q = 1238 (using modular wrap-around addition), it can be represented using shares X1 = 1111, X2 = 2222, and X3 = 1234 with a q value of 3329.

[0042] i In a particular example, the cryptographic system 110 may be arranged to perform an operation to convert between two different masking formats. For example, a linear operation such as XOR or addition can be applied independently to a data share only if the data share is in the corresponding masking format. In some cases, Boolean masking may be converted to arithmetic masking or vice versa. When Boolean masking is converted to arithmetic masking, this can be performed by determining a second data share set {Y

Number

Number

[0043] The specific arithmetic primitive applied as an operation by the arithmetic unit 136 can be achieved with the aid of the conversion function within the masked operation mode (or the conversion function can be implemented directly by the operation). For example, in the case of Boolean masked addition and subtraction, the set of output data shares {Z i} is such that the XOR sum satisfies X + Y = Z or X - Y = Z (mod q), for the input shares {X i} and {Y i} may be calculated from. Other masked functions may follow the same pattern. Bitwise logic in the masked mode can be performed, for example, by applying AND, OR, and XOR operations to arithmetically masked data shares or Boolean masked data shares. Similarly, shifts, rotations, and bit operations can be applied to arithmetically masked data shares or Boolean masked data shares. Comparisons can be performed by analyzing the equivalence or order of masked variables (e.g., using less than or greater than). The result of a comparison can also be masked (e.g., the true or false value can be a masked bit). Post-quantum cryptography field arithmetic and special functions can also be applied to masked variables.

[0044] Certain post-quantum cryptographic operations operate on ring polynomials. For example, lattice-based cryptography utilizes ring polynomial and matrix multiplications. Many of these multiplications are between a secret polynomial and a public polynomial. In these cases, the secret polynomial may be masked, and there is no need to mask the public polynomial. In the case of multiplying a secret polynomial X and a public polynomial C, the secret polynomial can be split into d data shares for the masked operation mode, such as CX = CX1 + CX2 + CX3 (mod q). In this case, multiplying by a constant (the public polynomial C) only increases the complexity by O(d). This means that lattice-based post-quantum cryptography is particularly suitable for the masked operation mode. By comparison, multiplying two masked representations, e.g., (X1 + X2 + X3)*(Y1 + Y2 + Y3), is at least O(d) with respect to the number of shares 2)(i.e., secondary) overhead is incurred. Similarly, in the case of many number theoretic transforms (NTTs) used to implement rings and module algebraic objects used in known lattice cryptoschemes, only one input of the NTT multiplication needs to be masked. This limits the overhead of applying the masking mode. Lattice cryptography further uses mixed bit-oriented operations such as right shifts, "rounding", and masked comparisons. These tasks can be achieved by more efficient partial masking transforms adjusted for each operation.

[0045] Masking is applied in the examples herein as a countermeasure against side channel attacks. The cryptographic system 11 provides hardware-accelerated cryptographic operations with integrated hardware masking support. Masking can be configured to meet the requirements of "non-invasive attack countermeasures" described in the FIPS 140-3 and ISO 19790 security standards (e.g., those defined in section 7.8 of ISO / IEC 19790:2012(E)), both of which are incorporated herein by reference. Tests of the effectiveness of countermeasures such as masking described herein may be performed using the procedures described in ISO / IEC 17825:2016(E) "Testing methods for the mitigation of non-invasive attack classes against cryptographic modules", which is incorporated herein by reference, more generally, those referred to as TVLA (Test Vector Leakage Assessment).

[0046] In an example of the present invention, the cryptographic processing module 35 executes data processing operations related to one or both of the KYBER and DILITHIUM post-quantum cryptographic algorithms.

[0047] Variations and further examples Regarding the packing module 27 and the unpacking module 29, it will be understood that there are many variant forms of the described algorithms that can be used to achieve the same result. For example, the order of processing pairs in PackRefresh-Long does not need to proceed sequentially with a single working variable, but if d is a power of 2 such as 8 or 16, it can be calculated in parallel using the following: (S’[i],K[i]) = PackRefresh(S[2*i-1],S[2*i]) for I = {1,2,..d / 2} The first iteration of such an array generates d / 2 random keys K[i] and d / 2 shares S’[i]. Next, the shares S’[i] are processed in parallel until a single share S’ remains, creating d / 4 random keys K[i] and d / 4 shares S’[i], at which point d-1 random keys are generated in the same way as the sequential calculation.

[0048] The secret shares can be in various formats, such as, for example, vector format, matrix format, or polynomial format. Thus, the intermediate data and the working data can also be in various formats to match the format of the secret shares.

[0049] It will be understood that the secret shares in the described examples correspond to the cryptographic key, but the secret shares may represent other forms of secret data. For example, the secret shares can represent financial data such as a bank account number.

[0050] In the above example, the work data generated by the packing operation corresponds to the modular addition of the share values and the inverse modular addition of the values of the intermediate data corresponding to each of the random keys. During the unpacking operation, however, the multiple secret shares correspond to the modular addition of the work data and the intermediate data corresponding to each of one or more random keys. Alternatively, the packing operation can include the modular addition of the share values and the values of the intermediate data corresponding to each of the random keys, and during the unpacking operation, the multiple secret shares correspond to the modular addition of the work data and the inverse modular addition of the intermediate data corresponding to each of one or more random keys.

[0051] The specific examples described herein provide a device (e.g., a cryptographic system or a coprocessor) that can perform post-quantum cryptography using masked arithmetic, i.e., data provided as masked data shares for side-channel protection. The masked operation mode can utilize one or more of Boolean and arithmetic masking, and the device can provide a conversion between (at least these) different masking formats. The examples described provide a novel cryptographic system structure or configuration that enables both accelerated post-quantum cryptographic processing and high security against side-channel attacks by performing masking operations in a flexible and efficient manner.

[0052] The specific examples described herein provide a device (e.g., a cryptographic system or a coprocessor) that not only aids in and / or accelerates cryptographic computations, but can also autonomously perform certain complete post - quantum cryptographic operations. For example, the device enables key establishment and encryption of public keys such as generation of public - private key pairs, encapsulation and / or encryption, and decapsulation and / or decryption. Further, the device enables not only digital signature functions such as generation of public - private integrity key pairs, signature generation, and signature verification, but also stateful hash - based signatures such as assistance and / or acceleration of key generation, signature generation, and / or signature verification functions. Such a device may be provided as a system - on - chip (e.g., integrated within a silicon design and / or provided as a separate FPGA / ASIC chip that can be attached).

[0053] The specific examples described herein provide a cryptographic system that can provide secure cryptographic computations. For example, it can implement one or more of the following post - quantum public - key cryptography algorithms: classical McEliece, (CRYSTALS - )KYBER, NTRU, SABER, BIKE, FrodoKEM, HQC, NTRU Prime, SIKE, and SIDH (Supersingular Isogeny Diffie - Hellman), and one or more of the following post - quantum digital signature algorithms: (CRYSTALS - )DILITHIUM, FALCON, Rainbow, GeMSS, and Picnic. Further details of these algorithms can be found in the available NIST publications of the "Post - Quantum Cryptography Project" and the publications of the CRYSTALS project, "Cryptographic Suite for Algebraic Lattices - Kyber and Dilithium", which are incorporated herein by reference.

[0054] The specific examples described herein have a control unit that controls cryptographic operations (so-called "no-touch" operations) without processing sensitive data. For example, the control unit may not have access to sensitive data within the cryptographic mathematical unit during the operation.

[0055] The specific examples further provide a way in which a control unit or a processor can track the flow of sensitive information within a cryptographic system, but without having access to that data, because the control unit or the processor can provide security tracking of secret data throughout the cryptographic operation.

[0056] The functions provided within the secure processing environment can be implemented in software, hardware, or a combination of software and hardware. Thus, when executed by a processor, the packing module 27, the unpacking module 29, and the cryptographic processing module 35 can be implemented as processor-executable instructions that execute the respective functions, or as hardware circuits that execute the respective functions, such as an FPGA or an ASIC, or as a combination of processor-executable instructions and hardware.

[0057] The above examples should be understood as illustrative. Further examples are envisioned. Although the specific components of each example have been described separately, it should be understood that the functions described with reference to one example may be suitably implemented in another example, and that the specific components may be omitted depending on the embodiment. It should be understood that any feature described in connection with any one embodiment may be used alone or in combination with other features described, and may also be used in combination with one or more features of any other embodiment, or any combination of any other embodiments. For example, the features described with respect to the system components may also be adapted to be implemented as part of the methods described. Further, the equivalents and modifications described above may be employed without departing from the scope of the invention as defined in the appended claims.

Description of Reference Numerals

[0058] 1 Computing system 3 At least one processor 5 Input / output device 7 Main system memory 9 Removable memory 11 Cryptosystem 13 Processor 15 Secure memory 17 Input / output device 19 Data memory 21 Program memory 23 Working memory 25 Key store 27 Packing module 29 Unpacking module 31 (Pseudo) random key generator module 33 Deterministic function module 35 Cryptographic processing module 37 Cloud storage

Claims

1. A method implemented by a computer for storing data corresponding to secret data represented by a plurality of shares, each of the plurality of shares having a first number of bits, the method implemented by the computer comprising: generating a plurality of random keys, each random key having a second number of bits less than the first number of bits, the plurality of random keys being one less than the plurality of shares; for each random key of the plurality of random keys, using the generated random key as a seed value of a deterministic function that outputs corresponding intermediate data having the first number of bits; performing a plurality of modulo addition operations to generate working data corresponding to either modulo addition of the values of the shares having the first number of bits and modulo addition or inverse modulo addition of the values of the intermediate data corresponding to each of the random keys; storing the working data and the plurality of random keys; A method implemented by a computer, comprising.

2. The method implemented by a computer according to claim 1, wherein performing the modulo addition operations includes performing an inverse modulo addition of at least one value of the intermediate data before performing all of the modulo addition of the values of the shares.

3. Generating the working data comprises: setting one of the plurality of shares as temporary data; for the remaining shares of the plurality of shares, repeatedly generating updated temporary data by performing a modulo addition of the value of the share and the value of the temporary data, and then performing an inverse modulo addition of each intermediate data, wherein the updated temporary data is used as the temporary data for the next iteration, and the primary data updated after the final iteration forms the working data; A method implemented by a computer according to claim 1 or claim 2, comprising.

4. The number of the plurality of shares is a power of 2, and generating the working data comprises repeatedly dividing the plurality of shares into pairs For each pair, by performing inverse modular addition of one value of the pair and the value of each intermediate data, first data is generated, and by performing modular addition of the other value of the pair and the value of the first data, second data is generated; setting the second data generated for each pair as the plurality of shares for the next iteration; comprising; The method implemented by a computer according to claim 1 or claim 2, wherein the second data in the final iteration forms the working data.

5. The method implemented by a computer according to any one of claims 1 to 4, wherein the method implemented by the computer is executed within a secure processing environment.

6. A method implemented by a computer for recovering a plurality of secret shares corresponding to secret data from stored working data and one or more random keys, each of the plurality of secret shares having a first number of bits, each of the one or more random keys having a second plurality of bits less than the first number of bits, the number of the one or more random keys being one less than the number of the plurality of secret shares, the method implemented by the computer comprising: determining intermediate data by using the random key as a seed value of a deterministic function that outputs corresponding intermediate data having the first number of bits for one random key or each random key among the one or more random keys; determining the plurality of secret shares such that the modular addition of the plurality of secret shares corresponds to either the modular addition of the working data corresponding to each of the one or more random keys and the intermediate data, or the inverse modular addition of the working data corresponding to each of the one or more random keys and the intermediate data; A method implemented by a computer comprising.

7. The plurality of secret shares consist of two secret shares, there is one random key, and determining the two secret shares comprises: generating random data having the first number of bits; performing modular addition of the working data and the random data to generate a first secret share; Performing inverse modular addition of intermediate data corresponding to the one random key and the random data; The method implemented by a computer according to claim 6, comprising:

8. Setting the value of the working variable to the value of the working data; Repeatedly for each of the random keys, Generating random data having the first number of bits; Calculating a corresponding one of the remaining secret shares by performing inverse modular addition of the corresponding intermediate data and the random data; Updating the working variable by performing modular addition of the working variable and the random data; After generating the remaining secret shares, setting the one secret share to the value of the working variable; The method implemented by a computer according to claim 6, further comprising:

9. An apparatus configured to perform a masked processing operation using a plurality of shares corresponding to secret data, each of the plurality of shares having a first number of bits, the apparatus comprising: Generating a plurality of random keys, each random key having a second number of bits less than the first number of bits, the plurality of random keys being one less than the plurality of shares; For each random key of the plurality of random keys, using the generated random key as a seed value of a deterministic function that outputs corresponding intermediate data having the first number of bits; Performing a plurality of modular addition operations to generate working data corresponding to either modular addition of the values of the shares and modular addition or inverse modular addition of the values of the intermediate data corresponding to each of the random keys, each having the first number of bits; Storing the working data and the plurality of random keys; An apparatus configured to perform the above.

10. The apparatus according to claim 9, wherein performing the modular addition operation includes performing inverse modular addition of at least one value of the values of the intermediate data for which all of the modular addition of the values of the shares has been performed.

11. Generating the working data includes: Setting one of the plurality of shares as temporary data; For the remaining shares among the plurality of shares, updated temporary data is repeatedly generated by performing modulo addition of the value of the share and the value of the temporary data, and then inverse modulo addition of each intermediate data is performed, where the updated temporary data is used as the temporary data for the next iteration, and the primary data updated after the final iteration forms the working data. The apparatus according to claim 9 or claim 10, comprising.

12. The number of the plurality of shares is a power of 2, Generating the working data iteratively, Dividing the plurality of shares into pairs, For each pair, generating first data by performing inverse modulo addition of one value of the pair and the value of each intermediate data, and generating second data by performing modulo addition of the other value of the pair and the value of the first data, Setting the second data generated for each pair as the plurality of shares for the next iteration, Including, The apparatus according to claim 9 or claim 10, wherein the second data of the final iteration forms the working data.

13. The apparatus according to any one of claims 9 to 12, wherein the apparatus provides a secure processing environment in which the masked processing operation is performed.

14. An apparatus configured to perform a masked processing operation using a plurality of shares corresponding to secret data, each of the plurality of shares having a first number of bits, the apparatus being configured to recover a plurality of secret shares corresponding to the secret data from stored working data and one or more random keys, each of the plurality of secret shares having the first number of bits, each of the one or more random keys having a second plurality of bits less than the first number of bits, the number of the one or more random keys being one less than the number of the plurality of secret shares, and recovering the plurality of shares includes Determining intermediate data by using the random key as a seed value of a deterministic function that outputs corresponding intermediate data having the first number of bits for one random key or each random key among the one or more random keys, Determining the plurality of secret shares such that the modular addition of the plurality of secret shares corresponds to either the modular addition of the work data and the intermediate data corresponding to each of the one or more random keys, or the inverse modular addition of the work data and the intermediate data corresponding to each of the one or more random keys; An apparatus, which is based on the above.

15. The plurality of secret shares consists of two secret shares, there is one random key, and determining the two secret shares includes: Generating random data having the first number of bits; Performing modular addition of the work data and the random data to generate a first secret share; Performing inverse modular addition of the intermediate data corresponding to the one random key and the random data; The apparatus according to claim 14, including the above.

16. Setting the value of a working variable to the value of the work data; ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​

Images