Information processing device and information processing method

Abstract

The present invention provides an information processing device and an information processing method capable of suppressing at least one of memory size and processing overhead. [Solution] The information processing device of this embodiment comprises: a first calculation unit that calculates a first polynomial from a seed for X elements among a plurality of elements in a matrix; a first storage unit that stores the first polynomial calculated by the first calculation unit; and a signature candidate generation unit that sequentially selects the plurality of elements, reads the first polynomial corresponding to the selected element from the first storage unit if the selected element is one of the X elements, performs an operation based on the first polynomial, and generates a signature candidate if the selected element is one of Y elements other than the X elements, calculates a second polynomial for the selected element from the seed, and performs an operation based on the second polynomial.

Description

Technical Field

[0001] Embodiments of the present invention relate to an information processing apparatus and an information processing method.

Background Art

[0002] In recent years, research on quantum computers has accelerated due to the entry of major IT (Information Technology) companies. If a quantum computer that can decrypt the RSA cipher and the elliptic curve cipher, which are widely used public-key ciphers at present, is realized, the information security systems using the RSA cipher and the elliptic curve cipher will become insecure. Therefore, research and development of post-quantum ciphers are being promoted in preparation for the case where a shift from the RSA cipher and the elliptic curve cipher to post-quantum ciphers (also called post-quantum public-key ciphers) becomes necessary.

[0003] One of the strong candidates for post-quantum ciphers is lattice ciphers and lattice signatures that are based on the security of the LWE (Learning with Errors) problem. For example, in the standard post-quantum cipher by NIST (National Institute of Standards and Technology), there are ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) and ML-DSA (Module-Lattice-Based Digital Signature Algorithm). In ML-KEM and ML-DSA, a matrix seed is held as part of the public key, and during the encryption process, the coefficients of the polynomial, which are the elements of the matrix, are calculated from the seed, and a matrix with polynomials as elements is held to perform matrix operations and polynomial operations.

[0004] While lattice cryptography and lattice signatures have the advantage of a good balance between key size and execution cycles compared to other post-quantum cryptography such as coded cryptography and isomorphism cryptography, they have the disadvantage that the memory size required for cryptographic processing, including key generation, encryption, decryption, key encapsulation, key deencapsulation, signature generation, and signature verification, is large compared to the key size. In lattice cryptography and lattice signatures, the matrix used for cryptographic processing is stored as a seed in the public key, which is a measure to reduce communication volume and storage size, but does not contribute to reducing the memory size required when executing cryptographic processing.

[0005] To reduce the memory size required when executing cryptographic processing, a streaming process has been proposed in which, when obtaining a matrix from a seed in cryptographic processing, the entire matrix is ​​not stored, but rather a portion of the matrix is ​​stored in units of rows or columns, units of polynomial elements, or units of coefficients contained in polynomial elements (i.e., units of "coefficients of the polynomial elements") (Non-Patent Literature 1, Non-Patent Literature 2, Non-Patent Literature 3). On the other hand, in signature generation processing, there is a repetitive structure in which signature candidates are generated, it is determined whether a condition is met, and the generation of signature candidates is repeated depending on the result of the determination. Since the matrix is ​​used inside the repetitive structure, simply applying streaming processing would result in the problem of large execution cycle overhead because the process of calculating the coefficients of the polynomial elements from the seed is repeated. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] https: / / eprint.iacr.org / 2020 / 1278 [Non-Patent Document 2] https: / / eprint.iacr.org / 2022 / 323 [Non-Patent Document 3] Yasushi Takahashi et al., "Resource Optimization of CRYSTALS-Dilithium using Hybrid Streaming Method," SCIS2024. [Non-Patent Document 4] https: / / csrc.nist.gov / pubs / fips / 204 / final [Overview of the project] [Problems that the invention aims to solve]

[0007] This embodiment provides an information processing device and an information processing method that can suppress at least one of memory size and processing overhead. [Means for solving the problem]

[0008] The information processing device of this embodiment includes: a first calculation unit that calculates a first polynomial from a seed for X elements among a plurality of elements in a matrix; a first storage unit that stores the first polynomial calculated by the first calculation unit; and a signature candidate generation unit that sequentially selects the plurality of elements, reads the first polynomial corresponding to the selected element from the first storage unit if the selected element is one of the X elements, performs an operation based on the first polynomial, and generates a signature candidate if the selected element is one of Y elements other than the X elements, calculates a second polynomial for the selected element from the seed, and performs an operation based on the second polynomial. [Brief explanation of the drawing]

[0009] [Figure 1] This is a functional block diagram of a digital signature generation device as an information processing device according to Embodiment 1. [Figure 2] A diagram showing the correspondence between the processing performed by each part of the digital signature generation device and the code in pseudocode E1. [Figure 3] This is a flowchart illustrating an example of the operation of the digital signature generation device according to Embodiment 1. [Figure 4] A diagram showing the correspondence between the processing performed by each part of the digital signature generation device and the code in pseudocode E2. [Figure 5] A flowchart illustrating an example of the operation of the digital signature generation device according to Embodiment 2. [Figure 6] An example of an operation sequence performed between a client and a server is shown. [Figure 7] A flowchart of the process performed by the execution of the pseudo-code P1. [Figure 8] A diagram showing a computer device as the hardware configuration of an information processing apparatus according to an embodiment of the present invention.

Mode for Carrying Out the Invention

[0010] Hereinafter, embodiments of the present invention will be described with reference to the drawings. The embodiments of the present invention relate to a method for suppressing the memory size and processing overhead (number of execution cycles) used in signature generation processing including an iterative structure of signature candidate generation.

[0011] Hereinafter, prior to the description of this embodiment, Comparative Example 1 and Comparative Example 2 of this embodiment will be described.

[0012] <Comparative Example 1> As an algorithm related to lattice signatures, there is ML-DSA (Module-Lattice-Based Digital Signature Algorithm) (Non-Patent Document 4). An example of pseudo-code obtained by simplifying a part of the signature generation process ML_DSA.Sign_internal of ML-DSA shown in Non-Patent Document 4 is shown below as pseudo-code P1. Pseudo-code P1 is a simplified code including the part of the process that is the main target of memory saving in ML_DSA.Sign_internal. The numbers on the left side are line numbers. FIG. 7 shows the process performed by the execution of pseudo-code P1 in the form of a flowchart.

[0013] (Pseudo-code P1) 01: A ← ExpandA(ρ) 02: (z, h) ← ⊥ 03: while (z, h) = ⊥ do 04: y ← ExpandMask(ρ″, κ) 05: w ← A y 06: c ← H(μ||HighBits(w)) 07: z ← y + c s1 08: If the specified condition then (z, h) ← ⊥ 09: Else 10: h ← MakeHint(input) 11: End if 12:End while

[0014] [Definition of symbols] ⊥: Blank symbol indicating no value ρ, ρ″: Seeds k: Counter value μ: Message A: Matrix z, h, y, w, s1: Vectors c: Polynomial ←: Operator representing assignment =: Equivalence operator representing comparison of two values for equality H: Hash function ||: Operator representing concatenation

[0015] Since the "specified condition" in line 8 of pseudo-code P1, the "input" in line 10, the function ExpandMask, the function HighBits, and the function MakeHint included in pseudo-code P1 are not related to the essence of this embodiment, explanations will be given within the necessary scope below, and detailed explanations will be omitted. For details, please refer to Non-Patent Document 4.

[0016] In step S11 of Figure 7 (corresponding to the first row of pseudocode P1), matrix A is obtained from seed ρ. Specifically, the function ExpandA takes seed ρ as input and calculates the coefficients of the polynomial for each element of matrix A, and stores the calculated polynomial coefficients. In this way, matrix A containing the polynomial as an element is stored. Function ExpandA is a hash function, and the calculation of the hash function includes an absorption process in which seed ρ is absorbed into the internal state as part of the hash function's processing, and an extraction process in which the hash value is squeezed out from the internal state as another process of the hash function. Seed ρ is generated from the secret key used for signing using a predetermined function. For example, seed ρ can be obtained by inputting the secret key into a decoding function (skDecode function (Non-Patent Literature 4)).

[0017] As an example, consider a case where matrix A is a k x l matrix, i.e., (k, l) dimension, and the polynomial has coefficients ranging from 0th to (n - 1)th order (n coefficients in total), with each coefficient stored in a 32-bit (4-byte) variable. In this case, storing matrix A requires k × l × n × 32 bits (k × l × n × 4 bytes) because each element stores the coefficient of the polynomial. In ML-DSA safety category 5, k = 8, l = 7, and n = 256, so storing matrix A requires 57,344 bytes.

[0018] In step S12 (corresponding to the second line of pseudocode P1), vector z and vector h are set to blank.

[0019] Steps S13 to S20 (lines 3 to 12 of pseudocode P1) are an iterative structure for generating signature candidates. In step S13 (corresponding to line 3 of pseudocode P1), it is determined whether vectors z and h are blank. If they are blank (YES), the process proceeds to step S14 (corresponding to line 4 of pseudocode P1). If they are not blank (NO), the process ends (corresponding to line 12 of pseudocode P1).

[0020] Steps S14-S17 (corresponding to lines 4-7 of pseudocode P1) generate signature candidates. In line 4, the function ExpandMask obtains a vector y using (ρ″, k) as input. ρ″ is a seed calculated from the data to be signed and the secret key using a predetermined function (for example, function H in Non-Patent Document 4). k is a counter value, which is incremented according to the number of iterations.

[0021] Step S18 (corresponding to line 8 of pseudocode P1) determines whether predetermined conditions for the signature candidate are met. These predetermined conditions are based on vectors w and z and polynomial c.

[0022] If the predetermined condition is met in step S18 (YES), then in step S19, vectors z and h are set to blank, and the process returns to step S13. In this way, steps S14 to S17 are repeated to generate signature candidates.

[0023] If the predetermined condition is not met on line 8 (NO), the process proceeds to step S20 (corresponding to line 10 of pseudocode P1), and the vector h is calculated by computing the MakeHint function. The input to the MakeHint function is information based on the polynomial c and the vector w. Once the vector h is calculated, the process terminates after going through step S13 (NO).

[0024] Next, the signature (c, z, h) is obtained using c, z, and h calculated by the operation of pseudocode P1. More specifically, c, z, and h are input to an encoding function (sigEncode function) to obtain a bit sequence (byte sequence) representing the digital signature.

[0025] The matrix A used in the fifth row of pseudocode P1 is the main target of memory reduction in this embodiment. Vectors y in the fourth row, z in the seventh row, and h in the tenth row could also be targets for memory reduction, but here we will focus on matrix A in our explanation.

[0026] The first line of pseudocode P1 is executed only once outside the iterative structure of signature candidate generation, generating matrix A and storing it in memory. The fifth line of pseudocode P1 reads matrix A from memory and performs various operations (matrix operations and polynomial operations). Matrix A remains in memory while the iterative process in the signature generation process is running. The memory size required to hold matrix A (e.g., 57,344 bytes) is sufficiently large compared to the size of the seed ρ (e.g., 32 bytes), and therefore, it can be seen that the memory size required for the signature generation process is extremely large compared to the key size.

[0027] <Comparative Example 2: Streaming Processing> In Comparative Example 2, in order to reduce the memory size required to hold matrix A compared to Comparative Example 1 (memory saving), the entire matrix A is not held. Instead, a portion of matrix A is held, either row-wise, column-wise, polynomial-wise (matrix element-wise), or coefficient-wise for the polynomial elements of the matrix. Signature candidates are generated by sequentially performing various operations while repeatedly updating and holding a portion of matrix A. This type of processing is called streaming processing. Below, an example of pseudocode for an algorithm using streaming processing is shown as pseudocode P2.

[0028] (Pseudocode P2) 01:(z, h) ← ⊥ 02:while (z, h) = ⊥ do 03: y ← ExpandMask(ρ″, κ) 04: for r from 0 to k-1 do 05: w[r] ← 0 06: for s from 0 to l-1 do 07: ρ′ ← ρ||s||r 08: a ← RejNTTPoly(ρ′) 09: w[r] ← w[r] + ay[s] 10: end for 11: endfor 12: c ← H(μ||HighBits(w)) 13: z ← y + c s1 14: if given condition then (z, h) ← ⊥ 15: else 16: h ← MakeHint(input) 17: end if 18: end while

[0029] a is a polynomial, r is a parameter that stores the row number, and s is a parameter that stores the column number. The other symbols are the same as pseudocode P1, so their explanation is omitted.

[0030] The first row of Comparative Example 1 corresponds to the seventh and eighth rows of Comparative Example 2. In the eighth row, the hash function RejNTTPoly is used to calculate the polynomial a (more specifically, the coefficients of polynomial a), which is an element of matrix A, from the seed ρ' (a concatenation of ρ, s, and r), and the calculated polynomial a is stored in memory. The calculation of RejNTTPoly includes an absorption process that absorbs the seed ρ' into the internal state, and an extraction process that squeezes out the hash value from the internal state.

[0031] In line 9, the polynomial 'a' to be stored is read from memory and the polynomial operation is performed. If polynomial 'a' has coefficients ranging from degree 0 to (n - 1), and the coefficients are stored in a 32-bit (4-byte) variable, then storing polynomial 'a' requires a memory size of n × 32 bits (n × 4 bytes). For example, in ML-DSA, n = 256, so storing polynomial 'a' requires a memory size of 1,024 bytes.

[0032] Lines 2 through 18 form a repeating structure for generating signature candidates. Lines 4 through 11 correspond to matrix operations. Lines 3 through 13 generate signature candidates, and line 14 determines whether predetermined conditions regarding the signature candidates are met. If the predetermined conditions are met, the generation of signature candidates (lines 3 through 13) is repeated; if the predetermined conditions are not met, the vector h is calculated in line 16. After this, the signature (c, z, h) is obtained using the vectors z and h calculated by the operations of pseudocode P2 and the polynomial c.

[0033] The fifth row of Comparative Example 1 corresponds to the ninth row of Comparative Example 2. Vectors y, z, and h are also targets for memory reduction, but here we will focus on matrix A in our explanation.

[0034] When streaming processing is performed as in pseudocode P2, the process on line 8 (calculation and storage of polynomial a) and the process on line 9 (operation) are repeatedly executed within the iterative structure of signature candidate generation as many times as there are combinations of r and s. Each time the process on line 8 (calculation and storage of polynomial a) is performed, the polynomial a in memory is overwritten (updated).

[0035] More specifically, during the iterative process of signature generation, polynomial a is held in memory using 1,024 bytes. The held polynomial a is updated each time the process on the 8th line is executed during the above iteration. Since matrix A is 57,344 bytes, it can be seen that the memory size required for the signature generation process is smaller than that of Comparative Example 1 (without streaming processing).

[0036] On the other hand, while the first row of Comparative Example 1 (calculation of matrix A) only needs to be executed once outside the iterative structure of signature candidate generation, in Comparative Example 2, the matrix operation (rows 4-11) is executed within the iterative structure of signature candidate generation as many times as the number of iterations (i.e., each time it is determined that the predetermined condition is met in row 14). In other words, the calculation of polynomial a for each combination of r and s (rows 7 and 8) is performed repeatedly as many times as the number of iterations. For this reason, the execution cycle overhead of Comparative Example 2 is larger than that of Comparative Example 1 (without streaming processing).

[0037] The pseudocode P2 described above is an example of streaming processing that stores coefficients on a polynomial a-by-polynomial basis, but similarly, streaming processing that stores coefficients on a row-by-row or column-by-column basis of matrix A, or on a coefficient-by-coefficient basis of polynomial a-by-polynomial basis, is also possible. Examples of the memory size required in these cases are shown below.

[0038] (When polynomial coefficients are stored row by row (when row vectors are stored)) If a row vector is l-dimensional, its polynomial has coefficients ranging from 0th to (n-1), and these coefficients are stored in a 32-bit (4-byte) variable, then the row vector requires a memory size of l × n × 32 bits (l × n × 4 bytes). For example, in ML-DSA safety category 5, l = 7 and n = 256, so the row vector requires a memory size of 7,168 bytes.

[0039] (When polynomial coefficients are preserved on a column-by-column basis (when column vectors are preserved)) If a column vector is k-dimensional, and the polynomial has coefficients ranging from 0th to (n-1), and these coefficients are stored in a 32-bit (4-byte) variable, then the column vector requires a memory size of k × n × 32 bits (k × n × 4 bytes). For example, in ML-DSA safety category 5, k = 8 and n = 256, so the column vector requires 8,192 bytes to be stored.

[0040] (When the coefficients of the polynomial are preserved at the coefficient level) If you store the coefficients of polynomial a in a 32-bit (4-byte) variable, you will need 32 bits (4 bytes) of memory to hold the coefficients.

[0041] Thus, the memory size required for the signature generation process in Comparative Example 2 is smaller than that in Comparative Example 1 (without streaming processing) because, due to streaming processing, only a portion of matrix A needs to be stored in memory, rather than the entire matrix A.

[0042] On the other hand, in Comparative Example 1, the process of calculating the coefficients of the polynomial elements of the matrix from the seed is executed only once outside the iterative structure of signature candidate generation, whereas in Comparative Example 2, the process of calculating the coefficients of the polynomial elements of the matrix from the seed is executed the number of times specified in the iteration (i.e., each time it is determined that a predetermined condition is met on the 14th row). Therefore, the overhead of the number of execution cycles in Comparative Example 2 is larger than that of Comparative Example 1.

[0043] This embodiment makes it possible to reduce at least one of the overheads of memory size and execution cycle count compared to Comparative Examples 1 and 2 described above. A detailed explanation follows.

[0044] <Embodiment 1> This embodiment 1 allows the user to choose whether to perform the process of calculating the polynomial coefficients for each element of the matrix only once outside the iterative structure for generating signature candidates, or to perform it multiple times within the iterative structure for generating signature candidates (streaming processing). The choice between these two methods may be predetermined for each element of the matrix, or it may be possible for the user to specify it as a parameter. Thus, in this embodiment 1, streaming processing is performed for some elements in the same way as in Comparative Example 2, while for other elements, the processing is performed only once outside the iterative structure in the same way as in Comparative Example 1 (referred to as non-streaming processing). This type of processing in this embodiment is called hybrid processing of streaming and non-streaming processing. This makes it possible to reduce at least one of the memory size and execution cycle overhead required for the signature generation process.

[0045] Figure 1 is a functional block diagram of the digital signature generation device 100 as an information processing device according to this embodiment. The digital signature generation device 100 comprises a storage unit 110, a first calculation unit 120, and a signature candidate generation unit 130. The signature candidate generation unit 130 includes a second calculation unit 140.

[0046] The storage unit 110 stores information necessary for the processing of this embodiment and information generated by the processing of this embodiment. Information necessary for the processing of this embodiment may include, for example, a secret key, the code (program) of the algorithm related to the processing according to this embodiment, and parameters used in the program. Information generated by the processing of this embodiment includes information generated during the calculation (various vectors, polynomials, signature candidates, etc.) and the digital signature that is ultimately generated as output information.

[0047] The storage unit 110 is composed of memory. The memory may be volatile or non-volatile. However, the storage unit 110 is not limited to memory and may be a storage device such as an SSD (Solid State Drive). The storage unit 110 may also be network storage.

[0048] The first calculation unit 120, the signature candidate generation unit 130, and the second calculation unit 140 are processing units that perform the processing according to this embodiment.

[0049] The first calculation unit 120 reads the secret key from the storage unit 110 and calculates a seed. Alternatively, a seed calculated in advance from the secret key may be stored in the storage unit 110 and read from there. The first calculation unit 120 calculates polynomials from the seed for X elements among the multiple elements of the matrix. The polynomials calculated for each of these X elements are called the first polynomials. The first calculation unit 120 writes the first polynomials calculated for each element to the storage unit 110. More specifically, it writes each coefficient of the first polynomial. The storage unit 110 stores the first polynomials calculated by the first calculation unit 120. Since a first polynomial is generated for each X element, the storage unit 110 stores X first polynomials. The storage unit 110 includes a first storage unit that stores the first polynomials.

[0050] The second calculation unit 140 calculates a polynomial from the seed for the element specified by the signature candidate generation unit 130. The polynomial calculated by the second calculation unit 140 is called the second polynomial. The second calculation unit 140 writes the calculated second polynomial to the storage unit 110. More specifically, it writes each coefficient of the second polynomial. The storage unit 110 stores the second polynomial calculated by the second calculation unit 140. When the second calculation unit 140 writes the second polynomial to the storage unit 110, it overwrites the second polynomial that was previously written to the storage unit 110. This means that at least the memory size for one second polynomial is sufficient for storing the second polynomial. However, it is also possible to prepare memory sizes for two second polynomials and overwrite them alternately. The storage unit 110 includes a second storage unit that stores the second polynomial.

[0051] The signature candidate generation unit 130 sequentially selects multiple elements in the matrix. If the selected element is one of the X elements, it reads the polynomial (first polynomial) corresponding to the selected element from the storage unit 110 and performs calculations based on the first polynomial. If the selected element is one of the Y elements other than the X elements, it uses the second calculation unit 140 to calculate a polynomial (second polynomial) for the selected element and writes it to the storage unit 110. The signature candidate generation unit 130 reads the polynomial calculated by the second calculation unit 140 for the selected element from the storage unit 110 and performs calculations based on the read second polynomial. By repeating this series of operations for multiple elements in the matrix, signature candidates are generated.

[0052] The signature candidate generation unit 130 determines whether predetermined conditions are met for the generated signature candidates. If the predetermined conditions are met, it repeats the above-described series of operations for multiple elements in the matrix to generate signature candidates. The signature candidate generation unit 130 repeats the generation of signature candidates until it is determined that the predetermined conditions are not met. The operations based on the above polynomials (first polynomial and second polynomial) performed in each iteration use a parameter that changes with each iteration (in this example, the counter value k). As a result, different signature candidates may be generated with each iteration.

[0053] If the signature candidate generation unit 130 determines that the predetermined conditions are not met, it obtains a digital signature based on the signature candidate and signature function at that time.

[0054] An example of pseudocode representing the algorithm for the processing according to this embodiment 1 is shown below as pseudocode E1.

[0055] (Pseudocode E1) 01:while (r, s) in List do 02: ρ′ ← ρ||s||r 03: A′[Pack(r, s)] ← RejNTTPoly(ρ′) 04:end do 05:(z, h) ← ⊥ 06:while (z, h) = ⊥ do 07: y ← ExpandMask(ρ″, κ) 08: for r from 0 to k - 1 do 09: w[r] ← 0 10: for s from 0 to l - 1 do 11: if (r, s) in List then a ← A′[Pack(r, s)] 12: else 13: ρ′ ← ρ||s||r 14: a ← RejNTTPoly(ρ′) 15: end if 16: w[r] ← w[r] + ay[s] 17: end for 18: end for 19: c ← H(μ||HighBits(w)) 20: z ← y + c s1 21: if given condition then (z, h) ← ⊥ 22: else 23: h ← MakeHint (input) 24: end if 25: end while

[0056] The first calculation unit 120, the signature candidate generation unit 130, and the second calculation unit 140 perform processing related to the pseudocode E1. Figure 2 shows the correspondence between the processing performed by each of these units and the code in the pseudocode E1. The first calculation unit 120 processes lines 1 to 4, the second calculation unit 140 processes lines 11, 13, and 14, and the signature candidate generation unit 130 processes lines 5 to 10, 12, and 15 to 25. However, this correspondence is just one example, and other correspondences are possible. If the first calculation unit 120, the signature candidate generation unit 130, and the second calculation unit 140 are implemented by a CPU, this corresponds to the CPU performing processing on each line in the pseudocode E1.

[0057] Lines 2 and 3 of this embodiment 1 correspond to line 1 of comparative example 1. Lines 13 and 14 of this embodiment 1 correspond to lines 7 and 8 of comparative example 2. Also, line 16 of this embodiment 1 corresponds to line 5 of comparative example 1 and line 9 of comparative example 2.

[0058] Lines 6 through 25 form the iterative structure for generating signature candidates. Lines 7 through 20 are the actual signature candidate generation. Lines 8 through 18 correspond to matrix operations. Line 21 determines whether a predetermined condition is met. More details about pseudocode E1 are as follows:

[0059] The List in the first row is a list that identifies the elements (the X elements mentioned above) in matrix A that are subject to non-streaming processing. For example, information indicating pre-selected elements or elements specified by the user is stored in the list. The list is stored in the storage unit 110. Assume that matrix A has k rows and l columns.

[0060] The elements specified by the List can be a continuous range from the first element, such as from row 0 to column k' (≤ k) to column l' (≤ l), or it can be any part of matrix A, such as matrix A' at row k' (≤ l'). Alternatively, the elements specified by the List can be a set of non-contiguous elements, or a set of random elements.

[0061] The `Pack` function in the third line specifies how to store the elements identified in the List.

[0062] The first calculation unit 120, as a process corresponding to the first to fourth rows of pseudocode E1, calculates a polynomial (first polynomial) for X elements identified by the List from among the multiple elements of matrix A, using the seed and the row and column numbers of those elements. Specifically, it concatenates the seed ρ with the row and column numbers of the element to create a new seed ρ′, and calculates a polynomial using seed ρ′ as input to RejNTTPoly. The calculation of RejNTTPoly includes an absorption process that absorbs seed ρ′ into the internal state and an extraction process that squeezes out the hash value from the internal state. The set of X polynomials calculated for the X elements (let's call it set A′) is stored in the storage unit 110. More specifically, the multiple (n) coefficients included in the X polynomials are stored in the storage unit 110.

[0063] A polynomial (let's call it polynomial a) has coefficients ranging from 0th to (n - 1) in degree (a0, a1, a2, ..., a) as shown in equation (1) below. n-1 If we assume that we have (a0, a1, a2, ..., a n-1 ) is maintained. Note that "x" in the following formula is lowercase and is distinguished from the uppercase "X" that represents the number of elements. a = a0 + a1x 1 +a2x 2 +····+a n-1 x n-1 ...(1)

[0064] When storing coefficients in a 32-bit (4-byte) variable, storing a polynomial for X elements requires X × n × 32 bits (X × n × 4 bytes). For example, in ML-DSA, n = 256, so when X = 11, storing a polynomial for a set of elements A′ requires 11,264 bytes.

[0065] The second calculation unit 140, as the processing corresponding to lines 11, 13, and 14 of the pseudocode E1, calculates a polynomial (second polynomial) from the seed, targeting Y elements of matrix A other than the X elements mentioned above, that is, among the multiple elements of matrix A, that are not specified by the List. RejNTTPoly on line 14 is a function that calculates the polynomial. The calculation of RejNTTPoly includes an absorption process that absorbs the seed ρ′ into the internal state and an extraction process that squeezes out the hash value from the internal state. The second calculation unit 140 writes the calculated polynomial (second polynomial) to the storage unit 110. More specifically, it stores each coefficient included in the polynomial in the storage unit 110. At this time, the previous polynomial (second polynomial) stored in the storage unit 110 is updated. As a result, the storage unit 110 holds the latest polynomial (second polynomial).

[0066] If polynomial a has coefficients ranging from degree 0 to (n - 1), and these coefficients are stored in a 32-bit (4-byte) variable, then storing polynomial a requires n × 32 bits (n × 4 bytes). For example, in ML-DSA, n = 256, so storing polynomial a requires 1,024 bytes.

[0067] The signature candidate generation unit 130 performs operations (line 16) on each of the X polynomials (first polynomials) obtained by the first calculation unit 120 in the processing of line 3. The signature candidate generation unit 130 also performs operations (line 16) on each of the Y polynomials (second polynomials) sequentially obtained by the second calculation unit 140 in the processing of line 14. After this, the signature candidate generation unit 130 performs operations in lines 19 and 20 to generate signature candidates c and z. It determines whether the predetermined conditions in line 21 are met for the generated signature candidates. If the predetermined conditions are met, the generation of signature candidates is repeated using the second calculation unit 140 (lines 7 to 20). If the predetermined conditions are not met, the vector h is calculated using the MakeHint function as the processing in line 23.

[0068] After this, the signature candidate generation unit 130 obtains a signature (c, z, h) using c, z, and h as processing outside of the pseudocode E1. More specifically, c, z, and h are input to an encoding function to obtain a bit sequence (byte sequence) representing the digital signature.

[0069] Figure 3 is a flowchart showing an example of the operation of the digital signature generation device 100 as an information processing method according to this embodiment 1.

[0070] The first calculation unit 120 reads a list specifying X elements from among multiple elements in a matrix, and a seed from the storage unit 110, and calculates a polynomial (first polynomial) for the X elements specified in the list, using the seed, the row number, and the column number of each element (S101). The first calculation unit 120 writes the first polynomial calculated for each element to the storage unit 110 (same as S101).

[0071] The signature candidate generation unit 130 obtains a vector (vector y) using a counter value k (a parameter whose value changes with each iteration) and a seed (seed ρ″) (S102).

[0072] The signature candidate generation unit 130 sequentially selects multiple elements in the matrix and determines whether the selected element is one of the X elements specified in the list (S103). If it is one of the X elements (YES), the unit reads the polynomial (first polynomial) corresponding to the selected element from the storage unit 110 and performs an operation (row 16) based on the first polynomial (S105).

[0073] If the selected element is one of the remaining Y elements other than the X elements (NO), the signature candidate generation unit 130 uses the second calculation unit 140 to calculate a polynomial (second polynomial) for the selected element and stores it in the storage unit 110 (S106). That is, the signature candidate generation unit 130 causes the second calculation unit 140 to calculate a second polynomial for the selected element and stores the calculated second polynomial in the storage unit 110. The signature candidate generation unit 130 reads the second polynomial calculated by the second calculation unit 140 from the storage unit 110 and performs an operation based on the second polynomial (line 16).

[0074] The process is checked in S108 to determine if steps S103 to S107 have been performed on all elements in the matrix. If there are elements that have not yet been processed, the process returns to step S103. If all elements have been processed, signature candidates c and z are generated based on the results of the operations on each element (S109), and it is determined whether predetermined conditions are met for the generated signature candidates (S110). If the predetermined conditions are met (YES), the process returns to step S102 and performs signature generation again. At this time, the counter value is incremented. If the predetermined conditions are not met (NO), a signature candidate (vector h) is calculated using the MakeHint function (S111). Then, the signature candidates c, z, and h are input to the encoding function to obtain a digital signature (S112).

[0075] (Effects of the first embodiment) In this embodiment 1, for a specific set of X elements, the process on line 3 is executed only once outside the iterative structure for generating signature candidates, thereby calculating and storing the corresponding polynomial. On the other hand, for Y elements other than the X mentioned above, the process on line 14 is executed a specified number of times inside the iterative structure for generating signature candidates, thereby calculating and storing (updating) the corresponding polynomial a.

[0076] Therefore, while the iterative process of generating signature candidates is being executed, a set A' of polynomials (first polynomials) corresponding to a specific X elements is held in the storage unit 110 with a memory size of 11,264 bytes, and polynomial a (second polynomial) is held in the storage unit 110 while being repeatedly updated with a memory size of 1,024 bytes. Since matrix A is 57,344 bytes, it can be seen that the memory size required for the signature generation process in this embodiment 1 is smaller than that of comparative example 1 (without streaming processing) and larger than that of comparative example 2 (with streaming processing).

[0077] Furthermore, the processing on line 3 of Embodiment 1 is executed only once outside the repeating structure for generating signature candidates, while the processing on lines 13 and 14 is executed the number of times specified within the repeating structure for generating signature candidates. On the other hand, line 1 of Comparative Example 1 is executed only once outside the repeating structure for generating signature candidates, while lines 7 and 8 of Comparative Example 2 are executed the number of times specified within the repeating structure for generating signature candidates. As a result, the execution cycle overhead of Embodiment 1 is larger than that of Comparative Example 1 (without streaming processing) and smaller than that of Comparative Example 2 (with streaming processing).

[0078] <Embodiment 2> In this second embodiment, for multiple elements in the matrix, the calculation of intermediate values ​​from a seed is performed outside the iterative structure for generating signature candidates, and the calculated intermediate values ​​are stored in the storage unit 110. Then, inside the iterative structure for generating signature candidates, the calculation of a polynomial from the intermediate value is performed repeatedly (streaming processing) for each of the multiple elements in the matrix. This reduces the memory size required for the signature generation process and the overhead of the number of execution cycles for the signature generation process.

[0079] The block diagram of this embodiment is the same as Figure 1 of Embodiment 1, but the functions of each block have been partially modified or expanded.

[0080] The first calculation unit 120 reads a seed calculated from the secret key from the storage unit 110 and calculates an intermediate value from the seed for each of the multiple elements in the matrix. In addition to the seed, the row number and column number of the element are used to calculate the intermediate value. The intermediate value corresponds to a value obtained during the calculation of the polynomial from the seed. In this embodiment, as will be described later, by calculating the polynomial from the intermediate value within the iterative structure of signature candidate generation, the execution cycle overhead can be reduced compared to calculating the polynomial from the seed.

[0081] The first calculation unit 120 writes the intermediate values ​​calculated for each element in the matrix to the storage unit 110. The storage unit 110 stores the intermediate values ​​calculated by the first calculation unit 120. Since an intermediate value is generated for each of the multiple elements, the storage unit 110 stores the same number of intermediate values ​​as the number of elements in the matrix.

[0082] The second calculation unit 140 calculates a polynomial from the intermediate values ​​of the elements specified by the signature candidate generation unit 130 among multiple elements in the matrix. Each time the second calculation unit 140 calculates a polynomial, it writes the calculated polynomial to the storage unit 110. More specifically, it writes each coefficient of the polynomial to the storage unit 110. The storage unit 110 stores the polynomials calculated by the second calculation unit 140. When the second calculation unit 140 writes a polynomial to the storage unit 110, it overwrites the polynomial that was previously written to the storage unit 110. Therefore, only the memory size for one polynomial is needed to store the polynomial. However, it is also possible to prepare memory size for two polynomials and overwrite them alternately.

[0083] The signature candidate generation unit 130 sequentially selects multiple elements in the matrix and calculates a polynomial using the second calculation unit 140 from intermediate values ​​read from the storage unit 110 for the selected elements. That is, the signature candidate generation unit 130 causes the second calculation unit 140 to calculate a polynomial for the selected elements and stores the calculated polynomial in the storage unit 110. The signature candidate generation unit 130 reads the polynomial from the storage unit 110 and performs operations based on the read polynomial. The signature candidate generation unit 130 generates signature candidates by repeating this series of operations for all of the multiple elements in the matrix.

[0084] The signature candidate generation unit 130 determines whether predetermined conditions are met for the generated signature candidates. If the predetermined conditions are met, it repeats the above-described series of operations for multiple elements in the matrix using the second calculation unit 140 to generate signature candidates. The signature candidate generation unit 130 continues generating signature candidates until it is determined that the predetermined conditions are not met. The operations based on the above polynomial performed in each iteration use a parameter (in this example, a counter value) that changes with each iteration. As a result, different signature candidates may be generated in each iteration.

[0085] An example of pseudocode representing the algorithm for the processing according to this embodiment 2 is shown below as pseudocode E2.

[0086] (Pseudocode E2) 01: for r from 0 to k -1 do 02: for s from 0 to l -1 do 03: ρ′ ← ρ||s||r 04: ctx[r, s] ← G.Init() 05: ctx[r, s] ← G.Absorb(ctx[r, s], ρ′) 06: end for 07:end for 08:(z, h) ← ⊥ 09:while (z, h) = ⊥ do 10: y ← ExpandMask(ρ″, κ) 11: for r from 0 to k - 1 do 12: w[r] ← 0 13: for s from 0 to l - 1 do 14: j ← 0 15: ctx′ ← ctx[r, s] 15: while j < n do 16: (ctx′, s′) ← G.Squeeze(ctx′, 3) 17: a[j] ← CoeffFromThreeBytes(s′[0], s′[1], s′[2]) 18: if a[j] ≠ ⊥ then 19: j ← j + 1 20: end if 21: end while 22: w[r] ← w[r] + a y[s] 23: end for 24: end for 25: c ← H(μ||HighBits(w)) 26: z ← y + c s1 27: if the specified condition then (z, h) ← ⊥ 28: else 29: h ← MakeHint(input) 30: end if 31: end while

[0087] The first calculation unit 120, the signature candidate generation unit 130, and the second calculation unit 140 perform processing related to the pseudocode E2. Figure 4 shows the correspondence between the processing performed by each of these units and the codes in the pseudocode E2. The first calculation unit 120 processes lines 1 to 7, the second calculation unit 140 processes lines 14 to 21, and the signature candidate generation unit 130 processes lines 8 to 13 and lines 22 to 31. When the first calculation unit 120, the signature candidate generation unit 130, and the second calculation unit 140 are implemented by a CPU, this corresponds to the CPU performing processing on each line in the pseudocode E2.

[0088] Lines 3 to 5 of this embodiment 2 correspond to line 1 of Comparative Example 1, and lines 14 to 21 of this embodiment 2 correspond to lines 7 and 8 of Comparative Example 2. Line 22 of this embodiment 2 corresponds to line 5 of Comparative Example 1 and line 9 of Comparative Example 2.

[0089] Lines 9 through 31 form the iterative structure for generating signature candidates. Lines 10 through 26 are the actual signature candidate generation. Lines 11 through 24 correspond to matrix operations. Line 27 determines whether a predetermined condition is met.

[0090] Function G represents an extensible output hash function, function G.Init represents its initialization process, function G.Absorb represents its absorption process, and function G.Squeeze represents its extraction process. In implementation, the boundaries of each process can be intentionally changed, parts of them can be split, or parts can be merged.

[0091] The first calculation unit 120, as the process corresponding to the 5th row, calculates the intermediate value ctx for each element of the k x l matrix A using G.Absorb outside the iterative structure for generating signature candidates, and stores it in the storage unit 110. That is, for each combination of row r and column s, the intermediate value ctx is calculated and stored. If the intermediate value ctx is stored in a 5x5 array of 64 bits (8 bytes), k x l x 64 x 25 bits (k x l x 8 x 25 bytes) are required for storage. For example, in ML-DSA security category 5, k = 8 and l = 7, so 11,200 bytes of memory are required to store the intermediate values ​​corresponding to all elements.

[0092] The second calculation unit 140, as the processing corresponding to rows 14 to 21, reads intermediate values ​​from the storage unit 110 for each element of matrix A and calculates polynomial a from the intermediate values. The second calculation unit 140 writes the calculated polynomial a to the storage unit 110. More specifically, it stores each coefficient included in polynomial a in the storage unit 110. At this time, the previously calculated polynomial a stored in the storage unit 110 is updated. As a result, the storage unit 110 holds the latest calculated polynomial a. The storage unit 110 includes a memory area for intermediate values ​​(first storage unit) and a memory area for polynomials (second storage unit).

[0093] If polynomial a has coefficients ranging from degree 0 to (n - 1), and the coefficients are stored in a 32-bit (4-byte) variable in line 17, then storing polynomial a requires a memory size of n × 32 bits (n × 4 bytes). For example, in ML-DSA, n = 256, so storing polynomial a requires a memory size of 1,024 bytes.

[0094] As the process on line 22, the signature candidate generation unit 130 performs calculations based on the polynomial obtained by the second calculation unit 140. That is, it reads polynomial a from the storage unit 110 and performs calculations. After performing polynomial calculations on all elements, the signature candidate generation unit 130 performs calculations on lines 25 and 26 to generate signature candidates c and z. As the process on line 27, the signature candidate generation unit 130 determines whether predetermined conditions are met for the generated signature candidates. If the predetermined conditions are met, it repeats the generation of signature candidates using the second calculation unit 140 (lines 10 to 26). If the predetermined conditions are not met, as the process on line 29, it calculates the vector h using the MakeHint function.

[0095] After this, the signature candidate generation unit 130 obtains a signature (c, z, h) using c, z, and h as processing outside of the pseudocode E2. More specifically, c, z, and h are input to an encoding function to obtain a bit sequence (byte sequence) representing the digital signature.

[0096] Figure 5 is a flowchart showing an example of the operation of the digital signature generation device 100 as an information processing method according to this second embodiment.

[0097] The first calculation unit 120 reads a seed calculated from the secret key from the storage unit 110, and calculates an intermediate value for each of the multiple elements in the matrix from the seed and the row and column numbers of that element (S201). The first calculation unit 120 writes the intermediate value calculated for each element to the storage unit 110 (same as S201).

[0098] The signature candidate generation unit 130 obtains a vector (vector y) using a counter value k (a parameter whose value changes with each iteration) and a seed (seed ρ″) (S202).

[0099] The signature candidate generation unit 130 sequentially selects multiple elements in the matrix (S203), reads intermediate values ​​from the storage unit 110 for the selected elements, and calculates a polynomial from the read intermediate values ​​using the second calculation unit 140 (S204). The second calculation unit 140 stores the calculated polynomial in the storage unit 110. The signature candidate generation unit 130 reads the polynomial of the element and performs the operation (row 16) (S205).

[0100] The signature candidate generation unit 130 determines whether the processing in steps S203 to S205 has been performed for all of the multiple elements in the matrix (S206). If there are elements that have not yet been processed, it returns to step S203. If processing has been performed for all elements (YES), it generates signature candidates c and z based on the results of the operations on each element (S207), and determines whether predetermined conditions are met for the generated signature candidates (S208). If the predetermined conditions are met (YES), it returns to step S202 and performs signature generation again. At this time, the counter value is incremented. If the predetermined conditions are not met (NO), it calculates a signature candidate (vector h) using the MakeHint function (S209). Then, by inputting the signature candidates c, z, and h into the encoding function, a digital signature is obtained (S210).

[0101] (Effects of the second embodiment) While the iterative process of generating signature candidates is being executed, the intermediate value ctx for all elements in the matrix is ​​held in the storage unit 110 using, for example, a memory size of 11,200 bytes, and the polynomial a is repeatedly updated and held in the storage unit 110 using, for example, a memory size of 1,024 bytes. Since the entire matrix A is 57,344 bytes, the memory size required for the signature generation process in this embodiment 2 is smaller than that of comparative example 1 and larger than that of comparative example 2.

[0102] Furthermore, in Comparative Example 1, the first line of pseudocode P1 (which is the process of calculating matrix A and includes the hash function absorption and extraction processes) is executed only once outside the iterative structure for generating signature candidates. In Comparative Example 2, the eighth line of pseudocode P2 (which is the process of calculating polynomial a and includes the hash function absorption and extraction processes) is executed within the iterative structure for generating signature candidates for the specified number of iterations (until the predetermined conditions are no longer met). In contrast, in this embodiment 2, the fifth line of pseudocode E2 (corresponding to the hash function absorption process) is executed only once outside the iterative structure for generating signature candidates, and the sixteenth line (corresponding to the hash function extraction process) is executed within the iterative structure for generating signature candidates for the specified number of iterations (until the predetermined conditions are no longer met). Therefore, the execution cycle overhead of this embodiment 2 is larger than that of Comparative Example 1 and smaller than that of Comparative Example 2.

[0103] (Comparison of Comparative Example 1, Comparative Example 2, Embodiment 1, and Embodiment 2) Let t be the number of iterations in the signature candidate generation loop structure (the number of iterations until it is determined that a predetermined condition is not met). The memory size and execution cycle overhead for Comparative Example 1, Comparative Example 2, Embodiment 1, and Embodiment 2 are summarized in Table 1 below.

[0104] [Table 1]

[0105] In Table 1, the execution cycle overhead is shown with the execution cycle count (processing amount) of Comparative Example 1 as the baseline (=0), and the overhead represents the number of execution cycles (processing amount) exceeding that baseline. In this example, the number of coefficients in one polynomial is assumed to be n = 256. The memory size used within the loop structure is assumed to be 1024 bytes, assuming the storage of one polynomial (256 coefficients). However, the memory size used within the loop structure varies depending on the unit in which the polynomial is stored; for example, it is 4 bytes when storing coefficients.

[0106] As can be seen from Table 1, the relationship of the memory size is Comparative Example 2 < Embodiment 1 < Comparative Example 1, Comparative Example 2 < Embodiment 2 < Comparative Example 1, That is. Also, the relationship of the execution cycle number overhead is Comparative Example 1 < Embodiment 1 < Comparative Example 2, Comparative Example 1 < Embodiment 2 < Comparative Example 2, That is.

[0107] It is better that the memory size and the execution cycle number overhead are smaller, but there is no best way for both simultaneously. The memory size and the execution cycle number overhead are in a trade-off relationship.

[0108] Which of Embodiment 1 and Embodiment 2 is better depends on k, l, X (< k × l), the execution cycle number of the absorption process, and the execution cycle number of the squeezing process. For example, when k = 8, l = 7, X = 11, and (the execution cycle number of the squeezing process) < (the execution cycle number of the absorption process) × 4, the memory sizes in Embodiment 1 and Embodiment 2 are about the same, and the execution cycle number overhead of Embodiment 2 is smaller than that of Embodiment 1. Therefore, Embodiment 2 is better than Embodiment 1.

[0109] <Embodiment 3> In this Embodiment 3, Embodiment 1 and Embodiment 2 are combined. The block diagram of this Embodiment 3 is the same Figure 1 as that of Embodiment 1, but some functions are changed or extended. More specifically, it is as follows.

[0110] The first calculation unit 120 executes the absorption process for X elements only once outside the repetitive structure of signature candidate generation to calculate the intermediate values of the X elements, and holds the calculated X intermediate values in the storage unit 110. For holding the intermediate values, for example, a memory size of 200 bytes per intermediate value is used.

[0111] The signature candidate generation unit 130, within the iterative structure of signature candidate generation, repeatedly performs a process to extract intermediate values ​​from the X elements and calculate a polynomial for the specified number of times. Similar to Embodiment 2, the signature candidate generation unit 130 uses the second calculation unit 140 to calculate the polynomial from the intermediate values.

[0112] The signature candidate generation unit 130 repeatedly performs polynomial calculation (absorption process + extraction process) from a seed, etc., for the remaining Y elements within the iterative structure of signature candidate generation. The signature candidate generation unit 130 uses the second calculation unit 140 for polynomial calculation from the seed, etc., as in Embodiment 1. In other words, in Embodiment 3, the second calculation unit 140 switches between calculating a polynomial from an intermediate value (extraction process) and calculating a polynomial from a seed, etc. (absorption process + extraction process) for each element. Within the iterative structure, the polynomial is held using a memory size equivalent to one polynomial.

[0113] The memory size and execution cycle overhead of this third embodiment are added to Table 1 above, and the result is shown below as Table 2. [Table 2]

[0114] In this case, the relationship between memory size is: Comparative Example 2 < Embodiment 3 < Embodiment 2, The relationship between the number of execution cycles and overhead is: Embodiment 2 < Embodiment 3 < Comparative Example 2. However, X <k×lである。

[0115] Embodiment 3 has a smaller memory size and a larger execution cycle overhead than Embodiment 2.

[0116] Whether Embodiment 3 or Embodiment 1 is better depends on k, l, X (note that X in Embodiment 1 and X in Embodiment 3 may be different), the number of execution cycles for the absorption process, and the number of execution cycles for the extraction process. For example, when k = 8, l = 7, X in Embodiment 1 = 1, X in Embodiment 3 = 5, and (number of execution cycles for the extraction process) < (number of execution cycles for the absorption process) × 4, the memory size is about the same for Embodiment 1 and Embodiment 3. On the other hand, the execution cycle overhead is smaller for Embodiment 3 than for Embodiment 1. Therefore, Embodiment 3 is better than Embodiment 1.

[0117] <Embodiment 4> This fourth embodiment combines Comparative Example 1, Embodiment 1, and Embodiment 2. The block diagram of this fourth embodiment is the same as that of Embodiment 1 (Figure 1), but some functions have been modified or expanded.

[0118] More specifically, the first calculation unit 120 performs the absorption process for (X' + X) elements only once outside the iterative structure of signature candidate generation, and the extraction process for X' elements only once outside the iterative structure of signature candidate generation. The polynomial of X' elements and the intermediate values ​​of X elements are stored in the storage unit 110.

[0119] The signature candidate generation unit 130 repeatedly performs the absorption process of (k×l - X′ - X) elements and the extraction process of (k×l - X′) elements within the iterative structure of signature candidate generation a number of times. Within the iterative structure of signature candidate generation, the polynomial is held using a memory size equivalent to that of one polynomial.

[0120] The memory size and execution cycle overhead of this embodiment 4 are added to Table 2 above and are shown below as Table 3. [Table 3]

[0121] Compared to Embodiment 3, although the memory size is larger, the execution cycle overhead can be suppressed.

[0122] <Application Examples> The following are examples of applications using the digital signature generation device 100 according to the embodiments described above. The digital signature generation device 100 is installed in the server and in the certification authority that authenticates the server certificate.

[0123] Figure 6 shows an example of an operation sequence between client 200 and server 300. It shows an example of performing a TLS 1.3 handshake, followed by encrypted data communication for one round trip.

[0124] Client 200 sends a Client Hello message to Server 300 to signal the start of TLS communication (S301). Server 300 responds to the Client Hello message by sending a Server Hello message (S302). This results in an agreement between Client 200 and Server 300 on the cipher suite and encryption key to be used for TLS communication.

[0125] Server 300 encrypts the information used for TLS communication, excluding the cipher suite and encryption key, and sends it to client 200 (S303). For example, it notifies the HTTPS version to be used for TLS communication.

[0126] Server 300 sends the server certificate required for server 300 authentication to client 200 (S304). The server certificate contains the server public key of server 300 and a digital signature that the Certificate Authority has previously generated on the server public key using the digital signature generator 100. This digital signature is generated by a signature generation process using the Certificate Authority's private key.

[0127] Server 300 uses the digital signature generation device 100 and the server private key to perform a signature generation process on the verification data and generate a digital signature. Server 300 sends the generated digital signature and the verification data to client 200 (S305). After this, server 300 sends a Finished message (S306).

[0128] Client 200 verifies the server certificate using the Certificate Authority's public key and verifies the verification data received from Server 300 using the server's public key. After this, Client 200 sends a Finished message (S307).

[0129] After this, client 200 sends encrypted application data (S308), server 300 sends encrypted application data (S309), client 200 sends an Alert (Close Notify) message to server 300 (S310), and the process ends.

[0130] According to this application example, the certification authority and server 300 can generate digital signatures at high speed and using a small amount of memory by using the digital signature generation device 100 according to this embodiment. In other words, it becomes possible to implement a memory-saving implementation of the grid signature signature generation process and reduce the number of execution cycles.

[0131] (Hardware configuration) Figure 8 shows a computer device as the hardware configuration of an information processing device 400 according to an embodiment of the present invention. At least one of the digital signature generation device 100, server 300, client 200, and certification authority can be configured as the information processing device 400 with the hardware configuration shown in Figure 8. The information processing device 400 comprises a CPU 401, an input interface 402, a display device 403, a communication device 404, a main memory 405, and an external memory device 406, which are interconnected by a bus 407.

[0132] The CPU (Central Processing Unit) 401 executes an information processing program, which is a computer program, on the main memory 405. The information processing program is a program that implements the aforementioned functional configurations of the digital signature generation device 100, server 300, client 200, or certification authority. The information processing program may not be a single program, but rather a combination of multiple programs or scripts. Each functional configuration is realized when the CPU 401 executes the information processing program.

[0133] The input interface 402 is a circuit for inputting operation signals from input devices such as keyboards, mice, and touch panels to the information processing device 400.

[0134] The display device 403 displays data output from the information processing device 400. The display device 403 is, for example, an LCD (liquid crystal display), an organic electroluminescent display, a CRT (cathode ray tube), or a PDP (plasma display), but is not limited to these. Data output from the computer device 400 can be displayed on this display device 403.

[0135] The communication device 404 is a circuit for the information processing device 400 to communicate with an external device wirelessly or via a wired connection. Data can be input from an external device via the communication device 404. The data input from the external device can be stored in the main memory 405 or the external memory 406.

[0136] The main memory 405 stores information processing programs, data necessary for executing the information processing programs, and data generated by the execution of the information processing programs. The information processing programs are deployed and executed on the main memory 405. The main memory 405 is, for example, RAM, DRAM, or SRAM, but is not limited to these. Each storage unit or database of the information processing device 400 may be built on the main memory 405.

[0137] The external storage device 406 stores information processing programs, data necessary for executing the information processing programs, and data generated by the execution of the information processing programs. These information processing programs and data are read into the main storage device 405 when the information processing programs are executed. The external storage device 406 is, for example, a hard disk, optical disk, flash memory, and magnetic tape, but is not limited to these. Each storage unit or database of the information processing device 400 may be built on the external storage device 406.

[0138] The information processing program may be pre-installed on the computer device 400, or it may be stored on a storage medium such as a CD-ROM. Alternatively, the information processing program may be uploaded to the internet.

[0139] Furthermore, the information processing device 400 may be configured as a single computer device, or as a system consisting of multiple interconnected computer devices.

[0140] It should be noted that the present invention is not limited to the embodiments described above, and the components can be modified and implemented in practice without departing from the spirit of the invention. Furthermore, various inventions can be formed by appropriately combining the multiple components disclosed in the above embodiments. For example, some components may be deleted from all the components shown in the embodiments. Moreover, components from different embodiments may be appropriately combined.

[0141] This embodiment may also have the following configuration. [Item 1] A first computation unit calculates the first polynomial from a seed for X elements among multiple elements in a matrix, A first storage unit that stores the first polynomial calculated by the first calculation unit, A signature candidate generation unit sequentially selects the aforementioned multiple elements, and if the selected element is one of the X elements, reads the first polynomial corresponding to the selected element from the first storage unit and performs an operation based on the first polynomial; if the selected element is one of the Y elements other than the X elements, calculates a second polynomial for the selected element from the seed and performs an operation based on the second polynomial to generate a signature candidate. Equipped with an information processing device. [Item 2] The system includes a second calculation unit that calculates a second polynomial from the seed for a specified element among the plurality of elements, If the selected element is one of the Y elements, the signature candidate generation unit specifies the selected element, The second calculation unit calculates the second polynomial for the selected element. The information processing device described in item 1. [Item 3] The signature candidate generation unit determines whether predetermined conditions for the signature candidate are met, and if the predetermined conditions are met, it repeats the process of generating the signature candidate again. The information processing device described in item 1. [Item 4] The system further comprises a second storage unit that stores the second polynomial calculated by the second calculation unit, The second calculation unit writes the second polynomial to the second storage unit each time it calculates the second polynomial. The signature candidate generation unit obtains the second polynomial by reading it from the second storage unit. The information processing device described in item 2. [Item 5] When the second calculation unit writes the second polynomial to the second memory unit, it overwrites the second polynomial that was previously written to the second memory unit. The information processing device described in item 4. [Item 6] The first calculation unit calculates the seed from the secret key, The signature candidate generation unit performs processing based on the data to be signed in the operations based on the first polynomial and the operations based on the second polynomial. The signature candidate generation unit generates a digital signature based on the signature candidate for which the predetermined conditions are not met. The information processing device described in item 3. [Item 7] A first calculation unit calculates an intermediate value from a seed for each of the multiple elements in the matrix, A first storage unit that stores a plurality of intermediate values ​​calculated by the first calculation unit, A signature candidate generation unit generates signature candidates by sequentially selecting the aforementioned multiple elements, calculating a polynomial from the intermediate values ​​read from the first storage unit for the selected elements, and performing operations based on the polynomial. Equipped with an information processing device. [Item 8] A second calculation unit that calculates a polynomial from the intermediate value for the selected element, The system further comprises a second storage unit that stores the polynomial calculated by the second calculation unit, The second calculation unit writes the polynomial to the second storage unit each time it calculates the polynomial. The signature candidate generation unit obtains the polynomial by reading it from the second storage unit. The information processing device described in item 7. [Item 9] The signature candidate generation unit determines whether predetermined conditions for the signature candidate are met, and if the predetermined conditions are met, it repeats the process of generating the signature candidate again. The information processing device described in item 7. [Item 10] When the second calculation unit writes the polynomial to the second storage unit, it overwrites the polynomial that was previously written to the second storage unit. The information processing device described in item 8. [Item 11] The process of calculating the intermediate value from the seed includes a part of the hash function process. The information processing device described in item 7. [Item 12] The process of calculating the polynomial from the aforementioned intermediate value includes another part of the process of the hash function. The information processing device described in item 11. [Item 13] The processing of the hash function includes an absorption process for the hash function. Another part of the processing of the hash function includes a process of extracting the hash function. The information processing device described in item 12. [Item 14] The first calculation unit calculates the intermediate values ​​for X elements among the multiple elements in the matrix, The signature candidate generation unit generates the signature candidate by, if the selected element is one of the X elements, reading the intermediate value from the first storage unit for the selected element and calculating the polynomial from the intermediate value; if the selected element is one of the Y elements other than the X elements in the matrix, calculating the polynomial for the selected element from the seed and performing operations based on the calculated polynomial. The information processing device described in item 7. [Item 15] A second calculation unit calculates a polynomial from the intermediate value for the selected element which is one of the X elements, and calculates the polynomial from the seed for the selected element which is one of the Y elements. The system further comprises a second storage unit that stores the polynomial calculated by the second calculation unit, The second calculation unit writes the polynomial to the second storage unit each time it calculates the polynomial. The signature candidate generation unit obtains the polynomial of the selected element by reading it from the second storage unit. The information processing device described in item 14. [Item 16] The first calculation unit calculates the seed from the secret key, The signature candidate generation unit performs processing based on the data to be signed in the operation based on the polynomial, The signature candidate generation unit generates a digital signature based on the signature candidate for which the predetermined conditions are not met. The information processing device described in item 9. [Item 17] For X elements among multiple elements in a matrix, calculate the first polynomial from the seed. The first polynomial that is calculated is written to the first memory unit, The system sequentially selects the aforementioned multiple elements, and if the selected element is one of the X elements, it reads the first polynomial corresponding to the selected element from the first storage unit and performs an operation based on the first polynomial. If the selected element is one of the Y elements other than the X elements, it calculates a second polynomial for the selected element from the seed and performs an operation based on the second polynomial to generate a signature candidate. Information processing methods. [Item 18] For each of the multiple elements in the matrix, calculate the intermediate value from the seed. The multiple intermediate values ​​that are calculated are written to the first storage unit. The system sequentially selects the aforementioned multiple elements, calculates a polynomial from the intermediate values ​​read from the first storage unit for the selected elements, and generates a signature candidate by performing operations based on the polynomial. Information processing methods. [Explanation of Symbols]

[0142] 100 Digital Signature Generators 110 Storage section 120 1st calculation section 130 Signature candidate generation section 140 2nd calculation section 200 clients 300 servers 400 Information Processing Devices 400 Computer devices 402 Input Interface 403 Display device 404 Communication equipment 405 Main storage 406 External storage device 407 Bus

Claims

1. A first computation unit calculates the first polynomial from a seed for X elements among multiple elements in a matrix, A first storage unit that stores the first polynomial calculated by the first calculation unit, A signature candidate generation unit generates a signature candidate by sequentially selecting the aforementioned multiple elements, reading the first polynomial corresponding to the selected element from the first storage unit if the selected element is one of the X elements, and performing an operation based on the first polynomial if the selected element is one of the Y elements other than the X elements, and calculating a second polynomial for the selected element from the seed and performing an operation based on the second polynomial. Equipped with an information processing device.

2. The system includes a second calculation unit that calculates a second polynomial from the seed for a specified element among the plurality of elements, If the selected element is one of the Y elements, the signature candidate generation unit specifies the selected element, The second calculation unit calculates the second polynomial for the selected element. The information processing apparatus according to claim 1.

3. The signature candidate generation unit determines whether predetermined conditions relating to the signature candidate are met, and if the predetermined conditions are met, it repeats the process of generating the signature candidate again. The information processing apparatus according to claim 1.

4. The system further comprises a second storage unit that stores the second polynomial calculated by the second calculation unit, Each time the second calculation unit calculates the second polynomial, it writes the second polynomial to the second storage unit. The signature candidate generation unit obtains the second polynomial by reading it from the second storage unit. The information processing apparatus according to claim 2.

5. When the second calculation unit writes the second polynomial to the second memory unit, it overwrites the second polynomial that was previously written to the second memory unit. The information processing apparatus according to claim 4.

6. The first calculation unit calculates the seed from the secret key, The signature candidate generation unit performs processing based on the data to be signed in the operations based on the first polynomial and the operations based on the second polynomial. The signature candidate generation unit generates a digital signature based on the signature candidate for which the predetermined conditions are not met. The information processing apparatus according to claim 3.

7. A first calculation unit calculates an intermediate value from a seed for each of the multiple elements in the matrix, A first storage unit that stores a plurality of intermediate values ​​calculated by the first calculation unit, A signature candidate generation unit generates signature candidates by sequentially selecting the aforementioned multiple elements, calculating a polynomial from the intermediate values ​​read from the first storage unit for the selected elements, and performing operations based on the polynomial. Equipped with an information processing device.

8. A second calculation unit that calculates a polynomial from the intermediate value for the selected element, The system further comprises a second storage unit that stores the polynomial calculated by the second calculation unit, The second calculation unit writes the polynomial to the second storage unit each time it calculates the polynomial. The signature candidate generation unit obtains the polynomial by reading it from the second storage unit. The information processing apparatus according to claim 7.

9. The signature candidate generation unit determines whether predetermined conditions relating to the signature candidate are met, and if the predetermined conditions are met, it repeats the process of generating the signature candidate again. The information processing apparatus according to claim 7.

10. When the second calculation unit writes the polynomial to the second storage unit, it overwrites the polynomial that was previously written to the second storage unit. The information processing apparatus according to claim 8.

11. The process of calculating the intermediate value from the seed includes a part of the hash function process. The information processing apparatus according to claim 7.

12. The process of calculating the polynomial from the aforementioned intermediate value includes another part of the process of the hash function. The information processing apparatus according to claim 11.

13. The processing of the hash function includes an absorption process for the hash function. Another part of the processing of the hash function includes a process of extracting the hash function. The information processing apparatus according to claim 12.

14. The first calculation unit calculates the intermediate values ​​for X elements among the multiple elements in the matrix, The signature candidate generation unit generates the signature candidate by, if the selected element is one of the X elements, reading the intermediate value from the first storage unit for the selected element and calculating the polynomial from the intermediate value; if the selected element is one of the Y elements other than the X elements in the matrix, calculating the polynomial for the selected element from the seed and performing operations based on the calculated polynomial. The information processing apparatus according to claim 7.

15. A second calculation unit calculates a polynomial from the intermediate value for the selected element which is one of the X elements, and calculates the polynomial from the seed for the selected element which is one of the Y elements. The system further comprises a second storage unit that stores the polynomial calculated by the second calculation unit, The second calculation unit writes the polynomial to the second storage unit each time it calculates the polynomial. The signature candidate generation unit obtains the polynomial of the selected element by reading it from the second storage unit. The information processing apparatus according to claim 14.

16. The first calculation unit calculates the seed from the secret key, The signature candidate generation unit performs processing based on the data to be signed in the operation based on the polynomial, The signature candidate generation unit generates a digital signature based on the signature candidate for which the predetermined conditions are not met. The information processing apparatus according to claim 9.

17. For X elements among multiple elements in a matrix, calculate the first polynomial from the seed. The first polynomial that is calculated is written to the first storage unit, The system sequentially selects the aforementioned multiple elements, and if the selected element is one of the X elements, it reads the first polynomial corresponding to the selected element from the first storage unit and performs calculations based on the first polynomial. If the selected element is one of the Y elements other than the X elements, it calculates a second polynomial for the selected element from the seed and performs calculations based on the second polynomial to generate a signature candidate. Information processing methods.

18. For each of the multiple elements in the matrix, calculate the intermediate value from the seed. The multiple intermediate values ​​that are calculated are written to the first storage unit. The system sequentially selects the aforementioned multiple elements, calculates a polynomial from the intermediate values ​​read from the first storage unit for the selected elements, and generates a signature candidate by performing operations based on the polynomial. Information processing methods.

Images