Cryptographic systems for post-quantum cryptographic operations

Abstract

Particular examples described herein relate to at least a cryptosystem and a method of operating the cryptosystem. The cryptosystem may be implemented as a coprocessor for performing post-quantum cryptographic functions. The cryptosystem comprises a bus interface set for coupling to an external computing system, a cryptographic numeric unit, and a control unit. The cryptographic numeric unit in particular examples is adapted to provide one or more masked modes of operation that protect cryptographic operations against side channel and non-invasive attacks. The method of operating the cryptosystem includes annotating secret data and tracking the annotations through one or more arithmetic operations.

Description

[Technical Field]

[0001] This invention relates to cryptographic hardware, and more particularly to a cryptographic system for performing cryptographic operations. This cryptographic system can be used as part of a post-quantum cryptography system on a chip. This cryptographic system can be used to perform cryptographic computations in a communicatively coupled computing system, and can operate, for example, as a cryptographic module for a computing board. Methods for operating the cryptographic system are also described. In particular, methods and systems relating to masking and side-channel security are provided. [Background technology]

[0002] Recently, the number of devices connected to computer networks has been exponentially increasing. For example, internet connectivity is extending beyond computing devices such as desktop and laptop computers to embedded systems in everyday items such as automobiles, light bulbs, refrigerators, medical devices, thermostats, and monitoring systems. Telecommunication links enable many low-cost computing devices worldwide to report sensor data and / or be controlled. One problem with such connected devices is that they tend to be vulnerable to attacks and malicious control. For example, hundreds or thousands of embedded devices could be compromised by malicious actors and used to carry out distributed denial-of-service attacks. Often, control of such devices can be easily gained due to poor or limited implementation of cryptographic protocols. As the number and proliferation of such connected devices increase, there are unresolved issues regarding how to protect them.

[0003] Another consideration when protecting connected computing devices is the potential for future attacks using quantum computing. For many years, quantum computers were merely a theoretical interest. However, research and implementation of quantum computers are rapidly advancing. Currently, 50-qubit and 72-qubit quantum computers are available, and many research groups are actively working on developing higher-qubit machines. Given the potential for quantum computing to become a reality in the future, recent research has shown that many widely known public-key cryptography systems could be broken by sufficiently powerful quantum computers.

[0004] When implementing cryptographic functions, especially "post-quantum" secure ones, there is the challenge that many of these functions are resource-intensive. For example, many cryptographic functions involve complex mathematical functions that use long bit lengths. These typically consume a large number of processor cycles, hindering implementation in low-resource embedded devices. Furthermore, as end-to-end encryption of both data and communications becomes more common, these cryptographic functions also need to be executed quickly and repeatedly. Being secure often means being slow.

[0005] WO2021 / 032946A1, incorporated herein by reference, describes a coprocessor that enables a processing unit to efficiently perform cryptographic operations. The coprocessor has an arithmetic unit configured to perform discrete binary operations using bit sequences loaded from memory. The coprocessor may be configured to compute certain functions, including low-level building blocks for cryptographic operations, quickly and with low power. Such functions may include Boolean logic and integer operations. The coprocessor has a set of control registers writable by the processing unit to control the coprocessor. To enable flexible operation, the addresses of one or more sources and destinations may be computed by the coprocessor. The coprocessor may enable the rapid computation of many advanced cryptographic operations, including “post-quantum” secure cryptographic operations.

[0006] The cryptographic coprocessors described in WO2021 / 032946A1 may be protected using security fuses and / or side-channel attack countermeasures. However, WO2021 / 032946A1 does not describe in detail how these may be implemented and / or integrated within a flexible cryptographic processing circuit.

[0007] US2010 / 115237A1, incorporated herein by reference, describes a coprocessor having one or more application engines that can be dynamically configured for a desired personality. For example, an application engine may be dynamically configured for one of several different vector processing instruction sets, such as a single-precision vector processing instruction set and a double-precision vector processing instruction set. The coprocessor also has common infrastructure common across different personalities, such as an instruction decoding infrastructure, a memory management infrastructure, a system interface infrastructure, and / or a scalar processing unit (having a base set of instructions). Thus, the coprocessor's common infrastructure remains consistent across different personalities, while the coprocessor's personality can be dynamically changed (by reconfiguring one or more of the coprocessor's application engines). US2010 / 115237A1 describes how a predefined instruction set may be designed to handle cryptographic operations, but does not describe specific adaptations for secure post-quantum cryptography.

[0008] WO2014 / 136594A1, incorporated herein by reference, describes a hash value generation device for generating hash values ​​based on the KECCAK algorithm. This device includes θ, ρ, π, χ, and ι processors for performing the five steps θ, ρ, π, χ, and ι that are part of the round processing of the KECCAK algorithm. The π processor takes data input in plane units and outputs data in sheet units. Because WO2014 / 136594A1 describes a device specifically for processing the KECCAK algorithm, its relevance to broader post-quantum cryptographic operations is limited.

[0009] In her doctoral dissertation, "Extended Security of Lattice-Based Cryptography," submitted to the HAL Archives on September 23, 2020, Melissa Rossi analyzes the real-world security of lattice-based post-quantum asymmetric schemes. Part I focuses on signature schemes and analyzes algorithmic protection against timing and side-channel attacks. The focus is on introducing algorithmic tools to address these attacks. The dissertation attempts to fill some of the gaps in proving timing protection and higher-order masking in lattice-based post-quantum asymmetric schemes (see Section 1.3). Part II of the dissertation focuses on cryptography. Chapter 3 further details masking of lattice-based signatures. Rossi states that masking of lattice-based signature schemes is extremely difficult, even considering the simplicity of the scheme (see page 62). In Section 3.1, Rossi states that implementations of lattice-based primitives present a new set of challenges as far as physical attacks such as side-channel attacks are concerned. Masking has been used in pre-quantum cryptography, but its application to post-quantum cryptography is not straightforward. Rossi examines several theoretical models and introduces high-level pseudocode "gadgets" that correspond to subparts of larger algorithms (see page 67). Several proof-of-concept implementations of masked signature schemes have been tested on Intel® Core® i7 CPU-based desktop machines (see sections 3.3.5 on page 89 and 3.5.4 on page 101). A simple implementation of the qTESLA scheme using order 1 masking has also been tested on a Cortex® M4 microcontroller.

[0010] US2010 / 0235417A1 describes a circuit for converting between Boolean masks and arithmetic masks.

[0011] It is desirable to provide an efficient implementation of an encryption operation. For example, it is desired to provide an implementation that can be used in a low-resource embedded system and / or in high-speed data processing operations while providing resistance to attacks in a post-quantum environment. For example, it is desired to easily provide secure post-quantum cryptographic services to different computing systems without requiring a large-scale redesign of those computing systems.

[0012] When implementing masking using a lattice-based encryption method, there is a further problem of providing an efficient yet secure low-level implementation. For example, the pseudo-code gadget provided by Rossi has a conventional CPU implementation (e.g., by execution of a computer program code implementing the pseudo-code). Such an implementation is vulnerable to attacks because confidential data, such as part of a secret key, still needs to be loaded from memory to the CPU before and during the masking operation. Thus, considering the complexity of modern CPUs, e.g., multiple caches and opaque processing pipelines, there can be a large number of points for eavesdropping and / or measurement available to malicious parties despite the masking being applied. SUMMARY OF THE INVENTION

[0013] Aspects of the present invention are set forth in the appended independent claims. Specific variations of the present invention are set forth in the appended dependent claims.

[0014] Hereinafter, embodiments of the present invention will be described by way of example while referring to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] [Figure 1] It is a schematic diagram showing an encryption system according to an embodiment. [Figure 2] It is a schematic diagram showing a pipeline operation executed by an arithmetic operation pipeline device according to an embodiment. [Figure 3]This is a schematic diagram illustrating an example of masking applied to confidential data. [Figure 4] This is a schematic diagram illustrating an example of an Extensible Output Function (XOF) device used to compute fast iterative hash values. [Figure 5] This is a schematic diagram illustrating the execution of a pipeline cryptography function according to an example. [Figure 6] This is a flowchart illustrating how to perform encryption operations according to the example. [Modes for carrying out the invention]

[0016] preface The specific embodiments described herein relate to cryptographic systems that enable a communicatively coupled computing system to efficiently perform cryptographic operations. For example, the cryptographic system may be provided as a system-on-chip device for inclusion on a larger computing circuit board and / or integrated circuit. The cryptographic system may be implemented as an integrated circuit design, manufactured in silicon, i.e., as a standalone (e.g., as an application-specific integrated circuit (ASIC)) or together with a larger computing system circuit, and / or as a field-programmable gate array (FPGA), for example, in the form of a specific configuration of an FPGA programmed with a suitable hardware description language. The cryptographic system can be used as a “post-quantum” cryptographic module or coprocessor, for example, enabling one or more processors in a communicatively coupled computing system to offload complex “post-quantum” cryptographic operations for fast and secure computation. For example, the cryptographic system may be configured to implement key establishment and digital signature functions on behalf of the computing system. The cryptographic system may be configured with security boundaries so that other devices and integrated circuits in the computing system, and possibly even the computing system itself, cannot access the confidential data being manipulated within the cryptographic system. This cryptographic system can be configured to autonomously perform post-quantum cryptographic operations as part of a larger hardware system, such as a larger ASIC or FPGA design.

[0017] In the specific embodiments described, the cryptographic system comprises a set of bus interfaces for communicatively coupling the cryptographic system to one or more system buses of a computing system, a cryptographic numerical arithmetic unit, and a control unit including at least one processor and memory for controlling the cryptographic system. These components enable the cryptographic system to operate as an autonomous system within a broader range of electronic hardware. The cryptographic numerical arithmetic unit may comprise a matrix memory for storing data configured as a multidimensional array, an address generator configured to receive control signals from the control unit and control access to the data in the matrix memory, and an arithmetic unit that performs a defined set of arithmetic operations on the data in the matrix memory accessed using the address generator. The arithmetic unit may be configured to perform discrete binary operations using bit sequences loaded from the matrix memory. Since these bit sequences can be blocks of bits, the cryptographic numerical arithmetic unit may implement a “britter” function, i.e., a hardware-assisted system for moving and manipulating blocks of bits in memory (the term “britter” here derives from the Xerox Alt Computer's “BitBLT” (Bit Block Transfer) microcode instruction). The cryptographic system may be configured to compute certain functions, including low-level building blocks for cryptographic operations, quickly and with low power. These functions may include Boolean logic, integer arithmetic and vector processing, as well as reordering cryptography. Therefore, the processing units of the coupled computing system can effectively offload resource-intensive computations for cryptographic operations to this cryptographic system, which operates as a dedicated and secure hardware device. This cryptographic system can provide low-level bitwise operations that are atomic from the perspective of the coupled computing system. Thus, this cryptographic system can enable the rapid computation of many advanced cryptographic operations, including "post-quantum" secure cryptographic operations.

[0018] In this specification, the term “post-quantum” is used to describe cryptographic operations and functions that provide protection against attacks by quantum computers. This term is well known in the field of cryptography. For example, many common public-key algorithms are not post-quantum secure and can be efficiently broken using a sufficiently powerful quantum computer. These “non-quantum secure” cryptographic algorithms include those based on prime factorization problems, discrete logarithm problems, or elliptic curve discrete logarithm problems. These can all be easily solved using Shor's algorithm on a sufficiently powerful quantum computer. Operations and functions that have been demonstrated to be post-quantum secure include those based on one or more of the following: lattice-based cryptography, multivariate cryptography, hash-based cryptography, code-based cryptography, and hypersingular elliptic curve isogeneic mapping cryptography. Below, specific examples of post-quantum operations and functions that can be implemented by the cryptographic systems described herein will be described in more detail.

[0019] The cryptographic system of this embodiment is suitable for a wide range of computing systems, from internet servers to embedded devices. In one embodiment, the cryptographic system may be provided as part of a cryptographic system-on-chip (SoC) that enables many low-cost embedded devices to implement "post-quantum" cryptography and provide "post-quantum" secure systems. For example, functions implemented by the cryptographic numerical arithmetic unit may enable code or grid-based cryptographic operations to be performed quickly by offloading many common low-level binary logic functions, such as integer addition, subtraction, and / or multiplication. The cryptographic system may be configured with a set of available functions that may be updatable over time, or it may be pre-programmed. The cryptographic system can quickly compute specific functions by avoiding the need to load and interpret separate instructions required by the processor of the coupled computing system. The cryptographic system may be conceived as a specialized computing device (i.e., a computer) designed to integrate with larger, general-purpose computing devices (e.g., to be used as a computer within a computer).

[0020] Examples of cryptographic systems Figure 1 shows an embodiment 100 of the cryptographic system 110. The cryptographic system 110 comprises a bus interface set 120, a cryptographic numerical arithmetic unit 130, and a control device 150. The bus interface set 120 is arranged to communicately connect the cryptographic system 110 to one or more system buses of a computing system. As described above, the computing system may comprise a computing device (such as a server board) or an integrated circuit (such as a larger FPGA and / or ASIC embedded system). In some cases, the cryptographic system 110 may be implemented as a system-on-a-chip (SoC) coupled to the motherboard (or other set of electronic circuit boards) of the computing device. The bus interface set 120 ensures that control instructions and / or confidential data are received from the computing system (e.g., from the computing system's processor and / or memory, or from one or more peripheral devices). In some cases, the computing system's processor may instruct the cryptographic system to perform cryptographic operations involving reading and / or writing data via the bus interface set. The cryptographic numerical arithmetic unit 130 comprises several components that perform mathematical operations for post-quantum cryptographic operations and functions. The cryptographic numerical arithmetic unit 130 can receive data from the bus interface set 120 and / or return processed data to the bus interface set 120. The cryptographic numerical arithmetic unit 130 operates under the control of the control unit 150. The control unit 150 comprises at least one processor and memory to control the cryptographic system. The cryptographic system 110 can be incorporated into a variety of devices, from smart cards to server boards, or can form part of the motherboard or circuit board of a computing device such as a server, laptop, tablet, or smartphone.

[0021] More specifically, the bus interface set 120 in the embodiment of Figure 1 includes a cryptographic register set 122 and a control register set 124, where “set” is used to refer to one or more registers. The cryptographic register set 122 is configured to transfer sensitive security parameters (SSPs) to and from the cryptographic system 110. Sensitive security parameters may include private key material and / or data from a random number generator (e.g., a true random number generator (TRNG) feed). Sensitive security parameters may be encrypted for transfer. The cryptographic register set 122 can be used as a dedicated cryptographic key management interface for transferring data and is therefore shown as a key interface in Figure 1. The cryptographic register set 122 may be used to transfer data between the cryptographic system 110 and secure non-volatile storage of the computing system and / or other cryptographic devices of the computing system (e.g., a trusted platform module (TPM) of the computing system). The cryptographic register set 122 is shown as communicably coupled to the SSP bus 126 for secure data transfer. The SSP bus 126 may comprise one or more dedicated secure buses for the computing system for cryptographic data transfer, and / or a reasonably secure general-purpose system bus (e.g., a reserved access channel for the general-purpose system bus). The control register set 124 enables high-level control interaction with the cryptographic system 110. In use, the dotted boundary of the cryptographic system 110 shown in Figure 1 forms a security boundary, allowing the computing system to restrict access to components and data within the security boundary. For example, confidential data may be exchanged only via the cryptographic register set 122 communicating with the SSP bus 126, and the computing system may communicate with the cryptographic system only via a predefined set of control instructions writable to the control register set 124 by at least one processor of the communicatively coupled computing system.For example, the control register set 124 and one or more computing system buses 128 may form an Advanced Extensible Interface (AXI) and / or Advanced High Performance Bus (AHB) interface to enable inter-chip communication between an (external) computing system and the cryptographic system 110. For example, at least one processor (or authorized peripheral) of the computing system may instruct cryptographic operations using AXI and / or AHB commands. In general, any bus architecture, including any advanced microcontroller bus architecture, may be used. In some cases, the cryptographic register set 122 and the control register set 124 may form separate AXI and / or AHB interfaces, for example, in the form of a first memory interface for reading and / or writing and a second control interface for control parameters.

[0022] During use, the control unit 150 controls the operation of the cryptographic numerical arithmetic unit 130 to perform cryptographic operations (e.g., processing of data received via the cryptographic register set 122) in accordance with high-level instructions received from the computing system (e.g., from the processor or authorized peripheral via the control register set 124). The cryptographic system 110 is configured to implement at least post-quantum cryptographic operations. In certain embodiments, the cryptographic system 110 can also perform non-quantum (e.g., classical) cryptographic operations. The control unit 150 and the cryptographic numerical arithmetic unit 130 may be optimized for lattice-based cryptography and code-based cryptography (in particular among other post-quantum approaches), as well as for "large integer" arithmetic operations (e.g., arithmetic operations using large integer values ​​defined by n bits, where n may be 32 or 64). The control register set 124 may be used to store one or more of the following: status (e.g., busy or waiting for instruction), function to execute, size of source data and / or destination data, storage location of source data and / or destination data, shift parameters, increment parameters for one or more of the address array and data array, and / or indicators indicating whether the current function has completed. An (external) computing system may be configured to read values ​​stored in the control register set 124 to determine whether the function's output is available, to receive interrupts from the cryptographic system 110, and / or to wait for a predetermined number of clock cycles associated with the function. Depending on the implementation requirements, various approaches may be used.

[0023] In some cases, the cryptographic system 110 is configured to perform one or more of the following: a key establishment function including one or more encryption and decryption; a digital signature function including one or more digital signature generation and digital signature verification; and a stateful hash-based signature. The cryptographic system 110 may be configured to perform these functions autonomously. For example, the processor of a computing system may instruct it to perform a cryptographic function on data in the secure memory of a computing device via data written to the control register set 124 (for example, by writing instructions to the registers mentioned above). The cryptographic system 110 may be configured to access the data copied to the cryptographic register set 122, and using the control unit 150 and the cryptographic numerical arithmetic unit 130, execute the instructed cryptographic function and then copy the result of the function back to secure memory via the cryptographic register set 122. Thus, the driver components of the cryptographic system 110 may be relatively simple. It may mainly relate to scheduling operations so that the computing system can arrange for input data to be made available and await access to the results of operations performed by the cryptographic system 110. When not performing encryption operations, the encryption system 110 may be configured to enter a "sleep" mode with minimal dynamic power consumption.

[0024] The operations performed by the control device 150 may be implemented by hardware in a hardwired manner (e.g., as part of an integrated circuit design) or may be updatable (e.g., via updatable firmware instructions). The operations may be selected from a set of available operations, and the set of available operations may be pre-configured (e.g., pre-programmed within or configured within an ASIC or FPGA, and / or extensible or modifiable, for example, via computer program code stored in memory). Parameters for the operations may be configured and / or selected using appropriate hardware abstraction layer (HAL) functions so that they are accessible, for example, via the aforementioned driver components to the operating system or other processes.

[0025] In Embodiment 100 of Figure 1, the control unit 150 comprises a processor 152, random access memory (RAM) 154, and read-only memory (ROM) 156. The processor 152 may be a reduced instruction set computer (RISC) processor, such as a RISC-V central processing unit (CPU). The processor 152 may be a 32-bit or 64-bit microprocessor (e.g., an RV32-I / E- / M / C Pluto core). The processor 152 may have one or more processing cores. The RAM 154 may comprise stack RAM for the control unit 150, i.e., memory for implementing a stack to manage control instructions sent to the cryptographic numerical arithmetic unit 130. The RAM 154 and / or ROM 156 may be used to store firmware instructions executed by the processor 152. The RAM 154 may comprise volatile memory, and the ROM 156 may comprise non-volatile memory for control instructions. ROM156 may include a programmable ROM that stores firmware instructions and enables firmware updates (for example, via bus interface set 120).

[0026] During use, the control unit 150 cannot access encrypted data received via the cryptographic register set 122, nor can it access encrypted data processed by the cryptographic numerical arithmetic unit 130. As shown in Figure 1, the bus interface set 120 may be communicatively coupled to the cryptographic numerical arithmetic unit 130 by a first internal bus 162, and communicatively coupled to the control unit 150 by a second internal bus 164. The first internal bus 162 may be secure and is used to transfer encrypted data to and from the cryptographic register set 122. The second internal bus 164 is used by the control unit 150 to access control instructions written to the control register set 124. The control unit 150 then controls the operation of the cryptographic numerical arithmetic unit 130 via a third internal bus 166. The third internal bus 166 may be a so-called "no-touch" control bus that does not allow access to the cryptographic numerical arithmetic unit 130's internal encrypted data. For example, it may be used only for controlling the cryptographic numerical arithmetic unit 130 and data access may be disabled. Similarly, the control unit 150 may not be able to access the data in the cryptographic register 122. The control unit 150 interprets post-quantum computing commands received via the bus interface set 120 and the first internal bus 164 and instructs the operation of the cryptographic numerical arithmetic unit 130 via the third internal bus 166 without touching the cryptographic data.

[0027] In Embodiment 100 of Figure 1, the cryptographic numerical arithmetic unit 130 comprises a matrix memory 132, an address generator 134, and an arithmetic unit 136. The matrix memory 132 is configured to store a multidimensional array of data, i.e., data arranged as a multidimensional array. The memory 132 is hardware-wise called the “matrix memory,” and it may be implemented using random access memory (RAM) configured to be accessed via the address generator 134, enabling the storage of a multidimensional array. The address generator 134 is configured to receive a control signal (shown as “CTRL” in Figure 1) from the control unit 150 and to control access to data in the matrix memory 132. The arithmetic unit 136 is configured to perform a defined set of arithmetic operations on the data in the matrix memory 132 accessed using the address generator 134. The cryptographic numerical arithmetic unit 130 may be called the “britta,” as described above. During use, the cryptographic numerical arithmetic unit 130 may be controlled to modify thousands of integer elements stored in the matrix memory 132. These integer elements may be defined as n-bit values ​​(for example, n is generally 16 or 32). The matrix memory 132 may be configured to enable efficient cryptographic operations on multidimensional representations of data and to store the results of the operations as similar multidimensional representations. For example, the matrix memory 132 may be able to store and / or access data as a two-dimensional array or matrix having defined height and width. An example of a matrix memory is described in WO2021 / 032946A1. In some cases, the matrix memory 132 may include a memory (such as RAM) in which the data is stored as a flattened sequence of words, and further, an external interface is provided for operations within the cryptographic numerical arithmetic unit 130 that represent the data as a multidimensional data structure. The matrix memory 132 may be (internally) converted from an array-based representation of data to a flattened sequence by iterating through a series of nested loops.In some cases, access to the data as a matrix may be performed via the address generator 134.

[0028] For example, the matrix memory 132 may have RAM with n bits of internally addressable memory, where n can be varied by configuration and may include (among others) 16, 32, 64, 96, 128, and 256 bits. In a particular test implementation, 32-bit or 64-bit memory was used. The matrix memory 132 may represent data as two-dimensional blocks of words (each word being n bits) having width and height (measured, for example, by the number of words in the first dimension or X dimension and the number of words in the second dimension or Y dimension). The size of each dimension of the multidimensional array may be set by a value set by the control device 150, for example, the control device 150 may configure the matrix "width" as the integer size of the words in the first dimension and the matrix "height" as the second integer size of the words in the second dimension. The size of each dimension may be set as an integer value of 1 or greater.

[0029] The data can be retrieved from matrix memory 132 by iterating over a sequence of words stored in memory (e.g., RAM) using a set of nested loops. The number of nested loops is equal to the number of dimensions of the multidimensional array. For example, two nested loops may be used to iterate over a sequence of words in memory that is treated as a two-dimensional matrix.

[0030] As an example, consider the sequence "ABCDEFGHIJKLMNOP". Here, each character represents a word stored in memory. This can be stored in matrix memory 132 as a configurable matrix with four rows of length 4. This matrix can be accessed in various ways by constructing an increment within a nested loop defined for access. For example, if the increment is 1 in the X direction and 0 in the Y direction, during iterations, rows may be read one word at a time, e.g., A, B, C, D. At the end of a row, the Y increment is applied. If this is set to 0, nothing happens at the end of a row, and subsequent iterations begin reading the next row linearly from where the previous row iteration ended, e.g., D, E, F, G. Thus, the data may be read as "ABCDDEFGGHIJJKLM", repeated every four words, and the last three words ignored. If there is an increment of 1 in both the X and Y directions, this can allow iteration along the row of words (taking words sequentially along the width direction, e.g., A, B, C, D) before moving to the next row (for example, the first 4 words are read, and after the row is complete, the Y increment advances by 1 again, so the next row starts with E, and becomes E, F, G, H). In this case, "ABCDEFGHIJKLMNOP" is read. By configuring the size and increment, a programmable path through the data can be determined, which can be controlled by one or more of the address generator 134 and the control device 150. For example, setting the X increment to 4 and the Y increment to -11 results in the sequence "AEIMBFJNCGKODHLP" being read. In other words, the transpose of the original data matrix, which is read along the column and has a width and height of 4 words, is effectively determined.

[0031] During use, the matrix memory 132 may be used to store both the private and public keys, as well as working variables. These variables may be represented as masked shares, as will be explained in more detail below. Visibility of the matrix memory 132 to the bus controller may be limited. Within an FPGA implementation, the matrix memory 132 may be implemented using block RAM (BRAM) resources. Byte parity error checking, etc., may be implemented using the memory compiler of the ASIC implementation. In certain variants, the matrix memory 132 may be externally accessible, for example, by an external computing system or authorized components of the system described above. Generally, the matrix memory 132 is defined within a security boundary, which may be maintained logically rather than physically in certain implementations (e.g., a security boundary similar to the dashed lines forming the cryptographic system 110 in Figure 1). In certain variants, the matrix memory 132 may be implemented using memory of an external computing system (e.g., RAM of the system described above) shared with other processors of the computing system. In these variations, the underlying memory used to implement the matrix memory 132 can be made secure (e.g., has controlled access so that access from reserved addresses and / or authorized processes is not enabled). The cryptographic system 110 can be configured so that memory addresses and access patterns within the matrix memory 132 do not leak confidential information. Below, we will further describe one approach that uses masking to ensure confidentiality against direct extraction of individual bits. With masking and / or cryptographic controls, the matrix memory 132 can be implemented using any known memory technology (e.g., available RAM technology). In some cases, the matrix memory 132 is implemented using one or more of the following to enhance security: error-correcting memory, scrambled memory, encrypted memory, and obfuscated memory.

[0032] In certain implementations, the cryptographic numerical arithmetic unit 130 has a set of source registers and a set of destination registers used in performing arithmetic operations. These registers may form part of the arithmetic unit 136, and data is transferred between these registers and the matrix memory 132. In this case, the address generator 134 is configured to determine the addresses in the matrix memory 132 for data written to or read from the source registers and / or destination registers (e.g., during a given iteration of the arithmetic unit 136). In some cases, the arithmetic unit 136 may include multiple registers that can be used as source registers or destination registers depending on the operation (e.g., configured by the control unit 150). While referring to source registers and destination registers, it should be noted that in certain implementations, data may instead be read directly from a location in the matrix memory 132.

[0033] The operating mode of memory access may depend on the type of memory used to implement the matrix memory 132 and / or the number of available ports. Certain memory technologies may have operating modes associated with fixed rules for memory access. In certain memory implementations, it may be possible to efficiently read and / or write to multiple addresses simultaneously (e.g., in the RAM implementing the matrix memory 132). For example, depending on the number of ports, it may be possible to read from and / or write to multiple locations (e.g., one of A, B, and C, or one of C and D) during any single iteration. While A, B, and C are referred to as input data sources and C and D as output data sources, in actual implementations, any memory address can be used as a data source (e.g., when data is read to be used as input to an operation) and / or a data destination (e.g., when data is written to be used as output to an operation). Parallel read and / or write operations may be performed for masked writes for side-channel security (e.g., as described later) and butterfly operations for number theory transformation (NTT) operations. The address generation performed by the address generator 134 also allows for flexible ordering of operations. For example, this can be achieved by configuring address increments in one or more dimensions of the matrix memory 132. For example, if the address generator uses an increment of 0 of X dimensions (width) for source data A, this implements a column matrix, and it may not be necessary to reread the value before the address is incremented at the end of the matrix row.

[0034] Returning to Figure 1, the operations performed by the arithmetic unit 136 during use are selected by the operation control unit 138 based on an operation control signal (indicated as OPER) from the control unit 150. The operation control unit 138 receives the operation control signal and configures the arithmetic unit 136 to perform the operation indicated by the operation control signal. This may include setting a function "oper" to be performed on data stored in source registers. The set of available operations performed by the arithmetic unit 150 may include certain integer arithmetic functions frequently used by post-quantum cryptography, such as lattice or code-based cryptography. Integer arithmetic functions may include multiplication, addition, and subtraction operations performed on one or more bit sequences that are considered to represent integer values ​​(e.g., 8, 16, or 32-bit integers). Boolean operations may also be performed; for example, a bit sequence read from memory as an operand may be treated as an independent sequence of bits (e.g., bit / bit logic). Different bit lengths may be supported. The indicated operations may be performed on binary data stored in one or more source and destination registers. In practice, registers may be used in many implementations to temporarily store data that is read from or written to matrix memory 132, but it should be noted that in certain implementations, reading from or writing to matrix memory 132 may be performed directly on one or more source or destination registers without intermediate storage.

[0035] The address generator 134 controls which matrix memory locations are read as operational inputs ("sources") and / or written as operational outputs ("destinations"). If source and destination (i.e., arithmetic) registers are used (e.g., four registers A, B, C, and D), each register may have its own address generator within the address generator 134, which can specify a non-sequential access pattern. The address generator 134 may be configured to determine a two-dimensional "bullet" window in the matrix memory 132. The address generator 134 may be configured to store one or more counters for nested loop calculations, as described above. For example, to implement a two-dimensional "bullet" window, the address generator 134 may use two nested counter layers for each source or destination register, where the counters are used to represent the "width" and "height" (i.e., a two-dimensional array of values) of the window. The address generator 134 may control the nested loop implementing the matrix memory 132, for example, determining how locations in memory are iterated over to access the two-dimensional window of values. For example, by controlling the addressing of each arithmetic register, the address generator 134 can control row operations and matrix transposition, sequences of FFT butterfly steps, and / or gate collection of data words for rejection sampling. This form of addressing makes it possible to perform vector-matrix, polynomial-polynomial, and / or multiplication of large integers in an "atomic" operation (i.e., a single "bullet") of a single cryptographic system. Further details of the operations that can be performed by the cryptographic numerical arithmetic unit 130 are described in WO2021 / 032946A1.

[0036] In "collection" mode, the arithmetic unit 136 can be controlled to influence the stepping of one or more address generators (i.e., provided as part of address generator 134) to perform rejection sampling (i.e., select values ​​that satisfy defined criteria). This "collection" mode may provide triggered stepping such that the access pattern is not entirely predetermined (compared to, for example, other operations performed by the arithmetic unit 136). However, since this triggered stepping may only be used for rejection sampling from random inputs, no sensitive information will be leaked.

[0037] In Embodiment 100 of Figure 1, the cryptographic system 110 further comprises a reordering device 140, which may include an extensible output function (XOF) device configured to apply cryptographic operations to generate an infinitely long output stream. The reordering device 140 may include optional devices provided in a preferred implementation. In Embodiment 100 of Figure 1, the reordering device 140 is controlled by a control unit 150 and is communicatively coupled to an arithmetic unit 136. The reordering device 140 is configured to implement a reordering computation (of cryptography). In some cases, the reordering device 140 is configured to implement the KECCAK-p reordering described in Federal Information Processing Standard (FIPS) 202 (or Secure Hash Algorithm 3 - “SHA-3” - Standard) - “SHA-3 Standard: Reordering-Based Hash and Extensible Output Function”, FIPS PUB 202, U.S. National Institute of Standards and Technology (NIST), August 2015, which is incorporated herein by reference. As described in Section 3 of the FIPS202 standard, each round of cryptographic reordering consists of five distinct (reordering) steps: theta θ(A), rho ρ(A), pi π(A), chi χ(A), and iota ι(A,i r ) may include its components. In the final step, round constant parameter i r It receives. Therefore, the compound round function of this standard can be defined as follows: Rnd(A,i r )=ι(χ(π(ρ(θ(A)))),i r)

[0038] In this example, the sorting device 140 may be configured to perform this compound round function Rnd for, for example, one round or multiple rounds. If the size of the sorting input A is 1600 bits, these round functions (with a specific round constant i) r The 24 combinations of (having ) constitute KECCAK-p[1600,24]. This provides the basic building blocks for the SHA-3 / SHAKE hash function as described in the FIPS202 standard. It also provides the basic building blocks for many other derived primitives. Examples of cryptographic rearrangements other than KECCAK-p include the B-bit rearrangement of ASCON, described by Christoph Dobraunig, Maria Aichlseder, Florian Mendel, and Martin Schlaffer in the "Ascon v1.2" proposal to the NIST LWC standardization activity in March 2019, which is incorporated herein by reference. For example, rearrangement device 140 may perform the ASCON rearrangement to generate a random bit sequence that can be used for masking as described below. In general, rearrangement device 140 may be used in one or more internal mask generation operations used to masquerade internal data with noise to protect against side-channel attacks (for example, as described in more detail below).

[0039] In this embodiment, the sorting device 140 is integrated with the cryptographic numerical arithmetic unit 130 and controlled using the control registers of the cryptographic numerical arithmetic unit 130 (e.g., via the control register set 124 in Figure 1). The sorting performed by the sorting device 140 can be configured and initiated by the control device 150 and / or other components of the cryptographic numerical arithmetic unit 130. This configuration may include setting the sorting rate and data block size performed by the sorting device 140. The address generator 134 may be used to generate read addresses and / or write addresses of the sorting state, and the sorting state may be stored in the matrix memory 132 (and, for example, in the internal data registers of the sorting device 140). Embodiments of the sorting device 140 may be based on the cryptographic sorting device described in WO2021 / 014125A1, which is incorporated herein by reference.

[0040] The sorting device 140 may be used to perform one of several defined sorting operations. These may include one or more of the following: cryptographic absorption operations, cryptographic squeeze operations, cryptographic sampling operations, and cryptographic random masking operations. Cryptographic absorption operations may include receiving an input data word and either overwriting a specific sorting state word (e.g., one of several data words representing a cryptographic sorting state) with the input data word, or performing a binary operation (e.g., an XOR operation) on a combination of the input data word and the specific sorting state word. This may represent the "absorption" of the input data word into a sorting state. Cryptographic squeeze operations may include passing a specific sorting state word from the sorting device 140 to the arithmetic unit 136 (e.g., for use in an arithmetic operation and / or for output to the matrix memory 132). This may represent the "narrowing" of sorting state words from a sorting state. Cryptographic sampling operations may include statistical sampling operations such as the use of a binary function and / or a cumulative distribution function (CDF). The CDF function may involve looking up the CDF value in a software or hardware lookup table (for example, the hardware lookup table may be defined for a normalized Gaussian distribution). Cryptographic sampling operations may be applied by the arithmetic unit 136 before writing the output to the matrix memory 132. In cryptographic random masking operations, the output of the reordering unit 140 may be used as a masking pseudorandom number generator for the binary sequence used in the masking operations described below. This may be used, for example, for conversions between different masking representations. In some cases, the cryptographic system 110 may have a “masked random” function that may or may not use the reordering unit 140, which may output a random bit sequence according to a non-deterministic function, for example, which may return a random word for each step or iteration used in the masking operation. The reordering unit 140 may be addressable, but the output of the masked random function may not be addressable.

[0041] If the reordering device 140 is configured to perform a Keccak-p reorder using a 1600-bit Keccak state, this state (i.e., the reorder state) can be decomposed into data words having the same size as the bandwidth of the binding in the cryptographic numerical arithmetic device 130. In masked reordering mode, the reorder state can be divided into individual shares, similar to the masking operation described below. Each reordering round can be further decomposed into individual steps applied to each share. In some cases, the XOF operation itself is masked, resulting in the use of two “layers” in the reordering device 140: one for generating the mask for masking, and the other for performing the masked reorder. For example, if sensitive data is used in a Keccak reorder, the reorder can be applied to masked data. A masked implementation of Keccak rearrangement may be based on a threshold implementation using re-randomization, as described by J. Daemen in "Changing of the Guards: a simple and efficient method for achieving uniformity in threshold sharing," IACR-CHES-2017, which is incorporated herein by reference. In this case, there may be m (e.g., 3) 1600-bit shares stored in the matrix memory 132, adapted to the specific hardware of the cryptographic system 110.

[0042] In certain embodiments, the address generator 134 may be further wired to one or more state registers of the reordering device 140 so that the address generator 134 can index individual data words associated with a reorder state controlled by the reordering device 140. In some cases, the window width of the cryptographic numerical arithmetic unit 130 (e.g., the matrix width set in relation to the matrix memory 132) may be used to specify the reorder rate (e.g., the Keccak rate), while the window height (e.g., the matrix height set in relation to the matrix memory 132) may specify the number of blocks for the reorder. A reorder may be triggered if there is a window or matrix at the end of a row. This configuration may allow absorption and / or squeeze operations (such as operations that implement SHA-3 SHAKE reordering) to be performed without interaction with a control device. Further details regarding window or matrix formats are described in WO2021 / 032946A1, and further details regarding reorder implementations are described in WO2021 / 014125A1, both of which are incorporated herein by reference.

[0043] Examples of pipeline operation The cryptographic numerical unit 130 is configured to efficiently perform arithmetic operations with complex addressing. In certain cases, such as those described with reference to Figures 2 and 5 below, pipeline processing may be used to improve the efficiency and speed of processing. For example, the arithmetic unit 136 may be configured to implement parallel processing and thus provide single-instruction multiple-data (SIMD) functionality. Therefore, it may also be combined with multi-port memory of matrix memory 132 so that different memory locations can be accessed (e.g., read or write) through each port. The exact pipeline configuration may vary depending on the implementation requirements. A series of iterations by the cryptographic system 110 may form part of an atomic operation from the perspective of an external computing system. For example, they may be instructed by a single instruction of the computing system. A set of iterations can be used to perform a single cryptographic operation on multiple sources, whose sources have a related multi-dimensional array of data stored in matrix memory 132. This single cryptographic operation may be called a "brit" (for example, in relation to the cryptographic numerical unit being a "brit"). In some cases, dual-port memory may be used, and parallel processing may be used to perform integer operations of 2, 4, or 8 every two cycles of "britta" steps (each "britta" step or "brit" performs a single mathematical operation). Sets of iterations may be synchronized with the clock cycle of the computing system; for example, a complete set may be executed in one clock cycle of the computing system. This means that while the same cryptographic operation performed on the computing system alone may require multiple fetch, decode, and execute cycles on both the computing system's data and address memory, the cryptographic system 110 can make the results available in accessible memory in a much shorter time, potentially resulting in a significant speed improvement. In certain embodiments, the clock rate of the cryptographic system 110 may differ from the clock rate of the computing system.In these cases, either the cryptographic system 110 or the computing system may execute the individual steps in a single cycle or multiple cycles. The number of steps executed may depend on the memory bandwidth and, in the case of the computing system, the complexity of the instructions.

[0044] Figure 2 shows an embodiment 200 of a method for parallel processing of multiple input streams using the arithmetic unit 136 in pipeline mode. Pipeline mode may also be used to implement security masking, as described below. Figure 2 shows a pipeline operation 210 in which multiple computation streams 212 are executed in parallel. Note that Figure 2 is a schematic diagram of one embodiment of the pipeline configuration, and different implementations may have different pipeline configurations, and the actual underlying hardware configuration may differ depending on the implementation (e.g., in the form of circuit patterns for silicon manufacturing and / or FPGA programmed gate configurations). In Figure 2, four computation streams 212 are shown, but the number of computation streams may vary depending on the configuration set by the control unit 150, for example, the number of computation streams may depend on the length of the set of independent data elements to be processed in parallel. The data elements may be binary data elements of length 8 bits, 16 bits, or 32 bits, and in some cases, Galois field elements of variable q (GF(q)), or Boolean GF(2) with a particular recurrence polynomial. n ) elements, etc., can be even smaller units. A pipeline operation 210 may represent a single operation ("bullet") directed by an external computing system via the bus interface set 120. A single operation is shown as "oper" in Figure 2, as in the previous example. An "oper" instruction 220 specifies the pipeline for the entire cryptographic numerical operation and may be provided via an OPER control signal received by the operation control unit 138 (for example, the "oper" instruction 220 in Figure 2 represents the operation control achieved by the operation control unit 138 to the arithmetic unit 136).

[0045] In Figure 2, each of the four computation streams 212 includes multiple stages that are computed sequentially over time for each stream. In Figure 2, each of the four computation streams 212 has stages 1 through n-1, with the final output of the computation determined in the last nth stage 214. Thus, in Figure 2, the pipeline operation 210 runs over n internal cycles. During the pipeline operation 210, data access to and from one or more of the matrix memory 132 and the reordering device 140 is controlled by an address generator 230, which may include the address generator 134 in Figure 1. To start the pipeline operation 210, data that may include data to be retrieved from the matrix memory 132 and / or the reordering device 140 is received from the input variable stream 240. In some cases, data from the reordering device 140 may be routed to the matrix memory 132 so that all data access operations are performed with respect to the matrix memory 132. In this embodiment, three input variables A, B, and C are taken as inputs to the pipeline operation 210. In the embodiment shown in Figure 2, the address generator 230 determines the address of each of these input variables (for example, in the matrix memory 132 or in the designated register of the reordering unit 140), and in block 232, the data (i.e., a sequence of bits) is read from the address ready for the pipeline operation 210. This may involve copying the data from a specific address in the matrix memory 132 to the input register of the arithmetic unit 136. In Figure 2, the three input variables A, B, and C are shown as 242, 244, and 246. To start the pipeline operation 210, the data from each of the input variables A, B, and C is provided as input to the first stage (i.e., stage 1) of the compute stream 212. In the case of simple Boolean operations such as (bitwise) AND, OR, and XOR, the data may consist of a sequence of bits of the same length as the original input variable.For example, if the bandwidth or data width of the arithmetic unit is 32 bits or 64 bits, an input variable having a length of 32 bits or 64 bits can be copied to each of the first stages (for example, as shown in Figure 2), where the arithmetic operation can be performed (for example, XOR can be a bitwise operation that can be considered as 32x or 64x parallel 1-bit XOR operations). In certain cryptographic algorithms, the size of the data received at each stage may differ from the input variable. For example, the dilithium post-quantum digital signature algorithm uses arithmetic operations with a 23-bit value (q=8380417). In this case, with a 32-bit input, from each input variable... A 32-bit value can be received, the upper 9 bits can be ignored, arithmetic operations (including modulus q) can be performed, and the output can be written as a 32-bit value with the upper bits set to zero. In a 64-bit system, two 23-bit paths can be contained within each 64-bit variable; for example, the 64-bit value A can be split into two 32-bit "halves," and the first upper 9 bits of each "half" can be ignored to operate as a 23-bit value. The result of the arithmetic operation is written as a 64-bit value with the upper 9 bits set to zero, just as in the 32-bit case. Therefore, in a 64-bit version of a cryptographic system, the throughput of a dilithium algorithm can be twice that of the 32-bit version.

[0046] As described below with reference to Figure 3, the data received by a stage may include shares of input variables (or the first one or more stages may calculate the shares). How each portion of the input variables is provided to each computation stream may be configured as part of the operation (i.e., the "oper" configuration), and Figure 2 shows only one possible example. In Figure 2, each computation stream receives data from each of the input variables 242-246 and applies n-1 computation stages sequentially. Each set of concurrently running stages (e.g., each row across computation stream 212 in Figure 2) may include access to matrix memory 132, which is indicated by address stream 234. In some cases, the address generator 230 outputs an address stream 234 that propagates within the stages simultaneously with the computation stages. In this case, the final result of the computation stages may be written to a matching address in the address stream (e.g., one or more addresses generated for the corresponding "address" stage). This can avoid pipeline hazards. Each computation stage repeatedly applies the same "oper" instruction 220. The pipeline operation 210 may have thousands of internal cycles (for example, n may be large). The repetition of the "oper" instruction 220 and the dedicated cryptographic matrix memory 132 allow for simplified control of the pipeline operation 210 depending on the capacity of the cryptographic numerical arithmetic unit 130 (for example, the capacity set by the internal bus bandwidth and register data word length). After the n-1 stages of each computation stream 212 have been applied, the final result is determined in the nth stage 214. This may involve recombining the individual results from each computation stream 212. The final result is then copied to a destination address (for example, in the matrix memory 132) determined by the address generator 230.

[0047] The cryptographic system 110 in Figure 1 can be configured to implement many different post-quantum cryptographic operations. Many of the operations that can be performed by the arithmetic unit 136 (e.g., specified by the "oper" instruction 220) can be stateless in the sense that the resulting data word depends only on the corresponding input value. In this case, the execution order used by the cryptographic numerical unit 130 can be flexible (e.g., enabling serial operations in the computation stream 212 in Figure 2). In some cases, information can be passed from the first call to a pipeline stage to a subsequent call to a pipeline stage (e.g., in certain arithmetic operation modes). This can make it possible for input data to be combined with data from previous inputs. In the default operation, stage n passes information to stage n+1 of the pipeline, but since stages can be heterogeneous, certain information can be transferred across multiple stages in this way (e.g., skipping one or more subsequent stages), and / or information can be fed back during operation. For example, overflows such as carry and borrow in large integer operations can be passed between pipeline stages using an internal arithmetic register or an address in matrix memory 132, which is written at the end of each stage and read at the beginning of the next stage. In some cases, a feedback source (e.g., a C data variable) can act as the “carry” for a memory comparison operation. This can occur, for example, when using butterfly mode or when part of the destination register D may be used, and the result of a single word may be returned as D for the operation (i.e., “oper”). Or, consider a hypothetical example of multiplying a single integer “3” by a “long” integer “57” (in reality, the operation is performed with binary values, but for ease of explanation, we will use a decimal example here). An implementation of digit-length integer multiplication can have two stages: “digit multiplication” and “carry addition”. These stages can operate simultaneously. A feedback variable in the form of a carry may be used, but it is initially set to 0.Starting from the right side of the long integer, the first "digit multiplication" operation is performed as 3*9=27, with the 7 on the right being written out and the 2 on the left being set as the carry forward. In the "digit multiplication" stage, we don't need to know the carry to start the multiplication of the next pair, 3*5=15, but the next call to "carry addition" can be calculated as 15+2=17, where the 7 is written out and the 1 is treated as the carry bit. Then in the final round, we can perform further "multiple digit" operations using the zero-type multiplication operation 3*0=0, and the final "carry addition" simply writes out the 1, ending with the final result provided as three written-out values ​​1, 7, 7 (i.e., 3*59=177). Comparison operations may also involve persistent data being fed back within the pipeline. For example, a state that indicates the status of the comparison of previously processed words may be maintained (e.g., the first inequality word changes the stage feedback for the entire comparison to "inequality").

[0048] Therefore, Figure 2 provides an embodiment of how an arithmetic arithmetic pipeline device may be provided, in which the arithmetic unit 136 receives control data (e.g., an "oper" instruction 220) from the control device 150 that indicates a selected operation to be performed, and the selected operation is performed over time as multiple stages. The multiple stages may comprise multiple parallel processing streams (e.g., computation streams 212), which receive data (e.g., 242-246) accessed from the matrix memory 132 (e.g., via the activity of the address generator 230). Thus, the arithmetic unit 136 performs pipeline operations 210 to implement SIMD-like functionality in which multiple pipelines function in parallel.

[0049] The cryptographic operations that can be performed by the arithmetic unit 136 (instructed, for example, by the OPER control signal in Figure 1 or the “oper” instruction 220 in Figure 2) may include certain mathematical operations and representations that support post-quantum cryptography algorithms or other targets for accelerated computation. Generally, operations may include a set of available functions configured to manipulate one or more bit sequences read from one or more data sources (also referred to herein as “sources,” such as A, B, C, etc.) and store the results of the operations as destination data (also referred to herein as “destinations,” such as C and D, etc.). A non-exclusive set of cryptographic operations includes multi-input bitwise Boolean operations, large integer arithmetic operations, polynomial arithmetic operations, sampling, normalization and comparison, sorting of data elements, serialization and deserialization conversions, and randomization operations. Multi-input bitwise Boolean operations include two- or three-input operations such as AND, OR, ANDN, XOR3, and CMOV (conditional move). These sets of operations may be used to compute bit-sliced ​​Boolean circuits. Large integer arithmetic may include arithmetic operations using integers represented by data word bit sequences that yield one or more carry bits. Large integer arithmetic may include multiplication, addition, subtraction, conversion, and combinational operations (e.g., multiplication-sum-product / subtraction is D=C+AB or D=C-AB). Sampling may include obtaining values ​​from statistical distributions, such as binomial sampling or sampling using CDF tables. Sampling operations may also include comparison and collection operations for rejection sampling (e.g., based on uniform or heterogeneous distributions). This comparison may include masked comparisons using masking, as described below. Normalization and comparison operations include operations that produce only single-word results, such as summing elements, dot product calculations, Hamming weight calculations, and full-scan (e.g., no early termination) comparisons. Sorting data elements may include arranging data elements (e.g., data elements 242-246) for pipeline operations.For example, the data loaded into the A, B, and C source registers can also be (re)arranged to perform tasks such as matrix trans trans, rotation, shuffling, or inversion of data elements. Serialization and deserialization conversions can include non-linear functions and conversions of vector results, such as endianness conversion or what is necessary for alignment. Randomization operations can include operations that use probability variables such as masked arithmetic operations and mask conversion operations (e.g., between boolean masking and addition masking). The random number values for randomization operations can be supplied from one or more of the internal random number generators (for the cryptographic system 110), such as an internal pseudo-random number generator seeded using the seeds provided by the permutation device 140 and an internal or external true random number generator.

[0050] The arithmetic operation device 136 operates on bit sequences. These bit sequences can be provided as data words, and the length of the data words is set based on the word length of the matrix memory 132 and / or the internal communication bus (e.g., within the cryptographic numerical operation device 130). The bit sequences can represent one or more of numerical values, points, vectors, matrices, polynomials, rings, fields, and other algebraic structures. Different bit sequences can represent different parts of these representations. For example, the data words read from and / or written to the matrix memory 132 can represent a part of a matrix or a polynomial. In a particular embodiment, the arithmetic operation device 136 is for modular integers (e.g., mod2 n ), small finite fields (e.g., GF(q)), representations in Montgomery form rather than canonical form (which can enable rapid modular conversion within a pipeline), other representations usable for projective coordinates and elliptic curve points, finite fields q = c2 n +1 defined by a particular cryptographic algorithm, vectors of elements within a binary field (e.g., GF(2 n))(Conversion by base of fixed polynomial can be performed in pipeline operation), for side-channel protection, one or more bit representations of the following are computed: a masked representation and a redundant bit representation for side-channel protection. Lattice cryptography is modulus 2 n Because it operates using either arithmetic operations or arithmetic operations on a small prime number q, the pipeline operation and bit decomposition described herein are particularly useful. Similarly, code-based multivariate cryptography benefits from small binary fields, which is also supported by the configuration of the cryptographic system described.

[0051] It should be noted that the pipeline configuration may differ between implementations depending on the requirements and the cryptographic operations to be implemented. In FPGA implementations, the pipeline configuration may be set via a Hardware Description Language (HDL) definition. For on-silicon implementations, the pipeline configuration may be set depending on design requirements such as implementation size, area cost, and power consumption. The number of stages and compute streams may be parameters for each instantiation in the described embodiment.

[0052] In addition, the number of pipelined stages may not significantly affect the programming interface; for example, the operation may consist of one or 64 cycles, with a trade-off between variable latency and / or throughput, but may still have a common fixed programming interface (e.g., callable from an external computing system via data written to control register 124). Different applications may use the same programming interface, but the cryptographic system 110 may be configured to suit their specific requirements. For example, embedded systems may specify a smaller footprint at the expense of operating speed, while server or supercomputer implementations may specify increased parallelism and throughput. Pipelining as described herein can be viewed as an implementation mechanism that improves throughput at the expense of (silicon) area. For example, consider a six-step algorithm with steps S1-S6. In this case, it may be impossible to execute all steps in a single cycle because a very long circuit path is required, and the design may not satisfy a "timing closure" with respect to the operating frequency. In this case, instead of repeating steps S1-S6 in six cycles, each step may be implemented as a physically separate pipelined stage. In this way, the first stage may be supplied with input values ​​each cycle, then the second stage, and so on, until the final result is provided in each cycle. In this case, the latency between input and output remains 6 cycles, but the throughput is 6 times greater compared to the iterative implementation. In the cryptographic operations described herein, throughput is often more important than latency because the building blocks of the operation are fast cryptographic primitives such as multiplication or masking transforms that are related to the cryptographic task and performed with long bit sequences.

[0053] Examples of masked calculations In the specific examples described herein, the security of the cryptographic system 110 can be enhanced using masked computation. Masked computation provides protection against side-channel attacks. Side-channel attacks are attacks that attempt to determine the secret bit patterns being manipulated by the cryptographic system 110 based on, for example, electromagnetic radiation, fluctuations in power usage, operating timing, or leakage of secret information through other unintended side channels. While some protection may be possible by providing physical shielding, security can be enhanced by masking the (secret) bit sequences being manipulated using the cryptographic numerical arithmetic unit 130, so that even sophisticated measurements of electromagnetic patterns from outside the cryptographic system 110 will not reveal information about the original secrets, such as the cryptographic keys loaded via the cryptographic register set 122.

[0054] In this embodiment, the cryptographic system is configured to perform masked arithmetic calculations by decomposing a confidential data value accessed via the bus interface set 120 into multiple data shares. The control unit 150 is then configured to control the arithmetic unit 136 and the address generator 134 to apply at least one of a defined set of arithmetic operations as multiple independent linear operations for each of the multiple data shares. The masked calculations can work synergistically with "no-touch" control of the cryptographic numerical unit 130 via the internal bus 166 and the pipeline operation configuration shown in Figure 2. The masked calculation approach applied by the cryptographic system 110 aims to minimize information leakage by increasing the signal-to-noise ratio of measurable side channels such as power fluctuations or electromagnetic radiation. In this embodiment, one or more of the control unit 150, the cryptographic numerical unit 130 (including the arithmetic unit 136), and the reordering device 140 are adapted to support both masked and unmasked calculations. In a preferred example, all of the aforementioned components may be adapted to support both computation modes (for example, as selectable by an external computing system and / or as part of a defined configuration of the cryptographic system 110).

[0055] In certain cases, a secret input and / or output is divided into data shares in a masked computation mode. The number of data shares is configurable and set by parameters of the cryptographic system 110 (e.g., there may be d data shares). In some cases, data received via the cryptographic register set 122 (e.g., SSP) in Figure 1 may be divided into data shares. A simple example of the operation applied to three data share sets (e.g., d=3) is shown in Figure 3. However, different numbers of data shares can also be set. In Figure 3, for the sake of clarity, the operation is shown for one set of data shares, but it should be noted that the operation can be applied as a computation stream, as shown in Figure 2 (e.g., the inputs to each of the first stages in Figure 2 may consist of three data shares, inputs A, B, and C). In some cases, to enhance security, a restriction may be imposed such that only one data share can be processed at a time by the arithmetic unit 136.

[0056] In masked post-quantum cryptography, arithmetic operations can be transformed into corresponding masked operations. For example, performing an unmasked (plain) arithmetic operation between variables X and Y yields the following result Z: Z = X op Y, where X is the share {X i} and {Y i Converted into a series of arithmetic operations from}, share {Z i This can provide}. This embodiment is shown in Figure 3.

[0057] Figure 3 shows an operation 300 performed on two input data variables 310 and 320 (shown as X and Y). The two input data variables 310 and 320 may include SSPs received via the bus interface set 120. In some cases, they may include confidential data variables received in encrypted form and decrypted only within the matrix memory 132. The two input variables 310 and 320 are divided into data share sets 330 and 340, respectively. In this embodiment, there are three data shares, with the first input variable 310 divided into data shares 332, 334, and 336, and the second input variable 320 divided into data shares 342, 344, and 346. Each data share may contain a sequence of bits of the same length as the sequence of bits representing the input variable. In the embodiment of Figure 3, the input variables are divided into data shares using Boolean masking. However, various forms of masking may be available as configurable or selectable control parameters. For example, there may be an option to generate data shares using either Boolean masking or arithmetic masking. The cryptographic system may also be configured to convert between different forms of masking for specific operations. In the embodiment of Figure 3, the data shares are generated by a binary exclusive OR (XOR) sum operation (e.g.,

[0058]

number

[0059] It is generated using (represented by ), and its sum may exceed the number of configurable data shares d. This is because

[0060]

number

[0061] This can be abbreviated as follows. In this case, each of the input variables 310 and 320 is equal to the XOR sum of their respective data shares 330 and 340.

[0062] The generation of data shares can be performed as an initial cryptographic numerical operation set. For example, Boolean masking decomposition can be performed by combining an initial input variable (e.g., 310 or 320) with a random mask generated by the rearrangement device 140. In this case, d-1 data shares can be generated by creating d-1 random bit sequences, combining these with the original secret (e.g., 310 or 320), and then generating the d-th share as a combination of the previous combinations. For example, in Figure 3, share 330 (or similarly for 340) can be generated as follows:

[0063]

number

[0064] In the formula, R i This is a uniformly random mask from the rearrangement device 140. Here, in the reconstruction of the original secret X, all individual shares X are used. i It is necessary.

[0065] Returning to Figure 3, once the data shares are generated, they are used to execute operation 350. Operation 350 is executed as a set of independent operations 352, 354, and 356, each receiving corresponding data shares from two sets of data shares 330 and 340. For example, operation 352 is executed with data shares 332 and 342 as input, operation 354 is executed with data shares 334 and 344 as input, and operation 356 is executed with data shares 336 and 346 as input. Each independent operation 352-356 is a repetition of the same arithmetic unit operation in a similar manner to the computation stream 212 in Figure 2 (i.e., the embodiment in Figure 3 can be seen as showing a first stage with three computation streams having share "oper" instructions 220). The operations can be executed independently by ensuring, for example, that the data of different data shares of confidential data values ​​are not computed simultaneously within the arithmetic unit 136, thus ensuring that they are kept spatially and temporally separate. Each of the masked arithmetic operations 352–356 (including the conversion to the masked format) is designed so that all intermediate variables (e.g., "wires" in the hardware circuit) are statistically independent of the sum of the (secret) shares. Operations 352–356 are performed on the secret data shares, but the data shares are not "collapsed" to reconstruct the secret. Therefore, the original secret is not "leaked" by a side-channel attack.

[0066] In Figure 3, after operation 350 is performed for each pair of data shares, the results from each of the individual operations 352, 354, and 356 are provided as the respective outputs 362, 364, and 366. The data share output set 360 can be reconstructed to provide the results of operation 350 applied to input variables 310 and 320 (i.e., Z = oper(X,Y)). In the embodiment of Figure 3, the reconstruction is an XOR sum of the individual data shares, i.e.

[0067]

number

[0068] This may be performed by, for example, when providing data as output via the bus interface set 120, or as a final stage after the completion of operation 350, or it may be performed externally (e.g., by an external computing system), or it may be performed only when the data share is encrypted as described below. In some cases, confidential data may not be exported from the cryptographic system 110 unless it is in an encrypted form.

[0069] In certain implementations (and / or defined configurations), secret information may be maintained as data shares throughout the key's lifecycle. For example, a secret key may be generated as a share, stored and loaded as a share into memory (e.g., both internal and external memory, the latter via cryptographic register 122), and used as a share (e.g., in cryptographic operations). When the key reaches the end of its lifespan, the share may be reset to zero. In some cases, only secret information is operated as a data share. In such cases, if the set of data shares representing the secret information is encrypted (e.g., using an encapsulation algorithm implemented by the encryption and / or cryptographic system), then the data is no longer "secret" (i.e., protected by encryption), and therefore those data shares may be collapsed together after encryption. For example, in a stream cipher, ciphertext C may be generated from plaintext P and keystream Z=cipher (key) via C=P XOR Z, and decryption may be performed as P=C XOR Z. If the cipher is implemented in a masked manner, keystream shares Z1, Z2, Z3 may be generated from a masked key, key1, key2, key3. In this case, different ciphertext portions can be encrypted using their respective key stream shares C1=P1XOR Z1, C2=P2XOR Z2, and C3=P3XOR Z3. Following encryption, the mask can be collapsed without revealing any secret information (i.e., C=C1XOR C2XOR C3). C can be securely exported in an encrypted form that does not reveal any information about P.

[0070] As shown in Figure 3, in certain examples, the masked computation may be achieved using at least operations performed by the cryptographic numerical arithmetic unit 130 (e.g., as a series of "bullets"). A number of different operations can be combined as sub-operations to perform the masked computation as a single atomic "operation" directed by an external computing system. For example, the masked computation may include performing operations using at least the cryptographic numerical arithmetic unit 130 when the input to the operation is a data share, a temporary data share, or a random variable (e.g., generated using the sorting unit 140). The set of operations can also be efficiently pipelined to speed up the computation.

[0071] The embodiment in Figure 3 shows the case of Boolean masking, but in other embodiments, arithmetic masking may be used instead. In some cases, data shares can be generated using arithmetic masking in the form of additive masking. Additive masking is similar to XOR masking but uses integer addition or modular addition. In some cases, the share is calculated as follows: that is, X = (Σ d X i ) mod (q), where q is a small prime number or q=2, depending on the algorithm. n It is modulus. For example, additive masking is wrap-around additive modulus 2. 16 It can be implemented by [method]. The fixed constant q may differ depending on the cryptographic algorithm. In many cryptographic algorithms, the size of q is less than 16 bits or 32 bits, or exactly a power of 2. For example, the KYBER algorithm uses a q value of 3329, and the SABER algorithm uses a value of 2 13 The values ​​of q for different cryptographic algorithms can be hardcoded into the implementation of the cryptographic numerical arithmetic unit 130. For example, the number X=1238 can be represented using the shares X1=1111, X2=2222, and X3=1234, since X1+X2+X3==4567 modq=1238 (using modular wrap-around addition), which gives a q value of 3329.

[0072] In certain cases, the cryptographic system 110 may be configured to perform operations that convert between two different masking formats. For example, linear operations such as XOR or addition may be applied individually to data shares only if the data shares are of the corresponding masking format. In some cases, Boolean masking may be converted to arithmetic masking and vice versa. When Boolean masking is converted to arithmetic masking, this is because the first set of data shares {X i The second set of data shares {Y} has a sum equal to the XOR sum of}. i This can be done by determining}. For example,

[0073]

number

[0074] Therefore, if arithmetic masking is converted to Boolean masking, the reverse operation can be performed, for example, on a second set of data shares {Y i} is the first set of data shares {X i It can be determined that it has a sum equal to the arithmetic sum of}. For example

[0075]

number

[0076] In some cases, the control unit 150 may be programmed to use the arithmetic unit 136 and matrix memory 132 to perform transformation operations in hardware similar to those described in the paper “An Instruction Set Extension to Support Software-Based Masking” by Gao et al., Cryptology ePrint Archive, Report2020 / 77, which is incorporated herein by reference. For example, the aforementioned paper defines BOOL2ARITH and ARITH2BOOL transformation functions that utilize underlying Boolean addition (BOOLADD) and Boolean substitution (BOOLSUB) operations. These Boolean addition and substitution operations involve relatively complex bit manipulation sequences with “masked random” inputs. The cryptographic system 110 offers a significant advantage over software implementations of the paper (which are commonly performed, for example, by the central processing unit of an external computing system) because the cryptographic numerical unit 130 is designed (and optimized) for fast execution of long sequences of Boolean operations (as demonstrated, for example, by the pipeline in Figure 2). Thus, the cryptographic system 110 enables faster operation.

[0077] Specific arithmetic primitives applied as operations by the arithmetic unit 136 can be achieved with the help of a transformation function within a masked operating mode (or the transformation function can be implemented directly in the operation). For example, in the case of Boolean masked addition and subtraction, the set of output data shares {Z i The input share {X} is such that the XOR sum satisfies X+Y=Z or XY=Z(mod q). i} and {Y iIt can be calculated from}. Other masked functions may follow the same pattern. Bitwise logic in mask mode can be performed by applying AND, OR, and XOR operations to arithmetic or boolean masked data shares. Similarly, shifts, rotations, and bit manipulations can be applied to arithmetic or boolean masked data shares. Comparisons can be performed by analyzing the equivalence or ordering of masked variables (e.g., using less than or greater than). The results of comparisons may also be masked (e.g., true or false values ​​may be masked bits). Field arithmetic operations and special functions for post-quantum cryptography can also be applied to masked variables.

[0078] Certain post-quantum cryptographic operations operate on ring polynomials. For example, lattice-based cryptography utilizes multiplication of ring polynomials with matrices. Many of these multiplications occur between a secret polynomial and a public polynomial. In such cases, the secret polynomial may be masked, while the public polynomial does not. When multiplying a secret polynomial X by a public polynomial C, the secret polynomial can be divided into d data shares for the masked operating mode. As a result, for example, CX = CX1 + CX2 + CX3 (mod q). In this case, multiplying by a constant (public polynomial C) only increases the complexity by O(d). This means that lattice-based post-quantum cryptography is particularly well-suited for masked operating modes. For comparison, multiplying two masked representations, for example, (X1 + X2 + X3) * (Y1 + Y2 + Y3), takes at least O(d) steps with respect to the number of shares. 2 This incurs an overhead of (i.e., quadratic). Similarly, in many number theory transformations (NTTs) used in implementations of ring and module algebraic objects used in known lattice cryptography, only one input to the NTT multiplication needs to be masked. This limits the overhead when applying the masking mode. Lattice cryptography also employs mixed bit-oriented operations such as right shifts, rounding, and masked comparisons. These tasks can be accomplished by more efficient partial masking transformations tailored to each operation.

[0079] In certain embodiments, masking may involve a "bullit" (i.e., operation of the cryptographic numerical arithmetic unit 130) that reads the data to be masked (e.g., X) from a source location or register (e.g., A), obtains a random bit sequence R through an internal operation, and writes the result of the masking to a share destination location or register. For example, a simple case of arithmetic masking of a data item X may involve splitting the data item into two shares X1 and X2 such that X1 + X2 = X. In this case, the first share X1 = XR may be written to destination D, and the second share X2 = R may be written to destination C. Remasking can be performed in a similar manner, but in this case the previous data share is used as input. For example, the operation of the cryptographic numerical arithmetic unit 130 may write the remasked data share -X1' to D as X1' = X1 - R, where R is the new random value, and the new mask R is written to C, providing temporary storage. Next, for remasking, there is a second arithmetic step of reading R from memory and calculating the second remasked data share as X2'=X2+R. After remasking, arithmetic masking continues to be applied, i.e., X1'+X2'=X. Note that the remasking operation avoids directly concatenating X1 and X2. Similar operations can be performed for Boolean masking and / or different share numbers. Masked arithmetic operations that internally use the randomness of masking may include conversions from arithmetic to Boolean masking (A2B) or vice versa (B2A). As described above, cryptographic system 110 may provide dedicated hardware (e.g., vector or matrix coprocessor) implementations of masking operations similar to those described in the paper by Gao et al. above. On the other hand, using cryptographic system 110 enhances security. For example, arithmetic operations are "remotely controlled" by processor 152 (e.g., via "no-touch" operation), whereas in the implementation by Gao et al., a general CPU could potentially access confidential data, creating a security risk.Furthermore, the data flow in this embodiment occurs via the cryptographic numerical processing unit 130, which allows for better control of side-channel leakage. The cryptographic numerical processing unit 130 not only provides faster data processing than a general-purpose processor (such as a CPU), but also has a simple and clear data path that is easy to protect.

[0080] In the examples herein, masking is applied as a countermeasure against side-channel attacks. The cryptographic system 110 provides hardware-accelerated cryptographic operation with integrated hardware masking support. The masking may be configured to meet the requirements of “non-invasive attack countermeasures” as described in the FIPS 140-3 and ISO 19790 security standards, both of which are incorporated herein by reference (for example, as defined in section 7.8 of ISO / IEC 19790:2012(E)). Effectiveness testing of countermeasures such as the masking described herein can be performed using laboratory procedures such as those described in ISO / IEC 17825:2016(E) “Testing methods for the mitigation of non-invasive attack classes against cryptographic modules,” which are incorporated herein by reference and more commonly known as test vector leak assessment (TVLA).

[0081] Example of a fast iterative hash Figure 4 shows an example of a cryptographic system, such as cryptographic system 110 in Figure 1, used in fast iterative hash mode. This mode may be provided to support hash-based signatures (HBS), such as those described in the National Institute of Standards and Technology (NIST) Special Publication 800-208, “Recommendation for Stateful Hash-Based Signature Schemes,” which is incorporated herein by reference. Examples of hash-based signature schemes that can be implemented using the current iterative hash mode include one or more of the following: Leighton-Micali signatures (LMS), Hierarchical Signature Systems (HSS), Extended Merkle Signature Schemes (XMSS), and Multi-Tree XMSS Schemes (XMMS). MT This mode may be part of an arbitrary selection implementation.

[0082] Figure 4 shows a computing system 410 ("host") communicatively coupled to a cryptographic system 420 that may comprise the cryptographic system 110 of Figure 1. In the current fast iterative hash mode, the cryptographic system 420 functions as a hash generator 430 that receives input from the host 410 and provides cryptographic output. The output can be used to compute a Winternitz hash chain and various types of Merkle trees. The control processor and address generator of the hash generator 430 (e.g., processor 152 and address generator 134 of the control unit 150 in Figure 1) enable evaluation of the hash chain without loading and storing individual hash results on the host 410. In signatures based on LMS, HSS, and XMSS as described above, the majority of the time spent providing the signature is spent computing the Winternitz one-time signature and the Merkle tree, which is an iteration of the hash function. Therefore, by providing a fast iterative hash mode, the cryptographic system 420 can speed up the computation of these signatures.

[0083] In Figure 4, host 410 provides the hash generator 430 with at least an initial hash Q412 and a message signature Y414. The initial hash Q412 can be computed by host 410 from the public key pk and message M via, for example, H(f(pk)|M), where H(···) is the hash function and f(···) is the public key function. The format of this hashed message can be specified by the HBS algorithm used. For example, many HBS schemes generate a message hash (Q) as a hash obtained by concatenating a prefix derived from the public key with the message M. The hash generator 430 also receives the message signature Y414. In certain embodiments, an analyzed version of the public key pk or public key pk' can also be passed to the hash generator 430 (for example, shown by 418 in Figure 4). In other embodiments, message M may be passed along with a version of the public key (for example, instead of the initial hash Q412), and the hash generator 430 can compute the initial hash Q. Next, the hash generator 430 obtains a root candidate (R) from the iterative hash of the initial hash Q. c ) or public key candidate (K c ) operates to provide 416. Host 410 then provides candidate R c or K c By comparing it with R or K, it is possible to determine, for example, whether the candidate is a component of the public key pk.

[0084] The embodiment in Figure 4 illustrates one way in which the cryptographic system of the example described can be used to support post-quantum cryptographic signature algorithms. For example, many such signature algorithms use randomized hashes. In such cases, the computing system may need to process the public key or randomized tag (e.g., using a randomized hash function) before hashing the message body. Thus, the hashed message may need to be computed as hm = H(pk|M) or H(tag|M), where M is the (raw) message, pk is the public key, tag is the randomized tag, and H is the hash function. The hash function may be the SHA3 hash function. In this case, the hash can be computed using the cryptographic system 110, and the SHA3 hash function can be computed using the sorting implemented by the sorting device 140.

[0085] In HBS verification, the cryptographic system can work in conjunction with the host system, for example, by providing assistance with specific key generation and signing processes. In such cases, the host system can finalize the output using intermediate variables that are computed more efficiently by the cryptographic system.

[0086] In some cases, the arithmetic unit 136 may not be directly involved in Winterntitz calculations, but the cryptographic numerical unit 130 allows for efficient copying of memory regions from one location to another (for example, to and from matrix memory 132) without the need for arithmetic calculations. Matrix memory 132 can be used to store sensitive data in an access-controlled manner, and cryptographic numerical unit 130 can be used to assist in formatting and preparing hashes for Winterntitz hash sequences, as well as in calculating hash-based signatures (and their verification).

[0087] It should be noted that different cryptographic algorithms may use different terminology while utilizing a shared or similar set of operations. Generally, an algorithm involves repeatedly hashing until a “match” is found, in which case it is the key candidate supplied by the hash generator 430 (e.g., R c or K c 416) may be a match between the data held by the host (e.g., R or K). In certain implementations, a template can be supplied to buffer 434, which is a byte sequence containing the immutable portion of the hash input for iteration, including padding bytes and format bytes. The processor 152 may prepare these templates. Index IDX432 may be a changing index number representing a different position in the input, used to load the hash output back into the correct position in the input. By using templates and iterating only on defined portions of the hash, the process is sped up because the time the processor spends preparing the input may be longer than the hash unit that computes the hash. Also, hash inputs are often very similar to each other, with few variable components in addition to the "hash feedback". In such cases, hash iteration can be sped up by preparing a template for the output and iterating only on specific portions.

[0088] Example of encryption operation The cryptographic system described herein has several components that can be configured to implement specific cryptographic operations. For example, the components shown in Figure 1 provide a set of hardware components that can be appropriately configured by (firmware) computer program code for the control unit 150. The cryptographic numerical arithmetic unit 130 and the control unit 150 thus enable a controllable and configurable hardware implementation of different cryptographic operations, thereby accelerating implementation compared to, for example, an external computing system. Various cryptographic operations may be supported (and functionality may be expanded) through firmware updates that include various hardware control configurations.

[0089] Each cryptographic operation within the set of available cryptographic operations can be configured (e.g., as a programmed function) to read data from a set source register (e.g., data to be loaded from matrix memory 132 using an address generated by address generator 134), perform a series of calculations (e.g., via arithmetic unit 136 and / or reordering unit 140), and output the result to at least one destination register (e.g., which can then be reloaded into matrix memory 132 using an address generated by address generator 134). Because post-quantum cryptography arithmetic operations often involve repeating the same function hundreds of times, they can be advantageously and securely implemented using pipeline configurations (e.g., shown in Figure 2) and masking (e.g., shown in Figure 3) while avoiding security or performance issues.

[0090] In certain implementations, a low-level, bus-independent driver programming interface may be provided to the cryptographic system. This programming interface may be provided, for example, using a hardware abstraction layer (HAL) in the C language. The HAL may also provide access to cryptographic test functions. In some cases, the cryptographic operations provided by the cryptographic system are expressed using a HAL function class. Thus, the cryptographic system may provide a mapping between values ​​written to control registers (such as the control register set 124 in Figure 1) and a set of HAL function classes. Cryptographic functions may be initiated by an external computing system without directly passing plaintext data to the cryptographic system.

[0091] In certain embodiments, the cryptographic system is configured to perform one or more of the following: a key establishment function and a digital signature function. The digital signature function may include a stateful hash-based signature function (e.g., a signature function implemented using the reordering device 140 described above). The key establishment function may provide a key-based encryption and / or decryption function. The digital signature function may include one or more of the following: digital signature generation and digital signature verification. The cryptographic system may consist of one or more of the following: a lattice post-quantum key establishment function, a code-based post-quantum key establishment function, a lattice post-quantum digital signature function, a code-based post-quantum digital signature function, a hash-based post-quantum digital signature function, a multivariate post-quantum digital signature function, and a hierarchical signature system function. These functions can be implemented without passing plaintext data to the cryptographic system; that is, the cryptographic system accesses only encrypted data via the cryptographic register 122.

[0092] Key establishment functions can be defined as a set of HAL groups (e.g., as a set of kem-key establishment-functions), as described above. For example, a HAL group (e.g., _kem_kg) may provide the generation of a secret key and a public key pair, e.g., (pk,sk)=keygen(seed), where sk is the secret key or private key, pk is the public key, and seed is an (optional) explicit seed parameter for generation. Another HAL group (e.g., _kem_enc) may provide encapsulation and / or cryptographic functions, e.g., (ct,ss)=encaps(pk,seed), where ct is the generated ciphertext, ss is the generated shared / shareable secret, pk is the public key, and seed is an (optional) explicit seed parameter for generation. Further HAL groups (e.g., _kem_dec) may provide decapsulation and / or decryption functions, e.g., ss = decaps(ss, sk), where ss is the generated shared / shareable secret, ss is the input shared / shareable secret, and sk is the secret key or private key. The seed parameter can be supplied from a random bit generator, as indicated within the cryptographic standard. The unmasked length of the seed is typically 32-96 bytes (depending on the cryptographic algorithm being implemented). Seed determinism can enable standardized testing of cryptographic functions. The masking randomness of masked behavior may not be deterministic (e.g., following the methods and systems described above), and therefore, in such cases, the seed parameter may simply contribute (e.g., as entropy bits).

[0093] Certain post-quantum key establishment functions may not possess the "commutative symmetry" of the conventionally used Diffie-Hellman cryptographic algorithm. In these examples, encapsulation and decapsulation may involve different computations. In post-quantum key exchange flows, the initial user key pair may be temporary, and a shared secret (the ss variable above) may be used by both parties to derive the session key. For example, the commutative symmetry of conventional (e.g., Diffie-Hellman) algorithms typically means that two parties perform similar operations (e.g., exponentiation) to reach the shared secret. However, in post-quantum algorithms, the two parties typically perform entirely different operations to reach the shared secret, with one party being the "initiator" who sends the first message. In some cases, an alternative key pair generation function (e.g., kem_kg_eph) may be provided that does not output the private key sk but retains it within the cryptographic system for the subsequent decryption operation (e.g., kem_dec_eph). In post-quantum public-key cryptography flows, the generated key pair may be stored for long-term use. In this case, encapsulation can be invoked to create a new shared secret (i.e., ss) for each message, and these shared secrets can be used to derive keys for encrypting and decrypting the message payload (for example, for the Advanced Cryptographic Standard (AES) in Associated Data Authenticated Cryptography (AEAD) mode). To counter (adaptive) chosen-ciphertext attacks, certain post-quantum key rochifunctions may have an implicit failure mode where a malicious ciphertext or encapsulation of a malicious ciphertext does not explicitly fail, but a specially constructed random ss value may be returned. In some cases, a post-quantum key rochifunction may receive or access additional flag variables to determine a set of side-channel countermeasures to implement.

[0094] In a similar manner to the post-quantum key establishment functions described above, a set of digital signature functions can also be defined as a set of HAL groups (e.g., as a set of sig functions). For example, a HAL group (_sig_kg, etc.) can provide the generation of a secret-public key pair, e.g., (pk,sk)=keygen(seed), where sk is the secret or private key, pk is the public key, and seed is the (optional) explicit seed parameter for generation. Another HAL group (e.g., _sig_sig) can be, e.g., sig=sign(hm,sk,seed), where sig is the generated signature, hm is the hashed message, sk is the secret or private key, and seed is the (optional) explicit seed parameter. Further HAL groups (e.g., _sig_ver) may provide separate signature verification functions, for example, {T,F}=verify(sig,hm,pk), where sig is the retrieved digital signature, hm is the hashed message, and pk is the public key, and the verification function returns True or False (i.e., verified or unverified).

[0095] For hash-based written signatures, a set of HBS functions can be defined as a set of HAL groups (e.g., a set of hbs functions). For example, a HAL group (e.g., _hbs_kg) can at least help generate a private-to-public key pair, e.g., (pk,sk)=keygen(seed), where sk is the private key, pk is the public key, and seed is the (optional) explicit seed parameter for generation. Another HAL group (e.g., _hbs_sig) can at least help generate isolated signatures, e.g., sig=sign(hm,sk,seed), where sig is the generated signature, hm is the hashed message, sk is the private key, and seed is the (optional) explicit seed parameter. A further HAL group (e.g., _hbs_ver) can provide an isolated signature verification function, e.g., pk c=Verification(sig,hm,pk), where sig is the obtained digital signature, hm is the hashed message, and pk is the public key. The verification function outputs the public key pk. c It returns candidate components (as explained, for example, by referring to Figure 4 above).

[0096] Figure 5 shows an embodiment 500 of a configured cryptographic operation 510 that can be used to perform lattice-based post-quantum cryptography. Similar to Figure 2, one or more "oper" instructions 220 (e.g., supplied from the operation control unit 138) control the suboperations that make up the configured cryptographic operation 510, and the addresses used during operation 510 are supplied from the address generator 134 as one or more address streams 530. The "oper" instruction(s) specify the pipeline operation of the entire "britta" operation. In this example, three source registers, A, B, C, 542, 544, and 546, are used, as in the example in Figure 2. This cryptographic operation 510 is a multiplication-addition operation that can be used to implement the SABER and NTRU cryptographic algorithms. In this case, the cryptographic operation 510 is two parallel modulo 2 nIt is implemented as a pipelined arithmetic coupler that computes multiplication and addition operations. First, the contents of source register A 542 are decomposed into two parts a0 and a1, indicated as 552 and 554. A similar procedure is performed to decompose the contents of source register B 544 into two parts b0 and b1, indicated as 556 and 558. The first parts from source registers A and B, a0 and b0-552 and 556-, are provided as inputs to the first multiplication operation 562, and the second parts from source registers A and B, a1 and b1-554 and 558-, are provided as inputs to the second multiplication operation 564. Parts of this example may include data sharing in a specific configuration. Next, the results of each multiplication are added in blocks 572 and 574 (representing "box addition") to their respective decomposed parts c0 and c1 (represented as 566 and 568) of the C source register 546, generating destination parts d0 and d1 (represented as 576 and 578), which are then combined to produce the output of destination register D580. Blocks 572 and 574 represent a "wrap-around" or modulo q operation (as described in other examples, for example). The value of q can vary depending on the cryptographic algorithm (in the case of SABER, q=2 13 ). Overflow carries due to addition can be ignored. The example in Figure 5 can also be applied to masked implementations. In this case, a large "bullet" occurs, and the arithmetic operations of the lattice cryptographic algorithm may be masked, for example, when a secret key is involved. In some cases, it is often possible to perform a ring multiplication operation ("bullet," etc.) on one mask share before proceeding to the next mask share, in which case the shares only need to be joined at specific points in the algorithm flow.

[0097] Details of control device examples In certain examples, the control unit 150 functions as a lightweight controller for the cryptographic numerical arithmetic unit 130. For example, the flow of information through the operation of the cryptographic numerical arithmetic unit 130 and the execution of post-quantum cryptography may be controlled by the processor 152 of the control unit. In some cases, the processor 152 has a RISC core and implements a corresponding RISC instruction set (such as the RV32I instruction set). In certain examples, the processor 152 executes instructions stored in ROM 156 (for example, stored as a ROM image). The control unit 150 (including the processor 152) may be triggered using an interrupt-like mechanism based on signals received on the bus interface set 120 (for example, based on signals from the bus manager of the above interface).

[0098] During use, the cryptographic system 110 may be configured so that confidential data (e.g., SSP) does not pass through the processor 152. Instead, the control unit 150 arranges a set of one or more defined operations (e.g., operations controlled via the OPER control signal) performed by the cryptographic numerical arithmetic unit 130 (for example, as schematically shown in Figures 2, 4, and 5). Specific cryptographic operations can be programmed using (or as) the subset B (BitManip) and / or subset K (Scalar Cryptography) RISC instruction set extensions. Certain functions, such as monitoring internal variables as described with reference to Figure 6 below, may be implemented as an additional set of their own custom instructions for the processor 152.

[0099] To prevent confidential data from passing through processor 152, post-quantum cryptography algorithms implemented using cryptographic system 110 may be configured as a set of unconditional instructions executed by processor 152. In some cases, control unit 150 may have access to matrix memory 132, but only when cryptographic numerical arithmetic unit 130 is not actively performing calculations (for example, processor 152 may be prevented from accessing matrix memory 132 during a "bullet" or a series of "bullets"). Access to matrix memory 132 outside of the operation of cryptographic numerical arithmetic unit 130 may be provided, for example, during the execution of self-tests during initialization, during public key analysis, and / or during XOR padding of data blocks for the implementation of Keccak operations.

[0100] While the examples described herein refer to system-on-chip implementations, it should be noted that the functionality can be emulated by a full system emulator. In this case, the full system emulator can emulate the components shown in Figure 1 (i.e., a full cryptographic system 110), including the control unit 150, the cryptographic numerical arithmetic unit 130, and other peripherals. Emulation offers a more convenient development flow compared to circuit simulation, as well as the potential for detailed implementation profiling and security analysis.

[0101] The cryptographic systems described herein can be easily programmed to support a variety of use cases and constraints (for example, additional functionality can be provided via firmware updates of images stored in ROM156 after manufacturing). Supported cryptographic algorithms may include, but are not limited to, NIST structured grid algorithms, including DILITHIUM, KYBER, SABER, and NTRU. The German Federal Office for Information Security (BSI) has developed algorithms such as FrodoKEM and Classic McEliece. LMS, HSS, XMSS, XMSS MT These are NIST SP800-208 hash-based signature algorithms.

[0102] In some cases, support for non-post-quantum ("classical") cryptography, such as the Rivest-Shamir-Adleman (RSA) algorithm and / or elliptic curve cryptography, may be provided. It should be noted that the specific cryptographic behavior implemented by the cryptographic system may form primitives of multiple different cryptographic algorithms, including both post-quantum and classical algorithms. The security parameters of classical cryptographic algorithms may be selected using a flowchart characterization process enabled by the cryptographic system. If elliptic curve and / or RSA functionality is provided by other hardware of the external computing system, certain functions, such as large integer arithmetic, may not be necessary (in some cases, communication with the cryptographic system may be possible, for example, via one or more of buses 126, 128, or 170).

[0103] In the design of cryptographic systems, literal constant-time operation may be guaranteed for implementation security. The masked operating modes described herein can provide further robust protection against non-invasive physical attacks. Thus, masked operating modes may meet and / or exceed the requirements of ISO / IEC 17825 Levels 3 and 4. The import and export of confidential data (such as SSPs containing private keys) can be configured using masked data shares, enabling secure key storage and key generation for external symmetric components such as the AES encryption engine. In certain implementations, cryptographic systems may provide FIPS 140-3 design features such as zeroing, self-testing, and integrity testing.

[0104] Examples of variable contamination methods Similar to the cryptographic systems described with reference to the examples above, methods for operating cryptographic systems may also be provided. While this method is particularly suited to the cryptographic system 110 in Figure 1 and other examples, it can still be applied to cryptographic systems other than those described herein, such as any cryptographic system configured to perform cryptographic operations.

[0105] This example provides a method for operating a cryptographic system while performing an encryption operation. The encryption operation may be a post-quantum encryption operation, and the cryptographic system may perform the above operation on a communicatingly coupled computing system. For example, the cryptographic system may include a system-on-a-chip for performing post-quantum cryptography.

[0106] Generally, this method involves defining a set of attributes for annotating at least a set of internal variables of a cryptographic system, performing one or more cryptographic operations on the set of internal variables, and providing an indication when at least one of a conditional instruction and an external data access operation of the cryptographic system is performed on an internal variable having a specific value. For example, each of the attribute sets may have one of at least two values, the at least two values ​​including a first value that indicates confidential data and a second value that indicates non-confidential data. These may be called "red" and "black" variables by those familiar with cryptographic rules. Performing one or more cryptographic operations on a set of internal variables may include applying one of at least two values ​​to data generated or received by the cryptographic system and updating attribute values ​​based on an arithmetic operation performed by the cryptographic system's arithmetic unit (e.g., implementing post-quantum cryptography operations). This indication may be provided when a specific instruction is performed on an internal variable having the first value, for example, on a "red" secret variable. By implementing this method, it is possible to ensure that the cryptographic system has not leaked confidential information. Furthermore, this method can also be used when testing new encryption behaviors (e.g., firmware updates) to prevent sensitive information from being (accidentally) leaked.

[0107] Figure 6 shows a specific example 600 of the method described above. Method 600 begins in block 610. In block 620, attributes in the form of defined “markers” are associated with one or more data registers (including registers in the bus interface set 120 and matrix memory 132). In some cases, attributes in the form of flag bits are assigned to architecture registers (e.g., all RISC-V registers used by the control unit 150) and internal memory (e.g., at least matrix memory 132) data words. When binary flags are used, one binary value represents “black” or non-secret data, and the other binary value represents “red” or secret data. In certain examples, zeroed-out (or zeroed-out) values, non-secret values ​​(such as public keys), and / or encrypted variables may be considered “black.” Applying annotations to variables may be considered a form of “contamination” or “coloring.”

[0108] In block 630, a set of tainting logic rules is applied during cryptographic operations, such as calculations performed by the cryptographic numerical arithmetic unit 130. For example, a flag value assigned in block 620 can be transferable and follow data values ​​manipulated within the cryptographic system (for example, in a data copy from one address to another, the flag value is also copied to the new location or register). In some cases, the set of tainting logic rules may include monitoring the results of at least all arithmetic operations applied by the arithmetic unit 136. Annotations that indicate sensitive data (e.g., "red" tainting) can be tracked so that all results of operations involving sensitive data are also annotated as sensitive (for example, by applying an "or" operation to an annotation of the input to the operation). For example, an operation on a "red" annotated input and a "black" annotated input produces a "red" annotated output. The set of tainting logic rules may be applied automatically by the control unit 150 and may not be visible to the general user process. In some cases, annotations indicating non-confidential data (e.g., "black" annotations) may only be set in response to a predefined set of actions performed on confidential data (e.g., "red" annotations). For example, a flag might change from "red" to "black" (e.g., from 1 to 0) only if a zeroing operation is performed on "red" data or if a specially authorized custom instruction is executed.

[0109] Returning to Figure 6, checks may be performed to determine if certain conditions have been violated with respect to annotated variables while the cryptographic system to which the contamination is applied is in use. In block 640, a check is performed to determine whether any conditional actions are performed on data annotated as secret (e.g., "red" data). For example, conditional jumps, loads, and / or stores performed on "red" variables may be prohibited to prevent intentional or unintentional disclosure of sensitive data through timing channels. In block 650, another check is performed to determine whether data annotated as secret (e.g., "red" data) has been exported from the cryptographic system. For example, to prevent the disclosure of sensitive information, only data annotated as non-secret (e.g., "black" data) may be exported from the cryptographic system. In some cases, "red" data may be exported when it has been "protected" or converted to "black," for example, when an encryption operation has been performed on the data. In Figure 6, if a check in either block 640 or block 650 indicates that a conditional action has been performed on sensitive data or that sensitive data has been exported, an alert is logged in block 660. If the checks in blocks 640 and 650 are met (i.e., there are no exceptions in the “red” data), the result of the encryption operation is provided in block 670. In some cases, the result may only be provided in block 670 if the checks are met. In other cases, the result may still be provided, but any output may be provided to the alert recorded in block 660. In block 680, method 600 terminates. During use, when calculations are performed on the data, and when the data is loaded and exported, at least blocks 620, 630, 640 and 650 can be continuously repeated.

[0110] The contamination method described here may incur only moderate silicon area or power implementation costs. For example, additional register bits may be provided to store the aforementioned flag bits used for annotations. The set of contamination logic rules is relatively simple (e.g., using simple OR operations on “red” data), resulting in limited computational overhead. Local RAM, such as one or more of the matrix memory 132 and the control unit RAM 154, can also be modified to store annotations (e.g., via a set of reserved 1-bit memory locations associated with each set of stored data words). This method is applicable to both hardware implementations and full system emulators, and both may operate in the same way, for example, so that tracking and monitoring are performed both in reality and under test.

[0111] For example, a key generation process may involve generating a public-private key pair. During this process, the generated public key data may be immediately assigned a "black" flag value because it is not secret, while the private key data may initially be assigned a "red" flag value and only be assigned a "black" flag value after being "wrapped" with the cryptographic key (i.e., KEK-wrapped) to form a ciphertext key blob. Following the assignment of the "black" flag value, the ciphertext key data may be exported from the cryptographic system.

[0112] As illustrated in the examples herein, a cryptographic system may include a secure data bus interface for loading secure data via a system bus of a communicatively coupled computing system. In this case, data loaded into the cryptographic system from the secure data bus interface (e.g., 122 in Figure 1) is initially assigned a first ("red") value. In some cases, the output of all arithmetic operations involving an internal variable with the first value (e.g., a "red" variable) is assigned the first value (e.g., annotated as "red"). In some cases, the conversion from the first value (e.g., a "red" variable) to the second value (e.g., a "black" variable) is performed only when performing a subset of predefined arithmetic operations on the internal variable (e.g., zeroing or encryption). The values ​​of the set of attributes can be stored using one or more registers in the cryptographic system or using additional bits of data stored in the matrix memory of the cryptographic system.

[0113] The method in Figure 6 is described with reference to the cryptographic system 110 in Figure 1, but can be used with any cryptographic system, including a cryptographic system that includes a security processor. In some cases, this method may be applied to cryptographic operations performed in a conventional central processing unit of a computing system. This method is applicable to both post-quantum cryptographic operations and non-post-quantum (i.e., classical) cryptographic operations.

[0114] Generally, the embodiment in Figure 6 provides a method for operating a cryptographic system while performing cryptographic operations. This method includes defining a set of attributes for annotating at least a set of internal variables of the cryptographic system, each of which has at least one of two values, the at least two of which include a first value that indicates sensitive data and a second value that indicates non-sensitive data; performing one or more cryptographic operations on the set of internal variables, which include applying at least one of the two values ​​to data generated or received by the cryptographic system and updating the attribute values ​​based on arithmetic operations performed by the cryptographic system; and providing an indication when at least one of external conditional instructions and data access operations is performed on an internal variable having the first value.

[0115] In certain variants, the cryptographic system may have a secure data bus interface for loading secure data via a system bus of a communicably coupled computing system, wherein data loaded into the cryptographic system from the secure data bus interface is initially assigned a first value. The output of all arithmetic operations may include assigning an internal variable that has a first value to the first value. This method may include converting from the first value to the second value when performing a predefined subset of arithmetic operations on the internal variable. The values ​​of a set of attributes may be stored using one or more registers in the cryptographic system or using additional bits of data stored in the matrix memory of the cryptographic system.

[0116] A brief overview of the features. The specific examples described herein provide a device (e.g., a cryptographic system or coprocessor) capable of performing post-quantum cryptography using masked arithmetic operations, i.e., data provided as a masked data share for side-channel protection. The masked operating mode can utilize one or more of Boolean and arithmetic masking, and the device can provide conversions between (at least these) different forms of masking. The described examples provide a novel cryptographic system structure or configuration that performs masking operations in a flexible and efficient manner, enabling both accelerated post-quantum cryptography co-processing and high security against side-channel attacks.

[0117] The specific examples described herein provide devices (e.g., cryptographic systems or coprocessors) that can assist and / or accelerate cryptographic computations and autonomously perform certain complete post-quantum cryptographic operations. For example, the device enables public key establishment and encryption, including the generation, encapsulation, and / or encryption of public-key-private key pairs, as well as decapsulation and / or decryption. The device further enables digital signature functions, such as the generation of public-private integrity key pairs, signature generation, and signature verification, as well as stateful hash-based signatures, including the assistance and / or acceleration of key generation, signature generation, and signature verification functions. Such devices may be provided as a system-on-a-chip (e.g., as a separate FPGA / ASIC chip integrated and / or mounted within a silicon design).

[0118] The specific examples described herein provide cryptographic systems capable of providing secure cryptographic computations. For example, one or more of the following post-quantum public-key cryptographic algorithms, namely Classic McEliece, (CRYSTALS-)KYBER, NTRU, SABRE, BIKE, FrodoKEM, HQC, NTRUPrime, SIKE, and SupersingularIsogenyDiffie-Hellman (SIDH), as well as one or more of the following post-quantum digital signature algorithms, namely (CRYSTALS-)DILITHIUM, FALCON, Rainbow, GeMSS, and Picnic, may be implemented. Details of these algorithms can be found in the available NIST "Post-Quantum Cryptography Project" publications and the CRYSTALS Project publication "Cryptographic Suite for Algebraic Lattices - Kyber and Dilithium," which are incorporated herein by reference.

[0119] Specific examples described herein provide a device with a cryptographic numerical unit implementing a “britta” accelerator structure. This structure may include an address generator, multiport memory, a reordering device, and a pipelined arithmetic coupling unit with selectable functions. In some embodiments, an XOF or hash unit is described that can stream output (e.g., in the case of a SHAKE implementation) and / or iterate through hashes (e.g., via Winternitz mode and / or Merkle mode) to accelerate hash-based signatures. Specific examples described herein have a control device that controls cryptographic operations (so-called “no-touch” operations) without handling sensitive data. For example, the control device may not have access to sensitive data in the cryptographic numerical unit during operation. Specific examples further provide a way in which the control device or processor can provide security tracking of sensitive data throughout the cryptographic operation. Thus, the control device or processor can track the flow of sensitive information in the cryptographic system but cannot access the data. Specific examples describe a cryptographic numerical unit specifically configured for cryptographic operations, but which may in some cases provide additional vector processing capabilities. For example, the cryptographic system can also be used as a vector coprocessor. In this case, the control unit of the cryptographic system can receive vector instructions (such as RISC-V vector instructions via control register 124 in Figure 1) and implement these instructions using the cryptographic numerical arithmetic unit. This may provide additional "bonus" capabilities to speed up certain mathematical operations.

[0120] The above examples should be understood as illustrative examples. Further examples are conceivable. While specific components of each example have been described individually, it should be understood that a function described by reference to one example can be adequately implemented in another example, and that certain components may be omitted depending on the implementation. It should be understood that any feature described in relation to any one example may be used alone or in combination with other features described, and may be used in combination with one or more features of any other example, or any combination of any other examples. For example, a feature described with respect to a system component may be adapted to be performed as part of the described method. Furthermore, equivalents and modifications not described above may be adopted without departing from the scope of the invention as defined in the appended claims.

Claims

1. A cryptographic system that performs post-quantum cryptographic operations on a communicationally coupled computing system, wherein the cryptographic system is isolated from the communicationally coupled computing system. A bus interface set for connecting the cryptographic system to one or more system buses of the computing system in a communicative manner, Cryptographic numerical processing unit and, A control device comprising at least one processor and memory for controlling the cryptographic numerical arithmetic device, wherein the control device is communicably coupled to the bus interface set via a first internal bus and communicably coupled to the cryptographic numerical arithmetic device via a second internal bus, and the first internal bus and the second internal bus do not allow access to the internal cryptographic data of the cryptographic numerical arithmetic device during the encryption operation, It is equipped with, The aforementioned cryptographic numerical processing device A matrix memory for storing multidimensional arrays of data, An address generator configured to receive control signals from the control device and control access to data in the matrix memory, An arithmetic unit that performs a defined set of arithmetic operations on data in the matrix memory accessed using the address generator, A sorting device configured to generate a random bit sequence, wherein the sorting device is controlled by the control device and is communicatively coupled to the arithmetic unit, Equipped with, The cryptographic system is configured to perform masked arithmetic calculations by decomposing a confidential data value into a plurality of data shares, and the control device is configured to control the arithmetic unit and the address generator to apply at least one of the defined set of arithmetic operations as a plurality of independent linear operations for each of the plurality of data shares.

2. The cryptographic system includes a masked operating mode, in which the masked operating mode, The bus interface set receives instructions from the communicably coupled computing system to perform masked arithmetic calculations as a single atomic operation, The control device determines a first set of control signals for controlling access to the data in the matrix memory, and a second set of control signals for controlling the operation of at least one of the arithmetic units to perform the masked arithmetic calculations. The confidential data value stored in the matrix memory is decomposed into a plurality of masked data shares by applying one or more random bit sequences from the sorting device to the confidential data value, The repeated application of the at least one operation to each of the plurality of data shares using the arithmetic unit to perform the masked arithmetic calculation, wherein the at least one operation is applied as a plurality of independent linear operations. The cryptographic system according to claim 1, configured to perform the following:

3. In the masked operating mode, the encryption system, To obtain encrypted confidential data values ​​via the aforementioned bus interface set, The process involves decrypting the encrypted confidential data values ​​and storing the decrypted data values ​​in the matrix memory in order to decompose them into the masked data shares. It is configured to do the following: The cryptographic system according to claim 2, wherein the result of at least one of the operations is exported in an encrypted form only to the communicably coupled computing system.

4. The cryptographic system according to claim 1, wherein the sorting device performs ASCON sorting.

5. The cryptographic system according to claim 1, wherein the control device comprises a set of unconditional instructions stored in the memory and executed by the processor.

6. The sorting device is It includes an extensible output function (XOF) device that applies cryptographic operations to generate an infinitely long output stream, The cryptographic system according to any one of claims 1 to 5, wherein the XOF device is controlled by the control device and is communicably coupled to the arithmetic unit.

7. The cryptographic system according to claim 6, wherein the XOF device is configured to perform one or more of the following operations: cryptographic absorption, cryptographic squeeze, cryptographic sampling, and cryptographic random masking.

8. The cryptographic system according to claim 6, wherein the XOF device comprises an n-bit cryptographic state that is divided into a plurality of data shares for masked arithmetic calculations.

9. The cryptographic system according to claim 1, wherein the cryptographic system is configured to compute a hash-based signature by repeatedly hashing the data stored in the matrix memory.

10. The cryptographic system according to claim 6, wherein the cryptographic system is configured to compute one or more Winternitz hash chains and Merkle tree data.

11. The aforementioned cryptographic system, A key establishment function that includes one or more encryption and decryption functions, A digital signature function that includes one or more of the following: digital signature generation and digital signature verification, The cryptographic system according to claim 1, configured to perform one or more of the following: stateful hash-based signing and

12. The aforementioned cryptographic system, Implement one or more of the lattice post-quantum key establishment functions and the codebase post-quantum key establishment function, Implement one or more of the following: lattice post-quantum digital signature function, code-based post-quantum digital signature function, hash-based post-quantum digital signature function, and multivariate post-quantum digital signature function. Implementing a hierarchical signature system function, The cryptographic system according to claim 11, configured to perform the following.

13. The cryptographic system according to claim 1, wherein the arithmetic processing unit receives control data from the control device that indicates an operation selected to be executed, and comprises an arithmetic processing pipeline unit that executes the selected operation as a plurality of stages over time.

14. The cryptographic system according to claim 13, wherein the plurality of stages comprises a plurality of parallel processing streams, and the plurality of parallel processing streams receive data accessed from the matrix memory.

15. The cryptographic system according to claim 1, wherein the processor of the control device is configured to receive vector instructions via the bus interface set and to convert the vector instructions into control instructions for the vector operation of the cryptographic numerical arithmetic unit.

16. The aforementioned bus interface set is A set of control registers writable by at least one processor of the communicationally coupled computing system, A set of cryptographic registers for securely encrypted data, The cryptographic system according to claim 1, comprising:

17. The cryptographic system according to claim 1, wherein the control device is configured to convert from a first masking format to a second masking format.

18. The cryptographic system according to claim 1, wherein the control device is configured to implement one or more of Boolean masking and arithmetic operation masking.

19. A method for operating a cryptographic system, wherein the cryptographic system is isolated from a communicationally coupled computing system, and the method is The encryption system receives instructions from the communicably coupled computing system to perform masked arithmetic calculations as a single atomic operation via the bus interface set of the encryption system, The control device of the cryptographic system, which comprises at least one processor and memory, accesses the instructions written to the bus interface set, The control device determines a first set of control signals for controlling access to data in the matrix memory of the cryptographic system, and a second set of control signals for controlling the operation of at least one arithmetic unit of the cryptographic system to perform the masked arithmetic calculations. The process involves applying one or more random bit sequences from the sorting device of the cryptographic system to the confidential data value, thereby decomposing the confidential data value stored in the matrix memory into a plurality of masked data shares. Using the first set of control signals and the second set of control signals, the arithmetic unit is used to perform the masked arithmetic calculation, repeatedly applying the at least one operation to each of the plurality of data shares, wherein the at least one operation is applied as a plurality of independent linear operations, Includes, The method wherein, at least during the disassembly and the repeated application, the control device is prevented from accessing the contents of the matrix memory or the arithmetic unit.

20. Exporting the non-confidential result of the masked arithmetic calculation to the communicationally coupled computing system via the bus interface set of the cryptographic system, If the masked arithmetic calculation provides a confidential result, the method includes encrypting the confidential result before exporting it. The method according to claim 19, including the method described in claim 19.

21. To obtain encrypted confidential data values ​​via the aforementioned bus interface set, Decrypting the encrypted confidential data value within the aforementioned encryption system, In order to decompose the masked data share, the decoded data values ​​are stored in the matrix memory, The method according to claim 19 or claim 20, including the method according to claim 19 or 20.

Images