Post-quantum cryptographic operation with blinded ntt

Abstract

The present disclosure provides a method for executing a cryptographic operation including a NTT computation that transforms a polynomial with N coefficients from time-domain to frequency-domain. The NTT computation is divided into successive stages of butterfly operations that combine coefficients, starting from the N coefficients up to N transformed coefficients. During each stage, each butterfly combines a pair of coefficients among the N coefficients, using a NTT twiddle factor to progressively transform the pair of coefficients and uses a set of mask-related twiddle factors such. This set is based on the two input masks and on the output mask. The butterfly operations are grouped into blocks of at least two butterfly operations where all the butterfly operations within a same block have a same combination of masks in input and output at each stage of the NTT computation.

Description

Post-Quantum Cryptographic Operation with Blinded NTT TECHNICAL FIELD

[0001] The present disclosure relates to a method and computing device for executing cryptographic operations, in particular post-quantum cryptographic operations, said cryptographic operations including a Number Theoretic Transform, NTT, computation applied on one or more polynomials. BACKGROUND

[0002] Cryptography is the practice and study of techniques for securing communication and data from third parties. It involves the use of algorithms to transform information into a secure format that can only be read by someone with the appropriate decryption key. Cryptographic operations are essential for ensuring the confidentiality, integrity, and authenticity of data in various applications, including secure communications, digital signatures, and data encryption.

[0003] In the field of cryptography, post-quantum cryptography refers to cryptographic algorithms that are believed to be secure against the potential future threat posed by quantum computers. Quantum computers have the potential to break many of the cryptographic algorithms currently in use, such as RSA and ECC, by efficiently solving problems that are computationally infeasible for classical computers. Lattice-based cryptography is one of the leading candidates for post-quantum cryptographic algorithms due to its strong security guarantees and resistance to quantum attacks.

[0004] Lattice-based cryptographic algorithms, including ML-KEM (Modular Lattice Key Encapsulation Mechanism) and ML-DSA (Modular Lattice Digital Signature Algorithm), have emerged as promising candidates for post- quantum cryptography. ML-KEM is a cryptographic algorithm for securely transmitting encryption keys, while ML-DSA is a cryptographic algorithm for creating digital signatures, ensuring data integrity and authenticity. These algorithms are much more complex than previous public cryptographyalgorithms such as RSA or ECC-based cryptographic algorithms. This complexity results in longer execution times, greater memory requirement, and more intermediate variables. The increased complexity also means more potential points of leakage and more variables susceptible to be considered as target for hackers, making these algorithms more prone to side-channel attacks. This makes securing them more complex and costly.

[0005] One of the key components of lattice-based cryptographic schemes is the Number Theoretic Transform (NTT). The NTT is a mathematical transformation used to perform efficient polynomial multiplications in finite fields. It is a generalization of the Discrete Fourier Transform (DFT) and is used to convert polynomials from their time-domain representation to a frequency- domain representation, where polynomial multiplication can be performed more efficiently. The NTT and its inverse (INTT) are essential for the implementation of lattice-based cryptographic schemes, such as CRYSTALS- Kyber (ML-KEM) and CRYSTALS-Dilithium (ML-DSA).

[0006] However, the implementation of the NTT in cryptographic schemes is susceptible to side-channel attacks, which exploit information leaked during the execution of cryptographic algorithms to recover secret keys. One of the most significant and effective families of side-channel attacks is the Soft Analytical Side-Channel Attacks (SASCA). SASCA targets the NTT by analyzing power or electromagnetic (EM) traces to extract information about the secret variables involved in the computation. This poses a significant threat to the security of lattice-based cryptographic scheme.

[0007] The document “Single-trace side-channel attacks on masked lattice- based encryption” by R. Primas, P. Pessl, and S. Mangard. describes a single- trace side-channel attack on masked lattice-based encryption schemes implemented on the ARM Cortex-M4 microcontroller. The proposed attack requires over a million templates for successful key recovery. The computation inside a Belief Propagation (BP) algorithm is sped up using the Fast Fourier Transform (FFT).

[0008] The document “More practical single-trace attacks on the number theoretic transform” by P. Pessl and R. Primas, describes an improved attack on the work presented in the above-presented document, which requires only a hundred templates when the target vector has a small range. This improvement comes at the expense of a slower computation of the BP algorithm.

[0009] There is thus a need for a method to secure the NTT against side- channel attacks, particularly SASCA, while maintaining the efficiency and low- cost requirements of lattice-based cryptographic schemes. This method should provide countermeasures that complicate the correlation between side- channel information and the internal computations of the NTT, thereby enhancing the security of the cryptographic implementation. SUMMARY

[0010] The present disclosure concerns a method for executing a cryptographic operation including a Number Theoretic Transform, NTT, computation that transforms at least one polynomial with N coefficients from a time-domain representation to a frequency-domain representation, wherein - the NTT computation is divided into successive stages of butterfly operations that combine coefficients, starting from the N coefficients of the polynomial, up to N transformed coefficients; and - during each stage, each butterfly operation combines a pair of coefficients among the N coefficients, using a NTT twiddle factor to progressively transform the pair of coefficients and uses at least one, advantageously a plurality of, mask-related twiddle factors in such a way that, during all intermediate stages of the NTT computation, the coefficients of each pair of coefficients combined within a butterfly operation are masked with: - two respective input masks, independent from one another, in input of the butterfly operation; - a same output mask in output of the butterfly operation, independent from said two input masks,the set of mask-related twiddle factors being based on the two input masks and on the output mask.

[0011] The butterfly operations can be grouped into blocks of at least two butterfly operations where all the butterfly operations within a same block have a same combination of masks in input and output at each stage of the NTT computation.

[0012] The present method is a computer-implemented method. It can be executed by at least one processor and / or a computing device.

[0013] The set, or plurality, of mask-related twiddle factors used by a given butterfly operation is collectively based on the two input masks and the output mask. In other words, the set as a whole uses all three masks. In an embodiment, the NTT and mask-related twiddle factors are used as multiplication factors to multiply with the coefficients.

[0014] In an embodiment, the N coefficients of the at least one polynomial belonging to an integer ringrepresenting the integers modulo q, each NTT twiddle factor used in a butterfly operation is a primitive N-th root of unity ^ modulo q raised by an exponent ^^, and said NTT twiddle factor ^^^belongs to the integer ringand changes according to the stage of the NTT computation and indices of the coefficients combined within the butterfly operation.

[0015] In an embodiment, each mask of the two input masks and output maskis the primitive N-th root of unity ^^ raised by an exponent, and is arandom or pseudo-random element within the integer ring ℤ^^.

[0016] In an embodiment, in a butterfly operation of an intermediate stage ofthe NTT computation, ^^, ^^ being the exponents of the two input masks and ^^being the exponent of the output mask, the butterfly operation uses two mask- related twiddle factorsand ^^^^−^^so as to multiply one coefficient of the pair of coefficients by a factor ^^^^−^^and the other coefficient of the pair of coefficients by another factor ^^^^+^^−^^.

[0017] In an embodiment, the (each) butterfly operation can include: - a first multiplication of one coefficient of the pair of coefficients by the factor- a second multiplication of the other coefficient of the pair of coefficients by the other factor ^^^^+^^−^^to obtain T2; - an addition of T1 and T2; - a subtraction of T2 from T1.

[0018] In an embodiment, a spacing between the coefficients combined within a butterfly operation during a given stage being divided by a factor 2 during the next stage, the NTT computation uses: - first blocks of size B that each includes B butterfly operations that are sequential by butterfly indices, if the spacing is greater than the block size ^^; - second blocks of size B that each includes B butterfly operations that are not sequential by butterfly indices, if the spacing is equal or lower than the block size B.

[0019] In an embodiment, at the first stage of the NTT computation, the coefficients of each pair of coefficients combined within a butterfly operation can be unmasked in input and masked with a same mask in output.

[0020] Advantageously, at the last stage of the NTT computation, the coefficients of each pair of coefficients combined within a butterfly operation are masked in input with two respective masks, independent from one another, and unmasked in output.

[0021] The integer q may be a prime number or an integer such that a primitive N-th root of unity exists in ℤ^^.

[0022] The present disclosure also concerns a method for executing a cryptographic operation including an Inverse Number Theoretic Transform, INTT, computation that transforms at least one polynomial with N coefficients from a frequency-domain representation to a time-domain representation, wherein- the INTT computation is divided into successive stages of butterfly operations that progressively combine coefficients, starting from the N coefficients in the frequency domain, up to N transformed coefficients in the time domain; and - during each stage, each butterfly operation combines a pair of coefficients using a INTT twiddle factor to progressively transform the coefficients and uses at least one, advantageously a plurality of, mask-related twiddle factor(s) in such a way that, during all intermediate stages of the NTT computation, the coefficients of each pair of coefficients combined within a butterfly operation are masked with: - a same input mask in input of the butterfly operation; - two respective output masks, independent from one another and from the input mask, in output of the butterfly operation; the at least one mask-related twiddle factor being based on the input mask and the two output masks.

[0023] The present disclosure also concerns: - a device comprising means for carrying out the steps of the above defined method; - a computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out the steps of this method; - a computer-readable medium comprising instructions which, when executed by a computer, cause the computer to carry out the steps of this method. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Other features, purposes and advantages of the disclosure will become more explicit by means of reading the detailed statement of the non-restrictive embodiments made with reference to the accompanying drawings.

[0025] Figure 1 shows a DISO-DIT butterfly structure (on the left) and a SIDO- DIF butterfly structure (on the right), according to the present disclosure.

[0026] Figure 2 shows a DIT butterfly (on the left) and a DIF butterfly (on the right), according to the prior art.

[0027] Figure 3 shows butterfly operations of an NTT of size 16 using four blocks of butterfly operations, according to an example of the present disclosure.

[0028] Figure 4A represents an example of a mask link graph for an NTT of size 64 with four blocks of butterflies of block size 16 (i.e., each block includes 16 butterflies), the blocks being unmixed, including sequential butterflies, during all stages of the NTT computation, according to.

[0029] Figure 4B represents another example of a mask link graph for an NTT of size 64 with four mask blocks of butterflies of size 16, the blocks being unmixed, including sequential butterflies, during the initial stages of the NTT computation and mixed, including non-sequential butterflies, during later stages of the NTT computation.

[0030] Figures 5-7 represent examples of pseudocodes for computing different DISO-DIT and SIDO-DIF algorithms, according to the present approach. DETAILED DESCRIPTION

[0031] In 2023, the National Institute of Standards and Technology (NIST) published the first post-quantum cryptography candidates for standardization. Among these, three cryptographic schemes are based on lattice-based cryptography: CRYSTALS-Kyber, CRYSTALS-Dilithium, and Falcon. The development and deployment of implementations that are both correct and protected against side-channel attacks have become essential. These secure implementations need to be low-cost and efficient, especially since these cryptographic protocols will likely be employed on various Internet of Things (IoT) devices.

[0032] Lattice-based cryptography, due to the novel structure compared to traditional cryptographic systems is susceptible to new types of side-channelattacks in addition to all existing and well-known side channel attacks. One of the most significant and effective families of attacks is the Soft Analytical Side- Channel Attack (SASCA), which targets a mechanism of lattice-based cryptographic schemes: the Number Theoretic Transform (NTT). The NTT is a linear transformation used to perform efficient polynomial multiplications in finite fields, and the implementation is important for the performance of lattice- based cryptographic schemes.

[0033] The computation of NTT (Number Theoretic Transform) in cryptographic algorithms often uses a butterfly operation or unit, also simply referred as a butterfly, to efficiently perform the necessary arithmetic operations. The butterfly operation refers to a pattern of data flow and operations that repeatedly, progressively combine data elements, through successive stages of computation, to perform the transform correctly and efficiently. In each stage of the NTT computation, a plurality of butterfly operations or units are executed, and each butterfly operation or unit processes a pair of data elements, each pair undergoing specific mathematical operations, such as additions and multiplications by twiddle factors, distributes back the results into a data array in a manner that prepares them for the next stage.

[0034] Existing countermeasures to SASCA on the NTT include blinding in time and blinding in data. Blinding in time introduces time delays and random shuffling of different butterflies within the NTT, increasing the complexity of the correlation between side-channel information and the internal computations. This approach significantly complicates the implementation, requires extensive random shuffling, and disrupts the constant-time properties desirable in cryptosystems. Blinding in data masks the butterflies (i.e., the butterfly operations) by computing them up to a factor, which includes a root of unity. This method counteracts SASCA attacks by adding loops within the belief propagation (BP) factor graph, hindering the convergence of the belief propagation factor graph. Despite this, the method requires numerousadditional multiplications, which can slow down the protocol significantly, potentially increasing computation time by up to four times.

[0035] The present approach pushes further the idea of blinding in data by improving the efficiency and resistance against SASCA.

[0036] The present disclosure proposes a method for executing a cryptographic operation including a Number Theoretic Transform (NTT) computation that transforms at least one polynomial with N coefficients from a time-domain representation to a frequency-domain representation. The NTT computation is divided into successive stages of butterfly operations that progressively (i.e., stage by stage) combine coefficients, starting from the N coefficients of the polynomial, up to N transformed coefficients. During each stage of the NTT computation, each butterfly operation combines a pair of coefficients (or data elements) among the N coefficients (or data elements), using a NTT twiddle factor to progressively transform or update the pair of coefficients, so as to correctly transform the polynomial coefficients from the time domain to the frequency domain through the different stages. Each of the butterfly operations uses at least one, advantageously a plurality of, mask- related twiddle factor(s) in such a way that, during all intermediate stages of the NTT computation (i.e., between the first stage and the last stage of the NTT computation), the coefficients of each pair of coefficients or data elements combined within a butterfly operation are masked with two respective input masks, independent from one another, in input of the butterfly operation, and with a same output mask in output of the butterfly operation, independent from the two input masks. The at least one mask-related twiddle factor is based on the two input masks and the output mask. When a plurality of mask-related twiddle factors are used within a butterfly operation, these mask-related twiddle factors are collectively based on the two input masks and the output mask. In an embodiment, each twiddle factor of the plurality of twiddle factors may be based on a respective one of the input masks and on the output mask. In other words, each of the multiple twiddle factors (a set or plurality) used by anybutterfly operation may be based on one of the two input masks and the output mask. In an embodiment, the butterfly operation may use a set or pair of two twiddle factors. Collectively, this pair of twiddle factors is based on both input masks and the output mask. For example, one twiddle factor of this set may be based on one of the input masks and on the output mask, while the other twiddle factor of the set may be based on the other one of the input masks and on the output mask.

[0037] The method or process may further include at least part of the following steps: 1. During each stage of the NTT computation, a stride of the stage is determined, which is a spacing or distance between two input elements of the butterflies. When the process moves from one stage to the next stage, the stride can be divided by two. The stride can be initially set to N / 2 in the first stage. 2. The butterflies or butterfly operations in a stage can be indexed by butterflyindices, for example from 0 to ^^ / 2 − 1, grouped into blocks of at least twobutterfly operations where all the butterfly operations within a same block have a same combination of masks in input and output, at each stage of the NTT computation. All blocks can have a same size (i.e., a same number of butterfly operations within a block). 3. If the stride is greater than the block size, the butterflies are arranged into first blocks that each include butterfly operations that are sequential by their butterfly indices. If the stride is equal or less than the block size, the butterflies are arranged into second blocks that each include butterfly operations that are not sequential by their butterfly indices. 4. The process uses the NTT twiddle-factor and mask-related twiddle factors (that are computed or pre-computed) as multiplication factors to multiply the coefficients within each butterfly operation. 5. The butterfly operations are executed, updating the polynomial coefficients (i.e., progressively transforming them) and applying masks during the successive stages.6. When the process moves from one stage to the next stage, the stride is divided by two as previously indicated, and the process repeats the above steps for the next stage until the stride is equal to 1.

[0038] The method ensures that the coefficients of each pair of coefficients combined within a butterfly operation are masked with two respective input masks, independent from one another, in input of the butterfly operation, and a same output mask, in output of the butterfly operation, independent from the two input masks. The independence (or lack of correlation) between the input and output masks of each butterfly operation through all the intermediate stages of the NTT computation complicates the correlation between side- channel information and the internal computations, enhancing the security of the cryptographic implementation.

[0039] The present disclosure also concerns a method for executing a cryptographic operation including an Inverse Number Theoretic Transform (INTT) computation that transforms at least one polynomial with N coefficients from a frequency-domain representation to a time-domain representation. The INTT computation is divided into successive stages of butterfly operations that progressively combine coefficients, starting from the N coefficients in the frequency domain, up to N transformed coefficients in the time domain. During each stage, each butterfly operation combines a pair of coefficients using an INTT twiddle factor to progressively transform, or update, the pair of coefficients and uses at least one, advantageously a plurality of, mask-related twiddle factor(s) in such a way that, during all intermediate stages of the INTT computation, the coefficients of each pair of coefficients combined within a butterfly operation are masked with a same input mask in input of the butterfly operation and two respective output masks, independent from one another and from the input mask, in output of the butterfly operation. The at least one mask- related twiddle factor is based on the input mask and the two output masks.

[0040] The proposed method provides a secure and efficient implementation of the NTT and INTT computations in lattice-based cryptographic schemes,enhancing their resistance against SASCA while maintaining low-cost and efficiency requirements.

[0041] In the present disclosure, the following abbreviations and notations are used: - q is an integer, for example a prime number (but not necessarily); - is the ring of integers modulo q (i.e., the integers {0, 1, 2, ..., q-1}), - is the ring of integers modulo N (i.e., the integers {0, 1, 2, ..., N-1}),- ℤ^^[^^]⁄ (^^) represents a ring of integer polynomials modulo f, where frepresents a polynomial, that may be referred as a “reduction polynomial”. Forexample, ^^ = ^^^^ + 1, where ^^ is an indeterminate or variable used to constructpolynomials and ^^ is an integer representing a polynomial degree. In anotherexample, ^^ = ^^^^ − 1. The elements of ℤ^^[^^]⁄ (^^) can be represented byinteger polynomials of degree less than N with coefficients reduced modulo q.The polynomials in ℤ^^[^^]⁄ (^^) can be expressed by the general form as follows:represent polynomial coefficients in- NTT: Number Theoretic Transform, - INTT: Inverse NTT, - ^ is a primitive root of unity of order ^^, also referred as a primitive N-th root of unity,all M<N.

[0042] In a variant, q may be an integer that is such that a primitive N-th root of unity exists in ℤ^^.

[0043] The present disclosure concerns a method for executing a cryptographic operation including a blinded NTT computation applied on at least onepolynomial, for example from ℤ^^[^^]⁄ (^^) , such as a polynomial that can beexpressed by ^^[0] + ^^[1]^^ + ^^[2]^^2 + ⋯ + ^^[^^ − 1]^^^^−1 , to transform thepolynomial from its time-domain representation with original coefficients suchas ^^[0], ^^[1], … , ^^[^^ − 1] to its frequency-domain representation withtransformed coefficients such as ^̂^[0], ^̂^[1], … , ^̂^[^^ − 1], where [0], [1], … , [^^ −1] represent the ordered indices of the coefficients. The index of a coefficient can correspond to the power of the variable that is multiplied by this coefficient in the polynomial in the time domain. The NTT computation is divided into successive stages of butterfly operations, also referred as computation stages, that progressively (i.e., stage by stage) combine coefficients, starting from the N coefficients of the polynomial (in the time domain), up to N transformed coefficients (in the frequency domain).

[0044] Each computation stage includes N / 2 butterflies or butterfly operations with a given stride, where the N / 2 butterflies update or process or combine the coefficients. The stride determines the spacing or distance between two input elements or data (here coefficients) of the butterflies or butterfly operations and each butterfly operation is based on a same butterfly structure that includes addition, subtraction, and multiplication by twiddle factors, as explained below.

[0045] In each stage, the N / 2 butterfly operations can be indexed by butterflyindices for example from 0 to ^^ / 2 − 1. Let’s consider the N polynomialcoefficients in time domain ordered from 0 to N, the N / 2 butterfly operations are stacked or layered or sequential by the indices of the polynomial coefficients processed by these butterfly operations, as shown in figure 3. The N / 2 butterfly operations or butterflies are thus stacked or layered in each stageand can be indexed from 0 to ^^ / 2 − 1 according to their position in the stack(or layer) in each stage. It should be noted that the different butterfly operations in a given stage can be executed in parallel, successively or in any order.

[0046] During a first stage of the NTT computation, the stride is N / 2 (for all butterflies during this first stage) and the input elements of the butterflyoperations can be the polynomial coefficients, for example ^^[0], ^^[1], … , ^^[^^ −1].

[0047] During any subsequent stage of the NTT computation, the stride of said computation stage is equal to the stride of the previous computation stage divided by a factor of two and the input elements of the butterflies or butterflyoperations include the (updated) coefficients produced as output of the butterfly operations during the previous stage.

[0048] During a last stage of the NTT computation, the stride of this last stage can be equal to 1. At this last stage, the output elements of the butterfly operations can be the transformed polynomial coefficients, for example^̂^[0], ^̂^[1], … , ^̂^[^^ − 1].

[0049] The present butterfly operation or structure or unit is represented in figure 1. It is a masking or blinded butterfly structure that is based on the known DIT butterfly structure represented in figure 2 but differs from it by features that will be described below. The left parts in figures 1 and 2 represent butterfly operations as used in a NTT computation, while the right parts in figures 1 and 2 represent butterfly operations as used in a INTT or Inverse-NTT computation.

[0050] In the present disclosure, the blinded NTT computation consists, similarly to the document “On Configurable SCA Countermeasures Against Single Trace Attacks for the NTT” by P. Ravi, R. Poussier, S. Bhasin and A. Chattopadhyay, to use masked butterflies inside the NTT computation, but different ones.

[0051] Each butterfly operation or unit is intended to: - process, combine a pair of coefficients among the N coefficients, as input elements, to progressively transform or update this pair of coefficients, and - produce the pair of updated coefficients, as output elements.

[0052] In the present disclosure, during each stage, each butterfly operation combines a pair of coefficients using a NTT twiddle factor to progressively transform or update this pair of coefficients and uses at least one mask-related twiddle factor in such a way that, during all intermediate stages of the NTT computation (i.e., between the first stage and the last stage), the coefficients of each pair of coefficients combined within a butterfly operation are masked with two respective input masks, independent from one another, in input of the butterfly operation, and with a same output mask in output of the butterfly operation, independent from said two input masks. The expression “toprogressively transform or update the coefficients” reflects a step-by-step or partial transformation of the coefficients as the coefficients are gradually altered, stage-by-stage during the NTT computation. The mask-related twiddle factor(s) is / are based on the two input masks and the output mask.

[0053] The term “independent” means that the masks are determined independently of each other and are consequently independent from one another or uncorrelated. As a result, the masks are generally different from one another but may accidentally be identical. The NTT and mask-related twiddle factors are used as multiplication factors to multiply the coefficients within the butterfly operation.

[0054] In an embodiment, each NTT twiddle factor used in a butterfly operation is a primitive N-th root of unity ^ modulo q raised by an exponent ^^, referred as a NTT exponent. This NTT twiddle factor ^^^belongs to the integer ringand changes according to the stage of the NTT computation and indices of the coefficients combined within the butterfly operation. The exponent ^^ can be an element of the integer ring . The butterfly operation includes a multiplication of one coefficient of the pair of coefficients in input by this NTT twiddle factor ^^^^and a combination of the coefficients. This multiplication by the twiddle factor ^^^^is well-known, as it is similarly executed within the known DIT butterfly operation represented in figure 2.

[0055] In an embodiment, each mask (input masks or output mask) is theprimitive N-th root of unity ^^ raised by a specific, respective exponent (^^, ^^, or ^^)referred as a masking exponent. Each of the masking exponents ^^, ^^, ^^ can berandomly or pseudo-randomly determined or selected in the integer ring ℤ^^. For each butterfly operation executed during an intermediate stage of the NTT computation, the two input masks are the primitive N-th root of unity ^^respectively raised by two exponents ^^, ^^, that are independent from each other,and the output mask is the primitive N-th root of unity ^^ raised by anotherexponent ^^ that is independent from the two exponents ^^, ^^. Each of the masks^^^^, ^^^^, ^^^^ is an element in ℤ^^. The exponentsthat are random orpseudo-random elements in ℤ^^, are generally different from each other but may accidentally (or fortuitously) be identical.

[0056] At the first stage of the NTT computation, the coefficients of each pair of coefficients combined within each butterfly operation can be unmasked in input and masked in output with an output mask. Optionally, the coefficients in input of the butterfly operations at the first stage may already be masked with input masks.

[0057] At the last stage of the NTT computation, the coefficients of each pair of coefficients combined within each butterfly operation are masked in input with two respective input masks, independent from one another, and can be unmasked in output. Optionally, the coefficients in output of the butterfly operations at the last stage may be masked with output masks.

[0058] In an embodiment, the present blinded NTT computation only uses DISO-DIT butterflies. However, this DISO-DIT butterflies could also be used as a SISO-DIT (Same Input Same Output – Decimation in Time) butterflies, if the input values are the same. In this way, the butterfly operations can be computed using only two multiplications, while handling three twiddle factors.

[0059] With reference to figure 1 (left part), the input and output elements of a masking or blinded butterfly operation as executed in the NTT computation according to an embodiment can be described as follows: - the first input element of the blinded butterfly operation is the productas shown in figure 1 (left part), which includes a first input coefficient ^^0(original in time domain or updated) among the N coefficients multiplied by the mask ^^^^that is the root of unity ^^ raised by the masking exponent ^^ (from a previous masking butterfly); - the second input element of the blinded butterfly operation is the productas shown in figure 1 (left part), which includes a first input coefficient ^^1(original in time domain or updated) among the N coefficients multiplied by the mask ^^^^that is the root of unity ^^ raised by the masking exponent ^^ (from a previous masking butterfly), the exponents ^^ and ^^ being independent from one another;- the two output elements of the blinded butterfly operation are the product ^^^^^^0′and the product ^^^^^^1′, where ^^0′and ^^1′are the two updated coefficients produced by the butterfly or butterfly operation and ^^^^is the output mask (currently applied by said butterfly), ^^ being the masking exponent.

[0060] This masking exponent ^^ corresponds to a specific mask applied by this specific masking or blinded butterfly operation.

[0061] The masking exponents can be random or pseudo-random integers from the integer ring ℤ^^, except for the input masking exponents ^^ and ^^ at the first stage that can be set to 0, and the output masking exponents ^^ at the last computation stage that can be set to 0. However, the output masking exponents ^^ at the last computation stage could be different from 0, to mask the transformed coefficients, as previously explained. In the same manner, the input masking exponents ^^ and ^^ at the first computation stage can be different from 0 if the original coefficients (in time domain) are already masked, as previously explained.

[0062] As shown in figure 1 (left part), the masking butterfly operation intended to apply the mask ^^ includes two multiplications, one addition and one subtraction. In an embodiment, this butterfly operation can include: - a first multiplication of the first input element (first input coefficient) by a mask-related twiddle factor that is the root of unity ^^ exponent ^^ − ^^ (i.e., by thefactor ^^^^−^^) which result is T1; - a second multiplication of the second input element (first input coefficient) bythe twiddle factor that is the root of unity ^^ exponent ^^ + ^^ − ^^ (i.e., by thefactor ^^^^+^^−^^that is the product of the NTT twiddle factor ^^^^and the mask- related twiddle factorwhich result is T2; - an addition of T1 and T2 to obtain a first output element (first output coefficient of same index as the first input coefficient); - a subtraction of T2 from T1 to obtain a second output element (second output coefficient of same index as the second input coefficient).

[0063] This masking butterfly operation executed can be expressed as follows:^^2 = ^^^^+^^−^^ × ^^[^^ + ^^];^^′[^^] = ^^1 + ^^2;^^′[^^ + ^^] = ^^1 − ^^2;where: - a is a coefficient index, with a=0, 1, …, N-1; - ^^ is the stride of the current computation stage (i.e., the spacing or length or distance between two input elements of the butterfly operations at the current computation stage);- ^^[^^] = ^^^^ × ^^[^^], represents an input polynomial coefficient ^^[^^] among theN coefficients (that can be an original polynomial coefficient in time domain at the first stage or an updated polynomial coefficient at a subsequent stage) multiplied by the input mask ^^^^that is the primitive N-th root of unity ^^ exponenta previous masking exponent ^^ (with ^^ = 0 at the first computation stage);- ^^[^^ + ^^] = ^^^^ × ^^[^^ + ^^], represents an input polynomial coefficient ^^[^^ + ^^]among the N coefficients (that can be an original polynomial coefficient in time domain at the first stage or an updated polynomial coefficient at a subsequent stage) multiplied by the input mask ^^^^that is the primitive N-th root of unity ^^exponent a previous masking exponent ^^ (with ^^ = 0 at the first computationstage);- ^^′[^^] = ^^^^ × ^^′[^^], represents the first output element of the maskingbutterfly structure, which corresponds to the updated or newly updated value of the polynomial coefficient ^^[^^]multiplied by the output mask ^^^^that is the primitive N-th root of unity ^^ exponent the current mask ^^ specific to the current butterfly operation;- ^^′[^^ + ^^] = ^^^^ × ^^′[^^ + ^^], represents the second output element of themasking butterfly structure, which corresponds to the updated or newlyupdated value of the polynomial coefficient ^^[^^ + ^^] multiplied by the outputmask ^^^^that is the primitive N-th root of unity ^^ exponent the current mask ^^ specific to the current butterfly operation.

[0064] In an embodiment, the butterfly operations (or butterflies) can be grouped into blocks, where all the butterfly operations within a same block have a same combination of masks in input and output during each stage of the NTT computation.

[0065] Advantageously, to further simplify the computations, the size of each block may be fixed through all stages of the NTT computation. For example, this size may be a power of two. The size of the blocks, or block size, denoted ^^ can be defined as the number of butterfly operations (or butterflies) included in a block.

[0066] Figures 4A and 4B show two different graphs of links between masks at different, successive stages of the NTT computation, according to twoexamples. The triplet of masks, ^^^^ , ^^^^), or the triplet of masking exponents(^^, ^^, ^^), can be the same for all the butterflies of the same block at a givenstage of the NTT computation. This triplet may change at each stage, but there may be a link between the different triplets of a same block used in different stages. For example, the triplet of masks used in the first block during the firststage in each of figures 4A and 4B is (0,0, ^^0), while this triplet of masks usedin this first block during the second stage is (^^0, ^^2, ^^0′). These two triplets are linked by the mask ^^0.

[0067] During the first stage of the NTT computation, and during each subsequent or later stage, if the stride of said stage (i.e., the spacing or distance between the input elements of the butterfly operations) is more than ^^ the size of the blocks (i.e., if ^^> 1), each block include ^^ butterfly operationsthat are sequential or follow one another by their butterfly indices. This is illustrated in figure 3 that shows the butterfly operations of the NTT computationof a N-1 degree polynomial with N=16 coefficients and a block size ^^ = 2. InFigure 3 (on the left part), during each stage, in each block, the two butterflyoperations of this block are sequential or adjacent by their butterfly indices. For example, in each of the first and second stage, butterflies ^^^^0and ^^^^1are within ^^^^^^^^^^0, the butterflies ^^^^2et ^^^^3are within ^^^^^^^^^^1, etc.The blocks of butterflies if ^^ ^^> 1 will be referred as “first blocks”.

[0068] If during a stage of the NTT computation, the stride of said computation ^^ stage becomes equal or less than the size of the blocks (i.e., if ^^≤ 1), thebutterfly operations are arranged into different types of blocks, that will be referred as “second blocks”. The second blocks still each include ^^ butterfly operations but these ^^ butterfly operations are not sequential by their butterfly indices. For example, to create the second blocks, the butterfly operations of the first blocks are mixed between two first blocks that are sequential or adjacent by their block indices, as illustrated in figure 3 (on the right part). As shown on the right part in this figure, the two butterflies of a same block are not sequential by their butterfly index but are separate from one another by a butterfly belonging to another block. For example, in each of the third and fourth stage, the butterflies ^^^^0and ^^^^2are within ^^^^^^^^^^0, the butterflies ^^^^1et ^^^^3arewithin ^^^^^^^^^^1, etc.

[0069] If a random mask is used for every butterfly inside the NTT computation, it would be required to sample up to random 6144 bits per NTT in ML-KEM and up to 8064 bits per NTT in ML-DSA, in case of a polynomial with N=256 coefficients. This would significantly temper the performance. The use of the blocks allows to address this issue. To compute the NTT, butterflies are arranged into blocks and every butterfly in a block has the masks, here the same raised twiddle factors, in input and output. Furthermore, to simplify the computation, the size of the blocks is a power of two and is fixed throughout the NTT computation. Using blocks, it is required to sample far less randomness. More specifically, for a block size of ^^, it is only required tosample 8 ∗ 6 ∗ 128 / ^^ bits of randomness for ML-KEM and 9 ∗ 7 ∗ 128 / ^^ bitsfor ML-DSA.

[0070] As the size of the blocks is a power of two, implementing the logic to keep track of the different raised twiddle factors can be efficiently done using 8-bit or 9-bit additions, together with bit shifts. Furthermore, the links between the previous blocks inside the NTT is representable itself as an NTT diagram of length 7 and of height log2128 / ^^, making it easy to construct and to control.

[0071] Figure 4A represents a mask link graph for an NTT computation of size N=64 with 4 blocks and all blocks include butterfly operations that are sequential by their indices through all stages. The inherent problem with masking by block in such a way is that the butterflies that are performed during the later stages of the NTT, i.e., during the stages when the distance between the two inputs of the butterfly is smaller than the block size, have the same input masks on both of their input coefficients, which tempers the resistance to SASCA. This is represented by the double arrows on the right part of figure 4A (between ^^^′^′and ^^^′^′′, between ^^^′^′′and ^^^′^′′′, and between ^^^′^′′′and 0). This is due to the link between the different triplets of a same block used in different stages, previously evoked.

[0072] To circumvent this problem, illustrated in figure 4A in a specific example, without additional cost, as previously explained, the butterfly operations beingindexed by butterfly indices from 0 to ^^ / 2 − 1 and the blocks being indexed byblock indices from 0 to ^^ − 1, at each stage, the present NTT computation canuse two types of blocks: - first blocks: used while the distance ^^ between two inputs of the butterfly is greater that the block size ^^. These first blocks simply depend on the index of the butterfly. More specifically, the ithbutterfly ^^^^^^belongs to the j-th block^^^^^^^^^^^^ (i.e., ^^^^^^ ∈ ^^^^^^^^^^^^) if= ^^ where the expression means that thevariable ^^ takes the value of the quotient obtained by dividing ^^ by ^^, but without any fractional part; - second blocks: used while the distance ^^ between two inputs of the butterfly is smaller than the block size ^^. In that case, the block appurtenance depends also on the spacing ^^ between the inputs of the butterfly. The ithbutterfly ^^^^^^belongs to the jth block ^^^^^^^^^^^^ (i.e., ^^^^^^ ∈ ^^^^^^^^^^^^) if:where- ^^ represents an index of a block with ^^ = 0, 1, … , ^^ − 1 ;- ^^ represents an index of a butterfly operation within a given stage of the NTTcomputation, with ^^ = 0, 1, … , ^^ − 1 ;- ^^ represents the size of the mask blocks; - & represents the bitwise AND binary operation operating on binary representations of numbers;- ⌊ ⌋ represents the floor function in mathematics, that takes a real numberand returns the greatest integer that is less than or equal to that number. - ^^ represents the stride or distance or spacing between the input elements within the butterflies.

[0073] The second blocks induce a shift in the different butterflies which ensures that the masks in input come from two different blocks, that can be in fact concomitant or sequential or adjacent by their block indices. In that case, the links between the masks at the different computation stages are shown in the graph of figure 4B.

[0074] An example of a detailed NTT computation is given below. The NTT is of size 256 (as in ML-KEM and ML-DSA). In other words, the cryptographic operation includes a NTT computation that is applied on at least onepolynomial, from ℤ^^[^^]⁄ (^^) , to transform the polynomial from its time-domainrepresentation with original coefficients ^^[0], ^^[1], … , ^^[^^ − 1], with N = 256, toits frequency-domain a representation with transformed coefficients^̂^[0], ^̂^[1], … , ^̂^[^^ − 1] through a succession of computation stages.

[0075] However, the present approach works for any size N that is a power of 2. As an illustrative and non-limitative example, figure 3 represents a diagram of the NTT computation according to the present approach for an NTT of size 16 (N=16) using four mask blocks.

[0076] The process first determines, or computes, all the twiddle factors (i.e., the exponents of the root of unity ^, which includes all the random masking exponents of the root of unity ^ and the NTT exponents ^^), that will be used inthe NTT computations, and initialises ^^ = 128, where ^^ is the initial stride(spacing or distance between the input elements of the butterflies) used during the first stage.

[0077] First part of the NTT computation

[0078] The first part of the NTT computation is carried out while> 1, i.e., ifthe distance between input elements of the butterflies is greater than the block size ^^.

[0079] During each stage, the set of all 128 butterflies are separated into different parts denoted ^^^^, where a butterfly in ^^^^uses the same NTT twiddle factor ^^^^.

[0080] Then each part ^^^^is split into first blocks ^^^^^^, where b represents a block’s index. The process computes, for each of the butterflies of this block ^^^^^^, the input exponents ^^, ^^ (that could be denoted ^^^^,^^^^) of the input masks,that correspond to the masking exponents at the previous stage (set to 0 at the first stage), together with the new masking exponent ^^ (that could be denoted ^^^^) of the specific mask applied by the butterfly. For each butterfly inside ^^^^^^, the computation is performed as follows: ^^′[^^] = ^^^^−^^^^[^^] + ^^^^+^^−^^^^[^^ + ^^]where^^[^^] and ^^[^^ + ^^] are polynomial coefficients;^^′[^^] and ^^′[^^ + ^^] are the updated polynomial coefficients;^ is a primitive N-th root of unity (i.e., of order N);^^, ^^ are the masking exponents of the masks in input;^^ is the masking exponent of the mask in output.

[0081] After computation of the butterflies during a stage, the process divides the stride ^^ (spacing or distance between the input elements of the butterflies) by two, and then goes to the next stage of the NTT computation. The operations as above defined are similarly performed but with the new stride during this next stage.

[0082] The above steps are repeated in loop during each stage of the NTT ^^ computation, as long as ^^> 1.

[0083] Second part of the NTT computation≤ ^^

[0084] The second part of the NTT computation is carried out while ^^ ^^ ≤ 1, i.e., if the distance between input elements of the butterflies is equal or less than the block size B and more or equal to one.

[0085] In the second part of the NTT computation, the butterflies are sorted, arranged into second or mixed blocks ^^^^, where b is the mask block’s index as previously described.

[0086] As previously explained, a masked butterfly takes in input the elements x0, x1, and handles the masks ^^^^, ^^^^, ^^^^(in other words, the maskingexponents ^^, ^^, ^^ of ^) and the value ^^ that is the exponent in the NTT twiddlefactor ^^^^of the butterfly required to multiply x1. This value ^^ is computed differently depending on the stage of the NTT: - For ^^ greater than the block size ^^ (first part of the NTT computation), the value ^^ is fixed within each block. - For ^^ equal or smaller than the block size ^^ (second part of the NTT computation), the value ^^ is not the same for each butterfly in a block.

[0087] As a result, in the first part of the NTT computation, the process computes first the value ^^ (to arrange the butterflies into parts ^^^^) and then handles the mask blocks ^^^^^^within each part ^^^^, while in the second part of the NTT computation, the process first handles the blocks ^^^^, qualified as “mixed” as each ^^^^mixes different values of ^^, and then handles the value ^^.

[0088] In the second part of the NTT computation, after sorting the butterflies into mixed blocks ^^^^, for each butterfly operation (or butterfly), the processcomputes the masking exponents ^^, ^^ (that could be denoted ^^^^,^^^^) of the masksin input ^^^^, ^^^^together with the new masking exponent ^^ of the mask ^^^^applied by the present butterfly (that could be denoted ^^^^), ^^ being set to 0 for the last stage, if the transformed coefficient in the frequency domain are unmasked.

[0089] Then, the process splits each mixed block ^^^^into blocks ^^^^^^, the block ^^^^^^including the butterflies using the same factor ^^.

[0090] For each butterfly inside ^^^^^^, the computation is performed: ^^′[^^] = ^^^^−^^^^[^^] + ^^^^+^^−^^^^[^^ + ^^]where^^[^^] and ^^[^^ + ^^] are polynomial coefficients;^^′[^^] and ^^′[^^ + ^^] are the updated polynomial coefficients;^ is the twiddle factor that is a primitive root of unity of order n;^^, ^^ are the masking exponents of the masks ^^^^, ^^^^ in input;^^ is the masking exponent of the mask ^^^^in output.

[0091] After computation of the butterflies during each stage, the process divides the stride ^^ (spacing or distance between the input elements of the butterflies) by two, before going to the next stage. The operations as above defined are similarly performed but with the new stride during the next stage.

[0092] The above steps are repeated in loop at each stage of the NTTcomputation, as long as ^^≤^^ ^^≤ 1, until the distance ^^ between the inputelements of the butterflies is equal to 1. During this last stage (when ^^ = 1), thebutterfly operations output the transformed coefficients ^̂^[0], ^̂^[1], … , ^̂^[^^ − 1].

[0093] Regarding how to compute ^^, the process can initialise ^^1at 1 and set ^^ as the bit reverse of ^^1. Once the process has finished a ^^^^, ^^1can be incremented by one.

[0094] The NTT computation that has been described above takes as input theunmasked polynomial coefficients (i.e., the entering masking exponent ^^, ^^ ofthe twiddle factors are 0) outputs are also unmasked (i.e., the masking exponent ^^ of the twiddle factors at the last computation stage is 0). However, this can easily be modified, to mask the transformed coefficients in output or take as inputs already masked coefficients.

[0095] It is also noted that the NTT computation outputs its factors in bit-reverse order, as shown in figure 3.

[0096] The transformed polynomial with the transformed coefficients^̂^[0], ^̂^[1], … , ^̂^[^^ − 1] can be used to execute the cryptographic operation andprovide a result of the cryptographic operation. For example, the cryptographic operation can include a multiplication between two polynomials. This multiplication can be easily performed in the frequency domain, after applying the NTT on the two polynomials.

[0097] The present disclosure also concerns a method for executing a cryptographic operation including a blinded INTT computation to transform the polynomial from its frequency-domain a representation with transformedcoefficients ^̂^[0], ^̂^[1], … , ^̂^[^^ − 1] to its time-domain representation withoriginal coefficients ^^[0], ^^[1], … , ^^[^^ − 1] through a succession of computationstages. The blinded INTT process is directly derived from the blinded NTT process by applying the Telegen’s principle, that ensure that the INTT is as efficient as the NTT and conserves the same structure and mechanism for the blinding. The main difference is that the inversion transforms the DISO-DIT butterflies used in the NTT computation into SIDO-DIF butterflies used in the INTT computation.

[0098] Therefore, the present disclosure also concerns a method for executing a cryptographic operation including an Inverse Number Theoretic Transform, INTT, computation that transforms at least one polynomial with N coefficients from its frequency-domain representation to its time-domain representation.

[0099] The INTT computation is divided into successive stages of butterfly operations that progressively (stage by stage) combine coefficients, starting from the N coefficients in the frequency domain, up to N transformed coefficients in the time domain. During each stage, each butterfly operation combines a pair of coefficients using a INTT twiddle factor to progressively transform or update the pair of coefficients and uses at least one mask-related twiddle factor in such a way that, during all intermediate stages of the NTT computation, the coefficients of each pair of coefficients combined within a butterfly operation are masked with: - a same input mask in input of the butterfly operation; - two respective output masks, independent from one another and from the input mask, in output of the butterfly operation; the at least one mask-related twiddle factor being based on the input mask and the two output masks.

[0100] The diagram of figure 3 remains a valid representation of the INTT computation when it is read from right to left (instead of from left to right for the NTT computation). All the root unity multiplications are inversed.

[0101] With reference to figure 1 (right part), the input and output elements of a masking or blinded butterfly operation as executed in the INTT computation according to an embodiment can be described as follows: - the first input element of the blinded butterfly operation is the product ^^^^^^0as shown in figure 1 (right part), which includes a first input coefficient ^^0(original in frequency domain in first stage or updated in a later stage) among the N coefficients multiplied by the mask ^^^^that is the root of unity ^^ raised by the masking exponent ^^ (from a previous masking butterfly); - the second input element of the blinded butterfly operation is the product ^^^^^^1as shown in figure 1 (right part), which includes a first input coefficient ^^1(original in frequency domain in first stage or updated in a later stage) among the N coefficients multiplied by the mask ^^^^that is the root of unity ^^ raised by the masking exponent ^^;- a first output element of the blinded butterfly operation is the product ^^^^^^0′where ^^0′is one of the pair of updated coefficients produced by the butterfly operation and ^^^^is the output mask, ^^ being the masking exponent; and - a second output element of the blinded butterfly operation is the product ^^^^^^1′where ^^1′is one of the pair of updated coefficients produced by the butterfly operation and ^^^^is the output mask, ^^ being the masking exponent; where the masks ^^^^, ^^^^, ^^^^(or their exponents ^^, ^^ and ^^) are independent from one another.

[0102] As previously described for the NTT computation, the masking exponents ^^, ^^ and ^^ used in the INTT computation can be random or pseudo- random integers from the integer ring ℤ^^, except for the input masking exponent ^^ at the first stage of the INTT computation that can be set to 0, andthe output masking exponents ^^, ^^ at the last stage of the INTT computation thatcan be set to 0. However, the input masking exponent ^^ at the first stage could be different from 0, if the coefficients in the frequency domain are masked, as previously explained. In the same manner, the output masking exponents ^^ and ^^ at the last stage can be different from 0 if the coefficients in the time domain are masked, as previously explained.

[0103] An example of the INTT computation process is given below:

[0104] The process first determines, or computes, all the twiddle factors (i.e., all the random masking exponents of the root of unity ^, and the factor k), and initialises the stride or distance ^^ between input elements of the butterflies toone, in other words ^^ = 1.

[0105] First part of the INTT computation

[0106] The first part of the INTT computation is carried out while≤ 1, in otherwords if the distance between input elements of the butterflies is equal or less than the block size B.

[0107] In the first part of the INTT computation, the butterflies are arranged into mixed blocks ^^^^, as previously described.

[0108] For each butterfly operation (or butterfly), the process computes the newmasking exponents ^^, ^^ of the masks in output together with the old maskingexponent ^^ of the mask in input (^^ being set to 0 during the first stage, if the transformed coefficients in the frequency domain are unmasked).

[0109] Then, the process splits the mixed blocks ^^^^into blocks ^^^^^^, the block ^^^^^^including the butterflies using the same NTT twiddle factor ^^^^.

[0110] For each butterfly inside ^^^^^^, the process performs the following computation:^^′[^^ + ^^] = −^^^^+^^−^^(^^[^^] − ^^[^^ + ^^])where^^[^^] and ^^[^^ + ^^] are the inputs of the butterfly and include polynomialcoefficients;^^′[^^] and ^^′[^^ + ^^] are the outputs of the butterfly and include polynomialcoefficients; ^ is the primitive root of unity of order n;^^, ^^ are the masking exponents of the masks ^^^^, ^^^^ in input;^^ is the masking exponent of the mask ^^^^in output.

[0111] After computation of the butterflies at each stage, the process multiplies the stride ^^ (spacing or distance between the input elements of the butterflies) by two, and then goes to the next stage. The operations as above defined are similarly performed but with the new stride during the next stage.

[0112] Second part of the INTT computation

[0113] The second part of the INTT computation is carried out while 1 <^^≤ 128 in other words if the distance between input elements of the butterflies is more than the block size B.

[0114] In the second part of the INTT computation, the 128 butterflies are split into blocks ^^^^, where the butterflies in ^^^^use the same twiddle factor ^^^^.

[0115] Then, the process splits the blocks ^^^^into blocks ^^^^^^, and, for each ^^^^^^,computes the new masking exponents ^^, ^^ of the masks ^^^^, ^^^^ in outputtogether with the old masking exponent ^^ of the mask ^^^^in input.

[0116] For each butterfly inside ^^^^^^, the process performs the following computation:where^^[^^] and ^^[^^ + ^^] are the inputs of the butterfly and include polynomialcoefficients;^^′[^^] and ^^′[^^ + ^^] are the outputs of the butterfly and include polynomialcoefficients; ^ is a primitive root of unity of order n;^^, ^^ are the masking exponents of the masks ^^^^, ^^^^ in input;^^ is the masking exponent of the mask ^^^^in output.

[0117] After computation of the butterflies at each stage, the process multiplies the stride ^^ (spacing or distance between the input elements of the butterflies) by two, and then goes to the next stage. The same operations as above defined are similarly performed but with the new stride during the next stage.

[0118] The above steps are repeatedly executed until the value ^^ = 128 isreached.

[0119] Regarding how to compute ^^, the process can initialise ^^1at 255 (or 127 in the case of ML-KEM) and set ^^ as the bit reverse of ^^1. Once the process has finished a ^^^^, ^^1can be incremented by one.

[0120] In an embodiment, the butterfly operations are grouped into blocks of at least two butterfly operations where all the butterfly operations within a sameblock have a same combination of masks in input and output at each stage of the INTT computation.

[0121] A spacing between the coefficients combined within a butterfly operation during a given stage can be multiplied by a factor 2 during the next stage. In such embodiment, the INTT computation may use: - second blocks of size B that each includes B butterfly operations that are not sequential by butterfly indices, if the spacing is equal or lower than the block size B; - first blocks of size B that each includes B butterfly operations that are sequential by butterfly indices, if the spacing is greater than the block size B.

[0122] The present method(s) can be carried out by a computing device. This computing device may be implemented with hardware and software. It may include: - at least one processor, - a memory or storage system, that may include one or more memories (e.g., Read Only Memory (ROM), Read Access Memory (RAM), volatile memory, non-volatile memory, etc.), - a random number generator for generating the random masks and / or masking exponents, - a cryptographic module for executing one or more cryptographic operations.

[0123] The present disclosure also concerns: - a computing device configured to perform the steps of the method previously defined; - a computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out the steps of the method previously defined; and - a computer-readable medium comprising instructions which, when executed by a computer, cause the computer to carry out the steps of the method previously defined.

[0124] The efficiency of the blinded NTT or INTT comes from the following points: - The randomness inside the NTT makes it significantly harder from a practical side-channel perspective, though not impossible to identify the underlying targeted operations within the NTT and compute templates. - The masks of each butterfly are randomly sampled at each step of the NTT, rendering the link between the different part of the NTT more complex. - Finally, let’s how the convergence of the BP algorithm can worsened, when used on our NTT. - The function ^^^^^^no longer links xs to ys in a one-to-one manner and is in fact a surjection (It is exactly 221^^^^ 1). It is of the following form: ^^^^^^(^^^^ , ^^^^+^^ , ^^^^ , ^^^^+^^, ^^, ^^, ^^) = 1 ^^^^ 0 ^^^^^^ℎ

[0125] This therefore heavily tempers the propagation in the BP algorithm. Furthermore, we have that our different masks create numerous additional loops inside the factor graph that represent our NTT. Indeed, each twiddle values are linked to 3^^ distinct functions, that occurs prior, after, and concurrently in our NTT. Those additional links induce a more volatile propagation which further tempers the convergence of the BP algorithm.

[0126] Furthermore, the mask NTT has an interesting property, namely that it enables a more compact ML-DSA. This comes from the fact that the blinded NTT can be performed completely (as it is the case in ML-DSA) or incompletely (meaning that the last step is not performed, as in ML-KEM, a case that requires a slightly modified pointwise multiplication). It occurs that multiplying with the blinded NTT is more efficient when performed incompletely (saving 256 modular multiplications) but this also induce that we require to precompute only half of the roots of unity. In the case of ML-DSA, this induces a compactification by more than 1kB (a 5% improvement).

[0127] The solution has excellent properties, and its efficiency is almost independent from the block size. More specifically, apart from the randomnessgeneration, the computations are performed with an efficiency that differs only slightly on the block size. In general, the NTT is only two times slower than an unprotected NTT, independently of the block size.

[0128] FINAL CONSIDERATIONS

[0129] Although an overview of the inventive subject matter has been described with reference to specific example embodiments, various modifications and changes may be made to these embodiments without departing from the broader spirit and scope of embodiments of the present invention. For example, various embodiments of features thereof may be mixed and matched or made optional by a person of ordinary skill in the art. Therefore, the Detailed Description is not to be taken in a limiting sense, and the scope of various embodiments is defined only by the appended claims, along with the full range of equivalents to which such claims are entitled.

Claims

CLAIMS 1. A method for executing a cryptographic operation including a Number Theoretic Transform, NTT, computation that transforms at least one polynomial with N coefficients from a time-domain representation to a frequency-domain representation, wherein - the NTT computation is divided into successive stages of butterfly operations that combine coefficients, starting from the N coefficients of the polynomial, up to N transformed coefficients; and - during each stage, each butterfly operation combines a pair of coefficients among the N coefficients, using a NTT twiddle factor to progressively transform the pair of coefficients and uses a set of mask-related twiddle factors in such a way that, during all intermediate stages of the NTT computation, the coefficients of each pair of coefficients combined within a butterfly operation are masked with: - two respective input masks, independent from one another, in input of the butterfly operation; - a same output mask in output of the butterfly operation, independent from said two input masks, the set of mask-related twiddle factors being based on the two input masks and on the output mask wherein the butterfly operations are grouped into blocks of at least two butterfly operations where all the butterfly operations within a same block have a same combination of masks in input and output at each stage of the NTT computation.

2. The method according to claim 1, wherein the NTT and mask-related twiddle factors are used as multiplication factors to multiply with the coefficients.

3. The method according to claim 2, wherein, the N coefficients of the at least one polynomial belonging to an integer ringrepresenting the integers modulo q, each NTT twiddle factor used in a butterfly operation is a primitive N-th root of unity ^ modulo q raised by an exponent ^^, and said NTT twiddlefactor ^^^belongs to the integer ring ℤ^^and changes according to the stage of the NTT computation and indices of the coefficients combined within the butterfly operation.

4. The method according to claim 3, wherein each mask of the two input masks and output mask is the primitive N-th root of unity ^^ raised by anexponent, and is a random or pseudo-random element within theinteger ring5. The method according to claim 4, wherein, in a butterfly operation of anintermediate stage of the NTT computation, ^^, ^^ being the exponents of the twoinput masks and ^^ being the exponent of the output mask, the butterfly operation uses two mask-related twiddle factors ^^^^−^^and ^^^^−^^so as to multiply one coefficient of the pair of coefficients by a factor ^^^^−^^and the other coefficient of the pair of coefficients by another factor ^^^^+^^−^^.

6. The method according to claim 5, wherein the butterfly operation includes: - a first multiplication of one coefficient of the pair of coefficients by the factor- a second multiplication of the other coefficient of the pair of coefficients by the other factor ^^^^+^^−^^to obtain T2; - an addition of T1 and T2; - a subtraction of T2 from T1.

7. The method according to any of claims 1 to 6, wherein a spacing between the coefficients combined within a butterfly operation during a given stage being divided by a factor 2 during the next stage, the NTT computation uses: - first blocks of size B that each includes B butterfly operations that are sequential by butterfly indices, if the spacing is greater than the block size B; - second blocks of size B that each includes B butterfly operations that are not sequential by butterfly indices, if the spacing is equal or lower than the block size B.

8. The method according to any of claims 1 to 7, wherein, at the first stage of the NTT computation, the coefficients of each pair of coefficients combined within a butterfly operation are unmasked in input and masked with a same mask in output.

9. The method according to any of claims 1 to 8, wherein, at the last stage of the NTT computation, the coefficients of each pair of coefficients combined within a butterfly operation are masked in input with two respective masks, independent from one another, and unmasked in output.

10. The method according to any of claims 3 to 9, when dependent on claim 3, wherein q is a prime number or an integer such that a primitive N-th root of unity exists11. A method for executing a cryptographic operation including an Inverse Number Theoretic Transform, INTT, computation that transforms at least one polynomial with N coefficients from a frequency-domain representation to a time-domain representation, wherein - the INTT computation is divided into successive stages of butterfly operations that progressively combine coefficients, starting from the N coefficients in the frequency domain, up to N transformed coefficients in the time domain; and - during each stage, each butterfly operation combines a pair of coefficients using a INTT twiddle factor to progressively transform the coefficients and uses a set of mask-related twiddle factors in such a way that, during all intermediate stages of the NTT computation, the coefficients of each pair of coefficients combined within a butterfly operation are masked with: - a same input mask in input of the butterfly operation; - two respective output masks, independent from one another and from the input mask, in output of the butterfly operation; the set of mask-related twiddle factors being based on the input mask and the two output masks wherein the butterfly operations are grouped into blocks of at least two butterfly operations where all the butterfly operations within a same block have a samecombination of masks in input and output at each stage of the INTT computation.

12. The method according to claim 11, wherein a spacing between the coefficients combined within a butterfly operation during a given stage being multiplied by a factor 2 during the next stage, the INTT computation uses: - second blocks of size B that each includes B butterfly operations that are not sequential by butterfly indices, if the spacing is equal or lower than the block size B; - first blocks of size B that each includes B butterfly operations that are sequential by butterfly indices, if the spacing is greater than the block size B.

13. A device comprising means for carrying out the steps of a method according to any of claims 1 to 12.

14. A computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out steps of a method according to any of claims 1 to 12.

15. A computer-readable medium comprising instructions which, when executed by a computer, cause the computer to carry out the steps of a method according to any claims 1 to 12.

Images