Detection of fault attacks

Abstract

A method is provided for detecting a fault attack when performing a process including a plurality of operations. The method comprises identifying a group of operations selected from the plurality of operations and performing operations from the group of operations in a random order such that each operation is repeated n times where n is less than or equal to a security parameter corresponding to a maximum number of potential fault attacks. The results of the n repetitions of each operation are compared to determine whether the output value of each repetition of the operation is the same. In a case that the output value of each repetition is not the same an action to record or mitigate a fault attack is performed.

Description

[0001] DETECTION OF FAULT ATTACKS

[0002] Technical Field

[0003] The present invention relates to method for detection of fault attacks. The invention also relates to an information processing apparatus and a program for performing such methods.

[0004] Hash-based signatures base their security on the hardness of finding collisions or preimages for hash functions. The security assumptions for hash-based signatures are considered to be favourable and are relatively easy to analyse.

[0005] Lamport proposed the first hash-based signature, which could only sign a single message before the key needed to be refreshed. Developments since then can be classified as stateful and state-less constructions. Stateful signatures, introduced by Merkle in 1990, require the signer to maintain a record of its used keys (and to not reuse the keys). Such a requirement may cause operational problems, such as when the key is used by multiple servers, which then need to be kept in sync. More recently, stateless signature schemes have been proposed such as SPHINCS that was proposed in response to NIST’s call for post-quantum cryptographic schemes.

[0006] Hash functions can be implemented efficiently on constrained devices and several implementations on micro-controllers have been proposed, including an implementation of SPHINCS. However, embedded devices are known to be sensitive to physical attacks including fault attacks. In a fault attack, an attacker can corrupt an internal state of an algorithm during execution, such as by attacking with lasers or electromagnetic stimulation.

[0007] It has been shown in ‘Grafting Trees: A Fault Attack Against the SPHINCS Framework’, Castelnovi et al, PQCrypto 2018, and ‘On Protecting SPHINCS+ Against Fault Attacks’, Genet, IACR 2023 that fault attacks are particularly effective against hash-based signature schemes such as SPHINCS. However, fault attacks may be used against many types of cryptographic techniques and are not limited to hash-based algorithms. Accordingly, techniques for detecting fault attacks to allow mitigating steps to be taken are desired.

[0008] Summary

[0009] According to a first aspect of the present invention, there is provided a method performed by an information processing apparatus for detecting a fault attack when performing a process including a plurality of operations, comprising: identifying a group of operations selected from the plurality of operations, performing operations from the group of operations in a random order such that each operation is repeated n times where n is less than or equal to a defined security parameter corresponding to a maximum number of potential fault attacks; and comparing the results of the n repetitions of each operation to determine whether the output value of each repetition of the operation is the same; in a case that the output value of each repetition is not the same performing an action to record or mitigate a fault attack.

[0010] The action to record or mitigate the fault attack may comprise one of interrupting operation of the information processing apparatus, resetting the information processing apparatus, and recording the case that the output value of each repetition is not the same in a log file.

[0011] Some implementations further comprise adding one or more dummy operations to the group of operations, wherein the dummy operation does not form part of the process being performed by the information processing apparatus. In such implementations the method may comprise adding dummy operations to the group of operations until a second security parameter corresponding to the success probability for attacking the group of operations reaches a predetermined value.

[0012] All operations in the group of operations may be of a same type of operation having a same format of input and output values.

[0013] The group of operations may be identified such that inputs for all of the operations are available without dependency upon previous completion of any other operation in the group of operations.

[0014] Performing operations from the group in a random order may comprise identifying instances of the operations from the group, whereby each instance of an operation is one of the n repetitions of the operation, and performing the instances in a random order.

[0015] The process may include operations relating to a tree structure, wherein the group of operations corresponds to operations relating to a layer of the tree structure. In a case that the process includes a plurality of tree structures, the group of operations may correspond to operations in corresponding layers of the plurality of tree structures.

[0016] In a case that a number of the plurality of operations that can be included in the group of operations is larger than a threshold value, the method may comprise forming two or more groups of operations.

[0017] In some examples, the method may further comprise forming a second group of operations from the plurality of operations and performing operations from the second group of operations such that each operation is repeated r times where r is equal at least one greater than the defined security parameter.

[0018] In a case that the process is a SLH-DSA signature process, separate groups of operations may be formed for each of operations relating to a pseudo-random function, and each type of hash function that takes different a different format of input. In such cases, the plurality of operations may be performed in an order of the following operations defined in SLH-DSA: PRF, then hash function F, then hash function Ti, then hash function H, and then hash function Tk.

[0019] According to a second aspect of the invention there is provided an information processing apparatus configured to perform a method according to the first aspect of the invention.

[0020] According to a third aspect of the invention there is provided a program that, when performed by an information processing apparatus, causes the information processing apparatus to perform a method according to the first aspect of the invention.

[0021] Further features and advantages of the invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, which is made with reference to the accompanying drawings.

[0022] Figure 1 is a schematic flow diagram illustrating a process for detecting fault injection attacks; Figure 2 shows Merkle trees for use in FORS signatures;

[0023] Figure 3 is a schematic diagram showing the hash chains for creating a WOTS+ signature;

[0024] Figure 4 illustrates a Merkle tree;

[0025] Figure 5 is a figure that illustrates the SLH - DSA signature scheme; and

[0026] Figure 6 is a schematic diagram showing hardware of an information processing apparatus

[0027] Detailed

[0028] Techniques will now be described for mitigating fault-based attacks on hardware for processing data.

[0029] Side-channel attacks are a potentially powerful way to attack cryptographic and other devices. Side-channel attacks exploit information that is leaked by a device to obtain secret information. For example, differential power analysis may measure power consumption of a device and use statistical methods to extract a secret key. Other approaches may examine electromagnetic emissions, timing information, or even sound emissions. In addition to passive attacks, which do not conspicuously interfere with the device under attack, active attacks may apply external or internal changes, such as temperature changes or interfering with the power supply. Optical fault injection attacks may use a light beam (such as a laser) to inject faults into semiconductor devices. Similarly, electromagnetic fault attacks may attempt to induce faults by inducing currents in the device using electromagnetic stimulus.

[0030] While fault injections attacks may not be preventable, countermeasures may be taken if an attack can be detected. For example, operation of the device may be halted / interrupted, an output from the device may be cancelled, a hardware reset may be implemented, etc.

[0031] One technique for detecting fault injection attacks is to cause a device performing a deterministic process to repeat the process two or more times. The results of the process should be identical. Accordingly, if the results don’t match a fault injection attack may have occurred.

[0032] Figure 1 is a schematic flow illustrating a process for detecting fault injection attacks. Input data, P, is repeatedly input to an algorithm 10. The results of the algorithm are shown as Ci, C2, C3 ... Cr. At step 11, a check is performed to see if all the results are equal to each other.

[0033] In order for an attacker to defeat this fault-injection attack detection method, the same fault needs to be injected into an operation of each of the duplicate executions of the algorithm. By repeating the algorithm more times, successful attacks are made more difficult and higher levels of security may be obtained. In general, if an algorithm / operation is repeated r + 1 times, even in the worst case, the device will be able to identify r faults being injected because the attacker cannot inject enough faults to cause all the process executions to arrive at the same (manipulated) results.

[0034] The following description will describe techniques for improving the detection of fault injection attacks. The description will refer to specific examples of cryptographic algorithms to illustrate the techniques. However, it will be appreciated that the techniques described below are applicable across a wide range of processes (including cryptographic and other processes).

[0035] First embodiment

[0036] Description of SLH - DSA

[0037] SLH-DSA is a known stateless hash-based digital signature scheme. For example, it is described in Federal Information Processing Standards Publication (FIPS 205). Accordingly, a brief overview to aid understanding is provided here. Further implementation details are publicly available.

[0038] SLH-DSA is a digital signature scheme that allows the generation of signatures and the verification of those signatures.

[0039] The SLH-DSA scheme is constructed from other hash-based signature schemes as components. In particular, the scheme uses forest of random subsets (FORS) which is a few-time signature scheme and extended Merkle Signature Scheme (XMSS) which is a multi -time signature scheme. The XMSS scheme is constructed using Wintemitz one-time signature plus (WOTS+) as a component. Each of these components will now be described before describing the scheme as a whole.

[0040] Forest of Random Subsets (FORS) is a few-time signature scheme that is used to sign digests of actual messages in SLH-DSA. The security of FORS degrades gradually as the number of signatures made using a FORS key increases. FORS involves two parameters: a number of Merkle trees, k, and a number of n-byte strings on the base of each Merkle Tree. The tree has a height a and t leaves at the base, t = 2“. Two example Merkle trees are illustrated in Figure 2. The Merkle trees shown in Figure 2 have a height of three, but in practice the trees may have different heights.

[0041] The strings at the base of each tree (illustrated by a circle in Figure 2) are generated using a pseudorandom function, a public seed value, a private seed value, and the address of the position within the tree. The values at the base of each tree are hashed together to form a Merkle tree with a root value. A hash function H that takes two inputs and the address of the node is used to generate the Merkle tree.

[0042] In order to generate a signature, a function splits a message digest, md. into k lengths of a bits. Each group of a bits is interpreted as an integer and used to select an integer value between 0 and M. The integer is used to identify a secret value that is a leaf of one of the k Merkle trees. For each secret value selected, an authentication path through the Merkle tree is computed and added to the signature.

[0043] With reference to the top of Figure 2, in an example, the a bits ‘100’ are being encoded. The circles indicate values of a Merkle tree with secret values on the bottom of the tree and hash values up the tree with lines indicating the values that are hashed together. It is noted that the hash values are generated using a hash function H, which takes a public seed, the address, and the values being hashed as inputs. At the top of each tree is a root value. The root values for trees ro and n are illustrated in Figure 2, but as described above, k Merkle trees are present in practice. The a bits ‘ 100’ in this example are interpreted as the integer ‘four’. The fourth secret value 20, starting from a left-most position of zero, is shown in black in the upper part of Figure 2. The authentication path is formed of the fourth secret value and hash values shown in grey in the Merkle tree. These hash values are added to the signature.

[0044] The lower part of Figure 2 shows a second example in which the a bits are ‘010’. These bits are interpreted as the value 2. The second secret value 21, starting from a left-most position of 2, is shown in black in the lower part of Figure 2. Again, the authentication path is formed of the second secret value and hash values shown in grey in the Merkle tree. These hash values are added to the signature. This process is repeated to encode all of the k a-bit portions of the message digest into the signature. Verifying a FORS signature involves computing a public-key value from a message digest value and a signature value. The public-key value is a concatenation of the roots of the k Merkle trees. Verification is successful if the correct public-key value can be computed starting from the message digest and the signature. The message digest is split into k o-bi t strings in the same manner as during the signing process. As before the o-bit strings are interpreted as an integer that provides the address. The process for each Merkle tree, begins by computing the leaf of the Merkle tree at the determined address from the o-bit string using the secret value included in the signature. The secret value is hashed with the values on the authentication path using the hash function F, the relevant addresses, and the public seed value to recreate the root value (Ro, Ri, etc.). The recreated root values can be compared with the public key.

[0045] Wintemitz one-time signature plus (WOTS+) signatures are one-time signatures. The WOTS+ signature uses hash chains to encode bit information. A security parameter n is a length of messages that may be signed. In some implementations, n may be 16, 24, or 32. A second parameter, Zgw, indicates a number of bits encoded by each hash chain that is used.

[0046] A WOTS+ private key consists of len secret values of length n. These may be generated using a seed and a pseudorandom function. Hash chains are the created from the secret values by using a chaining function that creates the hash chain (formed by sequentially hashing values). The chains have length, w, and the last values in the chain are public values.

[0047] To generate a signature, the message to be signed is first converted into an array of base-vi’ integers. A checksum for this string of integers is calculated and converted into further base-w integers. Each base-w integer is assigned a respective chain and the hash value in the chain corresponding to the base-w integer forms part of the signature. Accordingly, the signature is the hashes from the hash chains corresponding to the base- w integer representing the message to be signed and checksum.

[0048] Figure 3 is a schematic diagram showing the hash chains for creating a WOTS+ signature. Vertically there are shown I hash chains. At the start of each hash chain is a secret value S (Si, S2, etc.). As explained above, the hash chains have length, w, and the final values are public values P. The intermediate locations on the chain are associated with integer values, such that the base-w integers correspond to a value in the hash chain. These values from the hash chain are included in the WOTS+ signature.

[0049] To verify the signature, the public values, P, are recreated from the signature. The number of times that the hash values in the signature need to be hashed to recreate the public value indicates their position in the hash chain. Accordingly, the signed integers, which correspond to positions in the hash chain, may be recovered. The checks include checking hash values corresponding to the check-sum value to recover the check sum and checking that the check-sum corresponds to the recovered integer values.

[0050] The extended Merkle Signature Scheme extends the WOTS+ signature scheme into one that can sign multiple messages.

[0051] To sign more than one message an option is to provide multiple WOTS+ public keys and select a key each time for the signature. To achieve this the XMSS signature scheme is based around the idea of Merkle trees for which the leaves (bottom row) are a set of WOTS+ public keys. It is recalled that the public keys in the WOTS+ signature scheme are the last values in the hash chains. The secret keys corresponding to each public key are available to the signer, but do not form part of the Merkle tree.

[0052] Figure 4 illustrates a simple Merkle tree that illustrates the basic concepts. A description of an extension to hypertrees will follow. The base of the tree is formed of WOTS+ public keys (wpo to wp?). Pairs of nodes are then hashed to form a Merkle tree with a root value, r, at the top.

[0053] The signature of a message comprises a WOTS+ signature formed using the WOTS+ secret keys corresponding to the public key at a selected leaf node of the Merkle tree along with an indication of the relevant node of the Merkle tree that contains the corresponding public key. The signature further includes the authentication path up to the root node which, as before, is a set of sufficient nodes to compute the root of the tree starting from the public key of the selected leaf node.

[0054] Verification of the signature is performed by checking the WOTS+ signature against the public key at the indicated node of the Merkle tree. The authentication path can then be checked to make sure that the public key was a part of the originally formed Merkle tree. A drawback of the method described so far is that in order to allow a large number of signatures to be performed without generating anew Merkle tree, the Merkle tree needs to be very large. As the size of the Merkle tree increases, the size of the authentication path grows rendering the method inefficient.

[0055] A solution to this is to use a hypertree. Figure 5 is a figure that gives an overview of SLH - DSA. Looking just at the three interconnected trees shown in Figure 5, the root of one tree (public value) is signed using the private WOTS+ key corresponding to the public key in the next tree above. Using such a construction brings the size of the trees down avoiding a need to explore all branches of a very large Merkle tree to produce a valid authentication path. The root of the highest layer tree of the hypertree represents the public key of the SLH-DSA scheme.

[0056] Looking at SLH-DSA in total, the SLH-DSA private key contains a secret seed value and a secret PRF key. The public key consists of a public seed and the root of the hypertree. A signature is created by hashing the message, using part of the message digest to select a FORS key, signing other bits from the message digest with the FORS key, and generating an XMSS signature for the FORS key.

[0057] Signature verification involves hashing the message to generate a message digest, extracting the FORS key from the bits of the message digest, checking the FORS key against the XMSS signature for the FORS key and checking the message signature using the FORS key.

[0058] Functions used in SLH-DSA include:

[0059] Hash function, H, which takes two inputs and one address (for use in generating a Merkle Tree),

[0060] Hash function, F, which takes one input and one address (for use at the beginning of FORS and WOTS+),

[0061] Pseudorandom function, PRF, which takes a seed, and

[0062] Hash function, Tk, which takes k inputs and one address.

[0063] Description of steps to mitigate fault injection attacks

[0064] The following techniques are based on the following assumptions, which are believed to correspond to reasonable assumptions for practical applications:

[0065] Probability of hash collisions is negligible An atacker can distinguish operations but not operands

[0066] The atacker cannot fault any comparison

[0067] The atacker can inject several faults, the number of faults being a security parameter, r.

[0068] The first assumption is a common assumption about the properties of hash functions.

[0069] The second assumption is likely to be true in practice because of the limitations of side-channel atacks. Typically, a particular process may generate a timing or electromagnetic signature but the same operation performed with a different value / operand is likely to be very similar in terms of its timing or electromagnetic signature and difficult to distinguish.

[0070] The third assumption needs some care and security measures may be designed into a particular device to allow comparisons to be protected from fault injection atacks.

[0071] The fourth assumption is flexible and characterises the strength of an attacker.

[0072] As discussed in connection with Figure 1, an approach to identifying fault injection atacks is to repeat a process for which fault injection atacks are to be detected r times in order to detect whether or not the process has been tampered with. As noted above, in theory this should be guaranteed to detect a fault-injection attack as long as there are r - 1 or fewer faults injected.

[0073] The following methods include, for at least some of the calculations, repetition of a process or algorithm n < r times on the same input, but with the repetitions being performed in a random order with respect to other operations on different values. The outcome of the n repetitions is compared. If the outcomes of the n repetitions do not equal each other, a possible fault injection attack has been detected.

[0074] By repeating the operations and performing them in a random order with respect to other operations, it is difficult for the attacker to target the same operation in each repetition such that a comparison generates the same result. It is noted that this approach does not guarantee that there has been no fault injection attack. However, if a large enough selection of operations are randomly performed, the probability of a fault injection atack can be controlled to an acceptably low level. This approach comes with some memory overhead, as will be described further below, but may save processing time and / or surface on a processing device such as a processor.

[0075] When executing SLH-DSA on a processing element, there are a number of operations that are performed repeatedly on different data. For example, the pseudo random function, PRF, is used to generate many secret values in the WOTS+ and FORS private keys based on the public seed, secret seed, and address. Several hash functions, such as hash functions F and H, are used to generate the WOTS+ chains and the values of the Merkle trees within the hypertrees.

[0076] For example, as shown in Figure 5, at each layer of each tree in the SLH-DSA hypertree, there are a set of hash operations that are possible to compute to generate the next layer. As indicated above, these operations are repeated a number of times (up to a desired level of a security parameter, r-7).

[0077] The method may comprise identifying a group of operations to perform in a random order. The operations should preferably be operations of the same type so that an attacker is not able to distinguish between the operations. In some examples, the group of operations may relate to generation of a tree structure, such as the described Merkle trees. For example, groups of operations may be formed corresponding to each layer of the tree structure. The operations may, for example, be the hashing of pairs of hash values at the current layer of the tree structure to generate hash values for the next layer up on the tree structure.

[0078] In a case where operations are grouped by layer of the tree structure, in cases where the tree structure is large, lower layers may be divided into more than one group to reduce maximum memory requirements. In some implementations, if there are more than a threshold number of available operations that may be performed, the available operations may be divided into two or more groups of operations. In such implementations, it is only the operations within each group that have the order of execution randomized. The groups of operations may be performed sequentially.

[0079] The operations within the group of operations are performed in a random order. Accordingly, it is desirable that the values required for each of the operations within a group of operations is available and that there are no dependencies within the group of operations. In the example of hash-based signature involving hyper-trees, such as SLH- DSA described above, each tree of the hyper-tree may be processed independently. In such cases, it is possible to form one or more groups of operations from the layers of the plurality of trees thereby allowing a larger number of available operations for randomized performance.

[0080] A group of operations may be augmented to include one or more dummy operations, which are operations of the same type as the other operations in the group. The dummy operations are generated using random or otherwise selected variables. The result of performing a dummy operation is not required for the overall process being performed (e.g. generation of a signature, encryption of a value, etc.).

[0081] In some examples, the introduction of dummy operations may be performed when a group of operations to be randomly ordered is not large enough to meet a security requirement. For example, if operations are grouped by layer in a tree structure, the upper layers of the tree structure will have fewer operations. Accordingly, further operations could be introduced to increase the size of the group of operations being randomized.

[0082] In principle, dummy operations can be introduced to a group of operations relating to a lower layer of a tree structure (i.e. operations to generate the next layer of the tree structure). However, doing so will tend to increase the maximum memory requirement for performing the operation. In contrast, a group of operations relating to a higher layer of a tree structure will include fewer operations and so adding dummy operations to groups of operations relating to higher layers of a tree structure is less likely to increase the maximum memory requirement for performing the operation.

[0083] The described method provides security by making it difficult for an attacker that cannot distinguish operations by their operands to consistently target the same operand and thereby thwart the comparison check following repetition of the operations to check that a same output has been obtained.

[0084] The order in which the operations is performed may be determined in accordance with numbers derived from a randomness source, such as a deterministic random bit generator (DRBG).

[0085] A second security parameter, prob, may be selected that corresponds to a minimum probability that an attacker could repeatedly hit the same operation by performing random fault injection atacks (i.e. oblivious to the operands of the operation). The number of dummy operations added to a group of operations to be repeated in random order may be selected to meet this security parameter. If P is the number of operations in a group, n is the number of times each operation is repeated, and b is the number of dummy operations the success probability for atacking a single group of operations is:

[0086] In a case where there are multiple groups of operations, the probability of atacker success is the maximum of the determined probabilities, prob.

[0087] In some implementations n may be selected to be equal to the first security parameter r-1. However, in other implementations, n may be lower than this such as r - 2. Here is it noted that having a higher number of fault injection atacks than the number of repetitions increases the chance of hitting the same operation, but also increases the chance of disrupting other operations such that the comparison check will still fail and the atack will be detected.

[0088] In some embodiments, rather than adding dummy operations, operations in a group of operations may be repeated r times in a case that the group of operations is too small. This recreates the method described with respect to Figure 1. Accordingly, some implementations may combine the randomization approach described herein with the approach described above in connection with Figure 1. The randomization approach may be selected in instances where a group of operations of a same type for which data is available to perform the calculation is large enough to meet a minimum level of security required by the security parameter or is above a predetermined threshold.

[0089] As noted above, each operation should be repeated n times and then the results compared to one-another to detect fault-injection atacks. However, the operations within a group of operations do not need to be performed in rounds (i.e. all operations are performed once in a first round and then all operations are performed a second time in a second round etc.). Accordingly, instances of the operations that need to be performed across all of the repetitions, may be included in one or more groups and performed in a random order.

[0090] The methods above typically repeat each operation n times where n is greater than or equal to two. However, in the case of a single performance of each operation, it is noted that while randomizing the order of operations does not provide a benefit, the presence of dummy operations will increase security because fault injection attacks performed on a dummy operation do not affect the outcome of the overall process being performed. Accordingly, in examples where hardware resources are not constrained, a large number of dummy operations may be employed which make it increasingly likely that a fault-injection attack with impact a dummy operation and the attacks will therefore be unsuccessful.

[0091] In connection with SLH-DSA, it has been noted that an ordering for performing groups of operations can be identified to allow all groups to be performed without encountering dependency problems. For SLH-DSA, groups of operations may be sequentially formed to perform operations relating to the PRF, then hash function F, then hash function Ti, then hash function H, and then hash function Tk. For example, operations using hash function F can be grouped to include both F hash operations associated with FORS and F hash operations associated with WOTS+. In accordance with the explanation above, each operation type has different groups of operations formed because the operations within each group should be indistinguishable. It is noted that hash function T appears in this list twice because it takes two different lengths of input. As these differing inputs may be detectable by an attacker, the hash operation T is treated as two different operations for present purposes.

[0092] The fault-injection attack countermeasure for detecting an attack may be applied to any process performed by an information processing apparatus. In the example of a signature scheme, such as SLH-DSA described above, the method may preferably be performed in connection with the generation of the signature. In other implementations, the fault-injection countermeasure may also be applied when verifying the signature.

[0093] The described methods tend to save processing time but may increase memory. The time saving is due to the reduction in the number of repetitions required compared to the method described with respect to Figure 1. However, to be able to select a random order for the operations within a group of operations, additional memory is typically required to keep track of the processing order, store the variables etc. Implementations that introduce dummy operations will incur an increase in processing time due to the need to carry out the dummy operations.

[0094] If a fault injection attack is detected using the techniques described above, an information processing apparatus may perform a counter measure. Examples of counter measures include halting or interrupting operation of the information processing apparatus, cancelling an output from the information processing apparatus, or performing a hardware reset of the information processing apparatus. In such implementations or in cases where no other countermeasure is taken, the information processing apparatus may record an identified fault attack in a log.

[0095] Number Theoretic Transform

[0096] The ideas so far have been described in connection with hash-based signature schemes, such as SLH-DSA. However, they are of broader application to operations included in a process that should not be corrupted by a fault-injection attack. The random order of performance of operations within a group of operations means that the techniques are most readily applied to situations in which the same type operation is already performed multiple times in a process, so that the order of performance of the operations can be randomly selected making it more difficult for an attack to avoid detection.

[0097] Number Theoretic Transform is a technique that has application in cryptography. For example, several promising post-quantum cryptography schemes are based on lattices and the assumed hardness of the learning with errors (LWE) problem and related problems such as Ring-Learning with errors (RLWE) and Module-learning with errors (ML WE).

[0098] A time-consuming part of many lattice-based schemes is matrix multiplication over a field. Number Theoretic Transform combined with Fast Fourier Transform can provide an efficient method for computing polynomial multiplication of high degree.

[0099] The cyclic convolution-based number theoretic transform takes a length n and modulus q, where n is a power of two and q is a prime number satisfying q = l(mod ri). The number theoretic transform on a polynomial of form a = isdefined as:

[0100] The inverse number theoretic transform is defined as: where co is the n’th primitive root of unity.

[0101] Both linear and cyclic convolution-based polynomial multiplication can be performed using NTT. For example, c = a. b e 7Lq[%] / (%” — 1) c = lNTT(NTT(a) ° NTT b))

[0102] Further details of operations and tricks for accelerating NTT are given in ‘Number Theoretic Transform and Its Applications in Lattice-based Cryptosystems: A survey’ Liang et al, arXiv:2211.1354624 November 2022.

[0103] It is apparent that performing a number theoretic transform or an inverse number theoretic transform will require many multiplication operations. To detect faultinjection attacks attempting to disrupt those calculations the techniques described in connection with the first embodiment may be applied. For example, the operations in a transform or inverse transform may be repeated n times where n is a number equal to or less than a number of fault-injection attacks desired to be detectable. The outputs of the n repetitions may be compared to determine whether or not they are identical to determine whether there has been a fault injection attack. In some implementations, dummy operations may be introduced. Similar operations, such as multiplications, may be formed into groups and performed in a random order using the same techniques as described above in connection with SLH-DSA. Optionally, dummy operations may be added to increase the size of the group and increase the chance that a fault-injection attack hits a dummy operation that does not relate to the process being performed.

[0104] Hardware and software

[0105] Figure 6 is a schematic diagram showing hardware of an information processing apparatus 6. The information processing unit may comprise a processor 60, a storage 61, an I / O unit 62, a network unit 63, and a power unit 64. Other components may be present but not shown as is well known in the art. The processor 60 is configured to execute instructions and perform computations. The processor may include one or more of a central processing unit (CPU), a graphics processing unit (GPU) and a neural processing unit (NPU). The storage unit may include both volatile (RAM) and nonvolatile (ROM, SSD, HDD) memory components. The storage unit 61 may store both the instructions to be executed by the processor 60 and the data on which these instructions operate. The Input / Output Interfaces unit 62 allows the apparatus to communicate with external devices. Input interfaces may include components like a keyboard, mouse, or touchscreen for user interaction, while output interfaces may include a display, printer, or speakers. The network unit 63 may enable the apparatus to connect to networks (e.g., LAN, WAN, Wi-Fi, Bluetooth, etc.) for data exchange. The network unit 63 may include wired or wireless communication modules. The power unit 64 may provide the necessary power for all components of the apparatus. The power unit 64 may be connected to an external power source or include an internal battery for portable use.

[0106] Any of the steps of the described methods may be performed by computer- readable instructions of one or more programs stored in a non-transitory storage and executed by a processor on one or more information processing apparatuses.

[0107] The methods above may, in some implementations, be performed using application-specific hardware, such as dedicated circuitry. Alternatively, the information processing apparatus may comprise parallel processing capability for processing more than one operation at once. Performing operations from the group of operations in a random order may comprise at least one of performing the operations sequentially in a random order and performing the operations in parallel whereby the operations are assigned to different processing hardware within the information processing apparatus at random. Accordingly, the repetition of operations may be performed by repeatedly processing operations through parallel dedicated circuits. The order in which the operations are processed through the dedicated circuits or parallel processors may be determined based on a randomness source. Accordingly, the methods described above in which the operations are processed in a random order does not mean that the operations cannot be in part or completely processed in parallel.

[0108] The above embodiments are to be understood as illustrative examples of the invention. Further embodiments of the invention are envisaged. For example, while the invention has been described with reference to SLH-DSA and number theoretic transform, the methods described may also find application in other methods such as Keccak algorithm, parts of the AES block cipher and other algorithms.

[0109] It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. Furthermore, equivalents and modifications not described above may also be employed without departing from the scope of the invention, which is defined in the accompanying claims.

Claims

CLAIMS1. A method performed by an information processing apparatus for detecting a fault attack when performing a process including a plurality of operations, comprising: identifying a group of operations selected from the plurality of operations, performing operations from the group of operations in a random order such that each operation is repeated n times where n is less than or equal to a defined security parameter corresponding to a maximum number of potential fault attacks; and comparing the results of the n repetitions of each operation to determine whether the output value of each repetition of the operation is the same; in a case that the output value of each repetition is not the same performing an action to record or mitigate a fault attack.

2. A method according to claim 1 , wherein the action to record or mitigate the fault attack comprises one of interrupting operation of the information processing apparatus, resetting the information processing apparatus, and recording the case that the output value of each repetition is not the same in a log file.

3. A method according to any preceding claim further comprising adding one or more dummy operations to the group of operations, wherein the dummy operation does not form part of the process being performed by the information processing apparatus.

4. A method according to claim 3, wherein the method comprises adding dummy operations to the group of operations until a second security parameter corresponding to the success probability for attacking the group of operations reaches a predetermined value.

5. A method according to any preceding claim, wherein all operations in the group of operations are a same type of operation having a same format of input and output values.

6. A method according to any preceding claim wherein the group of operations is identified such that inputs for all of the operations are available without dependency upon previous completion of any other operation in the group of operations.

7. A method according to any preceding claim, wherein performing operations from the group in a random order comprises identifying instances of the operations from the group, whereby each instance of an operation is one of the n repetitions of the operation, and performing the instances in a random order.

8. A method according to any preceding claim, wherein the process includes operations relating to a tree structure, wherein the group of operations corresponds to operations relating to a layer of the tree structure.

9. A method according to claim 8, wherein the process includes a plurality of tree structures and the group of operations corresponds to operations in corresponding layers of the plurality of tree structures.

10. A method according to any preceding claim wherein in a case that a number of the plurality of operations that can be included in the group of operations is larger than a threshold value, the method comprises forming two or more groups of operations.

11. A method according to any preceding claim further comprising forming a second group of operations from the plurality of operations and performing operations from the second group of operations such that each operation is repeated r times where r is equal at least one greater than the defined security parameter.

12. A method according to any preceding claim, wherein the process is a SLH-DSA signature process and the wherein separate groups of operations are formed for each of operations relating to a pseudo-random function, and each type of hash function that takes different a different format of input.

13. A method according to claim 12, wherein the plurality of operations are performed in an order of the following operations defined in SLH-DSA: PRF, then hash function F, then hash function Ti, then hash function H, and then hash function Tk.

14. A method according to any preceding claim, wherein performing operations from the group of operations in a random order comprises at least one of performing the operations sequentially in a random order and performing the operations in parallel whereby the operations are assigned to different processing hardware within the information processing apparatus at random.

14. An information processing apparatus configured to perform a method according to any preceding claim.

15. A program that, when performed by an information processing apparatus, causes the information processing apparatus to perform a method according to any of claims 1 to 13.

Images