Information processing device, masking product calculation method, and program

Abstract

This information processing device calculates a masking product of a first polynomial and a second polynomial on a residue class ring of an L-th order polynomial, the information processing device comprising a calculation unit that: for each division element, performs inter-component multiplication between a vector holding a coefficient of the first polynomial and a vector holding a coefficient of the second polynomial, thereby acquiring a (2 (L-1) +1)-th order vector holding a coefficient of a polynomial resulting from the multiplication; and, for each division element, converts the coefficient held in the (2 (L-1) +1)-th order vector into a coefficient of an (L-1)-th order polynomial.

Description

Information processing device, masking product calculation method, and program

[0001] This invention relates to a technique for calculating the product of partitioned polynomials over a quotient ring.

[0002] Masking implementations are known as countermeasures against implementation-based attacks called side-channel attacks, which involve physically observing hardware to obtain confidential internal information.

[0003] Currently, the most common masking implementation is the one defined as SNI security disclosed in Non-Patent Document 1, which guarantees security even if d pieces of information are taken by dividing the confidential information into d+1 parts.

[0004] In relation to the masking implementation described above, Non-Patent Document 2 discloses a masking function for multiplication.

[0005] Gilles Barthe, Sonia Belaid, Franois Dupressoir, Pierre-Alain Fouque, Benjamin Gregoire, Pierre-Yves Strub, Rebecca Zucchini, "Strong Non-Interference and Type-Directed Higher-Order Masking," CCS'16, October 24 - 28, 2016, Vienna, Austria"CryptoExperts / high-order-ecc-implementation"https: / / github.com / CryptoExperts / high-order-ecc-implementation

[0006] With the widespread use of IC cards and IoT devices, there are increasing opportunities to directly access encryption devices. To use encryption securely, measures are needed to prevent important information from being stolen through side-channel attacks. One basic measure is the masking implementation mentioned above.

[0007] Furthermore, with the current development of quantum computers, a new cryptographic scheme called post-quantum cryptography is being standardized, and these schemes often perform polynomial operations on quotient rings. Therefore, masking products on quotient rings become necessary.

[0008] This invention has been made in view of the above points, and aims to provide a technique for realizing a masking product on a quotient ring.

[0009] According to the disclosed technology, an information processing device is provided that calculates the masking product of a first polynomial and a second polynomial on the quotient ring of an L-degree polynomial, the device comprising: for each partitioning element, an operation unit that performs component multiplication between a vector holding the coefficients of the first polynomial and a vector holding the coefficients of the second polynomial to obtain a (2(L-1)+1)-dimensional vector holding the coefficients of the resulting polynomial; and for each partitioning element, an operation unit that converts the coefficients held in the (2(L-1)+1)-dimensional vector into the coefficients of an L-1 degree polynomial.

[0010] According to the disclosed technology, it becomes possible to implement a masking product on a quotient ring.

[0011] This figure shows an example configuration of the information processing device 100. This figure shows masked_FqL_mul. This figure shows halfmasked_FqL_mul. This figure shows a specific example of masked_FqL_mul. This figure shows an example of the hardware configuration of the device. This figure shows an example of the system configuration in an application example. This figure is for explaining the system's operation overview.

[0012] Hereinafter, embodiments of the present invention (this embodiment) will be described with reference to the drawings. The embodiments described below are merely examples, and the embodiments to which the present invention is applied are not limited to the embodiments described below.

[0013] (Example of the configuration of the information processing device 100) Among the operations used in cryptography, polynomial multiplication is frequently used. Therefore, in this embodiment, the information processing device 100 implements masking for multiplication on a residue ring by extending the conventional masking technique for multiplication.

[0014] FIG. 1 shows a configuration example of an information processing apparatus 100 used as a signature apparatus 100. As shown in FIG. 1, the information processing apparatus 100 includes an input unit 110, an arithmetic unit 120, an output unit 130, and a data storage unit 140.

[0015] Information (e.g., a divided vector) necessary for multiplication on a residue ring is input from the input unit 110. The arithmetic unit 120 performs a masking product by executing the processing of an algorithm described later. In the data storage unit 140, for example, a polynomial f for calculating a residue in advance is stored, and the arithmetic unit 120 reads out the polynomial from the data storage unit 140 and uses it for the calculation. The output unit 130 outputs the calculation result by the arithmetic unit 120.

[0016] Hereinafter, specific processing will be described.

[0017] (masked_FqL_mul) FIG. 2 shows an algorithm of masked_FqL_mul that performs an operation of a product on an enlarged body (a masking product on a residue ring). The algorithm corresponds to the procedure of the processing executed by the arithmetic unit 120. Hereinafter, the line numbers attached to the diagram of the algorithm will be described as step numbers.

[0018] X and Y in step 1 are input information to the function, respectively. X and Y are each Z ｑ , ｑ , ｑ The coefficients in the L - 1 degree polynomial (having L coefficients including constants) obtained by dividing [x] by the L degree polynomial f are taken as a vector (L - dimensional vector). L is an integer of 1 or more.

[0019] Z ｑ [x] is a polynomial ring (a set of polynomials) having elements of the finite field Z ｑ as coefficients. q is, for example, an integer of 1 or more. Here, "Z ｑ [x] is divided by the L degree polynomial f having elements of the finite field Z ｑ as coefficients, and the ring consisting of the set of "remainders" is called a residue ring, and is expressed as "Z ｑ [x] / f". "Z ｑ [x] / f" may be called the residue ring of the polynomial ring Z ｑ [x] by f. Also, "Z ｑThe expression "[x] / f" may also be called the quotient ring of f. In this embodiment, the quotient ring may also be called an extension field.

[0020] In step 1, Σ is X （ｉ） , Y （ｉ） This means that each of these represents an element (also an L-dimensional vector) obtained by dividing X and Y into d+1 parts. In step 2, Z represents the output information from the function, and Z = X × Y. （ｉ） These are the partitioning elements of Z.

[0021] In steps 3 to 5, the calculation unit 120 performs each T （ｉ） Initialize T. （ｉ） This is a "2(L-1)+1" dimensional vector of partition element i.

[0022] In the loop of i, j, and k in steps 6-13, SecMult((X[i]) in step 8 ０≦ｋ≦ｄ , (Y[j]) ０≦ｋ≦ｄ ) The calculation unit 120 safely multiplies the i-th component of X and the j-th component of Y for each k (partition element) of 0 ≤ k ≤ d. Since the i-th component of X and the j-th component of Y are each partitioned by d, the product of the components is calculated with the output still partitioned, as is the case with the existing SecMult function.

[0023] Step 10 T （ｋ） [i + j] = T （ｋ） [i + j] + Tmp ｋ Therefore, the calculation unit 120 is T （ｋ） The (i+j) component is Tmp ｋ Add it.

[0024] Next, we will explain the processing within the loops for i=2L-2 down to L do and for j=0 to do in steps 14-19.

[0025] T itself is a vector approximately twice the length of the original vectors being multiplied, and it stores the coefficients of the resulting polynomial. Specifically, the maximum x （Ｌ－１） ×x （Ｌ－１） x ２（Ｌ－１） The coefficients up to this point are stored in each T[i] in the order (0 ≤ i ≤ 2(L-1)).

[0026] Since this function calculates the product on the quotient ring, it is necessary to calculate coefficients up to degree L-1. Therefore, the calculation unit 120 performs step 16 and 17 "T （ｊ） [i - L = T] （ｊ） [i-L]+fe0T （ｊ） [i], T （ｊ） [i-L+fe]=T （ｊ） [i-L+fe]+feT （ｊ） [i] The degree of the multiplication result is x （Ｌ－１） Anything exceeding a certain threshold is modified by a polynomial relation that represents the remainder.

[0027] f = x ｎ When considering the quotient ring of ax + b, x in the polynomial that is the result of the above multiplication ｎ x ｎ By substituting -ax-b, we can obtain the remainder of the polynomial with respect to f (a polynomial up to degree L-1). That is, x ｎ The relationship x when ax + b = 0 ｎ Use the formula = -ax - b.

[0028] For example, "3x （ｎ＋３） ⇒3x ｎ ×x ３ ⇒3(-ax-b)x ３ ⇒ -3 (ax ４ +bx ３ It can be changed to something like this: )

[0029] Performing the above transformation will reliably reduce the degree by at least 1, so in the algorithm in Figure 2, by performing i sequentially from 2L-2 down to L, it is possible to transform into a polynomial of degree L-1. This calculation is performed for each partition element j.

[0030] In steps 20 to 24, the calculation unit 120 performs the calculation "Z （ｉ） [j] = T （ｉ） The coefficients in each dimension of each partition element are calculated using "[j] (mod q)". A more specific example of multiplication on the quotient ring will be explained in Figure 4, which will be described later.

[0031] (halfmasked_FqL_mul) Figure 3 shows the algorithm for halfmasked_FqL_mul, which performs a product operation on an extension field (masking product on a quotient ring). Here, we will explain the differences from masked_FqL_mul.

[0032] In the algorithm shown in Figure 3, the SecMult((X[i]) of the algorithm shown in Figure 2 ０≦ｋ≦ｄ , (Y[j]) ０≦ｋ≦ｄ The part ) is missing, T （ｋ） [i + j] = T （ｋ） [i + j] + Tmp ｋ However, T （ｋ） [i + j] = T （ｋ） [i+j]+X[i]Y （ｋ） It's set to [j].

[0033] The algorithm shown in Figure 3 is used when one of X and Y (specifically X) is publicly available information. Since X is not divided, no special calculations are required, and the process is as shown in Figure 3.

[0034] (masked_FqL_mul (Specific Example)) Figure 4 shows a more specific example of the masked_FqL_mul algorithm for performing product operations on extension fields (masked product on quotient rings). The example in Figure 4 is for the quotient ring Z ｑ [x] / (x Ｌ -ax ａ０ -bx ｂ０ The above shows the multiplication. The differences from the example in Figure 2 will be explained below.

[0035] The example shown in Figure 4 differs from the example in Figure 2 only in steps 16 and 17. In other words, in steps 16 and 17, "T （ｊ） [i-L+a0]=T （ｊ） [i-L+a0]+aT （ｊ） [i], T （ｊ） [i-L+b0]=T （ｊ） [i-L+b0]+bT （ｊ） Perform the calculation [i].

[0036] In the example in Figure 6, x Ｌ = ax ａ０ +bx ｂ０ Therefore, x in the multiplication resultＬ The order of degree above is changed to L-1 or lower.

[0037] For example, the coefficient in i = 2L - 2, that is, x in the result of multiplication. （２Ｌ－２） The coefficient of x is stored in T[2L-2]. Ｌ = ax ａ０ +bx ｂ０ By using the following relationship, the transformation can be performed as shown below.

[0038] T[2L-2]x （２Ｌ－２） ⇒T[2L-2]x Ｌ ×x （Ｌ－２） ⇒T [2L-2] (ax ａ０ +bx ｂ０ ) x （Ｌ－２） ⇒T [2L-2] (ax （ａ０＋Ｌ－２） +bx （ｂ０＋Ｌ－２） ) If we write the above with i = 2L - 2, then T[i]x ｉ ⇒T[i](ax （ｉ－Ｌ＋ａ０） +bx （ｉ－Ｌ＋ｂ０） )

[0039] Since the coefficient of the i-L+a0th degree in the multiplication result is stored in T[i-L+a0], by adding a×T[i] obtained in the above transformation to the original multiplication result T[i-L+a0], we can obtain the x of the polynomial in the quotient ring. （ｉ－Ｌ＋ａ０） The coefficients can be obtained. In the algorithm in Figure 6, the above process is performed for each partitioning element from the 2L-2 order to the L order. Note that by taking mod q in step 22, Z ｑ The coefficient shown above is obtained.

[0040] (Example Hardware Configuration) The information processing device 100 described in this embodiment can be realized, for example, by having a computer execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0041] In other words, the device can be realized by using hardware resources such as the CPU and memory built into a computer to execute a program corresponding to the processing performed by the device. The program can be recorded on a computer-readable recording medium (such as portable memory), saved, and distributed. It can also be provided via a network, such as the Internet or email.

[0042] Figure 5 shows an example of the hardware configuration of the computer described above. The computer in Figure 5 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., all of which are interconnected by bus B. The computer may also be equipped with a GPU.

[0043] The program that enables processing on the computer is provided on a recording medium 1001, such as a CD-ROM or memory card. When the recording medium 1001 containing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001; it may also be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files and data.

[0044] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when a program startup command is received. The CPU 1004 implements the functions related to the memory device 1003 according to the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) etc., based on a program. The input device 1007 consists of a keyboard and mouse, buttons, or a touch panel, etc., and is used to input various operation commands. The output device 1008 outputs the calculation results.

[0045] More specifically, in each algorithm, the vector or matrix is ​​stored, for example, in memory (which may also be called a storage unit), and the CPU (which may also be called an arithmetic unit) reads the values ​​of the vector (or matrix) from that memory to execute the processing described in each algorithm. If the calculation result is a vector (or matrix), that calculation result is stored in memory as a vector (or matrix).

[0046] (Effects of the technology according to the embodiment) As described above, the technology according to this embodiment makes it possible to implement masking of multiplication on a remainder ring. With this technology, multiplication operations can be performed with enhanced safety.

[0047] (Examples of application of the technology according to the embodiment) The application of the technology according to the present invention is not limited to a specific field, but for example, the technology according to the present invention can be used for the masking implementation of signature QR-UOV, which is a candidate for standardization by NIST in the United States. For example, the quotient ring Z ｑ [x] / (x Ｌ -fcx ｆｅ In multiplication on -fc0), if both inputs are secret information, the calculation can be performed using masked_FqL_mul as shown in Figure 2; if one of them is public information, the calculation can be performed using halfmasked_FqL_mul as shown in Figure 3.

[0048] (System Configuration and Operation in Application Example) Fig. 6 shows a configuration example of the system in the application example. As shown in Fig. 6, this system has an information processing device 100 (referred to here as a signature device 100) and a verification device 200 connected by a network 300.

[0049] Referring to the sequence diagram of Fig. 7, the operation outline of this system will be described. In S101 (Step 101), the signature device 100 generates a secret key and a public key. In S102, the signature device 100 generates a signature s using the message M and the secret key, and sends the message M, the signature s, and the public key to the verification device 200. The public key may be sent in advance. Both the secret key and the public key are matrices representing multivariate polynomials. Also, the signature device 100 executes processing while keeping the information divided. Further, the operations related to polynomials and matrices are operations on a residue ring.

[0050] The verification device calculates M from the public key and the signature s, and determines that the verification is successful if the calculated M matches the M received from the signature device 100.

[0051] In this embodiment, the signature device 100 performs key generation and signature generation while keeping the information divided based on the QR-UOV method. Since QR-UOV itself is a known technology, only an outline will be described here.

[0052] In key generation, the signature device 100 generates the following MF ｉ (i = 1,..., m) and MS as secret keys, and generates MP ｉ (i = 1,..., m) as public keys. m corresponds to the number of polynomials.

[0053] (1) Irreducible polynomial: f = x ｌ - ax ｉ - 1 (Note: l is the lowercase of L) W ∈ F ｑ ｌ×ｌ s.t. ∀g ∈ F ｑ [x] / (f), WΦ ｇ ｆ : Symmetric matrix (2) MF ｉ : block WΦ ｇ ｆ [[ID=3\6]] matrices (i = 1,..., m) MS: block Φ ｇｆ matrix (3) MP ｉ = MS Ｔ MF ｉ MS MP ｉ : block WΦ ｇ ｆ The matrices signature device 100 has s = (MS Ｔ ・MF・MS) －１ The signature s is generated by (M). This calculation is equivalent to solving a system of polynomials. The verification device 200 verifies whether M = MP(s) holds.

[0054] The following additional information is disclosed regarding the embodiments described above.

[0055] <Notes> (Note 1) An information processing device for calculating the masking product of a first polynomial and a second polynomial on the quotient ring of an L-degree polynomial, comprising: a memory; and at least one processor connected to the memory, wherein the processor obtains a (2(L-1)+1)-dimensional vector holding the coefficients of the polynomial, which is the result of multiplication, by performing component multiplication between a vector holding the coefficients of the first polynomial and a vector holding the coefficients of the second polynomial for each partition element, and converts the coefficients held in the (2(L-1)+1)-dimensional vector to the coefficients of an L-1 degree polynomial for each partition element. (Note 2) The information processing device according to Note 1, wherein the processor converts the coefficients held in the (2(L-1)+1)-dimensional vector to the coefficients of the L-1 degree polynomial using a relational expression when the L-degree polynomial = 0. (Note 3) The coefficients of the L-1 degree polynomial are in a finite field Z ｑIn the case of the above number, the processor obtains the coefficients of the final L-1 polynomial by taking the mod q of the coefficients obtained by the conversion, as described in Appendix 2. (Appendix 4) A masking product calculation method executed by an information processing device that calculates the masking product of a first polynomial and a second polynomial on the quotient ring of an L polynomial, comprising the steps of: for each partitioning element, performing component multiplication between a vector holding the coefficients of the first polynomial and a vector holding the coefficients of the second polynomial to obtain a (2(L-1)+1)-dimensional vector holding the coefficients of the polynomial resulting from the multiplication; and for each partitioning element, converting the coefficients held in the (2(L-1)+1)-dimensional vector into the coefficients of an L-1 polynomial. (Appendix 5) A non-temporary storage medium storing a program for causing a computer to function as an arithmetic unit in the information processing device described in any one of Appendix 1 to 3.

[0056] Although this embodiment has been described above, the present invention is not limited to this specific embodiment, and various modifications and changes are possible within the scope of the gist of the invention as described in the claims.

[0057] 100 Signature device, information processing device 110 Input unit 120 Calculation unit 130 Output unit 140 Data storage unit 200 Verification device 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input device 1008 Output device

Claims

1. An information processing device for calculating the masking product of a first polynomial and a second polynomial on the quotient ring of an L-degree polynomial, comprising: for each partitioning element, an operation unit that performs component multiplication between a vector holding the coefficients of the first polynomial and a vector holding the coefficients of the second polynomial to obtain a (2(L-1)+1)-dimensional vector holding the coefficients of the resulting polynomial; and for each partitioning element, an operation unit that converts the coefficients held in the (2(L-1)+1)-dimensional vector into the coefficients of an L-1 degree polynomial.

2. The information processing apparatus according to claim 1, wherein the calculation unit converts the coefficients held in the (2(L-1)+1)-dimensional vector into the coefficients of the L-1 polynomial using the relational expression when the L-1 polynomial = 0.

3. The coefficients of the L-1 polynomial are in the finite field Z ｑ In the case of the above number, the arithmetic unit obtains the coefficient of the final L-1 polynomial by taking the mod q of the coefficient obtained by the transformation, as described in claim 2.

4. A masking product calculation method executed by an information processing device that calculates the masking product of a first polynomial and a second polynomial on the quotient ring of an L-degree polynomial, comprising the steps of: for each partitioning element, obtaining a (2(L-1)+1)-dimensional vector holding the coefficients of the resulting polynomial by performing component multiplication between a vector holding the coefficients of the first polynomial and a vector holding the coefficients of the second polynomial; and for each partitioning element, converting the coefficients held in the (2(L-1)+1)-dimensional vector into the coefficients of an L-1 degree polynomial.

5. A program for causing a computer to function as an arithmetic unit in an information processing device according to any one of claims 1 to 3.

Images