Information processing device, information processing method, and program

Abstract

This information processing device computes secret information in a multivariable polynomial-based digital signature scheme into which a quotient ring structure is introduced, and comprises a computation unit that generates a public key using processing for calculating the product of a first polynomial and a second polynomial in a quotient ring while a vector corresponding to the first polynomial and a vector corresponding to the second polynomial are partitioned, obtains an inverse matrix of a matrix corresponding to the public key while the matrix is partitioned, and generates a signature by multiplying a message by the inverse matrix.

Description

Information processing device, information processing method, and program

[0001] This invention relates to QR-UOV (Quotient Ring-Unbalanced Oil and Vinegar) technology, which performs calculations while keeping all confidential information divided.

[0002] Masking implementations are known as countermeasures against implementation-based attacks called side-channel attacks, which involve physically observing hardware to obtain confidential internal information.

[0003] Currently, the most common masking implementation is the one defined as SNI security disclosed in Non-Patent Document 1, which guarantees security even if d pieces of information are taken by dividing the confidential information into d+1 parts.

[0004] The QR-UOV disclosed in Non-Patent Document 2 is a multivariate polynomial-based digital signature and is expected to be a quantum-resistant primitive. The basic structure of QR-UOV is based on UOV, and a quotient ring structure is introduced to reduce the public key length, which is a disadvantage of UOV.

[0005] Gilles Barthe, Sonia Belaid, Franois Dupressoir, Pierre-Alain Fouque, Benjamin Gregoire, Pierre-Yves Strub, Rebecca Zucchini, "Strong Non-Interference and Type-Directed Higher-Order Masking," CCS'16, October 24 - 28, 2016, Vienna, AustriaQR-UOV, https: / / info.isl.ntt.co.jp / crypt / qruov /

[0006] With the widespread use of IC cards and IoT devices, there are increasing opportunities to directly access encryption devices. To use encryption securely, measures are needed to prevent important information from being stolen through side-channel attacks. One basic measure is the masking implementation mentioned above.

[0007] Furthermore, with the current development of quantum computers, a new type of cryptography called post-quantum cryptography is being standardized, and many of these methods rely on multivariable polynomials as the basis for their security. However, there are challenges, such as the lack of a secure implementation method like masking operations.

[0008] This invention has been made in view of the above points, and aims to provide a technique for realizing a masking operation for a signature scheme of a multivariable polynomial cryptography.

[0009] According to the disclosed technology, an information processing device is provided for performing calculations on confidential information in a multivariable polynomial-based digital signature scheme that introduces a quotient ring structure, the device comprising: an information processing device that generates a public key by calculating the product of a first polynomial and a second polynomial on the quotient ring while keeping the vector corresponding to the first polynomial and the vector corresponding to the second polynomial separate; and an information processing device that generates a signature by finding the inverse of the matrix corresponding to the public key while keeping the matrix separate, and multiplying the message by the inverse.

[0010] The disclosed technology provides a technique for implementing masking operations on multivariate polynomial cryptographic signature schemes.

[0011] This figure shows an example of the system configuration in an embodiment of the present invention. This figure is for explaining the system's operation overview. This figure shows an example of the information processing device 100 configuration. This figure shows masked_FqL_mul. This figure shows halfmasked_FqL_mul. This figure shows a specific example of masked_FqL_mul. This figure shows masked_FqL_add. This figure shows masked_FqL_tra. This figure shows masked_Mat_inv. This figure shows MatRefresh. This figure shows Mat_M2A. This figure shows masked_solve. This figure shows an example of the device's hardware configuration.

[0012] Hereinafter, embodiments of the present invention (this embodiment) will be described with reference to the drawings. The embodiments described below are merely examples, and the embodiments to which the present invention is applied are not limited to the embodiments described below.

[0013] In the embodiments described below, QR-UOV is used as an example of a multivariate polynomial cryptographic signature scheme, but the masking implementation of the present invention is not limited to QR-UOV.

[0014] (System Configuration and Operation) Figure 1 shows an example of the system configuration in this embodiment. As shown in Figure 1, this system has a signature device 100 and a verification device 200 connected by a network 300.

[0015] The operation overview of this system will be explained with reference to the sequence diagram in Figure 2. In S101 (step 101), the signature device 100 generates a private key and a public key. In S102, the signature device 100 generates a signature s using message M and the private key, and sends message M, signature s, and the public key to the verification device 200. The public key may be sent in advance. Both the private key and the public key are matrices representing multivariable polynomials. The signature device 100 also performs processing while keeping the information divided. Furthermore, operations on polynomials and matrices are operations on the quotient ring.

[0016] The verification device calculates M from the public key and signature s, and determines that the verification is successful if the calculated M matches the M received from the signing device 100.

[0017] In this embodiment, the signature device 100 generates keys and signatures while keeping the information divided, based on the QR-UOV method. Since QR-UOV itself is a known technology, only an overview will be described here.

[0018] The signature device 100 performs the following MF in key generation. ｉ (i=1, ..., m) and MS are generated as the secret key, MP ｉ Generate a public key (i=1, ..., m), where m corresponds to the number of polynomials.

[0019] (1) Irreducible polynomial: f=x ｌ -ax ｉ-1 (Note: l is the lowercase of L), W ∈ F ｑ ｌ×ｌ s.t. ∀g ∈ F ｑ [x] / (f), WΦ ｇ ｆ : Symmetric matrix (2) MF ｉ : block WΦ ｇ ｆ matrices (i = 1,..., m) MS: block Φ ｇ ｆ matrix (3) MP ｉ = MS Ｔ ・MF ｉ ・MS MP ｉ : block WΦ ｇ ｆ matrices The signature device 100 is s = (MS Ｔ [[ID= / / ID=29]]・MF・MS) －１ [[ID= / / ID=31]] (M) to generate the signature s. This calculation corresponds to solving a system of simultaneous polynomials. The verification device 200 verifies whether M = MP(s) holds.

[0020] (Configuration example of the information processing device 100) FIG. 3 shows a configuration example of the information processing device 100 used as the signature device 100. As shown in FIG. 3, the information processing device 100 includes an input unit 110, an arithmetic unit 120, an output unit 130, and a data storage unit 140.

[0021] Information (e.g., message M) necessary for key generation and signature generation of QR-UOV is input from the input unit 110. The arithmetic unit 120 performs key generation and signature generation by executing a process including the algorithm described later. In the data storage unit 140, for example, an irreducible polynomial is stored in advance, and the arithmetic unit 120 reads the irreducible polynomial from the data storage unit 140 and uses it for key generation. The output unit 130 outputs the calculation result by the arithmetic unit 120.

[0022] In the present embodiment, a masking function for basic operations such as multiplication on the residue ring is introduced, and the arithmetic unit 120 performs operations using the masking function. Also, for parts where masking implementation such as LU decomposition is difficult, the overall masking implementation is realized by using the inverse matrix or the like.

[0023] It should be noted that there seems to be an error in the original text at line 29 where the closing parenthesis is missing in the expression "(MS・MF・MS)". The translation has an attempt to correct this in the translation of that part but might need further confirmation depending on the context. Also, in line 31, there is an extra " / / ID=" which is removed in the translation.(Functions used for QR-UOV masking calculation) The calculation unit 120 performs QR-UOV masking calculation using the following functions. Of the following functions, SecMult is an existing function, and the other functions are new functions.

[0024] (1) SecMult SecMult is an existing function used as a subfunction within the masked_Fql and masked_solve functions.

[0025] (2) masked_FqL_mul / halfmasked_FqL_mul masked_FqL_mul / halfmasked_FqL_mul are functions used as subfunctions of masked_Mat_mul and hlafmasked_Mat_mul, which will be described later.

[0026] (3) masked_FqL_add masked_FqL_add is a function used as a subfunction of masked_Mat_add.

[0027] (4) masked_FqL_tra masked_FqL_tra is a function used when calculating the transpose matrix. Specifically, it is used when calculating the transpose of a matrix on a secret extension field. In the QR-UOV algorithm, MS Ｔ It is used for calculations such as [this].

[0028] (5) masked_Mat_mul / halfmasked_Mat_mul (6) masked_Mat_add The above two are used for multiplication and addition on extension fields. Basically, QR-UOV operations are written in matrices, and the masked function is used if each matrix contains secret information, and the halfmasked function is used only if one of them contains public information (information included in the public key).

[0029] In other words, the two functions mentioned above are matrix versions of masked_FqL_mul / halfmasked_FqL_mul and masked_FqL_add. They perform matrix operations, but for the product and sum of each element, they use masked_FqL_mul / halfmasked_FqL_mul and masked_FqL_add as subfunctions.

[0030] In other words, for matrix multiplication, masked_FqL_mul (or halfmasked_FqL_mul) and masked_FqL_add are used. As an example of matrix multiplication, see the MP mentioned above. ｉ = MS Ｔ MF ｉ - There is a public key generation process shown in MS.

[0031] In other words, the information processing device 100 can generate a public key by calculating the product of a first polynomial and a second polynomial on a quotient ring, while keeping the vector corresponding to the first polynomial and the vector corresponding to the second polynomial separate.

[0032] (7) masked_Mat_inv masked_Mat_inv is a function used as a subfunction of the masked_solve function.

[0033] (8) MatRefresh MatRefresh is a function used as a subfunction of the Mat_M2A and masked_solve functions.

[0034] (9) Mat_M2A Mat_M2A is a function used as a subfunction of the Masked_solv function.

[0035] (10) masked_solv masked_solv is a function used, for example, in solving simultaneous equations in QR-UOV signature generation. In the proposed scheme, the solution is performed by multiplying the message by the inverse matrix. For example, as mentioned above, s = (MS Ｔ ・MF・MS) －１ As (M), the signature s is generated by multiplying the message by the inverse matrix of the public key.

[0036] In other words, the information processing device 100 can generate a signature by calculating the inverse of the matrix corresponding to the public key while keeping the matrix divided, and then multiplying the message by the inverse.

[0037] The following provides a detailed explanation of each function.

[0038] (masked_FqL_mul) Figure 4 shows the algorithm for masked_FqL_mul, which performs a product operation on an extension field (masked product on a quotient ring). This algorithm corresponds to the steps of the processing executed by the arithmetic unit 120. Hereafter, the row numbers in the diagram of the algorithm will be used as step numbers for explanation.

[0039] In Step 1, X and Y are the input information for the function, respectively. X and Y are Z ｑ This is a vector (L-dimensional vector) where the coefficients of the L-1 degree polynomial (which has L coefficients including a constant) are the remainder obtained by dividing [x] by the L degree polynomial f. L is an integer greater than or equal to 1.

[0040] Z ｑ [x] is a finite field Z with q elements. ｑ It is a polynomial ring (a set of polynomials) whose coefficients are the elements of q. For example, q is an integer greater than or equal to 1. Here, "Z ｑ [x] is a finite field Z ｑ A ring consisting of the "remainders when divided by an L-degree polynomial f whose coefficients are elements of Z" is called a quotient ring, and "Z ｑ It is expressed as "Z ｑ [x] / f" is the polynomial ring Z ｑ It can also be called the quotient ring of [x] under f. ｑ The expression "[x] / f" may also be called the quotient ring of f. In this embodiment, the quotient ring may also be called an extension field.

[0041] In step 1, Σ is X （ｉ） , Y （ｉ） This means that each of these represents an element (also an L-dimensional vector) obtained by dividing X and Y into d+1 parts. In step 2, Z represents the output information from the function, and Z = X × Y. （ｉ） These are the partitioning elements of Z.

[0042] In steps 3 to 5, the calculation unit 120 performs each T （ｉ） Initialize T. （ｉ） This is a "2(L-1)+1" dimensional vector of partition element i.

[0043] In the loop of i, j, and k in steps 6-13, SecMult((X[i]) in step 8 ０≦ｋ≦ｄ , (Y[j]) ０≦ｋ≦ｄ ) The calculation unit 120 safely multiplies the i-th component of X and the j-th component of Y for each k (partition element) of 0 ≤ k ≤ d. Since the i-th component of X and the j-th component of Y are each partitioned by d, the product of the components is calculated with the output still partitioned, as is the case with the existing SecMult function.

[0044] Step 10 T （ｋ） [i + j] = T （ｋ） [i + j] + Tmp ｋ Therefore, the calculation unit 120 is T （ｋ） The (i+j) component is Tmp ｋ Add it.

[0045] Next, we will explain the processing within the loops for i=2L-2 down to L do and for j=0 to do in steps 14-19.

[0046] T itself is a vector approximately twice the length of the original vectors being multiplied, and it stores the coefficients of the resulting polynomial. Specifically, the maximum x （Ｌ－１） ×x （Ｌ－１） x ２（Ｌ－１） The coefficients up to this point are stored in each T[i] in the order (0 ≤ i ≤ 2(L-1)).

[0047] Since this function calculates the product on the quotient ring, it is necessary to calculate coefficients up to degree L-1. Therefore, the calculation unit 120 performs step 16 and 17 "T （ｊ） [i - L = T] （ｊ） [i-L]+fe0T （ｊ） [i], T （ｊ） [i-L+fe]=T （ｊ） [i-L+fe]+feT （ｊ） [i] The degree of the multiplication result is x （Ｌ－１） Anything exceeding a certain threshold is modified by a polynomial relation that represents the remainder.

[0048] f = x ｎ When considering the quotient ring of ax + b, x in the polynomial that is the result of the above multiplication ｎx ｎ By substituting -ax-b, we can obtain the remainder of the polynomial with respect to f (a polynomial up to degree L-1). That is, x ｎ The relationship x when ax + b = 0 ｎ Use the formula = -ax - b.

[0049] For example, "3x （ｎ＋３） ⇒3x ｎ ×x ３ ⇒3(-ax-b)x ３ ⇒ -3 (ax ４ +bx ３ It can be changed to something like this: )

[0050] Performing the above transformation will reliably reduce the degree by at least 1, so in the algorithm in Figure 4, by performing i sequentially from 2L-2 down to L, it is possible to transform into a polynomial of degree L-1. This calculation is performed for each partition element j.

[0051] In steps 20 to 24, the calculation unit 120 performs the calculation "Z （ｉ） [j] = T （ｉ） The coefficients in each dimension of each partition element are calculated using "[j] (mod q)". A more specific example of multiplication on the quotient ring will be explained in Figure 6, which will be described later.

[0052] (halfmasked_FqL_mul) Figure 5 shows the algorithm for halfmasked_FqL_mul, which performs a product operation on an extension field (masking product on a quotient ring). Here, we will explain the differences from masked_FqL_mul.

[0053] In the algorithm shown in Figure 5, the SecMult((X[i]) of the algorithm shown in Figure 4 ０≦ｋ≦ｄ , (Y[j]) ０≦ｋ≦ｄ The part ) is missing, T （ｋ） [i + j] = T （ｋ） [i + j] + Tmp ｋ However, T （ｋ） [i + j] = T （ｋ） [i+j]+X[i]Y （ｋ） It's set to [j].

[0054] The present algorithm in FIG. 5 is an algorithm used when one of X and Y (specifically X) is public information. Since X is not divided, no special calculation is required, and the process shown in FIG. 5 is adopted.

[0055] (masked_FqL_mul (specific example)) FIG. 6 shows a more specific example of the algorithm of masked_FqL_mul that performs the operation of the extended product (masked product on the residue ring). The example in FIG. 6 is for the residue ring Z ｑ [x] / (x Ｌ - ax ａ０ - bx ｂ０ ) shows the multiplication. Hereinafter, the parts different from the example in FIG. 4 will be described.

[0056] The example shown in FIG. 6 is different from the example in FIG. 4 only in steps 16 and 17. That is, in steps 16 and 17, the calculation of "T （ｊ） [i - L + a0] = T （ｊ） [i - L + a0] + aT （ｊ） [i], T （ｊ） [i - L + b0] = T （ｊ） [i - L + b0] + bT （ｊ） [i]" is performed.

[0057] In the example of FIG. 6, x Ｌ = ax ａ０ + bx ｂ０ is used to change the degree of x Ｌ higher than the next in the multiplication result to L - 1 or lower.

[0058] For example, the coefficient at i = 2L - 2, that is, the coefficient of x （２Ｌ－２） in the multiplication result is stored in T[2L - 2]. By using the relational expression of x Ｌ = ax ａ０ + bx ｂ０ , the conversion can be performed as follows. <​​​​​​​​​​​​​​（ｂ０＋Ｌ－２） ) If we write the above with i = 2L - 2, then T[i]x ｉ ⇒T[i](ax （ｉ－Ｌ＋ａ０） +bx （ｉ－Ｌ＋ｂ０） )

[0060] Since the coefficient of the i-L+a0th degree in the multiplication result is stored in T[i-L+a0], by adding a×T[i] obtained in the above transformation to the original multiplication result T[i-L+a0], we can obtain the x of the polynomial in the quotient ring. （ｉ－Ｌ＋ａ０） The coefficients can be obtained. In the algorithm in Figure 6, the above process is performed for each partitioning element from the 2L-2 order to the L order. Note that by taking mod q in step 22, Z ｑ The coefficient shown above is obtained.

[0061] (masked_FqL_add) Figure 7 shows the algorithm for masked_FqL_add, a function that calculates the sum over an extension field. X and Y in step 1 are the same as X and Y in Figure 4.

[0062] As shown in steps 3 to 7 of Figure 6, the calculation unit 120 processes the divided element X （ｉ） , Y （ｉ） For each element, the sum of its vector components is calculated, and the sum over the extension field is obtained by taking the modulo q of that sum.

[0063] (masked_FqL_tra) Figure 8 shows the algorithm for masked_FqL_tra, a function that calculates the transpose of a matrix.

[0064] In step 1, X (and the partitioned element X(i)) is an M row and V column matrix. As shown in steps 3 to 8 of Figure 7, the calculation unit 120 processes the partitioned element X （ｉ） Each time, the process of swapping rows and columns is executed.

[0065] (masked_Mat_inv) Figure 9 shows the algorithm for masked_Mat_inv, a function that calculates the inverse matrix of a matrix.

[0066] X (and partition element X) in step 1 of the algorithm shown in Figure 9 （ｉ）) is an n x n invertible matrix. According to this algorithm, the arithmetic unit 120 performs the calculation of the inverse matrix while the matrix is ​​partitioned by utilizing the transformation of addition masking and multiplication masking.

[0067] In the loop of steps 3 to 10 i=0 to d (processing for each partition element i), first, the arithmetic unit 120 calculates the random number n x n invertible matrix R in step 4. （ｉ） Obtain it.

[0068] In steps 5 to 7, the calculation unit 120 calculates each division element X （ｊ） ni R （ｉ） The result of multiplying by X （ｊ） Let's assume that.

[0069] In step 8, the calculation unit 120, R （ｉ） Let X be the result of applying the matrix's linear refresh function (MatRefresh) to X after multiplying by the given factor. In other words, MatRefresh shuffles the components of the partitioned elements.

[0070] In step 9, the calculation unit 120 uses the random number R （ｉ） new division element Z （ｄ－ｉ） It will be kept as such.

[0071] At the end of step 10, X = π ０ ｉ＝ｄ R （ｉ） X is (the X on the right side is the original X at the time of input). In step 11, the calculation unit 120 is Z （０） = X －１ ・Z （０） = (PiR （ｉ） X) －１ R （ｄ） This means that Z （ｉ） The product of i=0 to d is the inverse matrix of the original X. In other words, the Z in question （ｉ） The product of i=0 to d is a masking of the inverse matrix of X represented by a product partition. In step 12, the calculation unit 120 obtains the partition of the desired inverse function Z by returning from the product partition to the original sum partition using the Mat_M2A function. （ｉ） The reason why the product of these two matrices is the inverse matrix of the original X is as follows:

[0072] "Z（０） = ( Π ０ ｉ＝ｄ R （ｉ） X) －１ R （ｄ） = X －１ Π ｄ ｉ＝０ R （ｉ）－１ R （ｄ） Therefore, it becomes "Π ｄ ｉ＝０ Z （ｉ） = X －１ Π ｄ ｉ＝０ R （ｉ）－１ R （ｄ） Π ０ ｉ＝ｄ－１ R （ｉ） = X －１ I = X －１ This statement holds true.

[0073] (MatRefresh) Figure 10 shows the algorithm for MatRefresh, a linear refresh function for matrices.

[0074] Step 1 X (and partition element X) （ｉ） ) is an n x n square matrix. In step 3, the calculation unit 120 is "Z （ｄ） ←X （ｄ） "

[0075] In steps 4 to 8, the calculation unit 120 generates a random number matrix R for each division element i (i = 0 to d-1). （ｉ Using "Z （ｉ） ←X （ｉ） +R （ｉ） "Z （ｄ） ←X （ｄ） -R （ｉ） Perform the following operation. The calculation result is Z = X.

[0076] (Mat_M2A) Figure 11 shows the algorithm for Mat_M2A, a matrix multiplication-to-sum conversion function.

[0077] Step 1 X (and the division element X in the product) （ｉ） ) is an n x n square matrix. In step 3, the calculation unit 120 is "Z （０） ←X （０） "

[0078] In steps 4 to 9, the calculation unit 120 calculates the input X with respect to Z. （ｉ） The numbers are multiplied sequentially, and Matrefresh is used to randomly rearrange them by partitioning by sum. Specifically, X （１） Change it into a partition of two sums (MatRefresh), and then apply X to those two partitions. （２） By multiplying by this and then dividing it into three parts, the result is X （１） X （２） The calculation unit 120 converts this into a partition of three sums. By performing this process to the end, X （１） X （２） ...X （ｄ） Change it to a sum divided into d+1 parts.

[0079] (masked_solve) Figure 12 shows the algorithm of masked_solve, a function that solves simultaneous equations.

[0080] Step 1 A (and division element A) （ｉ） ) is a finite field F ｑ The above is an m x m matrix, where y (and partition element y) （ｉ） ) is a finite field F ｑ The above is an m-dimensional vector. As described in Step 2, masked_solve finds the solution x of the system of equations Ax = y while keeping A, y, and x separated.

[0081] In steps 3 to 5, the calculation unit 120 calculates x for i = 0 to d. （ｉ） Initialize it to 0.

[0082] In step 6, the calculation unit 120 uses masked_Mat_inv to calculate the inverse matrix A of A. －１ We seek.

[0083] In steps 7 to 13, for each i and each j, the calculation unit 120 calculates SecMult((A －１ [i, j]) ０≦ｋ≦ｄ , (y[j]) ０≦ｋ≦ｄ ) by A －１ The calculation of safely multiplying the i and j components of x by the j-th component of y is performed for each k (partition element) of 0 ≤ k ≤ d to find Tmp. Furthermore, the calculation unit 120 calculates for each k, "x[i] （ｋ）←x[i] （ｋ） +Tmp （ｋ） This calculates the value of each component i of each partition element in solution x.

[0084] (Hardware Configuration Example) Any of the devices described in this embodiment (signature device 100, information processing device 100, verification device 200) can be realized, for example, by having a computer execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0085] In other words, the device can be realized by using hardware resources such as the CPU and memory built into a computer to execute a program corresponding to the processing performed by the device. The program can be recorded on a computer-readable recording medium (such as portable memory), saved, and distributed. It can also be provided via a network, such as the Internet or email.

[0086] Figure 13 shows an example of the hardware configuration of the computer described above. The computer in Figure 13 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., all of which are interconnected by bus B. The computer may also be equipped with a GPU.

[0087] The program that enables processing on the computer is provided on a recording medium 1001, such as a CD-ROM or memory card. When the recording medium 1001 containing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001; it may also be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files and data.

[0088] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when a program startup command is received. The CPU 1004 implements the functions related to the memory device 1003 according to the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) etc., based on a program. The input device 1007 consists of a keyboard and mouse, buttons, or a touch panel, etc., and is used to input various operation commands. The output device 1008 outputs the calculation results.

[0089] More specifically, in each algorithm, the vector or matrix is ​​stored, for example, in memory (which may also be called a storage unit), and the CPU (which may also be called an arithmetic unit) reads the values ​​of the vector (or matrix) from that memory to execute the processing described in each algorithm. If the calculation result is a vector (or matrix), that calculation result is stored in memory as a vector (or matrix).

[0090] (Summary of the technology related to the embodiment) As described above, the technology related to this embodiment introduces a masking function to the QR-UOV reference implementation. Specifically, the secret information is modified to be stored in a divided manner. The secret information includes, for example, random numbers, secret key information, and the intermediate calculation results other than the public information.

[0091] For operations involving sensitive information, the existing function calls will be changed to masking function calls.

[0092] Note that in some cases, processing is performed using a different procedure than the reference implementation. Specifically, for samples, the number of samples is allocated by performing the sample function for each masking division (the same applies to random numbers, etc.).

[0093] Furthermore, regarding the part where the equation is solved, the masked version solves it by multiplying by the inverse matrix, so the processing order is different from the current reference implementation. Specifically, we will implement it using a salt-fixed version in which the matrix of the linear equation is always full-rank, and incorporate the masked_Mat_inv function into that version.

[0094] (Effects of the technology according to the embodiment) The technology according to this embodiment enables masking implementation of QR-UOV, and as a result, post-quantum computer cryptographic signatures can be performed with enhanced security.

[0095] (Examples of application of the technology according to the embodiment) The application of the technology according to the present invention is not limited to a specific field, but for example, the technology according to the present invention can be applied to the signature portion of next-generation IC cards, etc. QR-UOV is a quantum-resistant signature that cannot be deciphered even by a quantum computer, and it is effective to use the technology according to the present invention in cases where there is a higher security requirement and there is an opportunity to directly access the cryptographic device.

[0096] The following additional information is disclosed regarding the embodiments described above.

[0097] <Note> (Note 1) An information processing device for performing calculations on secret information in a multivariable polynomial-based digital signature scheme that introduces a quotient ring structure, comprising: a memory; and at least one processor connected to the memory, wherein the processor generates a public key by calculating the product of a first polynomial and a second polynomial on a quotient ring, while keeping the vector corresponding to the first polynomial and the vector corresponding to the second polynomial separate; and generates a signature by finding the inverse matrix of the matrix corresponding to the public key while keeping the matrix separate, and multiplying the message by the inverse matrix. (Note 2) The information processing device according to Note 1, wherein the quotient ring is a quotient ring of an L-degree polynomial, and the processor obtains a (2(L-1)+1)-dimensional vector that holds the coefficients of the polynomial resulting from the multiplication by multiplying the components between a vector that holds the coefficients of the first polynomial and a vector that holds the coefficients of the second polynomial for each partitioning element, and converts the coefficients held in the (2(L-1)+1)-dimensional vector to the coefficients of an L-1 degree polynomial for each partitioning element. (Note 3) The information processing device according to Note 1, wherein the matrix is ​​the first matrix, and the processor obtains partitioning elements of the product of the second matrix which is the inverse of the first matrix by multiplying the first matrix partitioned by the sum by a random number matrix as many times as there are partitioning elements, and calculates the inverse matrix partitioned by the sum from the second matrix partitioned by the product. (Appendix 4) An information processing method to be performed by an information processing device that performs calculations on secret information in a multivariable polynomial-based digital signature scheme that introduces a quotient ring structure, comprising the calculation steps of generating a public key by calculating the product of a first polynomial and a second polynomial on a quotient ring, while keeping the vector corresponding to the first polynomial and the vector corresponding to the second polynomial separate, and generating a signature by finding the inverse of the matrix corresponding to the public key while keeping the matrix separate, and multiplying the message by the inverse. (Appendix 5) A non-temporary storage medium storing a program for causing a computer to function as the calculation unit in the information processing device described in any one of Appendix 1 to 3.

[0098] Although this embodiment has been described above, the present invention is not limited to this specific embodiment, and various modifications and changes are possible within the scope of the gist of the invention as described in the claims.

[0099] 100 Signature device, information processing device 110 Input unit 120 Calculation unit 130 Output unit 140 Data storage unit 200 Verification device 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input device 1008 Output device

Claims

1. An information processing device for performing calculations on secret information in a multivariable polynomial-based digital signature scheme that introduces a quotient ring structure, comprising: an information processing device that generates a public key by calculating the product of a first polynomial and a second polynomial on a quotient ring, while keeping the vector corresponding to the first polynomial and the vector corresponding to the second polynomial separate; and an information processing device that generates a signature by finding the inverse of the matrix corresponding to the public key while keeping the matrix separate, and multiplying the message by the inverse.

2. The information processing apparatus according to claim 1, wherein the quotient ring is a quotient ring of an L-degree polynomial, and the arithmetic unit obtains a (2(L-1)+1)-dimensional vector holding the coefficients of the polynomial obtained by multiplying the components between a vector holding the coefficients of the first polynomial and a vector holding the coefficients of the second polynomial for each partitioning element, and converts the coefficients held in the (2(L-1)+1)-dimensional vector to the coefficients of an L-1 degree polynomial for each partitioning element.

3. The information processing apparatus according to claim 1, wherein the matrix is ​​the first matrix, and the calculation unit performs the process of multiplying the first matrix, which has been divided by a sum, by a random number matrix a number of times equal to the number of division elements, thereby obtaining the division elements of the product of the second matrix which is the inverse matrix of the first matrix, and calculates the inverse matrix, which has been divided by a sum, from the second matrix which has been divided by the product.

4. An information processing method executed by an information processing device that performs calculations on secret information in a multivariable polynomial-based digital signature scheme that introduces a quotient ring structure, comprising the steps of: generating a public key by calculating the product of a first polynomial and a second polynomial on a quotient ring while keeping the vector corresponding to the first polynomial and the vector corresponding to the second polynomial separate; finding the inverse of the matrix corresponding to the public key while keeping it separate; and generating a signature by multiplying the message by the inverse.

5. A program for causing a computer to function as an arithmetic unit in an information processing device according to any one of claims 1 to 3.

Images