Low-Memory Masked Dilithium Signing Without Polynomial y Regeneration

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing implementations of the Dilithium signature scheme require significant memory resources and incur additional overhead and side-channel leakage due to the need to re-generate sensitive variables like y and w0, making them unsuitable for memory-constrained devices.

Innovation Solution

A modified method for computing the polynomial {tilde over (r)} using Az − ct − αw1, allowing y to be kept in memory without overwriting it with w0, reducing the need for re-generation and minimizing side-channel leakage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Volume of stationary object

If y is overwritten with w0 to reduce memory usage, then memory footprint is reduced, but y must be re-generated causing additional overhead and side-channel leakage

Engineering Contradiction:
Improvememory footprintVSAvoidoverhead from re-generation
Core Design Contradiction:
Volume of stationary objectVSLoss of time

Solution Approach 1:

The patent applies preliminary action by computing and storing the polynomial r = Ay − cs2 immediately after y is generated, before y is overwritten with w0. This preliminary computation captures the necessary information from y while it is still in memory, eliminating the need to re-generate y later. The stored polynomial r is then used in subsequent signature generation steps, thus avoiding the overhead and side-channel leakage that would result from re-generating y.

Inventive Principle:
Principle #10Preliminary action

2Volume of stationary object

If y is overwritten with w0 to save memory, then memory resources are conserved, but side-channel leakage increases due to re-generation

Engineering Contradiction:
Improvememory resourcesVSAvoidside-channel leakage
Core Design Contradiction:
Volume of stationary objectVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary action by computing and storing the polynomial r = Ay − cs2 immediately after y is generated, before y is overwritten with w0. This preliminary computation captures the necessary information from y while it is still in memory, eliminating the need to re-generate y later. The stored polynomial r is then used in subsequent signature generation steps, thus avoiding the overhead and side-channel leakage that would result from re-generating y.

Inventive Principle:
Principle #10Preliminary action

3Loss of time

If y is kept in memory without overwriting, then re-generation is avoided reducing overhead, but memory footprint increases

Engineering Contradiction:
Improveoverhead from re-generationVSAvoidmemory footprint
Core Design Contradiction:
Loss of timeVSVolume of stationary object

Solution Approach 1:

The patent applies the extraction principle by removing the polynomial s2 from the computation of r, transforming the expression from r = Ay − cs2 to r = Ay − ct where t = s2 + cs1. This extraction allows the computation to be performed using only y and publicly known values (A, c, t), enabling y to be overwritten with w0 immediately after r is computed, thus reducing memory footprint without requiring y to be retained.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies preliminary action by computing and storing the polynomial r = Ay − cs2 immediately after y is generated, before y is overwritten with w0. This preliminary computation captures the necessary information from y while it is still in memory, eliminating the need to re-generate y later. The stored polynomial r is then used in subsequent signature generation steps, thus avoiding the overhead and side-channel leakage that would result from re-generating y.

Inventive Principle:
Principle #10Preliminary action

4Volume of stationary object

If re-generation of y is performed, then memory can be reused, but productivity decreases due to additional computations

Engineering Contradiction:
Improvememory reuseVSAvoidsigning performance
Core Design Contradiction:
Volume of stationary objectVSProductivity

Solution Approach 1:

The patent applies the extraction principle by removing the polynomial s2 from the computation of r, transforming the expression from r = Ay − cs2 to r = Ay − ct where t = s2 + cs1. This extraction allows the computation to be performed using only y and publicly known values (A, c, t), enabling y to be overwritten with w0 immediately after r is computed, thus reducing memory footprint without requiring y to be retained.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies preliminary action by computing and storing the polynomial r = Ay − cs2 immediately after y is generated, before y is overwritten with w0. This preliminary computation captures the necessary information from y while it is still in memory, eliminating the need to re-generate y later. The stored polynomial r is then used in subsequent signature generation steps, thus avoiding the overhead and side-channel leakage that would result from re-generating y.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentUS12388657B2Low-memory masked Dilithium with alternative signing algorithm
Publication Date: 2025.08.12 NXP BV
  • US12388657B2 patent drawing
  • US12388657B2 patent drawing
  • US12388657B2 patent drawing

AI summary

A method of performing a Dilithium signature operation on a message M using a secret key sk, including: generating a polynomial y using an ExpandMask function; calculating a polynomial z based upon y, c, and s1; performing a bound check on z based upon γ1 and β; performing a bound check on ct0 based upon γ2; calculating a polynomial {tilde over (r)} based upon A, z, c, t, α, and w1; performing a bound check on {tilde over (r)} based upon γ2 and β; calculating a hint polynomial h based on the {tilde over (r)}; and returning a digital signature of the message M where the digital signature includes z and h.