Masked Polynomial Rejection Check for Post-Quantum Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing post-quantum digital signature schemes are vulnerable to side-channel attacks due to unprotected implementations, particularly in the rejection check of polynomials, which can lead to the extraction of secret keys, and current masking solutions require costly conversions and multiple Boolean-masked additions, limiting efficiency.
Innovation Solution
The proposed solution introduces a generic and efficient masked norm-based rejection check using arithmetic masking with an arbitrary modulus, leveraging signed addition and power-of-two moduli, and employing algorithms like SecBoundCheck and SecReject to securely perform boundary checks on polynomial coefficients, reducing the need for costly conversions and parameter searches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If masking solutions are applied to protect against side-channel attacks, then security is improved, but computational cost increases due to costly conversions and multiple Boolean-masked additions
Solution Approach 1:
The patent changes the parameter representation from Boolean masking to arithmetic masking with arbitrary modulus. This involves transforming the masking domain and parameters to allow direct arithmetic operations on masked values without requiring conversion to Boolean shares, thereby maintaining security while reducing computational overhead
Solution Approach 2:
The patent extracts and eliminates the costly conversion step from arithmetic shares to Boolean shares. By working directly with arithmetic masking throughout the computation, the unnecessary intermediate conversion operation is removed, reducing the number of computational steps required
2Productivity
If arithmetic masking with arbitrary modulus is used, then efficiency is improved by reducing conversions, but implementation complexity increases
Solution Approach 1:
The patent creates a universal arithmetic masking framework that handles arbitrary modulus q and arbitrary bounds λ0, λ1. The same set of arithmetic operations can be applied regardless of the specific parameters, making the implementation adaptable without requiring parameter-specific optimization or complex conditional logic
3Reliability
If norm-based rejection check is performed on masked polynomials, then security against side-channel attacks is improved, but runtime increases due to multiple Boolean-masked additions
Solution Approach 1:
The patent substitutes the mechanical process of multiple Boolean-masked additions with a more efficient arithmetic operation. By leveraging the properties of arithmetic masking and modular arithmetic, the norm-based rejection check can be performed with fewer operational steps, directly computing the necessary comparisons without iterative Boolean operations
Data Source
AI summary
Various embodiments relate to a data processing system including instructions embodied in a non-transitory computer readable medium, the instructions for a cryptographic operation using masked coefficients of a polynomial having d arithmetic shares for lattice-based cryptography in a processor, the instructions, including: shifting an arithmetic share of the d arithmetic shares by a first bound λ0; converting the d shifted arithmetic shares to d Boolean shares; securely subtracting the first bound λ0 and a second bound λ1 from the Boolean shares to obtain z′B,k+1 having d shares, wherein k is the number of bits in the masked coefficients of the polynomial; setting the shares of a boundary check bit to a sign bit of z′B,k+1; and carrying out a cryptographic operation using the d arithmetic shares of the polynomial when the d shares of the boundary check bit indicate that the coefficients of the polynomial are within the first bound λ0 and second bound λ1.