SHA Datapath Blocks for Quantum-Resistant Signature Hardware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing public-key digital signature algorithms like RSA and ECDSA are not secure against brute-force attacks from quantum computers, necessitating the development of post-quantum cryptography solutions such as hash-based signatures to ensure secure communication systems.
Innovation Solution
The implementation of hash-based signature schemes like XMSS and LMS, which utilize secure hash algorithms like SHA2-256 and SHA3, combined with one-time signature schemes like WOTS, to generate and verify digital signatures, ensuring single-use of private keys and resistance to quantum attacks through Merkle trees and pseudo-random functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hash-based signature schemes like XMSS and LMS are implemented to provide quantum attack resistance, then security against quantum attacks is improved, but device complexity increases due to the need for Merkle trees and pseudo-random functions
Solution Approach 1:
The patent segments the cryptographic operations into distinct functional blocks: hash function modules, Merkle tree construction modules, pseudo-random function modules, and signature generation/verification modules. This segmentation allows each component to be optimized independently while maintaining the overall security architecture required for quantum attack resistance.
Solution Approach 2:
The patent introduces intermediary components such as Merkle trees that mediate between the private key and the signature verification process. These intermediaries enable quantum-resistant security by providing an additional layer of cryptographic protection without requiring complete redesign of the entire signing system.
2Reliability
If one-time signature schemes like WOTS are used to ensure single-use of private keys, then security is improved, but productivity decreases due to the inability to reuse keys
Solution Approach 1:
The patent applies preliminary action by pre-construction of Merkle trees and pre-generation of one-time signature key pairs before actual signing operations. This allows the system to maintain high security through single-use private keys while improving productivity by preparing cryptographic materials in advance, so that actual signing operations can proceed efficiently without repeated key generation.
Solution Approach 2:
The patent implements a system where one-time private keys are discarded after single use, while the underlying Merkle tree structure and public key infrastructure are recovered and reused for multiple signature operations. This approach maintains the security benefits of one-time keys while enabling continued productivity through reusable public components.
3Reliability
If state synchronization mechanisms are implemented for hash-based signatures, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent implements feedback mechanisms that monitor and track the state of cryptographic operations, including key usage status and Merkle tree node consumption. This feedback enables automatic state synchronization across distributed systems without requiring complex manual coordination, improving reliability while managing complexity through automated state tracking.
Data Source
AI summary
An apparatus comprises an input register comprising a state register and a parity field, a first round secure hash algorithm (SHA) datapath communicatively coupled to the state register, comprising a first section to perform a θ step of a SHA calculation, a second section to perform a ρ step and a ρ step of the SHA calculation, a third section to perform a χ step of the SHA calculation and a fourth section to perform a τ step of the SHA calculation.