Granted Patent B2

US 12,273,464 · App. 18/541,533 · Granted Apr 8, 2025

Inventor: Thomas Poeppelmann (Munich, DE)

Assignee: Infineon Technologies AG

H04L9/3247H04L9/0894H04L9/3093H04L9/3218

Abstract

Claims (61)

1. A method for compiling a cryptographic information, comprising:

(a) determining a first portion of the cryptographic info nation based on are input, and a randomness;

(b) checking whether a rejection criterion based on the first portion of the cryptographic information is fulfilled; and

(c) re-starting step (a) with a new randomness in the event the rejection criterion is fulfilled with respect to the first portion of the cryptographic information; and,

(d) for each of any subsequent portion of the cryptographic information not yet determined,

(d1) determining a subsequent portion of the cryptographic; information based on the input and the most recently used randomness,

(d2) checking whether the rejection criterion is fulfilled based on the subsequent portion of the cryptographic information, and

(d3) re-starting step (a) with a new randomness in the event the rejection criterion is fulfilled with respect to the respective subsequent portion of the cryptographic information; and

(e) responsive to the first portion and each subsequent portion being determined without any respective events of fulfillment of the rejection criterion:

(e1) determining the first portion of the cryptographic information again, based on the input and the most recently used randomness and conveying the determined first portion of the cryptographic information; and

(e2) determining each subsequent portion of the cryptographic information again, based on the input and the randomness, and conveying each determined subsequent portion.

2. The method of claim 1 , wherein the method comprises not storing more than one portion of the cryptographic information at one time when processing the loop determined by steps (a) to (d).

3. The method of claim 1 , wherein the method comprises not storing more than one determined portion of the cryptographic information at one time when performing steps (e1) and (e2).

4. The method of claim 1 , wherein said determining the first portion each subsequent portion of the cryptographic information again and conveying the determined first portion and each determined subsequent portion comprises, for each portion determined again, conveying the portion determined again before determining any further portion again.

5. The method of claim 1 , further comprising:

for each portion of the cryptographic information determined by the loop of steps (a) to (d), generating and storing a first hash value that is associated with the respective portion of the cryptographic information;

within step (e), generating a second hash value for each portion of the cryptographic information and comparing the second hash value with the first hash value that is associated with the same portion of the cryptographic information; and

conveying the respective portion only if the first hash value corresponds to the second hash value.

6. The method of claim 5 , wherein in the event that the first hash value does not correspond to the second hash value, the method further comprises triggering at least one of any one or more of the following actions:

issuing a notification or an alarm;

stopping the method;

entering an exception handling;

re-starting step (a) with a different randomness.

7. The method of claim 1 , wherein the cryptographic information is or comprises at least one of any one or more of the following:

a signature;

a pairing information;

an information associated with a zero-knowledge-proof.

8. The method of claim 1 , wherein the method further comprises:

encrypting each portion of the cryptographic information with a secret key, prior to conveying the respective portion; and

conveying the secret key.

9. The method of claim 8 , wherein the secret key is conveyed after the last encrypted portion of the cryptographic information has been conveyed.

10. The method of claim 1 , wherein the input is a message.

11. The method of claim 1 , wherein the cryptographic information is compiled based on the portions of the cryptographic information conveyed.

12. The method of claim 11 , comprising conducting an authentication based on the cryptographic information.

13. The method of claim 1 , wherein processing the cryptographic information or a portion of the cryptographic information utilizes at least one cryptographic Lattice operation.

14. The method of claim 1 , wherein used on a security device or for operating a security device, wherein such security device comprises at least one of any one or more of the following:

an integrated circuit,

a hardware security module,

a trusted platform module,

a crypto unit,

a FPGA,

a processing unit,

a controller,

a smartcard.

15. A security device for compiling a cryptographic information, the security device comprising digital hardware and interface circuitry configured to:

(a) determine a first portion of the cryptographic information based on an input and a randomness;

(b) check whether a rejection criterion based on the first portion of the cryptographic information is fulfilled; and

(c) re-start step (a) with a new randomness in the event the rejection criterion is fulfilled with respect to the first portion of the cryptographic information; and,

(d) for each of any subsequent portion of the cryptographic information not yet determined,

(d1) determine a subsequent portion of the cryptographic information based on the input and the most recently used randomness,

(d2) check whether the rejection criterion is fulfilled based on the subsequent portion of the cryptographic information, and

(d3) re-start step (a) with a new randomness in the event the rejection criterion is fulfilled with respect to the respective subsequent portion the cryptographic inform ration; and

(e) responsive to the first portion and each subsequent portion being determined without any respective events of fulfillment of the rejection criterion:

(e1) determine the first portion of the cryptographic information again, based on the input and the most recently used randomness, and conveying the determined first portion of the cryptographic information; and

(e2) determine each subsequent portion of the cryptographic information again, based on the input and the randomness, and conveying each determined subsequent portion.

16. The security device of claim 15 , wherein the digital hardware is configured to not store more than one portion of the cryptographic information at one time when performing steps (e1) and (e2).

17. The security device of claim 15 , wherein the digital hardware and interface circuitry are configured to determine the first portion and each subsequent portion of the cryptographic information again and convey the determined first portion and each determined subsequent portion such that each portion determined again is conveyed before any further portion is determined again.

18. A consumable comprising the security device of claim 15 .

19. A system comprising a security device according to claim 15 and a host, wherein the security device is arranged to convey the respective portion of the cryptographic information to the host.

20. The system of claim 17 , wherein the host is arranged to authenticate the security device based on the portions of the cryptographic information received.

21. A non-transitory computer-readable medium comprising, stored thereupon, a computer program product directly loadable into a memory of a digital processing device, the computer program product comprising software code portions for performing the steps of the method of claim 1 .

Assignments (1)

Priority Claims (1)

Continuity (2)

References Cited (21)