Executing a cryptographic operation
A method for executing a cryptographic operation is provided comprising acts comprising: (i) sampling a first polynomial, wherein one or more (e.g., one, some and/or all) coefficients of the first polynomial are determined; (ii) sampling a second polynomial, wherein a selection of k coefficients of the second polynomial is determined; (iii) multiplying the first polynomial with the second polynomial to determine a result; and (iv) using the result of the multiplication in the cryptographic operation. A security device arranged to perform one, some and/or all of the acts is provided.
1. A method for executing a cryptographic operation on a security device, the method comprising:
sampling a first polynomial, wherein coefficients of the first polynomial are determined based on a first distribution such that:
a value 0 of the first polynomial occurs with a probability amounting to ζ,
a value −lim1 of the first polynomial occurs with a probability amounting to α, and
a value lim1 of the first polynomial occurs with a probability amounting to β, wherein ζ+α+β=near 1;
sampling a second polynomial, wherein a selection of k coefficients of the second polynomial is determined based on a second distribution;
multiplying the first polynomial with the second polynomial to determine a result; and
executing the cryptographic operation using the result of the multiplication, wherein the method is performed to increase the robustness of the security device against one or more side-channel attacks.
2. The method according to claim 1 , wherein the cryptographic operation is an operation using at least one of a secret or an error, wherein the result of the multiplication is at least one of the secret or the error.
3. The method according to claim 1 , comprising using the cryptographic operation to at least one of:
generate a public key,
generate a signature,
generate a private key, or
encrypt data.
4. The method according to claim 1 , wherein the coefficients of the first polynomial and the k coefficients of the second polynomial are determined based on random numbers.
5. The method according to claim 1 , comprising randomly shuffling coefficients of at least one of the first polynomial, the second polynomial or the result.
6. The method according to claim 1 , wherein the k coefficients of the second polynomial are determined such that
a value −lim2 of the second polynomial occurs with a probability of 0.5 and
a value lim2 of the second polynomial occurs with a probability of 0.5.
7. The method according to claim 6 , wherein lim2 is a number between 1 and 5.
8. The method according to claim 1 , wherein the method is used on the security device comprising at least one of:
an integrated circuit,
a hardware security module,
a trusted platform module,
a crypto unit,
a Field Programmable Gate Array (FPGA),
a processing unit,
a controller, or
a smartcard.
9. The method according to claim 1 , wherein the cryptographic operation is a cryptographic Lattice operation.
10. The method according to claim 1 , wherein at least one of sampling the first polynomial or sampling the second polynomial comprises at least two acts of sampling and one act of selecting at least one of the first polynomial or the second polynomial from the at least two acts of sampling.
11. A security device that is arranged to execute acts, the acts comprising:
sampling a first polynomial, wherein coefficients of the first polynomial are determined based on a first distribution such that:
a value 0 of the first polynomial occurs with a probability amounting to ζ,
a value −lim1 of the first polynomial occurs with a probability amounting to α, and
a value lim1 of the first polynomial occurs with a probability amounting to β, wherein ζ+α+β=near 1;
sampling a second polynomial, wherein a selection of k coefficients of the second polynomial is determined based on a second distribution;
multiplying the first polynomial with the second polynomial to determine a result; and
executing a cryptographic operation using the result of the multiplication, wherein the acts are performed to increase the robustness of the security device against one or more side-channel attacks.
12. The security device according to claim 11 , wherein the security device comprises at least one of:
an integrated circuit,
a hardware security module,
a trusted platform module,
a crypto unit,
a Field Programmable Gate Array (FPGA),
a processing unit,
a controller, or
a smartcard.
13. A computer program product loadable into a memory of a digital processing device, comprising software code for performing acts for executing a cryptographic operation on a security device, the acts comprising:
sampling a first polynomial, wherein coefficients of the first polynomial are determined based on a first distribution such that:
a value 0 of the first polynomial occurs with a probability amounting to ζ,
a value −lim1 of the first polynomial occurs with a probability amounting to α, and
a value lim1 of the first polynomial occurs with a probability amounting to β, wherein ζ+α+β=near 1;
sampling a second polynomial, wherein a selection of k coefficients of the second polynomial is determined based on a second distribution;
multiplying the first polynomial with the second polynomial to determine a result; and
executing a cryptographic operation using the result of the multiplication, wherein the acts are performed to increase the robustness of the security device against one or more side-channel attacks.
14. The computer program product according to claim 13 , wherein the cryptographic operation is an operation using at least one of a secret or an error, wherein the result of the multiplication is at least one of the secret or the error.
15. The computer program product according to claim 13 , the acts comprising using the cryptographic operation to at least one of:
generate a public key,
generate a signature,
generate a private key, or
encrypt data.
16. The computer program product according to claim 13 , wherein:
the first distribution
is different than the second distribution.
17. The computer program product according to claim 13 , wherein the coefficients of the first polynomial and the k coefficients of the second polynomial are determined based on random numbers.