Masked infinity norm check for crystals-dilithium signature generation
A data processing system and method for norm checking a cryptographic operation for lattice-based cryptography in a processor, the instructions, including: multiplying a first polynomial by a second polynomial to produce a first output, wherein the d arithmetic shares have a modulus q′; securely converting the first output to d Boolean shares; securely subtracting a third polynomial from the first output to produce a second output, wherein the third polynomial is randomly generated and then offset by a first constant parameter; securely adding a first constant based upon a bound check and the first constant parameter to the second output to shift the values of the second output to positive values to produce a third output; and securely adding a second constant based upon the bound check to the third output to produce a carry bit.
1. A data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for norm checking a cryptographic operation for lattice-based cryptography in a processor, the instructions comprising processor-readable instructions that, when executed, cause a processor to:
determine data to be digitally signed;
begin digitally signing the determined data using a crystals-Dilithium signature generation process;
multiply a first polynomial having d arithmetic shares by a second polynomial to produce a first output, wherein the d arithmetic shares have a modulus q′;
securely convert the d arithmetic shares of the first output to d Boolean shares;
securely subtract a third polynomial with d Boolean shares from the first output to produce a second output with d Boolean shares, wherein the third polynomial is randomly generated and then offset by a first constant parameter;
securely add a first constant based upon a bound check and the first constant parameter to the second output to shift values of the second output to positive values to produce a third output with d Boolean shares;
securely add a second constant based upon the bound check to the third output to produce a carry bit with d Boolean shares; and
continue digitally signing the determined data when the carry bit indicates that the second output satisfies a norm check based upon the bound check.
2. The data processing system of claim 1 , wherein q′ is a power of two.
3. The data processing system of claim 1 , wherein ∥ĉ∘ŝ∥ ∞ <q′, where ĉ is the first polynomial that is public and ŝ is the second polynomial that is secret where ∥·∥ ∞ ≤q′ means that the absolute value of each of the coefficients of the polynomial is less than or equal than q′.
4. The data processing system of claim 1 , wherein the processor-readable instructions further cause the processor to:
secretly expand coefficients of the Boolean shares of the third polynomial to k+1 bits by appending zeros, where k is a number of bits of the coefficients of the third polynomial; and
secretly expand coefficients of the d Boolean shares of the first output to k+1 bits by appending zeros.
5. The data processing system of claim 4 , wherein the processor-readable instructions causing the processor to securely subtract the third polynomial with d Boolean shares from the first output include instructions that cause the processor to compute:
z
′
B
,
k
+
1
←
Sec
Sub
k
+
1
d
(
sc
B
,
k
+
1
,
x
B
,
k
+
1
)
where sc B,k+1 is the Boolean shares of the expanded first output, x B,k+1 is the Boolean shares of the is the expanded third polynomial, SecSub k+1 d is a secure subtraction function, and z′ B,k+1 is the Boolean shares of a fourth output.
6. The data processing system of claim 5 , wherein the processor-readable instructions causing the processor to securely add the first constant based upon the bound check and the first constant parameter to the second output include instructions that cause the processor to compute:
z
′
B
,
k
+
1
←
Sec
Add
k
+
1
d
(
z
B
,
k
+
1
,
β
+
γ
)
where β is the bound check, γ is the first constant parameter, and SecAdd k+1 d is a secure addition function.
7. The data processing system of claim 6 , wherein the processor-readable instructions causing the processor to securely add the second constant based upon the bound check to the third output include instructions that cause the processor to compute:
b
B
,
1
←
Sec
Add
k
+
2
d
(
z
′
B
,
k
+
1
,
2
k
+
2
-
2
·
β
)
[
k
+
1
]
where b B,1 are the d Boolean shares of the carry bit.
8. The data processing system of claim 1 , wherein the processor-readable instructions further comprise instructions that, when executed, cause the processor to securely unmask the d Boolean shares of the carry bit to produce the carry bit.
9. The data processing system of claim 1 , wherein the d Boolean shares of the first output include k′ bits, where k′=┌log 2 q′┐.
10. The data processing system of claim 1 , wherein coefficients of the third polynomial are unsigned such that 0≤x<2 k , where k is the number of bits of the coefficients of the third polynomial.
11. A method for norm checking a cryptographic operation for lattice-based cryptography, the method comprising:
determining, by a processor of a computing device, data to be digitally signed;
beginning digitally signing, by the processor, the determined data using a crystals-Dilithium signature generation process;
multiplying, by a processor of a computing device, a first polynomial having d arithmetic shares by a second polynomial to produce a first output, wherein the d arithmetic shares have a modulus q′;
securely converting, by the processor, the d arithmetic shares of the first output to d Boolean shares;
securely subtracting, by the processor, a third polynomial with d Boolean shares from the first output to produce a second output with d Boolean shares, wherein the third polynomial is randomly generated and then offset by a first constant parameter;
securely adding, by the processor, a first constant based upon a bound check and the first constant parameter to the second output to shift values of the second output to positive values to produce a third output with d Boolean shares;
securely adding, by the processor, a second constant based upon the bound check to the third output to produce a carry bit with d Boolean shares; and
continuing digitally signing the determined data, by the processor, when the carry bit indicates that the second output satisfies a norm check based upon the bound check.
12. The method of claim 11 , wherein q′ is a power of two.
13. The method of claim 11 , wherein ∥ĉ∘ŝ∥ ∞ <q′, where ĉ is the first polynomial that is public and ŝ is the second polynomial that is secret where ∥·∥ ∞ ≤q′ means that the absolute value of each of the coefficients of the polynomial is less than or equal than q′.
14. The method of claim 11 , further comprising:
secretly expand, by the processor, coefficients of the Boolean shares of the third polynomial to k+1 bits by appending zeros, where k is a number of bits of the coefficients of the third polynomial; and
secretly expand, by the processor, coefficients of the Boolean shares of the first output to k+1 bits by appending zeros.
15. The method of claim 14 , wherein securely subtract the third polynomial with d Boolean shares from the first output includes computing:
z
′
B
,
k
+
1
←
Sec
Sub
k
+
1
d
(
sc
B
,
k
+
1
,
x
B
,
k
+
1
)
where sc B,k+1 is the Boolean shares of the expanded first output, x B,k+1 is the Boolean shares of the expanded third polynomial, SecSub k+1 d is a secure subtraction function, and z′ B,k+1 is the Boolean shares of a fourth output.
16. The method of claim 15 , wherein securely adding a first constant based upon a bound check and the first constant parameter to the second output includes computing:
z
′
B
,
k
+
1
←
Sec
Add
k
+
1
d
(
z
B
,
k
+
1
,
β
+
γ
)
where β is the bound check, γ is the first constant parameter, and SecAdd k+1 d is a secure addition function.
17. The method of claim 16 , wherein securely adding a second constant based upon the bound check to the third output includes computing:
b
B
,
1
←
Sec
Add
k
+
2
d
(
z
′
B
,
k
+
1
,
2
k
+
2
-
2
·
β
)
[
k
+
1
]
where b B,1 are the d Boolean shares of the carry bit.
18. The method of claim 11 , further comprising securely unmasking, by the processor, the d Boolean shares of the carry bit to produce the carry bit.
19. The method of claim 11 , wherein the d Boolean shares of the first output include k′ bits, where k′=┌log 2 q′┐.
20. The method of claim 11 , wherein coefficients of the third polynomial are unsigned such that 0≤x<2 k , where k is the number of bits of the coefficients of the third polynomial.