Granted Patent B2

US 12,388,616 · App. 18/169,467 · Granted Aug 12, 2025

Inventors: Markus Schoenauer (Vienna, AT); Melissa Azouaoui (Norderstedt, DE); Olivier Bronchain (Auderghem, BE); Tobias Schneider (Graz, AT); Christine van Vredendaal (Veldhoven, NL)

Assignee: NXP B.V.

H04L9/004H04L9/3093H04L9/3247

Abstract

Claims (36)

1. A data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a fault detection in a digital signature algorithm in a processor, the instructions, comprising:

computing vector z based on a secret nonce vector y, a first secret key vector s_(1), and a challenge polynomial c, wherein each of the vector z, the secret nonce vector y, and the first secret key vector s_1 includes a number of polynomials l having a number coefficients n, wherein the challenge polynomial c has the number of coefficients n, and wherein the number of polynomials l and the number of coefficients n are integers;

computing a difference value between all of the n coefficients of the l polynomials in the vector z;

computing a number of how many of the computed difference values are outside a specified value range;

computing a digital signature for an input message; and

rejecting the digital signature when the computed number is greater than a threshold value.

2. The data processing system of claim 1 , further comprising accepting the digital signature when the computed number is not greater than the threshold value.

3. The data processing system of claim 1 , wherein the specified value range is [−2τη,2τη] where η∈{2,4} and τ∈{39,49,60}.

4. The data processing system of claim 1 , wherein the digital signature algorithm is Dilithium.

5. A data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a fault detection in a digital signature algorithm in a processor, the instructions, comprising:

computing vector z based on a secret nonce vector y, a first secret key vector s_1, and a challenge polynomial c, wherein each of the vector z, the secret nonce vector y, and the first secret key vector s_1 includes a number of polynomials l having a number of coefficients n, wherein the challenge polynomial c has the number of coefficients n, and wherein the number of polynomials l and the number of coefficients n are integers;

right shifting all of the n coefficients of the l polynomials in the vector z by a number of bits a wherein the number of bits a is an integer;

computing a number of the right shifted coefficients of the polynomials in the vector z that have a same value;

computing a digital signature for an input message; and

rejecting the digital signature when the computed number is greater than a threshold value.

6. The data processing system of claim 5 , further comprising accepting the digital signature when the computed number is not greater than the threshold value.

7. The data processing system of claim 5 , wherein the instructions cause the processor to perform a method comprising computing a number of how many of the computed difference values are outside a specified value range, the specified value range is [−2τη,2τη] where η∈{2,4} and τ∈{39,49,60}.

8. The data processing system of claim 5 , wherein the digital signature algorithm is Dilithium.

9. A fault detection method for a digital signature algorithm, comprising:

computing vector z based on a secret nonce vector y, a first secret key vector s_1, and a challenge polynomial c, wherein each of the vector z, the secret nonce vector y, and the first secret key vector s_1 include a number of polynomials l having a number of coefficients n, wherein the challenge polynomial c has the number of coefficients n, and wherein the number of polynomials l and the number of coefficients n are integers;

computing a difference value between all of the n coefficients of the l polynomials in the vector z;

computing a number of how many of the computed difference values are outside a specified value range;

computing a digital signature for an input message; and

rejecting the digital signature when the computed number is greater than a threshold value.

10. The method of claim 9 , further comprising accepting the digital signature when the computed number is not greater than the threshold value.

11. The method of claim 9 , wherein the specified value range is [−2τη,2τη] where η∈{2,4} and τ∈{39,49,60}.

12. The method of claim 9 , wherein the digital signature algorithm is Dilithium.

13. A fault detection method for a digital signature algorithm, comprising:

computing vector z based on a secret nonce vector y, a first secret key vector s_1, and a challenge polynomial c, wherein each of the vector z, the secret nonce vector y, and the first secret key vector s_1 includes a number of polynomials l having a number of coefficients n, wherein the challenge polynomial c has the number of coefficients n, and wherein the number of polynomials l and the number of coefficients n are integers;

right shifting all of the n coefficients of the l polynomials in the vector z by a number of bits a wherein the number of bits a is an integer;

computing a number of right shifted coefficients of the polynomials in the vector z that have a same value;

computing a digital signature for an input message; and

rejecting the digital signature when the computed number is greater than a threshold value.

14. The method of claim 13 , further comprising accepting the digital signature when the computed number is not greater than the threshold value.

15. The method of claim 13 , further comprising computing a number of how many of the computed difference values are outside a specified value range, wherein the specified value range is [−2τη,2τη] where η∈{2,4} and τ∈{39,49,60}.

16. The method of claim 13 , wherein the digital signature algorithm is Dilithium.

Assignments (1)

Continuity (1)

References Cited (25)