Constant time secure arithmetic-to-Boolean mask conversion
AssigneeCryptography Research, Inc.
InventorsMichael Hutter, Michael Tunstall
Life of this patent
Estimating the term…
Abstract
A first arithmetic input share and a second arithmetic input share of an initial arithmetically-masked cryptographic value are received. A sequence of operations using the arithmetic input shares and a randomly generated number is performed, where a current operation in the sequence of operations generates a corresponding intermediate value that is used in a subsequent operation. At the end of the sequence of operations, a first Boolean output share and a second Boolean output share are generated. The arithmetic-to-Boolean mask conversion is independent of the input bit length.
Claims20
A computer-implemented method comprising:
- receiving an indication that an initial cryptographic value created using an arithmetic operation is to be converted into a modified cryptographic value that is compatible with Boolean operations, wherein the initial cryptographic value comprises an underlying secret value that is arithmetically masked using a first random number as a mask;
- receiving a first arithmetic input share and a second arithmetic input share of the initial cryptographic value, wherein each of the first and the second arithmetic input shares has a bit length equal to a bit length of the initial cryptographic value;
- generating a second random number whose bit length is the same as the bit length of each of the first and the second arithmetic input shares;
- performing a sequence of operations using the arithmetic input shares and the second random number to generate a first Boolean output share and a second Boolean output share at the end of the sequence of operations, wherein a current operation in the sequence of operations generates a corresponding intermediate value that is used in a subsequent operation in the sequence of operations;
- and
- performing the Boolean operations on both the first Boolean output share and the second Boolean output share independently to create the modified cryptographic value that is Boolean masked.
A system comprising:
- a memory;
- and
- a computer processor operatively coupled with the memory, to:
- receive an indication that an initial cryptographic value created using an arithmetic operation is to be converted into a modified cryptographic value that is compatible with Boolean operations, wherein the initial cryptographic value comprises an underlying secret value that is arithmetically masked using a first random number as a mask;
- receive a first arithmetic input share, and a second arithmetic input share of the initial cryptographic value, wherein both the first and the second arithmetic input shares have a bit length equal to a bit length of the initial cryptographic value;
- generate a second random number whose bit length is the same as the bit length of the first and the second arithmetic input shares;
- perform a sequence of operations using the arithmetic input shares and the second random number to generate a first Boolean output share and a second Boolean output share at the end of the sequence of operations, wherein a current operation in the sequence of operations generates a corresponding intermediate value that is used in a subsequent operation in the sequence of operations;
- and
- perform the Boolean operations on both the first Boolean output share and the second Boolean output share independently to create the modified cryptographic value that is Boolean masked.
Dependencies are inferred from the claim text.