Executing digital signature operations in a secure element platform runtime environment

A method, comprising:

• initializing a signature validation object in a secure element (SE) platform runtime environment, wherein the SE platform runtime environment is executing on at least one SE processor of a SE hardware device;
• accessing, via the signature validation object, an authentication path comprising a set of hash values corresponding to a set of nodes of a tree structure associated with a hash-based signature protocol utilized to generate a digital signature;
• computing, via the signature validation object, a root hash value corresponding to a root node of the tree structure based on the set of hash values of the authentication path;
• wherein computing the root hash value of the tree structure comprises:
• computing a first intermediate hash value based at least in part on (a) a public key corresponding to a private key utilized to generate the digital signature and (b) a first hash value of the set of hash values;
• determining that the set of hash values comprises a second hash value that has yet to be utilized in computing the root hash value;
• responsive at least in part to determining that the set of hash values comprises the second hash value, computing a second intermediate hash value at least by applying a hash function to a concatenation of the first intermediate hash value and the second hash value;
• wherein computing the root hash value of the tree structure further comprises:
• prior to determining that the set of hash values comprises the second hash value that has yet to be utilized in computing the root hash value:
• storing the first intermediate hash value in a first transient memory element of the SE hardware device;
• initializing a temporary entry point object comprising a pointer to the first transient memory element;
• responsive at least in part to determining that the set of hash values comprises the second hash value:
• accessing the first intermediate hash value via the temporary entry point object;
• computing the second intermediate hash value at least by applying the hash function to the concatenation of the first intermediate hash value and the second hash value;
• verifying, via the signature validation object, the root hash value against a root public key associated with the digital signature;
• determining, via the signature validation object, that the digital signature is valid responsive at least in part to successfully verifying the root hash value against the root public key.

A system comprising:

• at least one secure element (SE) hardware processor;
• the system being configured to perform operations comprising:
• initializing a signature validation object in a secure element (SE) platform runtime environment,
• wherein the SE platform runtime environment is executing on at least one SE processor of a SE hardware device;
• accessing, via the signature validation object, an authentication path comprising a set of hash values corresponding to a set of nodes of a tree structure associated with a hash-based signature protocol utilized to generate a digital signature;
• computing, via the signature validation object, a root hash value corresponding to a root node of the tree structure based on the set of hash values of the authentication path;
• wherein computing the root hash value of the tree structure comprises:
• computing a first intermediate hash value based at least in part on (a) a public key corresponding to a private key utilized to generate the digital signature and (b) a first hash value of the set of hash values;
• determining that the set of hash values comprises a second hash value that has yet to be utilized in computing the root hash value;
• responsive at least in part to determining that the set of hash values comprises the second hash value, computing a second intermediate hash value at least by applying a hash function to a concatenation of the first intermediate hash value and the second hash value;
• wherein computing the root hash value of the tree structure further comprises:
• prior to determining that the set of hash values comprises the second hash value that has yet to be utilized in computing the root hash value:
• storing the first intermediate hash value in a first transient memory element of the SE hardware device;
• initializing a temporary entry point object comprising a pointer to the first transient memory element;
• responsive at least in part to determining that the set of hash values comprises the second hash value:
• accessing the first intermediate hash value via the temporary entry point object;
• computing the second intermediate hash value at least by applying the hash function to the concatenation of the first intermediate hash value and the second hash value;
• verifying, via the signature validation object, the root hash value against a root public key associated with the digital signature;
• determining, via the signature validation object, that the digital signature is valid responsive at least in part to successfully verifying the root hash value against the root public key.