Back to results
US 2023/0155828 A1Published application
Reduction and conversion of a scalar to a tau-adic representation
AssigneeSTMicroelectronics (Rousset) SAS
InventorGuilhem ASSAEL
Life of this patent
Estimating the term…
Abstract
The present disclosure relates to a cryptographic method including the execution, by a cryptographic circuit, of an algorithm applied to a scalar in order to generate an output vector, of length L+n, which digits are d0, . . . , dL+n−1, the algorithm comprising iterations i, each iteration i taking an input data value, initially equal to said scalar and an input vector of length c, which digits are d′i, . . . , d′i+c−1, where for each j∈{i, . . . , i+c−1}, the digit d′j is such that: d j ′ = { d j if j < L d j - m otherwise .
Claims35
A method comprising:
- performing a cryptographic operation;
- and
- protecting the performing of the cryptographic operation, the performing the cryptographic operation and the protecting including:
- execution, by a cryptographic circuit, of an algorithm applied to a scalar to generate an output vector, of length L+n, having digits d0, . . . , dl+n−1, the algorithm comprising a number of iterations i, each iteration i taking an input data value (ρ), initially equal to said scalar and an input vector of length c, having digits d′i, . . . , d′i+c−1, where for each j∈{i, . . . , i+c−1}, the digit d′j is determined according to
- d
- j
- ′
- =
- {
- d
- j
-
- if
-
- j
- <
- L
- d
- j
- -
- m
-
- otherwise
- ,
- where m, L and n are positive integers and each iteration i comprises:
- a) calculating a first intermediate data value (u) by a first operation applied, modulo τ, to the first input data (ρ) and to the input vector, wherein τ is a complex number;
- b) updating the value of the first input data value (ρ) by a second operation applied to the first input data value, to the input vector, to the first intermediate data value (u), and to τ;
- and
- c) setting a digit (di) at position i of the output vector equal to the first intermediate data value (u),
- wherein the number of iterations is determined by the cryptographic circuit based on a stop criterion and wherein coordinates of the output vector (d0, . . . , dL+n−1) correspond to digits of the scalar in a reduced τ-adic form.
27 more elements
A non-transitory computer readable medium having contents which cause a cryptographic circuit to perform a method, the method comprising:
- performing a cryptographic operation;
- and
- protecting the performing of the cryptographic operation, the performing the cryptographic operation and the protecting including:
- executing an algorithm applied to a scalar to generate an output vector, of length L+n, having digits d0, . . . , dL+n−1, the algorithm comprising a number of iterations i, each iteration i taking an input data value (ρ), initially equal to said scalar and an input vector of length c, having digits d′i, . . . , d′i+c−1, where for each j∈{i, . . . , i+c−1}, the digit d′j is determined according to
- d
- j
- ′
- =
- {
- d
- j
-
- if
-
- j
- <
- L
- d
- j
- -
- m
-
- otherwise
- ,
- where m, L and n are positive integers and each iteration i comprises:
- a) calculating a first intermediate data value (u) by a first operation applied, modulo τ, to the first input data (ρ) and to the input vector, wherein τ is a complex number;
- b) updating the value of the first input data value (ρ) by a second operation applied to the first input data value, to the input vector, to the first intermediate data value (u), and to τ;
- and
- c) setting a digit (di) at position i of the output vector equal to the first intermediate data value (u),
- wherein the number of iterations is determined by the cryptographic circuit based on a stop criterion and wherein coordinates of the output vector (d0, . . . , dL+n−1) correspond to digits of the scalar in a reduced τ-adic form.
27 more elements
A device, comprising:
- a memory;
- and
- cryptographic circuitry coupled to the memory, wherein the cryptographic circuitry, in operation, performs a cryptographic operation and protects the performing of the cryptographic operation, the performing the cryptographic operation and the protecting including:
- executing an algorithm applied to a scalar to generate an output vector, of length L+n, having digits d0, . . . , dL+n−1, the algorithm comprising a number of iterations i, each iteration i taking an input data value (ρ), initially equal to said scalar and an input vector of length c, having digits d′i, . . . , d′i+c−1, where for each j∈{i, . . . , i+c−1}, the digit d′j is determined according to
- d
- j
- ′
- =
- {
- d
- j
-
- if
-
- j
- <
- L
- d
- j
- -
- m
-
- otherwise
- ,
- where m, L and n are positive integers and each iteration i comprises:
- a) calculating a first intermediate data value (u) by a first operation applied, modulo τ, to the first input data (ρ) and to the input vector, wherein τ is a complex number;
- b) updating the value of the first input data value (ρ) by a second operation applied to the first input data value, to the input vector, to the first intermediate data value (u), and to τ;
- and
- c) setting a digit (di) at position i of the output vector equal to the first intermediate data value (u),
- wherein the number of iterations is determined by the cryptographic circuit based on a stop criterion and wherein coordinates of the output vector (d0, . . . , dL+n−1) correspond to digits of the scalar in a reduced τ-adic form.
27 more elements
A system, comprising:
- a host processor;
- and
- cryptographic circuitry coupled to the host processor, wherein the cryptographic circuitry, in operation, performs a cryptographic operation and protects the performing of the cryptographic operation, the performing the cryptographic operation and the protecting including:
- executing an algorithm applied to a scalar to generate an output vector, of length L+n, having digits d0, . . . , dL+n−1, the algorithm comprising a number of iterations i, each iteration i taking an input data value (ρ), initially equal to said scalar and an input vector of length c, having digits d′i, . . . , d′i+c−1, where for each j∈{i, . . . , i+c−1}, the digit d′j is determined according to
- d
- j
- ′
- =
- {
- d
- j
-
- if
-
- j
- <
- L
- d
- j
- -
- m
-
- otherwise
- ,
- where m, L and n are positive integers and each iteration i comprises:
- a) calculating a first intermediate data value (u) by a first operation applied, modulo τ, to the first input data (ρ) and to the input vector, wherein τ is a complex number;
- b) updating the value of the first input data value (ρ) by a second operation applied to the first input data value, to the input vector, to the first intermediate data value (u), and to τ;
- and
- c) setting a digit (di) at position i of the output vector equal to the first intermediate data value (u),
- wherein the number of iterations is determined by the cryptographic circuit based on a stop criterion and wherein coordinates of the output vector (d0, . . . , dL+n−1) correspond to digits of the scalar in a reduced τ-adic form.
27 more elements
Dependencies are inferred from the claim text.