Abstract: Various embodiments relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a cryptographic operation using masked compressing of coefficients of a polynomial having ns arithmetic shares for lattice-based cryptography in a processor, the instructions, including: shifting a first arithmetic share of the ns arithmetic shares by an input mask ?1; scaling the shifted first arithmetic share by a value based on a first compression factor ? and a masking scaling factor ?1; shifting the scaled first arithmetic share by a value based on the masking scaling factor ?1; scaling a second to ns shares of the ns arithmetic shares by a value based on the first compression factor ? and the masking scaling factor ?1; converting the ns scaled arithmetic shares to ns Boolean shares; right shifting the ns Boolean shares based upon the masking scaling factor ?1 and a second compression factor ?2; XORing an output mask ?2 with the shifted first Boolean s

Abstract: plurality of objects that comprise an input to a cryptographic signing function. For each object in the plurality of objects, an output value yi of a hash function is calculated, where the value i is equal to an index value of the object, a compressed output value xi of a compression function is calculated, the output value yi from the computer readable memory, and the compressed output value xi is stored. For each object in the plurality of objects, an output value y?i of the hash function is calculated, where the value i is equal to the index value of the object, a compressed output value x?i of the compression function executed on the output value y?i is calculated, the output value x?i is determined to be equal to the output value xi, and the output value y?i is transmitted in an output data stream.

Abstract: A device includes a computer readable memory storing a plurality of one-time signature (OTS) keypairs and a processor that is configured to execute a hash function on a message using a first private key of a first OTS keypair of the plurality of OTS keypairs to determine a message signature, execute the hash function to calculate a leaf node value of a hash tree using the first OTS keypair, determine a plurality of authentication path nodes in the hash tree, retrieve, from the computer readable memory, values of a first subset of the plurality of authentication path nodes, calculate values for each node in a second subset of the plurality of authentication path nodes, and store, in the computer readable memory, the values for each node in the authentication path and the value of the leaf node.

Abstract: Various embodiments relate to a method for multiplying a first and a second polynomial in a ring q [X]/(Xn+1) where q is a positive integer.

Abstract: Various embodiments relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for signing messages using a plurality of one-time signing (OTS) keys and a binary-hash-tree structure having a height h and a plurality of nodes configured to provide a public key having, including: generating and storing an authentication path A[d:h?1] for a first 2d signatures corresponding to the first 2d OTS keys of the plurality of OTS keys, where d is the height of a sub-tree associated with first 2d OTS keys; initiating a signature counter; signing a first message using the first OTS key of the plurality of OTS keys; incrementing the signature counter; determining if 2d messages have been signed; signing a second message and incrementing the signature counter when 2d messages have not been signed; and updating authentication path A[d:h?1] for a second 2d signatures corresponding to the second 2d OTS keys of the plurality of OTS keys when 2d messages hav

Abstract: A data processing system and a method are provided for recognizing a scanned biometric characteristic in the data processing system. The data processing system includes a biometric sensor, a rich execution environment (REE), and a secure element (SE). In one embodiment, during an enrollment operation, a random challenge is applied to scanned data to produce a biometric template that is stored. During subsequent validation operations, the SE determines if user data includes evidence of the random challenge before providing access to a secure application. Evidence of the random challenge indicates the user data was provided by the biometric sensor. In another embodiment, the sensor data is split between the REE and the SE and partially processed in the SE. The described embodiments prevent a replay attack from being conducted in communications between the REE and the SE.

Abstract: Various embodiments relate to a system for provisioning a cryptographic device, including: a memory; a processor coupled to the memory, wherein the processor is further configured to: determine a maximum PQC private key size, maximum PQC public key size, and maximum PQC updater size of a plurality of post quantum cryptography algorithms; provision memory in the cryptographic device to store a PQC-update non-PQC private key, a secret PQC-update non-PQC public key, PQC private key, PQC public key, and PQC updater based upon the determined maximum PQC private key size, maximum PQC public key size, and maximum updater size; and provision the cryptographic device with the PQC-update non-PQC private key, the secret PQC-update non-PQC public key, a non-PQC secret key, a non-PQC public key, and non-PQC algorithm code configured to carry out non-PQC cryptographic algorithms.

Abstract: Various embodiments relate to a system for provisioning a cryptographic device, including: a memory; a processor coupled to the memory, wherein the processor is further configured to: determine the maximum key generation seed size, maximum PQC private key size, maximum PQC public key size, and maximum PQC updater size of a plurality of post quantum cryptography algorithms; provision memory in the cryptographic device to store a key generation seed, PQC private key, PQC public key, and PQC updater based upon the determined maximum key generation seed size, maximum PQC private key size, maximum PQC public key size, and maximum PQC updater size; and provision the cryptographic device with a non-PQC secret key, a non-PQC public key, and non-PQC algorithm code configured to carry out non-PQC cryptographic algorithms.

Abstract: A method for protecting a machine learning model is provided. In the method, a first machine learning model is trained, and a plurality of machine learning models derived from the first machine learning model is trained. Each of the plurality of machine learning models may be different from the first machine learning model. During inference operation, a first input sample is provided to the first machine learning model and to each of the plurality of machine learning models. The first machine learning model generates a first output and the plurality of machine learning models generates a plurality of second outputs. The plurality of second outputs are aggregated to determine a final output. The final output and the first output are classified to determine if the first input sample is an adversarial input. If it is adversarial input, a randomly generated output is provided instead of the first output.

Abstract: Various embodiments relate to a method for masked decoding of a polynomial a using an arithmetic sharing a to perform a cryptographic operation in a data processing system using a modulus q, the method for use in a processor of the data processing system, including: subtracting an offset ? from each coefficient of the polynomial a; applying an arithmetic to Boolean (A2B) function on the arithmetic shares of each coefficient ai of the polynomial a to produce Boolean shares âi that encode the same secret value ai; and performing in parallel for all coefficients a shared binary search to determine which of coefficients ai are greater than a threshold t to produce a Boolean sharing value {circumflex over (b)} of the bitstring b where each bit of b decodes a coefficient of the polynomial a.

Abstract: A method is provided for detecting copying of a machine learning model. In the method, the first machine learning model is divided into a plurality of portions. Intermediate outputs from a hidden layer of a selected one of the plurality of portions is compared to corresponding outputs from a second machine learning model to detect the copying. Alternately, a first seal may be generated using the plurality of inputs and the intermediate outputs from nodes of the selected portion. A second seal from a suspected copy that has been generated the same way is compared to the first seal to detect the copying. If the first and second seals are the same, then there is a high likelihood that the suspected copy is an actual copy. By using the method, only the intermediate outputs of the machine learning model outputs have to be disclosed to others, thus protecting the confidentiality of the model.

Abstract: Various embodiments relate to a method for multiplying a first and a second polynomial in a ring q[X]/(Xn+1) to perform a cryptographic operation in a data processing system where q is a positive integer, the method for use in a processor of the data processing system, comprising: receiving the first polynomial and the second polynomial by the processor; mapping the first polynomial into k smaller third polynomials over k smaller rings based upon primitive roots of unity, where k is a positive integer; mapping the second polynomial into k smaller fourth polynomials over the k smaller rings based upon primitive roots of unity; applying an isomorphism to the k third polynomials resulting in k fifth polynomials; applying the isomorphism to the k fourth polynomials resulting in k sixth polynomials; applying a Kronecker substitution on the k fifth polynomials and the k sixth polynomials and perform the multiplication of the k fifth polynomials and the k sixth polynomials to produce a multiplication result; applyin

Abstract: Various embodiments relate to a method for securely comparing a first polynomial represented by a plurality of arithmetic shares and a second compressed polynomial represented by a bitstring where the bits in the bitstring correspond to coefficients of the second polynomial, including: performing a first masked shift of the shares of the coefficients of the first polynomial based upon the start of the interval corresponding to the compressed coefficient of the second polynomial and a modulus value; performing a second masked shift of the shares of the coefficients of the first polynomial based upon the end of the interval corresponding to the compressed coefficient of the second polynomial; bitslicing the most significant bit of the first masked shift of the shares coefficients of the first polynomial; bitslicing the most significant bit of the second masked shift of the shares coefficients of the first polynomial; and combining the first bitsliced bits and the second bitsliced bits using an AND function to p

Abstract: Various embodiments relate to a hardware device configured to compute a plurality of chained hash functions in parallel, including: a processor implementing p hash functions configured to operate on a small input, where p is an integer; a data unit connected to the plurality of hash functions, configured to store the outputs of plurality of hash functions that are then used as the input to a next round of computing the hash function, wherein the processor receives a single instruction and p small data inputs, and wherein each of the p hash functions are used to perform a chained hash function operation on a respective small input of the p small inputs.

Abstract: A method for protecting a first machine learning (ML) model is provided. In the method, a dataset of non-problem domain (NPD) data is selected from a large dataset using a second ML model. The second ML model classifies the large dataset into NPD classifications and PD classifications. The PD classified data is excluded. A distinguisher includes a third ML model that is trained using selected NPD data from the large dataset. The distinguisher receives input samples that are intended for the first ML model. The third ML model provides either a PD classification or NPD classification in response to receiving each input sample. An indication of a likely extraction attempt may be provided when a predetermined number of NPD classifications are provided. The method provides an efficient way to create a training dataset for a distinguisher and for protecting a ML model with the distinguisher.

Abstract: A biometric authentication method is provided. In the method, identification information is collected from a user. A biometric scanner is used to scan a particular biometric characteristic of the user. If the user identification corresponds to the scanned biometric characteristic, then the scanner requests the user perform a predetermined action of a portion of the user's body. The predetermined action may be, for example, a hand gesture. The biometric characteristic is monitored while the predetermined action is being scanned. The scanner determines that the predetermined action is performed with the same portion of the user's body that was scanned for the biometric characteristic. The scanner determines if the portion of the user's body leaves the scanning area and monitors the scanning area for extraneous objects. The method provides more resistance against a replay attack.

Abstract: A method and machine learning system for detecting adversarial examples is provided. A first machine learning model is trained with a first machine learning training data set having only training data samples with robust features. A second machine learning model is trained with a second machine learning training data set, the second machine learning training data set having only training data samples with non-robust features. A feature is a distinguishing element in a data sample. A robust feature is more resistant to adversarial perturbations than a non-robust feature. A data sample is provided to each of the first and second trained machine learning models during an inference operation. if the first trained machine learning model classifies the data sample with high confidence, and the second trained machine learning model classifies the data sample differently with a high confidence, then the data sample is determined to be an adversarial example.

Abstract: Various embodiments relate to a method and system for securely comparing a first and second polynomial, including: selecting a first subset of coefficients of the first polynomial and a second subset of corresponding coefficients of the second polynomial, wherein the coefficients of the first polynomial are split into shares and the first and second polynomials have coefficients; subtracting the second subset of coefficients from one of the shares of the first subset of coefficients; reducing the number of elements in the first subset of coefficients to elements by combining groups of / elements together; generating a random number for each of the elements of the reduced subset of coefficients; summing the product of each of the elements of the reduced subset of coefficients with their respective random numbers; summing the shares of the sum of the products; and generating an output indicating that the first polynomial does not equal the second polynomial when the sum does not equal zero.

Abstract: A method and data processing system are provided for determining if a machine learning model has been copied. The machine learning model has a plurality of nodes, the plurality of nodes is organized as a plurality of interconnected layers, and the plurality of interconnected layers includes an input layer and an output layer. The output layer has a predetermined number of output nodes for classifying input samples into a predetermined number of categories, where each output node corresponds to a category. An additional watermarking node is added to the output layer. The model is trained to classify the input data into the predetermined number of categories and into an additional category for the additional node. The additional node may be added to another model to determine if the another model is a copy or clone of the ML model.

Abstract: Various embodiments relate to a method for securely comparing a first polynomial represented by a plurality of arithmetic shares and a second compressed polynomial represented by a bitstring where the bits in the bitstring correspond to coefficients of the second polynomial, including: performing a first masked shift of the shares of the coefficients of the first polynomial based upon the start of the interval corresponding to the compressed coefficient of the second polynomial and a modulus value; performing a second masked shift of the shares of the coefficients of the first polynomial based upon the end of the interval corresponding to the compressed coefficient of the second polynomial; bitslicing the most significant bit of the first masked shift of the shares coefficients of the first polynomial; bitslicing the most significant bit of the second masked shift of the shares coefficients of the first polynomial; and combining the first bitsliced bits and the second bitsliced bits using an AND function to p