Abstract: Methods and systems for detecting fault injection attacks in digital signatures include initiating a first counter to count a number of digital signature candidates, initiating a second counter to count a number of digital signature candidates which fail security checks, incrementing the first counter for each generated digital signature candidate, selecting a size ? and parsing the first counter in block intervals of said size ?, performing a security check on each digital signature candidate, incrementing the second counter when a digital signature candidate fails the security check, and, when the first counter is an integer multiple of ?: assigning a third counter to a last completed block interval to count failed security checks, comparing the third counter with a criterion based on a probabilistic threshold and on said size ?. In response to the third counter not fulfilling the criterion, the method detects a fault injection attack.

Abstract: A device may include a computer-readable memory and an integrated circuit including a processor configured to implement a cryptographic operation, wherein the cryptographic operation enables computation of a cryptographic result using a bit masking value y. The processor may be configured to access the computer-readable memory to determine a set of bit indexes, wherein each bit index in the set of bit indexes is associated with a bit value in the bit masking value y, for each bit index in the set of bit indexes, calculate an adaptive share value in which the bit value associated with the bit index is masked, and execute a cryptographic operation using the adaptive share value.

Abstract: A system and method of carrying out a binary arithmetic operation in a cryptographic operation for lattice-based cryptography. The variables used in the binary arithmetic operation may have their bits randomly rotated to counter side channel attacks. An addition and multiplication operation on variables with rotated bits are disclosed.

Abstract: A method is proposed to improve the resistance of signature generation against physical attacks. The method may include obtaining a message to be signed, obtaining a key transformation parameter, and obtaining a secret key that is orthogonal to a public key. The method may include transforming the secret key based on the key transformation parameter to generate a transformed secret key while maintaining the orthogonality of the secret key and the public key; and generating the cryptographic signature for the obtained message based on the transformed secret key.

Abstract: A data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a fault detection in a digital signature algorithm in a processor, the instructions, including: computing vector z based on a secret nonce vector y, a first secret key vector s1, and a challenge polynomial c, wherein vectors z, y, and s1 include l polynomials having n coefficients, wherein polynomial c has n coefficients, and wherein l and n are integers; computing a difference value between all of the coefficients of the polynomials in the vector z; computing a number of how many of the computed difference values are outside a specified value range; computing a digital signature for an input message; and rejecting the digital signature when the computed number is greater than a threshold value.

Abstract: A system and method of carrying out a binary arithmetic operation in a cryptographic operation for lattice-based cryptography. The variables used in the binary arithmetic operation may have their bits randomly rotated to counter side channel attacks. An addition and multiplication operation on variables with rotated bits are disclosed.

Abstract: A data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a fault detection in a digital signature algorithm in a processor, the instructions, including: computing vector z based on a secret nonce vector y, a first secret key vector s1, and a challenge polynomial c, wherein vectors z, y, and s1 include l polynomials having n coefficients, wherein polynomial c has n coefficients, and wherein l and n are integers; computing a difference value between all of the coefficients of the polynomials in the vector z; computing a number of how many of the computed difference values are outside a specified value range; computing a digital signature for an input message; and rejecting the digital signature when the computed number is greater than a threshold value.

Abstract: A device may include a computer-readable memory and an integrated circuit including a processor configured to implement a cryptographic operation, wherein the cryptographic operation enables computation of a cryptographic result using a bit masking value y. The processor may be configured to access the computer-readable memory to determine a set of bit indexes, wherein each bit index in the set of bit indexes is associated with a bit value in the bit masking value y, for each bit index in the set of bit indexes, calculate an adaptive share value in which the bit value associated with the bit index is masked, and execute a cryptographic operation using the adaptive share value.

Abstract: Various implementations relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a cryptographic operation including a masked decomposition of a polynomial a having ns arithmetic shares into a high part a1 and a low part a0 for lattice-based cryptography in a processor, the instructions, including: performing a rounded Euclidian division of the polynomial a by a base ? to compute t(?)A; extracting Boolean shares a1(?)B from n low bits of t by performing an arithmetic share to Boolean share (A2B) conversion on t(?)A and performing an AND with ??1, where ?=???1 is a power of 2; unmasking a1 by combining Boolean shares of a1(?)B; calculating arithmetic shares a0(?)A of the low part a0; and performing a cryptographic function using a1 and a0(?)A.

Abstract: Various embodiments relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a cryptographic operation using masked compressing of coefficients of a polynomial having ns arithmetic shares for lattice-based cryptography in a processor, the instructions, including: shifting a first arithmetic share of the ns arithmetic shares by an input mask ?1; scaling the shifted first arithmetic share by a value based on a first compression factor ? and a masking scaling factor ?1; shifting the scaled first arithmetic share by a value based on the masking scaling factor ?1; scaling a second to ns shares of the ns arithmetic shares by a value based on the first compression factor ? and the masking scaling factor ?1; converting the ns scaled arithmetic shares to ns Boolean shares; right shifting the ns Boolean shares based upon the masking scaling factor ?1 and a second compression factor ?2; XORing an output mask ?2 with the shifted first Boolean s

Abstract: Various embodiments relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for masked sampling of polynomials for lattice-based cryptography in a processor, the instructions, including: determining a number m of random bits to be sampled based upon a sample bound parameter ?; producing a plurality of Boolean masked shares of a polynomial coefficient each having the determined number m of random bits using a uniform random function; determining that the polynomial coefficient is within a range of values based upon the sample bound parameter ?; converting the plurality of Boolean masked shares of the polynomial coefficient to a plurality of arithmetic masked shares of the polynomial coefficient; and shifting the plurality of arithmetic masked shares based upon the sample bound parameter ?.

Abstract: Various implementations relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a cryptographic operation including a masked decomposition of a polynomial a having ns arithmetic shares into a high part a1 and a low part a0 for lattice-based cryptography in a processor, the instructions, including: performing a rounded Euclidian division of the polynomial a by a base ? to compute t(?)A; extracting Boolean shares a1(?)B from n low bits of t by performing an arithmetic share to Boolean share (A2B) conversion on t(?)A and performing an AND with ??1, where ?=???1 is a power of 2; unmasking a1 by combining Boolean shares of a1(?)B; calculating arithmetic shares a0(?)A of the low part a0; and performing a cryptographic function using a1 and a0(?)A.

Abstract: Various embodiments relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for masked sampling of polynomials for lattice-based cryptography in a processor, the instructions, including: determining a number m of random bits to be sampled based upon a sample bound parameter ?; producing a plurality of Boolean masked shares of a polynomial coefficient each having the determined number m of random bits using a uniform random function; determining that the polynomial coefficient is within a range of values based upon the sample bound parameter ?; converting the plurality of Boolean masked shares of the polynomial coefficient to a plurality of arithmetic masked shares of the polynomial coefficient; and shifting the plurality of arithmetic masked shares based upon the sample bound parameter ?.