Abstract: Some embodiments are directed to a circuit compiling device for compiling a function into a binary circuit and a function evaluation device for evaluating a function using such a binary circuit. The binary circuit comprises conjunction subcircuits each computing a conjunction of function input bits and XOR subcircuits each computing a function output bit. Each function output bit may be represented as a sum of interpolation terms, the plurality of function input bits and the interpolation terms of the one or more function output bits together forming a plurality of interpolation terms. A conjunction subcircuit computes an interpolation term as a conjunction of two interpolation terms. A XOR subcircuit computes a function output bit as a XOR of interpolation terms. Thereby, the first interpolation term and second interpolation term are also used in XOR subcircuits, hence the binary circuit has a smaller number or likelihood of ineffective faults.

Abstract: Some embodiments are directed to an electronic cryptographic device arranged to perform a cryptographic operation on input data obtaining output data. The cryptographic device stores an internal state as sets of shares. Fourier coefficients corresponding to the sets of shares satisfy a predetermined relationship among them. The cryptographic operation is performed by repeatedly updating the internal state.

Abstract: An electronic key pre-distribution device (110) for configuring multiple network nodes (210, 211) with local key information is provided. The key pre-distribution device comprises applies at least a first hash function (147) and a second hash function (148) to a digital identifier of a network node. The first and second hash functions map the digital identifier to a first public point (141; H1(ID)) and a second public point (142; H2(ID)) on a first elliptic curve (131) and second elliptic curve (132). A first and second secret isogeny (135) is applied to the first and second public elliptic curve point (141, 142), to obtain a first private elliptic curve point (151) and second private elliptic curve point (152) being part of private key material (155) for the network node (210).

Abstract: An electronic calculating device (100) arranged to convert an input number (y) represented ((y1, y2, . . . , yk)) m a residue number system (RNS) to an output number represented in a radix representation ((e0, e1, . . . es?1)), the calculating device comprising an input interface (110) arranged to receive the input number (y) represented in the residue number system, and a processor circuit (120) configured to iteratively update an intermediate number (?) represented in the residue number system, wherein iterations produce the digits (e0, e1, . . . es?1) in the radix representation with respect to the bases (b0, b1, . . . , bs?1), at least one iteration comprises computing the intermediate number modulo a base (bt) of the radix representation to obtain a digit (et=(?)bt) of the radix representation, updating the intermediate number (??(??et+F)/bt) by subtracting the digit from the intermediate number, adding an obfuscating number (F; Ft), and dividing by the base (bt).

Abstract: An electronic key pre-distribution device for configuring multiple network nodes with local key information is provided. The key pre-distribution device applies at least a first hash function and a second hash function to a digital identifier of a network node. The first and second hash functions map the digital identifier to a first public point and a second public point on a first elliptic curve and second elliptic curve. A first and second secret isogeny are applied to the first and second public elliptic curve points, to obtain a first private elliptic curve point and second private elliptic curve point that are part of private key material for the network node.

Abstract: A first device and a second device are disclosed for reaching agreement on a secret value. Herein, the second device comprises a receiver configured to receive information indicative of a reconciliation data h from the first device, a processor configured to compute a common secret s based on an integer value b, an equation, and system parameters. The processor is configured to compute b based on a key exchange protocol. The first device has a number a in approximate agreement with the number b. The first device comprises a processor configured to determine a common secret s based on an integer value a an equation, and system parameters, and determine a reconciliation data h. The first device further comprises a transmitter configured to transmit information indicative of the reconciliation data h to the second device.

Abstract: The invention relates to an operational state determination apparatus (1) for determining whether a variation in a determined electrical parameter of an electrical network (2) is caused by a variation in an operational state of an electrical consumer of the electrical network. The electrical network comprises multiple electrical consumers (3, 4, 5) and a voltage source (6), wherein a variation classification unit (10) determines whether a variation in the determined electrical parameter of the electrical network is caused by a variation in the operational state of an electrical consumer of the network depending on a decision variable which depends on a variation in a measured voltage and a variation in a measured current of the electrical network. This determination can be performed, without directly using the variation in the determined electrical parameter of the electrical network and is therefore less influenced by random voltage fluctuations in the electrical network.

Abstract: Some embodiments are directed to an electronic computation device (100) arranged for obfuscated execution of a multiplication. The device comprises a storage (120) arranged for storing multiple variables used in the execution of an arithmetic operation, a variable (x: y; 2) of the multiple variables being represented as multiple multiplicative shares (X=(x0, x1, . . . , xm?1); Y=(y0, y1, . . . , ym?1); 20), said multiplicative shares being represented in the storage as multiple additive shares (xi=(xi,0,xi,1, . . . , xi,n?1); Yi=(yi,0,yi,1, . . . , yi,n?1); 210, 220).

Abstract: Some embodiments are directed to an electronic cryptographic device arranged to perform a cryptographic operation on input data obtaining output data. The cryptographic device stores an internal state as sets of shares. Fourier coefficients corresponding to the sets of shares satisfy a predetermined relationship among them. The cryptographic operation is performed by repeatedly updating the internal state.

Abstract: A cryptographic device (100) arranged to compute a target block cipher (Bt) on an input message (110), the device comprising a first and second block cipher unit (121, 122) arranged to compute the target block cipher (Bt) on the input message, and a first control unit (130) arranged to take the first block cipher result and the second block cipher result as input, and to produces the first block cipher result only if the block cipher results are equal.

Abstract: Some embodiments are directed to an electronic cryptographic device arranged to perform a cryptographic operation on input data obtaining output data. The cryptographic device stores an internal state as sets of shares. Fourier coefficients corresponding to the sets of shares satisfy a predetermined relationship among them. The cryptographic operation is performed by repeatedly updating the internal state.

Abstract: Some embodiments are directed to an electronic cryptographic device arranged to perform a cryptographic operation on input data obtaining output data. The cryptographic device stores an internal state as sets of shares. Fourier coefficients corresponding to the sets of shares satisfy a predetermined relationship among them. The cryptographic operation is performed by repeatedly updating the internal state.

Abstract: An electronic point multiplication device (100) is provided for computing a point multiplication (kG) on an elliptic curve between a multiplier (k) and a base point (G) on the elliptic curve (E) for use in a cryptographic protocol. The device being arranged to compute from a first set of multiple joint encodings (Ai) a blinded base multiplier (A, 131), and a second set of multiple joint encodings (Bi) multiple blinded auxiliary multipliers (?i, 136). The device performs obtains the point multiplication (141) (kG) of the multiplier (k) and the base point (G) by computing the point addition of the point multiplication of the blinded base multiplier and the base point on the elliptic curve, and the multiple point multiplications of a blinded auxiliary multiplier and an auxiliary point. The blinded base multiplier and auxiliary multipliers may be represented in a plain format during the performing of the elliptic curve arithmetic.

Abstract: Some embodiments are directed to a circuit compiling device for compiling a function into a binary circuit and a function evaluation device for evaluating a function using such a binary circuit. The binary circuit comprises conjunction subcircuits each computing a conjunction of function input bits and XOR subcircuits each computing a function output bit. Each function output bit may be represented as a sum of interpolation terms, the plurality of function input bits and the interpolation terms of the one or more function output bits together forming a plurality of interpolation terms. A conjunction subcircuit computes an interpolation term as a conjunction of two interpolation terms. A XOR subcircuit computes a function output bit as a XOR of interpolation terms. Thereby, the first interpolation term and second interpolation term are also used in XOR subcircuits, hence the binary circuit has a smaller number or likelihood of ineffective faults.

Abstract: A network node (110) is provided configured for a cryptographic protocol based on a shared matrix. The network node is arranged to construct the shared matrix (A) in accordance with the selection data and a shared sequence of values. Multiple entries of the shared matrix are assigned to multiple values of the sequence of data as assigned by the selection data. The shared matrix is applied in the cryptographic protocol.

Abstract: Some embodiments are directed to a computation device for performing a computation on at least a set of values. The values are stored in memory as a plurality of shares that define the value. An operation of the computation may be performed on a set of input values to obtain an output value. The output value may be defined by at least one shared share and at least one computed share. The at least one shared share may also define a further value, e.g., an output of a previously performed computation or an output of a further operation performed in parallel with the operation. The at least one computed share is computed from the at least one shared share and shares of the set of input values. A fault in the shared share affects the further value but a fault in the computed share, complicating share reduction attacks.

Abstract: A first electronic network node (110) is provided configured for goo a key exchange (KEX) protocol, the first network node is configured to—obtain a shared matrix (A) shared with a second network node, entries in the shared matrix A being selected modulo a first modulus q, generate a private key matrix (SI), entries in the private key matrix being bounded in absolute value by a bound (s) generate a public key matrix (PI) by computing a matrix product between the shared matrix (A) and the private key matrix (SI) modulo the first modulus (q) and scaling the entries in the matrix product down to a second modulus (p).

Abstract: A computation device (200) arranged to evaluate a data function (S) mapping a number (n) of input variables to a number of output variables (m). The computation device comprises selection mechanism (220) receiving as input selection variables and an evaluation mechanism (210) arranged to receive the one or more evaluation variables and to evaluate the evaluation functions for the received evaluation variables, an evaluation function receiving as input the evaluation variables.

Abstract: A first electronic network node (110) is provided configured for a key exchange (KEX) protocol, the first network node is configured to obtain a shared polynomial (a) shared with a second network node, coefficients of the shared polynomial a being selected modulo a first modulus q, generate a private key polynomial (skI), coefficients of the private key polynomial being bounded in absolute value by a bound (s) generate a public key polynomial (pkI) by computing a polynomial product between the shared polynomial (a) and the private key polynomial (skI) modulo the first modulus (q) and scaling the coefficients of the polynomial product down to a second modulus (p).

Abstract: A cryptographic system (100) is provided for distributing certificates comprising a certificate authority device (110) and multiple network nodes (140, 150, 160). A network node (140) sends a public key to the certificate authority device. The certificate authority device (110) generate a certificate comprising the public key, forms an identifier by applying an identity forming function to the certificate and generates local key material specific for the network node by applying a local key material generation algorithm of an identity based key pre-distribution scheme on the identifier, and sends the local key material encrypted to the network node. The network node may be authenticated implicitly through its access to a shared key obtainable from the local key material.