Abstract: Cryptographic information is compiled by: (a) determining a first portion of the cryptographic information based on an input and a randomness: (b) checking a rejection criterion based on the first portion; (b1) re-starting step (a) with a different randomness if the rejection criterion is fulfilled; (b2) if not all portions of the cryptographic information have been generated, determining a subsequent portion of the cryptographic information based on the input and the randomness and continuing with step (b) or, otherwise, continuing with step (c); (c) determining the first portion of the cryptographic information based on the input and the randomness; (d) conveying the respective portion of the cryptographic information; and (e) if not all portions of the cryptographic information have been generated, determining a subsequent portion of the cryptographic information based on the input and the randomness and continuing with step (d).

Abstract: Cryptographic information is compiled by: (a) determining a first portion of the cryptographic information based on an input and a randomness; (b) checking a rejection criterion based on the first portion; (b1) re-starting step (a) with a different randomness if the rejection criterion is fulfilled; (b2) if not all portions of the cryptographic information have been generated, determining a subsequent portion of the cryptographic information based on the input and the randomness and continuing with step (b) or, otherwise, continuing with step (c); (c) determining the first portion of the cryptographic information based on the input and the randomness; (d) conveying the respective portion of the cryptographic information; and (e) if not all portions of the cryptographic information have been generated, determining a subsequent portion of the cryptographic information based on the input and the randomness and continuing with step (d).

Abstract: A method is suggested for providing a response, wherein the method comprises: obtaining a challenge from a host, determining the response based on the challenge, determining an auxiliary value based on the response or the challenge, providing the auxiliary value to the host, obtaining a random value from the host, checking the validity of the challenge based on the random value, and providing the response to the host only if the challenge is valid. Also, corresponding methods running on the host and system are provided. Further, corresponding devices, hosts and systems are suggested.

Abstract: A method for executing a cryptographic operation is provided comprising acts comprising: (i) sampling a first polynomial, wherein one or more (e.g., one, some and/or all) coefficients of the first polynomial are determined; (ii) sampling a second polynomial, wherein a selection of k coefficients of the second polynomial is determined; (iii) multiplying the first polynomial with the second polynomial to determine a result; and (iv) using the result of the multiplication in the cryptographic operation. A security device arranged to perform one, some and/or all of the acts is provided.

Abstract: An apparatus for decrypting an encrypted bit sequence comprises a test device configured to subject the bit sequence to a statistical test in view of an expected distribution of the bits in the bit sequence in order to obtain a test result. The apparatus is configured to decrypt the bit sequence should the test result indicate that the distribution follows the expected distribution, and to not decrypt the bit sequence should the test result indicate that the distribution does not follow the expected distribution.

Abstract: A method is suggested for providing a response, wherein the method comprises: obtaining a challenge from a host, determining the response based on the challenge, determining an auxiliary value based on the response or the challenge, providing the auxiliary value to the host, obtaining a random value from the host, checking the validity of the challenge based on the random value, and providing the response to the host only if the challenge is valid. Also, according methods running on the host and system are provided. Further, corresponding devices, hosts and systems are suggested.

Abstract: A method is suggested for providing a response, wherein the method comprises: obtaining a challenge from a host, determining the response based on the challenge, determining an auxiliary value based on the response or the challenge, providing the auxiliary value to the host, obtaining a random value from the host, checking the validity of the challenge based on the random value, and providing the response to the host only if the challenge is valid. Also, corresponding methods running on the host and system are provided. Further, corresponding devices, hosts and systems are suggested.

Abstract: A storage element that is operable based on a system clock signal, the storage element including a clock gating circuitry configured to generate a gated clock signal based on at least one Boolean signal and the system clock signal or a preprocessed system clock signal, wherein the clock gating circuitry comprises physical connections of small capacitance such that tapping of at least one of the physical connections results in a hold-time violation. Also, a hardware-based cryptography accelerator or a secured processing system including at least one such storage element, and a method for operating at least one storage element.

Abstract: A device and method for processing a ciphertext, including determining a seed using a secret key and the ciphertext, extracting a public key candidate from the ciphertext using the seed, determining a checkvalue candidate based on the public key candidate, comparing the checkvalue candidate with a checkvalue, and further processing the ciphertext if the comparison indicates that the checkvalue candidate corresponds to the checkvalue.

Abstract: In various embodiments, a method for performing a lattice-based cryptographic operation is provided. The method includes obtaining a noise polynomial, a secret polynomial and a public polynomial, disguising at least one of the noise polynomial, the secret polynomial and the public polynomial by means of multiplying it with a random blinding polynomial, calculating the sum of the noise polynomial with the product of the public polynomial and the secret polynomial based on the disguised at least one polynomial, and determining a result of the lattice-based cryptographic operation based on the calculated sum of the noise polynomial with the product of the public polynomial and the secret polynomial.

Abstract: A method for providing challenges to a device comprising (i) compiling a first challenge based on a first random value and a parameter; (ii) compiling a second challenge based on a second random value, the parameter and based on the first challenge or any intermediate result thereof; and (iii) providing the first challenge and the second challenge to the device.

Abstract: Cryptographic information is compiled by: (a) determining a first portion of the cryptographic information based on an input and a randomness; (b) checking a rejection criterion based on the first portion; (b1) re-starting step (a) with a different randomness if the rejection criterion is fulfilled; (b2) if not all portions of the cryptographic information have been generated, determining a subsequent portion of the cryptographic information based on the input and the randomness and continuing with step (b) or, otherwise, continuing with step (c); (c) determining the first portion of the cryptographic information based on the input and the randomness; (d) conveying the respective portion of the cryptographic information; and (e) if not all portions of the cryptographic information have been generated, determining a subsequent portion of the cryptographic information based on the input and the randomness and continuing with step (d).

Abstract: A device has a receiver designed to receive a data packet from a communication partner, a data processor to process the data packet in order to obtain a secret value, a transmitter designed to transmit a transmit message having information based on the secret value to the communication partner, and an authentication device designed to receive a challenge message and to use the secret value to create a response message, wherein the transmitter is designed to create the transmit message to include the response message.

Abstract: According to one embodiment, an execution unit is described, which includes a mask generation circuit configured to generate a mask by multiplying a mask generation vector by blocks of codewords of a plurality of cyclic codes, a masking circuit configured to mask data to be processed by means of the mask, and an arithmetic logic unit configured to process the masked data by means of additions and rotations.

Abstract: A method is suggested for providing a response, wherein the method comprises: obtaining a challenge from a host, determining the response based on the challenge, determining an auxiliary value based on the response or the challenge, providing the auxiliary value to the host, obtaining a random value from the host, checking the validity of the challenge based on the random value, and providing the response to the host only if the challenge is valid. Also, according methods running on the host and system are provided. Further, corresponding devices, hosts and systems are suggested.

Abstract: A method for checking results, including (a) determining a first result by conducting an operation g( ) based on test data; (b) determining combined data by performing a combining operation based on the test data and user data; (c) determining a second result conducting the operation g( ) based on the combined data; and (d) determining whether the second result is indicative of the first result.

Abstract: A device comprises a receive device which is designed to receive a data packet from a communication partner. The device comprises a data processing device which is configured to process the data packet in order to obtain a secret (e.g. predetermined) value. The device further comprises a transmit device which is designed to transmit a transmit message comprising information based on the secret value to the communication partner. The device further comprises an authentication device which is designed to receive a challenge message and to use the secret value to create a response message. The transmit device is designed to create the transmit message in such a way that it comprises the response message.

Abstract: An electronic device may include a memory configured to store a cryptographic blockchain address, an input configured to receive at least parts of a blockchain block a verification circuit configured to verify whether the blockchain block includes a transaction with a predetermined property which is addressed to the blockchain address and a controller configured to enable a function of the electronic device if the verification circuit has verified that the blockchain block includes a transaction with the predetermined property which is addressed to the blockchain address.

Abstract: A storage element that is operable based on a system clock signal, the storage element including a clock gating circuitry configured to generate a gated clock signal based on at least one Boolean signal and the system clock signal or a preprocessed system clock signal, wherein the clock gating circuitry comprises physical connections of small capacitance such that tapping of at least one of the physical connections results in a hold-time violation. Also, a hardware-based cryptography accelerator or a secured processing system including at least one such storage element, and a method for operating at least one storage element.

Abstract: A method for conducting an operation including (a) lifting coefficients of a data structure from a representation modulo q to a representation modulo q?, wherein the data structure comprises values which are reduced modulo q, wherein q and are integers; (b) randomizing the coefficients in modulo q?, wherein for each coefficient a random value is multiplied with the value of q and the result of this multiplication is added to the coefficient; (c) conducting an operation on the lifted and randomized coefficients; and (d) reducing the lifted and randomized coefficients by conducting an operation modulo q.