US 11,991,274 B2
Authenticated lattice-based key agreement or key encapsulation
Oscar Garcia Morchon, Eindhoven (NL); Ludovicus Marinus Gerardus Maria Tolhuizen, Waalre (NL); and Sauvik Bhattacharya, Eindhoven (NL)
Assigned to Koninklijke Philips N.V., Eindhoven (NL)
Appl. No. 17/617,607
Filed by KONINKLIJKE PHILIPS N.V., Eindhoven (NL)
PCT Filed Jun. 11, 2020, PCT No. PCT/EP2020/066179
§ 371(c)(1), (2) Date Dec. 9, 2021,
PCT Pub. No. WO2020/254177, PCT Pub. Date Dec. 24, 2020.
Claims priority of application No. 19181035 (EP), filed on Jun. 18, 2019.
Prior Publication US 2022/0231843 A1, Jul. 21, 2022
Int. Cl. H04L 9/08 (2006.01); H04L 9/30 (2006.01)
CPC H04L 9/0844 (2013.01) [H04L 9/3093 (2013.01)] 30 Claims
OG exemplary drawing
 
1. A second cryptographic device comprising:
a communication interface circuit, wherein the communication interface circuit is arranged to communicate with a first cryptographic device using a lattice-based key exchange or a lattice-based key encapsulation key agreement protocol; and
a processor circuit,
wherein the processor circuit is arranged to compute a final seed from a pre-seed and a pre-shared secret,
wherein the pre-seed is received from the first cryptographic device,
wherein the pre-shared secret is pre-shared between the second cryptographic device and the first cryptographic device,
wherein the processor circuit is arranged to compute a common object from the final seed using a deterministic random bit generator or a pseudorandom number generator,
wherein the processor circuit is arranged to obtain a first public-key and a second public-key,
wherein the first public-key is associated with the first cryptographic device,
wherein the second public-key is associated with the second cryptographic device,
wherein the first public-key is computed at the first cryptographic device,
wherein the computation comprises a first multiplication between the common object and a first private-key of the first cryptographic device,
wherein the processor circuit is arranged to compute a second public-key from the second private-key,
wherein computing the second public-key comprises multiplying the second private-key with the common object,
wherein the processor circuit is arranged to compute a second raw key from the first public-key and the second private-key,
wherein computing the second raw key comprises a second multiplication between the second private-key and the first public-key,
wherein the processor circuit is arranged to transfer the second public-key to the first device.