US 12,335,365 B2
Protection of transformations by intermediate randomization in cryptographic operations
Michael Alexander Hamburg, 's-Hertogenbosch (NL); Helena Handschuh, Palo Alto, CA (US); and Mark Evan Marson, Carlsbad, CA (US)
Assigned to CRYPTOGRAPHY RESEARCH, INC., San Jose, CA (US)
Appl. No. 18/008,602
Filed by CRYPTOGRAPHY RESEARCH, INC., San Jose, CA (US)
PCT Filed Jun. 4, 2021, PCT No. PCT/US2021/036005
§ 371(c)(1), (2) Date Dec. 6, 2022,
PCT Pub. No. WO2021/252294, PCT Pub. Date Dec. 16, 2021.
Claims priority of provisional application 62/705,027, filed on Jun. 8, 2020.
Prior Publication US 2023/0254115 A1, Aug. 10, 2023
Int. Cl. H04L 9/06 (2006.01); G06F 17/14 (2006.01)
CPC H04L 9/0631 (2013.01) [G06F 17/142 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method to perform a cryptographic operation that comprises a number theoretic transformation (NTT) of a first vector to a second vector, the method comprising:
obtaining, by a processing device, components of the first vector;
obtaining, by the processing device, one or more random numbers;
performing, by the processing device, a plurality of iterations, wherein each of the plurality of iterations comprises:
determining a plurality of output values, wherein each of the plurality of output values is a linear combination of two or more input values;
wherein (1) the input values into a first iteration of the plurality of iterations are the components of the first vector, (2) the input values into each subsequent iteration of the plurality of iterations are the output values of a previous iteration of the plurality of iterations, (3) the output values of the last of the plurality of iterations are representative of components of the second vector, and wherein one or more of the output values of a first randomized iteration of the plurality of iterations are randomized using a first randomization operation that comprises multiplying at least one input value into the first randomized iteration by a first random number of the one or more random numbers; and
determining, by the processing device, based on the output values of the last of the plurality of iterations, the components of the second vector.