US2014153716A1PendingUtilityA1
White-box implementation
Est. expiryMar 5, 2028(~1.6 yrs left)· nominal 20-yr term from priority
H04L 9/16H04L 9/06H04L 9/30H04L 2209/16G06F 7/723
41
PatentIndex Score
0
Cited by
0
References
0
Claims
Abstract
A system for enabling a device to compute an outcome of an exponentiation C x having a base C and/or an exponent x, the system comprising means for establishing a plurality of values λ i ; means for establishing a plurality of values ω i satisfying ω i =C λi ; means for establishing a plurality of values φi satisfying that the sum of the values λ iφi equals x; and an output for providing the device with the plurality of values φ i . A device computes an outcome of the exponentiation C x . The device comprises means for computing a product of the values ω i to the power of φ i . The device is arranged for using the product as a result of the exponentiation C x .
Claims
exact text as granted — not AI-modified1 - 16 . (canceled)
17 . A method for computation of an outcome of an exponentiation C x having a base C and an exponent x by means of a white-box implementation of the exponentiation, the method comprising:
receiving information indicative of at least a part of a plurality of values ω i and at least a part of information indicative of a plurality of values φ i , the plurality of values ω i satisfying ω i =C λ i , the plurality of values φ i , satisfying
x
=
∑
i
=
1
r
λ
i
ϕ
i
,
i=1, 2, . . . , r ; and
encrypting a message to obtain a ciphertext and/or decrypting the ciphertext to obtain the message, by using
P
=
∏
i
=
1
r
ω
i
ϕ
i
wherein P=C x , thereby hiding at least one of the precise value of the base C and exponent x from a white-box attack.
18 . The method according to claim 17 , wherein the base C is a ElGamal public key.
19 . The method according to claim 17 , wherein encrypting a message m comprises:
generating a ciphertext including calculating α k2 by using P, k2 corresponding to x, α being associated with the key.
20 . The method according to claim 19 , wherein generating a ciphertext comprises:
generating the ciphertext given by (γ, δ) by using P, γ=α k1 , δ=m·(α a ) k1 ·α k2 α being associated with a public key g being a function, α being associated with a private key, 1≦k1≦n−1, k2=g(γ).
21 . The method according to claim 17 , wherein decrypting a ciphertext comprises:
decrypting a ciphertext including calculating α k2 by using P, k2 corresponding to x, α being associated with the key.
22 . The method according to claim 21 , wherein decrypting a ciphertext comprises:
decrypting the ciphertext given by (γ, δ) by using P to obtain the message m given by γ −a ·α −k2 ·δ, γ=α k1 , δ=m·(α a ) k1 ·α k2 , a being associated with a public key, g being a function, α being associated with a private key, 1≦k1≦n−1, k2=g(δ).
23 . A non-transitory computer readable storage storing a program comprising instructions, which when executed by a processor, causes the processor to perform computation of an outcome of an exponentiation C x having a base C and an exponent x by means of a white-box implementation of the exponentiation, comprising:
receiving a device with information indicative of at least a part of a plurality of values ω i and at least a part of information indicative of a plurality of values φ i , the plurality of values ω i satisfying ω i =C λ i , the plurality of values φ i satisfying
x
=
∑
i
=
1
r
λ
i
ϕ
i
,
i=1, 2, . . . , r; and
encrypting a message m to obtain a ciphertext and/or decrypting the ciphertext to obtain the message m, by using
P
=
∏
i
=
1
r
ω
i
ϕ
i
wherein P=C x , thereby hiding at least one of the precise value of the base C and exponent x from a white-box attack.
24 . A method for computation of an outcome of an exponentiation C x having a base C and an exponent x by means of a white-box implementation of the exponentiation, the method comprising:
establishing a plurality of values λ i , for i=1, 2, . . . , r, establishing a plurality of values ω i for i=1, 2, . . . , r, satisfying ω i =C λ i , C being associated with a key of a cipher, establishing a plurality of values φ i , for i=1, 2, . . . , r, satisfying
x
=
∑
i
=
1
r
λ
i
ϕ
i
;
and
providing a device with information indicative of at least a part of the plurality of values ω i and at least a part of information indicative of the plurality of values φ i to calculate
P
=
∏
i
=
1
r
ω
i
ϕ
i
wherein P=C x , thereby hiding at least one of the precise values of the base C and exponent x from a white-box attack.
25 . The method according to claim 24 , wherein the base C is a ElGamal public key.
26 . The method according to claim 24 , wherein encrypting a message m comprises:
generating a ciphertext including calculating α k2 by using P, k2 corresponding to x, α being associated with the key.
27 . The method according to claim 26 , wherein generating a ciphertext comprises:
generating the ciphertext given by (γ, δ) by using P, γ=α k1 , δ=m·(α a ) k1 ·α k2 , α being associated with a public key g being a function, α being associated with a private key, 1≦k1≦n−1, k2=g(γ).
28 . The method according to claim 24 , wherein decrypting a ciphertext comprises:
decrypting a ciphertext including calculating α −k2 by using P, k2 corresponding to x, α being associated with the key.
29 . The method according to claim 28 , wherein decrypting a ciphertext comprises:
decrypting the ciphertext given by (γ, δ) by using P to obtain the message m given by γ −a ·α −k2 ·δ, γ=α k1 , δ=m·(α a ) k1 ·α k2 , α being associated with a public key, g being a function, α being associated with a private key, 1≦k1≦n−1, k2=g(γ).
30 . The method according to claim 17 , wherein the exponent x is variable, and wherein establishing a plurality of values λ i comprises:
establishing a set V of values to be used as the exponent x, and a plurality of sets of values W 1 , W 2 . . . , W r such that
V
⊆
{
∑
i
=
1
r
λ
i
·
w
i
(
w
1
,
w
2
,
…
,
w
r
)
∈
W
1
×
W
2
×
…
×
W
r
}
.
31 . The method according to claim 30 , wherein establishing the plurality of values φ i comprises:
selecting the values φ i such that φ i ∈W i , for i 1, 2, . . . , r.
32 . The method according to claim 24 , wherein W i ={0,1}, for i=1, 2, . . . , r.
33 . The method according to claim 24 , wherein C is of order q, q being a positive integer such that C x =1.
34 . The method according to claim 17 , comprising at least one of:
selecting different pluralities of values λ i with respect to the base C and the exponent x, to be used in respect of different devices; and selecting different values r with respect to the base C and the exponent x, in respect of different devices.
35 . The method according to claim 17 , comprising at least one of:
selecting wherein r is an integer and r≧2; generating the key; encrypting and/or decrypting information indicative of the plurality of values ω i and information indicative of the plurality of values φ i .
36 . A non-transitory computer readable storage storing a program comprising instructions, which when executed by a processor, causes the processor to perform computation of an outcome of an exponentiation C x having a base C and an exponent x by means of a white-box implementation of the exponentiation, comprising:
establishing a plurality of values λ i , for i=1, 2, . . . , r, establishing a plurality of values ω i for i=1, 2, . . . , r, satisfying ω i =C λ i , C being associated with a key of a cipher, establishing a plurality of values ω i , for i1, 2, . . . , r, satisfying
x
=
∑
i
=
1
r
λ
i
ϕ
i
;
and
providing a device with information indicative of at least a part of the plurality of values ω i and at least a part of information indicative of the plurality of values φ i to calculate
P
=
∏
i
=
1
r
ω
i
ϕ
i
wherein P=C x , thereby hiding at least one of the precise values of the base C and exponent x from a white-box attack.Join the waitlist — get patent alerts
Track US2014153716A1 — get alerts on status changes and closely related new filings.
We store only your email — no account needed. See our privacy policy.