UNIFIED ACCELERATOR FOR CLASSICAL AND POST-QUANTUM DIGITAL SIGNATURE SCHEMES IN COMPUTING ENVIRONMENTS

• US 20190319804A1
• Filed: 06/28/2019
• Published: 10/17/2019
• Est. Priority Date: 06/28/2019
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: MATHEW, SANU, SASTRY, MANOJ, GHOSH, SANTOSH, SURESH, VIKRAM, REINDERS, ANDREW H., KUMAR, RAGHAVAN, MISOCZKI, RAFAEL
• Granted Patent: US 11,456,877 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
• CPC Class Codes: H04L 2209/122 Hardware reduction or efficient architectures
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A mechanism is described for facilitating unified accelerator for classical and post-quantum digital signature schemes in computing environments, according to one embodiment. A method of embodiments, as described herein, includes unifying classical cryptography and post-quantum cryptography through a unified hardware accelerator hosted by a trusted platform of the computing device. The method may further include facilitating unification of a first finite state machine associated with the classical cryptography and a second finite state machine associated with the post-quantum cryptography though one or more of a single the hash engine, a set of register file banks, and a modular exponentiation engine.

Claims

1. At least one machine-readable medium comprising instructions which, when executed by a computing device, cause the computing device to perform operations comprising:

unifying classical cryptography and post-quantum cryptography through a unified hardware accelerator hosted by a trusted platform of the computing device; and

facilitating unification of a first finite state machine associated with the classical cryptography and a second finite state machine associated with the post-quantum cryptography though one or more of a single the hash engine, a set of register file banks, and a modular exponentiation engine.

2. The machine-readable medium of claim 1, wherein the first finite state machine comprises a classical public key cryptography signatures (PKCS) finite state machine, and wherein the second finite state machine comprises an extended Merkel signature scheme (XMSS) finite state machine, wherein the trusted platform includes a field-programmable gate array (FPGA) platform coupled to one or more processors including a central processing unit.

3. The machine-readable medium of claim 1, wherein the operations further comprise allowing the hash engine, the set of register file banks, and the modular exponentiation engine access to a memory based on a direct memory access, wherein the hash engine comprises a secure hash algorithm (SHA) engine.

4. The method of claim 1, wherein the operations further comprise:

computing a bitmask based on an address and a seed and writing the bitmask to a first bank of the set of register file banks using the hash engine; and

computing a key based on the address and the seed and writing the key to a second bank of the set of register file banks using the hash engine.

5. The machine-readable medium of claim 4, wherein the operations further comprise fetching a first hash function from a third back of the set of register file banks and adding the first hash function to the bitmask in the first bank.

6. The machine-readable medium of claim 5, wherein the operations further comprise:

appending results of the addition of the first hash function to the bitmask to the key;

computing a second hash function based on the results using the hash engine;

writing the results to the third bank; and

upon completing a signature and verification loop, fetching the results from the third bank through direct memory access.

7. The machine-readable medium of claim 1, wherein the computing device comprises the one or more processors including one or more of the central processing unit and a graphics processing unit, wherein the one or more processors are co-located on a common semiconductor package.

8. A method comprising:

unifying classical cryptography and post-quantum cryptography through a unified hardware accelerator hosted by a trusted platform of the computing device; and

facilitating unification of a first finite state machine associated with the classical cryptography and a second finite state machine associated with the post-quantum cryptography though one or more of a single the hash engine, a set of register file banks, and a modular exponentiation engine.

9. The method of claim 8, wherein the first finite state machine comprises a classical public key cryptography signatures (PKCS) finite state machine, and wherein the second finite state machine comprises an extended Merkel signature scheme (XMSS) finite state machine, wherein the trusted platform includes a field-programmable gate array (FPGA) platform coupled to one or more processors including a central processing unit.

10. The method of claim 8, further comprising allowing the hash engine, the set of register file banks, and the modular exponentiation engine access to a memory based on a direct memory access, wherein the hash engine comprises a secure hash algorithm (SHA) engine.

11. The method of claim 8, further comprising:

computing a bitmask based on an address and a seed and writing the bitmask to a first bank of the set of register file banks using the hash engine; and

computing a key based on the address and the seed and writing the key to a second bank of the set of register file banks using the hash engine.

12. The method of claim 11, further comprising fetching a first hash function from a third back of the set of register file banks and adding the first hash function to the bitmask in the first bank.

13. The method of claim 12, further comprising:

appending results of the addition of the first hash function to the bitmask to the key;

computing a second hash function based on the results using the hash engine;

writing the results to the third bank; and

upon completing a signature and verification loop, fetching the results from the third bank through direct memory access.

14. The method of claim 8, wherein the method is facilitated by a computing device having one or more processors including one or more of the central processing unit and a graphics processing unit, wherein the one or more processors are co-located on a common semiconductor package.

15. An apparatus comprising:

one or more processors to;

unify classical cryptography and post-quantum cryptography through a unified hardware accelerator hosted by a trusted platform of the computing device; and

facilitate unification of a first finite state machine associated with the classical cryptography and a second finite state machine associated with the post-quantum cryptography though one or more of a single the hash engine, a set of register file banks, and a modular exponentiation engine.

16. The apparatus of claim 15, wherein the first finite state machine comprises a classical public key cryptography signatures (PKCS) finite state machine, and wherein the second finite state machine comprises an extended Merkel signature scheme (XMSS) finite state machine, wherein the trusted platform includes a field-programmable gate array (FPGA) platform coupled to one or more processors including a central processing unit.

17. The apparatus of claim 15, wherein the one or more processors are further to allow the hash engine, the set of register file banks, and the modular exponentiation engine access to a memory based on a direct memory access, wherein the hash engine comprises a secure hash algorithm (SHA) engine.

18. The apparatus of claim 15, wherein the one or more processors are further to:

compute a bitmask based on an address and a seed and writing the bitmask to a first bank of the set of register file banks using the hash engine; and

compute a key based on the address and the seed and writing the key to a second bank of the set of register file banks using the hash engine.

19. The apparatus of claim 18, wherein the one or more processors are further to fetch a first hash function from a third back of the set of register file banks and adding the first hash function to the bitmask in the first bank.

20. The apparatus of claim 19, wherein the one or more processors are further to:

append results of the addition of the first hash function to the bitmask to the key;

compute a second hash function based on the results using the hash engine;

write the results to the third bank; and

upon completing a signature and verification loop, fetch the results from the third bank through direct memory access, wherein the one or more processors include one or more of the central processing unit and a graphics processing unit, wherein the one or more processors are co-located on a common semiconductor package.