WO2017103226A1 - Improved system for key sharing - Google Patents

Abstract

A first network device (300) arranged to determine a shared key with a second network device (350), the first network device comprising a private key processing unit (330) arranged to substitute a second identity number (η) into a sequence of mixing functions ({Ø _k |k = 0... α}) obtaining a sequence of mixing coefficients ({Ø _k |k = 0... α}), compute the sum (A) of multiple products of a private key coefficient (G _{ξ , k} ) of the sequence of private key coefficients with a corresponding mixing coefficient (Ø _k (η)) of the sequence of mixing coefficients, reduce the sum modulo the public global reduction integer (N), and derive the shared key from the reduced sum.

Description

Improved system for key sharing

FIELD OF THE INVENTION

The invention relates to a network device, a key material generation device, a key sharing method, a key material generation method, a computer program, and a computer readable medium.

BACKGROUND

In the paper "HIMMO - A lightweight collusion-resistant key pre-distribution scheme", by O. Garcia-Morchon, D. Gomez-Perez, J. Gutierrez, R. Rietman, B.

Schoenmakers and L. Tolhuizen, IACR Preprint, Report 2014/698, Version Aug. 18, 2015, http://iacr.org/2014/698 a system is for deriving shared keys between two network devices is described.

For integers x and q , we will use (x) to denote the integer in {0,l,... , q - 1 } that differs an integer multiple of q from x .The system uses a key generation system, e.g., a trusted third party (TTP). It has the following system parameters:

· B , the bit length of the identifiers to be used in the system

• b , the bit length of the generated keys

• a , the degree of polynomials to be used in the system

• m≥ 2

• the public modulus N , an odd integer of length exactly (a + l )B + b bits The TTP secretly and randomly generates the following root keying material:

• m distinct random moduli q q₂,... ,q_m of the form q_t = N - 2^h β where where 0 < 3_i < 2^B and at least one of ..., _m is odd.

• for 1 < i≤ m and 0 < j < k < a , a random integer R^_k with 0 < R ^ < q_i - \ ,

For each node ξ in the system, with 0≤ ξ < 2^B , the TTP provides the coefficients of the key generating polynomial G- : a m α

<¼ C =∑<¼__* where = <∑<¾¾ >,·

k=0 i=l 7=0

If node ξ wishes to communicate with node η with 0≤ η < 2^B , it computes Κ(ξ ,η) = ((Ο_ξ (η))_Ν)_2ΐ)

It can be shown that for all ξ ,η , the keys Κ(ξ ,η) and Κ(η, ξ) are nearly equal. To be more precise, for each ξ ,η with 0 < 2^B - 1

(η , ξ ) e {< (ξ ,η ) + N> _2¾ I G Z, I 7 |< 2m} .

In order to come to a common key, node ξ can send some helper data to node η so that the latter can determine Κ(ξ ,η) from its own key Κ(η, ξ) and the received helper data.

SUMMARY OF THE INVENTION

The system described above uses β_{ < 2^B for i = 1 , ... , m . This ensures that the keys Κ(ξ ,η) and Κ(η, ξ) are nearly equal. It turns out that a collusion attack can be mounted against this choice that is often successful. In a collusion attack, an attacker collects the keying material of multiple colluding nodes and uses this to find the key between two other (non-colluding) nodes. It was found that the work of the attacker is simplified because for each i , the quotient β_ίΙΝ is relatively small. Accordingly, the mixing of modular operations in the determination of the keying material is less strong. Another problem is that N is large, which is undesirable since it implies large storage requirements and large-integer computations.

A key generation device and network device is provided with the advantage that the quotient β_ίΙΝ is much larger, which makes collusion attacks more complicated.

Another advantage of the invention is that the bitlength of N is much smaller.

According to an embodyment, a key material generation device is provided that can configure multiple network devices according to an embodiment. The configured network devices have private key coefficients that allow the devices to derive a shared key together.

A method according to the invention may be implemented on a computer as a computer implemented method, or in dedicated hardware, or in a combination of both.

Executable code for a method according to the invention may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product comprises non-transitory program code stored on a computer readable medium for performing a method according to the invention when said program product is executed on a computer.

In a preferred embodiment, the computer program comprises computer program code adapted to perform all the steps of a method according to the invention when the computer program is run on a computer. Preferably, the computer program is embodied on a computer readable medium.

Another aspect of the invention provides a method of making the computer program available for downloading. This aspect is used when the computer program is uploaded into, e.g., Apple's App Store, Google's Play Store, or Microsoft's Windows Store, and when the computer program is available for downloading from such a store.

BRIEF DESCRIPTION OF THE DRAWINGS

Further details, aspects, and embodiments of the invention will be described, by way of example only, with reference to the drawings. Elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. In the

Figures, elements which correspond to elements already described may have the same reference numerals. In the drawings,

Figure 1 schematically shows an example of an embodiment of a key material generation device,

Figure 2a schematically shows an example of an embodiment of a first network device,

Figure 3a is a schematic block diagram of a key sharing system 100,

Figure 3b is a schematic block diagram of a key sharing system 102

Figure 4a is schematic block diagram of an integrated circuit 400, Figure 4b schematically shows a computer readable medium (1000) having a writable part (1020) comprising a computer program according to an embodiment,

Figure 5 schematically shows a flowchart illustrating a key sharing method, Figure 6 schematically shows a flowchart illustrating a key material generation method. DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

While this invention is susceptible of embodiment in many different forms, there are shown in the drawings and will herein be described in detail one or more specific embodiments, with the understanding that the present disclosure is to be considered as exemplary of the principles of the invention and not intended to limit the invention to the specific embodiments shown and described.

In the following, for the sake of understanding, elements of embodiments are described in operation. However, it will be apparent that the respective elements are arranged to perform the functions being described as performed by them.

Further, the invention is not limited to the embodiments, and the invention lies in each and every novel feature or combination of features described above or recited in mutually different dependent claims.

Below an embodiment of the key sharing method is described in mathematical terms. The key sharing method may be implemented in devices as described below, e.g., on a key material generation device (200), a network device (300), in a key sharing system (100), (102) and the like.

In the embodiment below network devices are configured to obtain a shared key. The shared key may have a number of bits that is less or equal than the number of bits of identity numbers of the network devices. Multiple of such shared keys may be combined to obtain a larger key, but this is not necessary. The method has a set-up phase and a use phase. The set-up phase may include an initiation phase and a registration phase. The initiation phase does not involve the network devices.

In the initiation phase system parameters are selected. The initiation phase may be performed by a trusted third party (TTP). The system parameters may also be regarded as given inputs. In that case the trusted third party need not generate them, and the initiation phase may be skipped. For example, the trusted third party may receive the system parameters from a device manufacturer. The device manufacturer may have performed the initiation phase to obtain the system parameters. For convenience of exposition we will refer to the trusted third party as performing the initiation phase, bearing in mind that this is not necessary.

Initiation phase

The desired key length for the key that will be shared between devices in the use phase is selected; this key length is referred to as 'b' in bits. The desired shared key length depends on the chosen application, with more secure applications requiring larger values of b. A suitable value of b for domestic applications may be b = 128.

The desired identity number length is also selected. During the later registration phase each device will be associated with an identity number of identity number length; the identity number length is referred to as 'β ' . The length of numbers are measured in bits. In an embodiment b < B. In an embodiment 16 < B.

3

In an embodiment b < B, e.g. b < B— 32 or b < - B. It has been found that b < B, increases resilience to so-called collusion attacks. In a collusion attack, an attacker obtains information on the shared key used between a target network node and multiple colluding network nodes. The amount of information learned from each additional colluding network node is of size b. However, the amount of information that needs to be reconstructed in order to break commutation between the target network node and non-colluding network nodes grows with B. In an embodiment B is a multiple of b; say B is at least 2b, or for recommended security levels, B is at least 4b.

One may also have that b = B. For example, b = B = 64, or b = B = 128.

Having b = B reduces key storage. It is noted that the present way of selecting a shared key also improves resistance against collusion attacks, so that having b = B is acceptable in many applications.

Next the parameters are selected. The desired degree 'a' is selected; the degree controls the size of certain matrices. The 'degree' a is a system parameter. Higher values of a create harder problems for an attacker to solve, on the other hand an increase in a may require more key reconciliation.

The matrix size will be a + 1. The degree a is at least 2. A more secure application may use a higher value of a, say 3 or 4, or even higher; for example, in embodiments a may even be 10 or more, 30 or more, etc. For low security application a value of > 2, say = 3 is possible. However, for high security ≥ 32 is recommended, say a = 32.

The number of matrices is selected. The number of matrices will be referred to as 'm'. A practical choice for m is 2. A more secure application may use a higher value of m, say 3 or 4, or even higher, say 10 or more.

Higher values of security parameters a and m increase the complexity of the system and accordingly increase its intractability. More complicated systems are harder to analyze and thus more resistant to cryptanalysis. Below it is assumed that m≥ 2. A number of m private moduli q , q₂,■■■ , q_m are selected. These are referred to as the second root-key set of reduction integers. Moduli are positive integers. Each selected number satisfies a relationship with a public global modulus N. In an embodiment, each private modulus satisfies the following relationship with public global modulus N: qi = N— 2^b _it for some integers βι with 1≤ βι≤ 2^A , for each 1 < i < m. A smaller value of A leads to less key reconciliation, a larger value of A, e.g., near B increases mixing and thus security. In an embodiment A = B. In an embodiment, A < B— 32 or A < 1/2B, etc.

For example, the βι may be random ,Α-bits integers; more preferably they have exactly A bits, i.e., 2^A_1≤ βι < 2^A . In an embodiment, A = B. There is however considerably more freedom in choosing the private moduli. An embodiment may use different choices for q or if using the above construction, β_ί . However, the above construction is both convenient in implementations, and gives good guarantees for the amount of reconciliation (see below).

The public modulus N may be selected around 2^A+D+b, e.g., 2^A+D+b≤ N.

Herein D is a further system parameter, the comparable range integer, further discussed below. In an embodiment, A = B = D, which means that public modulus N may be chosen to have 2B + b bits. For example, with B=256, and b=128, N may have 640 bits. In an embodiment, D = B, but A is allowed to be less than B. In an embodiment, public modulus N has exactly A + D + b, or 2B + b bits. For example, N may be chosen at random in this interval, satisfying these constraints. In an embodiment, N = 2^{A+B +b} — 1.

In an embodiment, N is odd. In particular, in a practical embodiment N is odd and has exactly 2B + b bits.

A sequence of mixing functions = 0 ... }) is selected. The mixing functions need not be kept secret and are at least known to all network devices that participate in the system for sharing keys. The mixing functions are used both to generate private key material: the sequence of private key coefficients, and to derive shared keys. The number of mixing functions is equal to the degree a + 1, that is the same as the size of the symmetric matrices.

The inventors found that mixing functions which have very different ranges are susceptible to collusion attacks. As some mixing functions dominate the computation, they may be analyzed separately up to a point, and then removed from the problem. This allows an attacker to approach the collusion attack in a piecemeal fashion. The inventors found that this problem may be avoided by choosing ranges of the mixing functions close together.

For example in an embodiment, at least a first mixing function (φ_α) and a second mixing function of the sequence of mixing functions have a comparable range. A comparable range is defined as the quotient of a first maximum m_a and a second maximum m_b being between one over c and c: - <— < c. The constant c is larger or equal to 1. The ranges of first and second mixing function are comparable. For example c may be chosen below 2¹⁶, which makes it harder for the attacker to separate the effect of the different mixing functions. In an embodiment, c=2, that is the quotient is between a half and two (- <— < 2). In an embodiment c=4. Here the first maximum is the maximum (m_a =

2 m_b

max{(0_a) (x)}) of the first mixing function (φ_α) and the second maximum is the maximum (m_b = max{(0_il) (x)}) of the second mixing function (ø_¾). The maximum is found by having the identity number range of all allowed identity numbers. In an embodiment, the identity number runs through all bit strings of a certain size, e.g., of 128 bits.

In general, the closer c is to 1, the more mixing and the harder the problem. In an embodiment, c < = 2, or even stricter c <= 3/2. In a further embodiment, c <= 1.1. For example, in embodiment, c = 1.0001.

In an embodiment, any two of the mixing functions have a comparable range, using the same constant c. This means that each mixing function has a similar impact on the mixing and cannot be isolated in a collusion attack.

One way to achieve this is to select a comparable range integer D and a further constant (c') for the sequence of mixing functions. The comparable range integer 2^D is an upper bound for all mixing functions. In particular the maximum (m_a = max{(0_a) (x)}) of each mixing function (φ_α) is less than two to the power of the comparable range integer (m_a < 2°). Moreover, all mixing functions come at least close to achieving this upper bound. For example, the maximum (m_a = max{(0_a) (x)}) of each mixing function (φ_α) is larger or equal than two to the power of the comparable range integer minus the further constant c',

D—c'

that is 2 < m_a). The further constant may be chosen as less than 16. Suitable values for further constant are 1 and 2, etc .

For example, if the further constant is 1, then mixing functions are chosen such that the maximum (m_a = max{(0_a) (x)}) of any mixing function (φ_α) is larger or equal than a quarter of two to the power of the comparable range integer (2^D~2 < m_a) and less than two to the power of the comparable range integer (m_a < 2^D). The criterion implies that all mixing functions have a comparable range.

There are many possible choices for the mixing functions. To further restrict the selection, the mixing function may be selected so that any two sequences of mixing coefficients \k = 0 ... a}) obtained by substituting any two identify numbers into the sequences of mixing functions ({ø_¾· \k = 0 ... a}) are different. That is for any identity number ξ and η the two sequences: (φ₀(ξ), Φ_ί (ξ), ... , « ( ))≠ (Φο0?λ Φι ΐ), - > Φα (η )- Below a number of valid choices for the mixing functions are given. We will refer to the input of a mixing function as x.

In an embodiment, the sequence of mixing functions are powers of the input

(x) modulo a prime (p), For example, we may have {ø_¾· = (x^k+1)_p \k = 0 ... a}. As x ranges over all allowable identity numbers, the maximum of each mixing function is close to p, and thus all have a comparable range. The prime p may be chosen different from each of the reduction integers q_t. For example, p may be chosen as a prime between 2^B and 2^{B +1}.

In an embodiment, the sequence of mixing functions are powers of the input

(x) modulo a prime (p) and further modulo a power of two ({ø_¾· = ((x^{k + 1} )_p )₂B \k = 0 ... }).

A suitable construction of mixing functions composes the mixing function from an inner function and a modulo operation. For example, = ft ( ) mod P. The modulo operation may use P = 2^D, possibly using D = B. Instead of a power of 2 also another number may be used, in particular a prime number.

The inner functions may be functions that have a maximum equal or larger range than P. For example, the mixing functions may be a sequence of different polynomials of degree at least 2, modulo the prime p and possibly also modulo 2^B . For example, the sequence of different polynomials may have increasing degree, say the degree of the polynomial used for 0_fe may be at k+1. The latter is not necessary though, as a result of the modulo operations the mixing functions are both different for all identity numbers and have a comparable range. In an embodiment, the mixing function have a minimum of zero.

In an embodiment D < B. For example, in an embodiment (a + 1)D > B. With these choices, the 0_fe may, e.g., chosen as pseudo-random functions, e.g. hashes. For example, D = 32, B = 64. An advantage of using pseudo-random functions is that the chance of a key collision is reduced.

Integer A should not be too small, since then the betas may be guessed: we definitely want m* A > b, so that guessing the betas by brute force is more work than guessing a key by brute force. On the other hand, if A is much larger than D, the least significant bits of beta affect only bits of keying material coefficients that do not influence the key: the system still works, but it wasteful.

It is not necessary to use polynomials, or more generally formula's to define the mixing functions for example, in an embodiment the mixing functions are obtained from a cryptographic pseudo-random number generator seeded with the input (x) and an index identifying the mixing function (k). For example, giving a hash function, preferably a cryptographic hash function we may choose ({ø_¾· = H(x\ \k) \k = 0 ... }), herein || denotes concatenation; the hash function may be shortened to the desired length of the mixing function, say B bits.

Yet another choice is that the sequence ( φ₀ (x), ...., φ_α ( )) consists of the (a + 1)D output bits of a pseudo- random number generator initialized with seed x.

For example, one may seed a stream cipher with input x and derive a sequence of a + 1 values, say each of length B.

For example, one may encrypt the input x with a block cipher keyed with the index k.

As noted many choices are possible for the mixing functions. It is noted that the choice 0_fe = x^k will not satisfy the comparable ranges criterion, as the maximum of any two selection function will differ with a factor of at least 2^B .

Often the degree a, number of matrices m, key length b, A, B, and D, and the mixing functions will be pre-determined, e.g., by a system designer and provided to the trusted party as inputs. The public modulus may also be fixed, say in a standard, but more typically will be selected by a key material generation device during generation of the parameters.

Since m > 1, the system is more complicated, and thus more secure, since modulo operation for different moduli are combined even though such operations are not compatible in the usual mathematical sense. For this reason it is advantageous to choose the selected private moduli q_j as pairwise distinct.

A number of m of symmetric matrices {R_k ^l \i = 0 ... m] are generated. The matrices are square and of size (a + 1) x (a + 1). These matrices are referred to as the first root-key set of symmetric matrices. A symmetric matrix R_k ^l satisfies R_k ^l = R_{j k}, for each 0 < j, k < a. In an embodiment, storage of the matrix may be compressed. For example, for a symmetric matrix the half below the diagonal is equal to the half above the diagonal; of these two halves only one needs to be stored.

Each matrix R_k ^l in the first root-key set there is associated with a reduction integer of the second root-key set q_t. For example, matrix R_k ^l may be formed from integers selected between 0 and q_t— 1 (inclusive). Matrix multiplications involving matrix R_k ^l are evaluated in the finite ring formed by the integers modulo q_t, obtained by computing modulo q_t. The integers modulo q_t form a finite ring with q_t elements. The matrices may be selected at random, e.g., by selecting random integers within these bounds.

The security of the key sharing depends on these matrices as they are the root key material of the system; so preferably strong measures are taken to protect them, e.g., control procedures, tamper-resistant devices, and the like. Preferably the second root-key set of reduction integer, selected integers q , q₂, - - - , q_m, are also kept secret, including the values βι corresponding to q_t .

The above embodiment can be varied in a number of ways. The restrictions on the public and private moduli may be chosen in a variety of ways, such that obfuscation of the sequence of private key coefficients is possible, yet that the shared keys obtained at network devices remain sufficiently close to each other sufficiently often. What is sufficient will depend on the application, the required security level, and the computing resources available at the network devices. The above embodiment combines positive integers such that the modular operations which are carried out when generating the matrices are combined in a non-linear manner when they are added over the integers, creating a non-linear structure for the local key material stored on a network device. The above choice for N and q_j has the property that: (i) the size of N is fixed for all network devices and may be chosen

independent of a; (ii) the non-linear effect appears in the coefficients forming the key material stored on the device.

Registration phase

In the registration step each network device is assigned key material (KM). The key material is unique to a network device.

A network device is associated with an identity number ξ , also referred to as

A. The identity number may be assigned on demand, e.g. by the TTP, or may already be stored in the device, e.g., stored in the device at manufacture, etc. The bit size of A is B bits. Generating A may be done in a variety of ways. For high security the low bits of A are random. For example, A may be selected as a random number; A may be the hash of a further identity number, say a serial number, possibly truncated to B bits.

The TTP generates a set of key material for a device ξ as follows: For

0 < k < a , the TTP provides node ξ with coefficients G^_k defined as follows:

∑m , <x

<) ¾y 0y(O>,_t >

i=i t—'j=o

The notation (a)_p denotes the integer between 0 and p— 1 that differs an integer number of times of p from a.

The set {G^ _fe | k = 0 ... } forms a sequence of private key coefficients, if needed sorted using the index k, e.g., as a sequence (G^ ₀, G^_a).

When computing the private key coefficients a TTP computes the sequence of mixing functions {ø_¾} for the identity number ξ obtaining sequence of mixing coefficients, e.g., φ(ξ) = (Φο ( _>— ' Φ_α ( · The sequence of mixing coefficients can be interpreted as a vector, for example, as a column vector or a row vector. Below we will assume the sequence is seen as a column vector through similar observations hold if the sequence is seen as a row vector.

The above formula for the private key coefficients can be seen as a number of matrix computations. For each matrix in the first root-key set, the matrix product of the symmetric matrix (R_k ^l ) with the sequence of mixing coefficients is computed, this is

R_fc Φ_] ( ⁼ 0■■■ cc]) and reduced modulo the reduction integer associated with the symmetric matrix; For example, by computing R^l φ _ξ) mod q_t for each i. The modulo operations may be integrated with the matrix multiplication. The result of the reduced matrix multiplication is referred to as an intermediate sequence. There are m intermediate sequences, these are added and reduced modulo the public global reduction integer N.

Note that vectors are added that have been computed modulo different reduction integers. The mixing effect over different finite rings provides a large contribution to security. Moreover, because the mixing functions have comparable range it is hard to isolate a part of the problem for an attacker.

As an optimization the middle significant part of a private key coefficient may be discarded. For example, the reduced summations of the set of intermediate sequences have a most significant part, a middle significant part, and a least significant part, the middle significant parts may be discarded before obtaining the sequence of private key coefficients. For example, if a coefficient has D+A+b bits, the middle A bits may be discarded.

Discarding the middle bits has only moderate effect on the shared bits. Instead of discarding the middle bits it is also possible to add further obfuscating numbers to the private key coefficients. For example, noise may be added to the middle significant bits. Adding noise will have some detrimental effect on the shared key, but less than discarding this part altogether. On the other hand adding noise will also somewhat reduce what an attacker may learn from a private key coefficient, thus making collusion attacks somewhat more difficult. This additional obfuscation is optional.

The key material may be stored as a list, e.g., an array, of the private key coefficients. The device A also receives the number N and may receive the mixing functions. The mixing functions may be hardcoded in the device. The mixing functions may be expressed as a sequence of coefficients. For example, the sequence of mixing functions may be expressed more generally as a series of polynomials, modulo a prime and a power of 2. The coefficients, e.g., the coefficients of the polynomials, and the prime may be

downloadable on the device thus making the mixing functions upgradeable.

Manipulation of matrices may be implemented, e.g., as manipulation of arrays containing the coefficients, e.g., listing all coefficient in a predetermined order. Note that matrices may be implemented, in other data structures, e.g., as an associative array (also known as a 'map') comprising a collection of (index, coefficient) pairs, preferably such that each coefficient appears at most once in the collection.

Sequence of private key coefficients generated in this fashion have the property that they may be used to derive shared keys, have resistance against collusion attacks and control over the distance between the shared key derived at the respective devices (if any). These properties are a result of the process used to generate the sequence of private key coefficients.

Use phase

Once two devices have an identity number ξ (or A) and η (or B) and received the key material from the TTP, they may use their key material to obtain a shared key, shared between them. Each device has received its own sequence of private key coefficients. Device A may perform the following steps, to obtain his shared key. First, device A obtains the identity number of device B. Then device A first generates the intermediate key by computing the following:

That is, A evaluates substitute the second identity number (η) into the sequence of mixing functions = 0 ... a}) obtaining a sequence of mixing coefficients

({4>k l) \k = 0 ... a}). Again the latter function may be interpreted as a vector, say as a column vector. Device A then computes the dot-product (also known as the inner product) of his sequence of private key coefficients and the sequence of mixing coefficients. This dot- product is computed modulo the global public reduction integer. The angle brackets indicate a modulo operation. The intermediate key is the result of the modulo N operation. The result of this operation may be referred to as the intermediate shared key. The mixing functions used by device A are the same mixing functions used during key generation.

Device B will execute a similar operation, it evaluates the same mixing functions but for the identity number of device A, and computes the dot-product with the sequence of private key coefficients of device B.

Note that device A and B both use the same mixing functions that were used to produce the private key coefficients of devices A and B.

It may be verified by mathematical calculation, that if the matrices in the root key material are symmetric then the intermediate shared keys of devices A and B are often, though not necessarily always, equal. The particular requirements on the reduction integers are such that the keys are often equal and always close to each. If devices A and B have obtained the same shared key, then they may use it as a symmetric key which is shared between devices A and B; for example, it may be used for a variety of cryptographic applications, for example, they may exchange one or more messages encrypted and/or or authenticated using the shared key. Preferably, a key derivation algorithm is applied to the shared key for further protection of the master key, e.g., a hash function may be applied.

In an embodiment, the intermediate key is used as the shared key. This may have as a consequence that sometimes two devices will not be able to communicate since they did arrive at the same shared key. However, for many pair of the network devices this will not be the case, many will arrive at the same keys. It depends on the application if this is acceptable. For example, in a mesh network, not all devices need to be able to talk to each other.

Even if devices A and B have not obtained the same shared key, it is certain that these keys are close to each other. It can mathematically be shown that Κ(η,ξ) e {(Κ(ξ,η) + ]Ν)₂, \ j≡Z,\ j \< Δ} , where

A = l + L - . max{¾ (x) | 0 < x < 2⁵ - l} . ¾J.

i=0 :=1

This means that even if the intermediate keys are not equal they are certain to be close to each other.

To ensure that the shared key is the same at both devices the devices may enter a so-called reconciliation phase. For example, device A may compute key-reconciliation data from the intermediate key, and send it to device B. Or the other way round, device B may compute key-reconciliation data from the intermediate key, and send it to device A.

The receiving party, say device A, may modify the intermediate key so that it conforms to the received key-reconciliation data, the shared key being derived from the modified intermediate key; e.g., the modified intermediate key itself, applying a key derivation function, hashing it, etc. Key reconciliation may comprise a number c of least significant bits of each of the intermediate keys. For example, the value c may be chosen to be [log₂ 2Δ1; a higher value of c gives higher assurance of obtaining the same key at both devices.

Key-reconciliation data may be a cryptographic hash over the intermediate key, e.g., a SHA-1 hash over the intermediate key. Device A may vary his intermediate key within the above identified parameters until key-reconciliation data computed over the modified bit-strings, e.g., the same hash function computed there over, equals the received key-reconciliation data.

For example, device A may generate all intermediate keys that conform to the above bounds until an intermediate key is found that conforms to the received key

reconciliation data.

The selected m reduction integers (also referred to as private moduli), q , q₂, ... , q_m, are preferably pair wise relatively prime. If these numbers are pair wise relatively prime the lack of compatibility between the modulo operations is increased.

Obtaining pair wise relatively prime numbers may be obtained by selecting the integers in order, testing for each new integer if all pairs of different numbers are still relatively prime, if not the just selected number is removed from the set. This procedure continues until all m numbers are selected. The complexity increases even further by requiring that the selected m private moduli, q_lt q₂, ... , q_m, are distinct prime numbers. In an embodiment, at least one of the reduction integers is odd.

The root key material may be chosen with, say, a = 30, and m = 10; There is a practical preference for power of two for the various parameters; From a cryptographical point of view there is however no need to restrict parameters to powers of two.

An important advantage of using mixing functions is that the public global reduction integer can be chosen smaller. In fact the public global reduction integer may be selected independent of . Accordingly, compared to sharing systems without mixing functions, more coefficients can be stored within the same memory requirements. As a result the parameter a can be chosen larger. In an embodiment, a is larger than 100, larger than 200 or even larger 300. In an embodiment, a = 300.

Figure 1 is a schematic block diagram of a key material generation device 200 for configuring a network device for key sharing and a first network device 300;

Key generation device 200 is typically implemented as an integrated device. For example, key material generation device 200 may be comprised in a server. Key generation device 200 may configure network devices over a network, say a wireless network, or the internet, and the like. However, key material generation device 200 may also be integrated in a manufacturing device for manufacturing the network devices.

Key generation device 200 comprises a key material obtainer 210, a network device manager 230, and a root-key processing unit 220. Key generation device 200 is intended to work with multiple network devices. Figure 1 shows one such device, first network device 300.

Key generation device 200 selects secret key material, also referred to as root key material. Key generation device 200 then derives local key material— the sequence of private key coefficients— for each of the multiple network devices. The local key material is derived from the root key material and at least one public identity number A of the network device. In figure 1 , network device 300 stores identity number 310. A network device may also store a further identity number and derive the identity number 310 therefrom when needed, e.g., by hashing the further identity number.

The local key material comprises parts that are private to a particular network device, i.e., only accessible to one particular network device and possibly trusted devices. The local key material may also contain parts that, though needed to obtain a shared key, are less critical to keep secret. The use of the adjectives public and private, is intended as helpful for understanding: Even with access to all public data, the private data cannot be computed, at least not without unreasonable high resources given the security of the application or compared to the resources needed for key material generation, encryption, and decryption. However, 'public' does not mean that the corresponding data is necessarily made available to anybody else than key material generation device 200 and the network devices. In particular, keeping the public global reduction integer and other public parameters secret from untrusted parties increases security. Likewise, access to private data may be restricted to the party that generated or needs that data, this increases security. However, a trusted party may be allowed access to the private data; Access to private data reduces security.

Using their local key material and the identity number of the other party, the network devices can agree on a shared key between them.

Key material obtainer 210 is configured to obtain in electronic form at least a first parameter set 250. Parameter set 250 comprises a public global reduction integer 256, N, a first root-key set of symmetric matrices 252, {R_k ^l \i = 1 ... m], and a second root-key set of reduction integers 254, q_t. With each matrix in the first set there is associated a reduction integer of the second set, and a public global reduction integer 256, N. The parameter set is generated for network nodes having identifying number of bit-size B. The parameter set will be used for generating local key material which in turn will be used to derive a shared key. The bit-size of the shared key b satisfies b < B. In an embodiment, b < B, in this way the amount of information that can be learned from the shared key is smaller than the amount of information that needs to be reconstructed. This makes the corresponding lattice problem harder. In an embodiment b = B.

The public global reduction integer of the parameter set 256, N is different from each of the reduction integers 254. Preferably, the public global reduction integer of parameter set 256, N is larger than each of the reduction integers 254 of that parameter set.

Key material obtainer 210 does not need interaction with a network device for obtaining the key material; in particular key material obtainer 210 does not need an identity number. Key generation device 200 may be a distributed system in which key material obtainer 210 is located at a different physical location than root-key processing unit 220. Key material obtainer 210 generates all or part of the key material and/or obtains all or part of the key material from an external source. For example, key material obtainer 210 is suited to receive the public global reduction integer 256 from an external source and generate the first root-key set 252 and second set 254. Key material obtainer 210 may comprise an electronic random number generator. The random number generator may be a true or pseudo random number generator. Key material obtainer 210 may generate a public global reduction integer, N, e.g., using the electronic random number generator. Although, the public global reduction integer is public information, introducing randomness makes analyzing the system more difficult.

With each matrix in a first set, a reduction integer from a second set is associated. The random coefficients may be randomly selected from the integers modulo the associated reduction integer.

Key material obtainer 210 may generate one or more coefficients of a reduction integer q_t in a second root-key set using the electronic random number generator. It is not necessary that the reduction integers are primes. However, they may be chosen as prime to increase resistance. Prime numbers give rise to fields, which is a species of rings. The same parameter set, i.e., the same first and second root-key sets, and public global reduction numbers, are used for all network devices that later need to share a key.

Key material obtainer 210 may generate one or more coefficients of a matrix R_k ^l in first root-key set 252, e.g., using the electronic random number generator. Key material obtainer 210 may generate all of the matrices in this fashion. Key material obtainer 210 may use the degree a (i.e., matrix dimension minus 1) of these matrices and fill the matrix with random coefficients, coefficients being copied within the matrix to ensure the matrix is symmetric.

It is convenient to prescribe some aspects of first root-key sets 252 such as the number of matrices in private sets 252 and the degrees of the matrices. It may also be prescribed that some of coefficients in the matrices are zero, e.g., for reducing storage requirements.

First set 252 may contain two equal matrices. This will work, however, unless the associated reduction integers are different the sets may be reduced in size. So typically, whenever two or more matrices in the first set are the same, the associated reduction integers, i.e. the underlying rings, are different.

In an embodiment all first root-key sets of matrices R_k ^l only comprise symmetric matrices. Using only symmetric matrices has the advantage that each network device can agree on a shared key with any other network device of the configured network devices. Key material obtainer 210 is configured to obtain in electronic form a first root-key set of symmetric matrices 252, also referred to as R_k ^l in formulas; herein the matrices are indexed by the superscript (here i), elements in the matrix are indexed by the subscript (here k and j). The embodiment described below assumes that all matrices in set 252 are symmetric.

The number of matrices in first root-key set 252 may be chosen differently depending on the application. A security advantage is obtained through mixing over different rings when the first set has at least 2 matrices in them, and the second set has at least 2 different reduction integers.

In the remainder, we will assume that first root-key set 252 comprises at least two symmetric matrices. In an embodiment, at least two, or even all of the matrices are different; this complicates analysis of the system considerably. It is not necessary though, the first root-key set 252 may comprise two equal matrices and still benefit from mixing in the summation step if these two matrices are evaluated over different rings. Note that different reduction integers define different rings. In an embodiment, first root-key set 252 comprises at least two equal matrices associated with different associated reduction integers. Having two or more equal matrices in the first set reduces storage requirements. In an embodiment, the first set comprises at least two matrices, and all integers in the second set are different

The matrices in first root-key set 252 may be of different sizes. We will consider all matrices to be square. If the size of a matrix is smaller than the number of mixing functions, than some part of the mixing function is not used for that matrix. The resulting intermediate set may be extended with zeros. At least one of the matrices has size + 1, e.g., is of dimension (a + 1) x (a + 1). In an embodiment, all matrices in the first set are square and of size + 1.

In an embodiment, the reduction integers are selected so that the difference of any two reduction integers in the same set of reduction integers has a common divisor. In particular, the common divisor may be 2 ^b ; or in words, the difference between any two reduction integers ends in a least as many zero's as the size of the shared key, when represented in binary.

For example, one way to generate the reduction integers and the public global reduction integer is as follows.

1. First generate the public global reduction integer N. For example as a

random integer of prescribed size 2. For each reduction integer q generate an integers βι with 1≤ βί≤ 2^A for 1 < i < m.

3. Generate the reduction integer p_t as the difference p_t = N— β^

The public global reduction integer may be chosen to have , say of 2B + b bits or more.

In general: the upper bound of βι is 2^A, in an embodiment A is the identity number length A = B. In an embodiment, the range of the mixing functions is 2^D (or so), and N = A + D + b. In an embodiment, we have: A = D = B .

Key material obtainer 210 may be programmed in software or in hardware or in a

combination thereof. Key material obtainer 210 may share resources with root-key processing unit 220.

Network device manager 230 is configured to obtain in electronic form an identity number 310, A for network device 300. Network device manager 230 may receive the identity number from the network device. For example, network device manager 230 may comprise or make use of a communication unit for receiving the identity number over a network. For example, network device manager 230 may comprise an antenna for receiving the identity number as a wireless signal. The identity number may be represented as a number of bits, typically, the number of bits in the identity number B is at least as large as the number of bits in the shared key b. In embodiments, B = b.

Root-key processing unit 220 is configured to compute a sequence of private key coefficients 229 for a parameter set and an identifying number A. Root-key processing unit 220 is applied to the parameter set of key material obtainer 210. The sequence of private key coefficients that is thus obtained and the corresponding public global reduction integer are part of the local key material that will be sent to the network device.

Root-key processing unit 220 receives the data in a parameter set from key material obtainer 210 over connection 238. Below it is described how root-key processing unit 220 determines a sequence of private key coefficients from the parameter set. Root-key processing unit 220 may compute the sequence of private key coefficients 229 as follows:

Univariate matrices are obtained by substituting the identity integer A into each of a sequence of mixing functions = 0 ... a}) obtaining a sequence of mixing coefficients \k = 0 ... }). The resulting sequence of mixing coefficients is then multiplied with each of matrix of the first root-key set. Each multiplication is done modulo the reduction integer associated with the particular matrix. The results of these vector times matrix multiplication are added together modulo the public global reduction integer. The sequence of mixing coefficients may be regarded as column or row vector. In fact, the computations do not have to be done in a particular order. For example, the sums in the formula may be computed in any order.

∑m , <x

<) ¾y 0y(O>,_t >

i=i t—'j=o

To ensure that the identity numbers act 'random' in the system a randomization step at a point in the chain is advantageous to ensure that lattice attacks do not simplify. Especially if the network devices are given identity numbers according to a particular order, e.g., serial numbers, such a randomization step is suitable. For example, a cryptographic hash, say, SHA-256 may be applied to the identity number, the result being shortened to B bits, before the substitution step in the mixing function. The same

randomization step is used by the key generation device as by the network device that uses the identity number to derive a shared key.

Furthermore, identity numbers may be extended to more bits. For example, an identity number of B ' bits may extended, e.g., by hashing and/or concatenation, to B bits, with B' < B. For example and identity number A may be extended to H(A) or to A \ \H(A); H denotes hashing and 11 denotes concatenation. The concatenation is done at the LSB side. A highly non-linear hash, such as a cryptographic hash is preferred for this operation.

Figure 1 shows one possible way to implement this function. Figure 1 shows a mixing unit 222, a modular multiplication unit 224, an addition unit 226, and a sum of a set of intermediate sequences 228; the latter will be sequence of private key coefficients 229. This may work as follows. Mixing unit 222 substitutes the identity integer A into a sequence of mixing functions = 0 ... a] obtaining a sequence of mixing coefficients

{0_fc ( ⁼ 0■■■ ^a)- This step needs to be done only once. The mixing functions may be hard coded in device 220. They may also be programmed in and defined, e.g., as a list of coefficients. In an embodiment, the mixing functions have a comparable range.

Modular multiplication unit 224 receives the result of mixing unit 222, and computes the product between the sequence of mixing coefficients and each of the matrices in the first set. Each matrix computation is done modulo the reduction integer corresponding to the matrix. The result of each matrix times the mixing coefficients may be represented as intermediate sequences. All of the intermediate sequences are then summed in addition unit 226.

Addition unit 226 receives the intermediate sequences and adds them to a running total in sum 228. Sum 228 was reset to 0 prior to the generation of the sequence of private key coefficients. Addition unit 226 may add the sequences coefficient-wise, using either natural arithmetic or modulo the public global reduction number N associated to the parameter set.

When all matrices of the first root-key set are processed in this way, the result in sum 228 may be used as the sequence of private key coefficients. The resulting sequence of private key coefficients, say in sum 228, may be represented as a list of coefficients.

Network device manager 230 is further configured for electronically storing the generated sequence of private key coefficients 229 and the corresponding public global reduction integer 256, N at the network device. Using the sequence of private key

coefficients 229 and its identity number or numbers, first network device 300 can share keys with other devices configured from the same root material. Network device manager 230 may also be configured for electronically storing the parameters B and b at the network device.

Although root-key processing unit 220 may be implemented in software, root- key processing unit 220 is particularly suited for implementation in hardware. If only modular multiplication unit 224 is implemented in hardware a significant speed improvement will be obtained; part of the functionality of key material generation device 200 that is not performed by a hardware version of the unit 224 may be performed in software running of a processor.

Figure 1 shows root-key processing unit 220 receiving an identity number message 232 from first network device 300; first network device 300 receiving a public global reduction integer message 234 from key material obtainer 210 and a sequence of private key coefficients message 236 from root-key processing unit 220. These messages typically are sent and received through network device manager 230. Sequence of private key coefficients message 236 and public global reduction integer message 234 may be combined in a single message. The public global reduction integer message 234 contains the public global reduction integer, corresponding to the sequence of private key coefficients in the sequence of private key coefficients message 236. Identity number message 232 may contain the identity number. Identity number message 232 may also or instead contain a further identity number, key material generation device 200 being configured to derive the identity number from the one or more further identity numbers, e.g., by hashing them.

Key generation device 200 may be configured to obtain an identity number by generating an identity number for first network device 300. Such a configuration is well suited to a manufacturing facility. In that case first network device 300 receives identity number message 232 from configuration key material generation device 200, instead of sending it, say receive identity number message 232 from key material obtainer 210 or root- key processing unit 220.

Figure 2a is a schematic block diagram of a first network device 300 and a second network device 350. First network device 300 and second network device 350 are configured to determine a shared key together.

Second network device 350 may be of the same design as network device 300. We only describe first network device 300 in detail, second network device 350 may be the same or similar. Figure 2a only shows that second network device 350 stores an identity number 355. The identity number 355 of second network device 350 is public and may be exchanged with network device 300 to share a key. Second network device 350 also needs local key material (not shown), in particular a sequence of private key coefficients corresponding to identity number 355.

First network device 300 comprises an electronic storage 320, a communication unit 342, a private key processing unit 330 and a key derivation device 340.

Storage 320 stores local key material of device 300; local key material comprises a sequence of private key coefficients and a public global reduction integer. In the embodiment shown in figure 2a, the device 300 comprises a set of key material 370. Key material 370 comprises sequence of private key coefficients 372 and a public global reduction integer 374.

Storage 320 also stores the identity number 310, A, that was used to generate the sequence of private key coefficients in the key material.

Storage 320 may be a memory, say a non-volatile and writable memory, such as flash memory. Storage 320 may be other types of storage, say magnetic storage such as a hard disk. Storage 320 may be write-once memory.

Communication unit 342 is configured to obtain the identity number 355 of second network device 350. Communication unit 342 may be implemented as a wired connection, say a Wi-Fi, Bluetooth or ZigBee connection. Communication unit 342 may be implemented with a connection over a data network, say the internet.

Private key processing unit 330 is configured to derive a shared key with device 350 using the key material in storage 320. Device 350 also has key materials corresponding to the same root key material as device 300. Device 300 may receive the identity number B from device 350. Device 300 may also receive a further identity number and derive the identity number therefrom. Below it is described how private key processing unit 330 may derive a shared key using first key material 370. Private key processing unit 330 may comprise a mixing unit 332, and a dot- product unit 334.

Mixing unit 332 is configured to substitute the received identity integer B, say of device 350, into the sequence of mixing functions |/c = 0 ... } obtaining a sequence of mixing coefficients. These are the same mixing coefficients that were used to generate the private key coefficients of device 350.

Dot-product unit 334 is arranged to compute the dot product between the sequence of mixing coefficients obtained by mixing unit 332 and the sequence of private key coefficients 372 and reduce the result modulo the public global reduction integer 374; thus obtaining an intermediate key. Private key processing unit 330 may use similar hardware or software as mixing unit 222 and modular multiplication unit 224. Note that first network device 300 does not have access to the first and second root-key set 252, 254.

The result of the dot-product unit 334 may directly be used as the shared key, though this runs the risk of sometimes not having the same shared key in both devices.

However, also further processing may be performed on the result of the reduced dot-product; we will refer to the latter as the intermediate key.

Optionally network device 300 comprises a key-reconciliation unit 336; shown in figure 2a as part of the key derivation unit 340. It may happen that device 300 and device 350 do not arrive at the same shared key. An application may chose to ignore this possibility. In doing so, some pairs of network devices may not be able to engage in encrypted and/or authenticated communication as they lack a common shared key. For some applications it is sufficient that only some pairs of network devices are secured, e.g., ad-hoc networks are an example of this. Devices 300 and 350 may also be configured with an optional key- reconciliation unit 336. In one of the two devices 300 and 350 the key-reconciliation unit 336 generates key-reconciliation data from the generated key and sends it to the other device; in the other device key-reconciliation unit 336 uses received key-reconciliation data to adapt the generated shared key so that the shared key derived in both devices is the same.

If key-reconciliation unit 336 is used to adapt keys, it adapts the generated intermediate key until it conforms to the key-reconciliation data, i.e., deriving key- reconciliation data from the adapted intermediate key would give the same result as the received key-reconciliation data for that key. If the least significant bits are used as confirmation data, the key-reconciliation unit adds multiples of the public reduction integer until the c least significant bits are the same as the received bits. After reconciliation key derivation device 340 may use, e.g., the adapted intermediate key directly as a key. Key derivation device 340 may also apply a key derivation function to the shared key, for example the function KDF, defined in the OMA DRM

Specification of the Open Mobile Alliance (OMA-TS-DRM-DRM-V2 0 2-20080723-A, section 7.1.2 KDF) and similar functions.

Figure 2a further shows an optional cryptographic unit 345 in first network device 300. Cryptographic unit 345 is configured to use the shared key. For example, cryptographic unit 345 may be an encryption unit configured for encrypting an electronic message with the shared symmetric key. For example, cryptographic unit 345 may be a decryption unit configured for decryption an electronic message with the shared symmetric key.

Typically, the device 200 and the 300 each comprise a microprocessor (not shown) which executes appropriate software stored at the device 200 and the 350; for example, that software may have been downloaded and/or stored in a corresponding memory, e.g., a volatile memory such as RAM or a non-volatile memory such as Flash (not shown). Alternatively, the devices 200 and 300 may, in whole or in part, be implemented in programmable logic, e.g., as field-programmable gate array (FPGA). Devices 200 and 300 may be implemented, in whole or in part, as a so-called application-specific integrated circuit (ASIC), i.e. an integrated circuit (IC) customized for their particular use. For example, the circuits may be implemented in CMOS, e.g., using a hardware description language such as Verilog, VHDL etc.

In an embodiment, first network device 300 comprises a storage circuit, communication circuit, and a private key processing circuit. The device 300 may comprise additional circuits, e.g., a key derivation circuit, and a key-reconciliation circuit. In an embodiment, key material generation device 200 comprises a key material obtainer circuit, a network device manager circuit, a root-key processing circuit. The circuits implement the corresponding units described herein. The circuits may be a processor circuit and storage circuit, the processor circuit executing instructions represented electronically in the storage circuits. The circuits may also be, FPGA, ASIC or the like.

Figure 3a is a schematic block diagram of a key sharing system 100.

Key sharing system 100 comprises key material generation device 200, and multiple network devices; shown are network device 300, 350 and 360. The network devices each receive an identity number, sequence of private key coefficients and the global reduction integer from key material generation device 200. Using this information they can agree on a shared key. For example, first network device 300 and second network device 350 each send their identity number to the other party. They can then compute a shared key. Someone with knowledge of the communication between first network device 300 and second network device 350 and even the global reduction integer cannot obtain their shared key, without using unreasonable large resources. Not even device 360 can derive the key shared between devices 300 and 350.

Figure 3b is a schematic block diagram of a similar key sharing system 102. System 102 is the same as system 100 except that the network devices receive their identity number from a configuration server 1 10, also referred to as a personalization device. The network devices then register with key material generation device 200 by sending their identity number. The configuration server 110 may assign an identity number that is also used for other purposes. For example, configuration server 110 may assign a network address, such as a MAC address. The network address is used by the network node for routing network traffic from a second network node to itself. However, the network address may also be used as the identity number. In this case, the network node makes its network address available to key material generation device 200 and receives a sequence of private key coefficients which allows the network node to engage in encrypted communication using its network address as identity number. It is preferred that an identity number has full entropy, i.e., B bits of entropy. However, when this cannot be realized, it is preferred to perform an entropy smoothing function, e.g., a hash function before using the number as the identity number.

The configuration server 110 may generate identity numbers to increase security of the system by avoiding identity numbers that are close, i.e., that share many or all of the most significant bits. For example, server 110 may generate the identity numbers randomly, say true or pseudo random. It is also sufficient to append predetermined number of random bits to an identity number, say 10 bits. The identity number may have the form A 11 A₂, in which A is not random, say a serial number, network address, or the like, and wherein A₂ is random. A₂ may be generated by a random number generator. A₂ may also be generated by hasing A . If a keyed hash is used, say an HMAC, this then A₂ is

indistinguishable from random to parties without access to said key. The key may be generated and stored by server 110.

Server 110 may be included in key material generation device 200, e.g., incorporated in network manager 230. Figure 4a is schematic block diagram of an integrated circuit 400 which may be configured as a key material generation device or network device. Integrated circuit 400 comprises a processor 420, a memory 430, and an I/O unit 440. These units of integrated circuit 400 can communicate amongst each other through an interconnect 410, such as a bus. Processor 420 is configured to execute software stored in memory 430 to execute a method as described herein. In this way integrated circuit 400 may be configured as key material generation device 200 or as a network device, such as first network device 300; Part of memory 430 may store a public global reduction integer, first root-key sets of matrices, second root-key sets of reduction integers, an identity number, a plain message and/or encrypted message as required.

I/O unit 440 may be used to communicate with other devices such as devices 200, or 300, for example to receive key data, such as first root-key set of symmetric matrices 252 and possibly associated parameters, such as sizes, degrees, moduli and the like, or to send and receive encrypted and/or authenticated messages. I/O unit 440 may comprise an antenna for wireless communication. I/O unit 440 may comprise an electric interface for wired communication.

Integrated circuit 400 may be integrated in a computer, mobile communication device, such as a mobile phone, etc. Integrated circuit 400 may also be integrated in lighting device, e.g., arranged with an LED device. For example, an integrated circuit 400 configured as a network device and arranged with lighting unit such as an LED, may receive commands encrypted with a shared symmetric key.

Multiple network devices, say incorporated in a lighting device, may form the nodes of an encrypted network, in which links are encrypted using shared keys between the nodes.

Although matrix manipulation may be performed by processor 420 as instructed by matrix manipulation software stored in memory 430, the tasks of key material generation, and calculating the intermediate sequences, etc, are faster if integrated circuit 400 is configured with optional matrix manipulation unit 450. In this embodiment, matrix manipulation unit 450 is a hardware unit for executing substitution and reduction operations.

Figure 4b shows a computer readable medium 1000 having a writable part

1010 comprising a computer program 1020, the computer program 1020 comprising instructions for causing a processor system to perform a method of key sharing or key material generation, according to an embodiment. The computer program 1020 may be embodied on the computer readable medium 1000 as physical marks or by means of magnetization of the computer readable medium 1000. However, any other suitable embodiment is conceivable as well. Furthermore, it will be appreciated that, although the computer readable medium 1000 is shown here as an optical disc, the computer readable medium 1000 may be any suitable computer readable medium, such as a hard disk, solid state memory, flash memory, etc., and may be non-recordable or recordable. The computer program 1020 comprises instructions for causing a processor system to perform said method of key sharing or key material generation.

Below further embodiments are disclosed. In an embodiment, the key material generation device (referred to as the TTP) uses system parameters B,b,a, m and N as in the background. However, the length of N can be much smaller than (a + \)B + b . Another set of system parameters are mixing functions φ₀, ...,φ_α which are such that for 0 < k≤ a and 0 < x≤ 2^B , the function value (j>_k(x) is a non-negative integer. The TTP secretly and randomly generates the following root keying material:

• m distinct random moduli q q₂,... ,q_m of the form q_t = N - 2^h β where where 0 < β_ί < 2^A and at least one of β_ι,... , β_ιη is odd.

• for 1 < i≤ m and 0 < j < k < a , a random integer R^_k with 0 < R ^ < q_i - \ ,

For 0 < k≤ a , the TTP provides node ξ with coefficients G, _k defined as

In the operational phase, if node ξ wishes to communicate with node computes the key Κ(ξ,η) defined as

a

Κ(ξ,η) = ((∑Ο_ξ φ,(η))_Ν)

k=0

The following result can be mathematically shown.

Let 0≤ ξ,η < 2^B - 1 . We have that

Κ(η,ξ) e {{Κ(ξ,η) + ]Ν)_2ΐ> \ j z Z,\ j \< Δ}, where

Clearly, as 0 < β_{≤ 2^A , we have that ^.₌₁A - ^m^^A · The inventors have realized that in order to thwart a specific collusion attack, it is advantageous that the maximum value of (j)_k(x) for x e [0,2^s) is (approximately) equal for all k . That is, there is an integer D such that

max{^( )| e[0,2⁵)}«2^D for k = 0,1,...,a.

For example, the functions φ₀,...,φ_α and D are chosen such that for all k

2°-¹≤ max¾( ) | x e [0,2⁵)} < 2^D.

With the above notations, we thus have that

Κ(η,ξ) (Κ(ξ ,η) + jn)_ib \ j e Z, | j \< Α_γ } , where

Δ, =1 + L (a+l)2^Z3-m-2'⁴J.

N

Instead of publishing m as a public parameter, the TTP preferably publishes A₁ as a public parameter. In this way, it need not publish the parameters A and D either. Thus m, A and D may be secret.

In ensure that different nodes have different keying materials, we have in an embodiment that for any distinct ξ,η e [0,2^s)

(φ₀(ξ),...,φ_α(ξ )≠(φ₀(η),-,ΦΛΐ )-

We finally remark that an embodiment can also be applied for generating a common key for groups consisting of t > 2 nodes. As an example, we consider t = 3. Node ξ gets as keying material the coefficients Θ_{ξ k e} of the the form For each i , it is required that R^(l) is symmetric in all all

three components. That is, for each j,k,£, it is required that

R = 1_* = ¾ = ^RkL = ^RS,_k =tfl■ ^For generating its key with devices η_λ and η₂ , node ξ computes (∑^_,£Ο_ξ1ί£φ_1ί(η_ι)φ_£(η₂))_Ν)2^Ί' . Also for t > 2 , it is advantageous that all functions φ_1ί have an output range of (approximately) equal size.

Below, we describe some furhter embodiments of the invention.

In order to have nearly equal pairwise keys, we have in an embodiment that 2^A+B+D IN be not too large. In order to have mixing, the equality is preferably essentially tight. Approximating p by 2^D , we find that a good choice for N is an integer of bit length approximately A + b + D , that is, N « 2^A+b+D . For example, N may be chosen as random integer having exactly A + b + D bits.

Since mixing involves products of β_; 's and _;{χ) , it is suitable to have A ~ D but that is not necessary. If it is desired that different input values x and y in [0,2 ^B ) yield different outputs, then it is necessary that 2^D≥ 2^B . It an embodiment, we have D > B . In an embodiment, we have D « B . If we choose A = D = B , the length of N equals 2B + b , which is much smaller than (a + \)B + b , the corresponding length used in the background. Furthermore, the costs for performing modular operations decrease. In particular, RAM requirements for storing intermediate results of modular operations become much smaller. Note that the size of the public global reduction integer N is indepenent of a.

The number of bits required for storing the coefficients G_{0 ξ} , ... , G_{a ξ} , equals

(a + \)L bits, where L is the bitlength of N (so L ¾ A + D + b ). For a given number of bits available for storing coefficients, we can vary a and L . With larger a , lattice attacks require more compromised nodes. Preferably, as 0 < V < 2^A , we should not have A too small as otherwise attacks based on guessing the β_; 's might become feasible.

Example Suppose that b = 128,5 = 256 and 327680 bits can be spent on keying material: then you can choose A = 256 and + l = 512 , or A = \ 28 and a + 1 = 640, or A = 32 and a + 1 = 787 . Various other choices are possible as well.

For an attacker, larger values of a leads to lattice problems of higher dimensions. Small values of A , however, can lead to attacks based on guessing the β_; 's. The latter seems infeasible for A = 32 and reasonable values of m , and surely for A = 128 . What is feasible depends on the security level of the application.

We describe four interesting choices for the functions φ₀,...,φ_α .

• For 0 < k≤ a and x e [0,2^s) , we choose φ_ί (χ) = (x^k+1) _p for some prime p of bitlength D « B . These functions provide a quasi-random output in [0,p - 1) and can readily be computed recursively.

• For 0 < k≤ a and x e [0,2^s) , we choose ^ ( ) = {{x^k+l)_p )₂s , where p is a prime (slightly) larger than 2^B . The extra reduction modulo 2^B allows for simplified implementation. • For 0 < k≤ a and each x e [0,2^s ) , we consider x is a bit string of length B and define §_k (x) = H( || k) , where H is a hash function, || denotes concatenation of strings, and k is represented as a bit string of length [log₂ (a + 2)1 . For adding the output of the evaluations of the hash functions, we consider them as integers.

•The vector (φ₀(χ), ... , φ_α (χ)) consists of the ( + l)D bits produced by a pseudo-random number generator initialized with seed x .

The numbers of bits of keying material to be stored at the nodes may be reduced at the cost of a somewhat larger difference between pairwise keys. Indeed, instead of storing all D + A + b bits of each coefficient, we can store only its D most significant bits and its b least significant bits. In other words, the A "middle" bits need not be stored. In the key computation, the nodes operate as if these A missing bits are set to zero. It can be shown that the the maximum discrepancy between keys is at most Δ₂ = A₁ + (a + 2) , where A₁ is as above.

With this method the number of required bits for storing the coefficients reduces to (a + \){L - A) , which in a preferred embodiment approximately equals

(a + \){B + b) , and hence is independent of A .

Below a particularly, efficient embodimebt is given, we take D = B and take N of the specific form N = 2^B+A+b - 1 . Furthermore, we take _k(x) = (x^k+l(modp))(mod2^B) where p is a prime number slightly larger than 2^B . Based on this, the following algorithm optimized key generation can be implemented:

INPUT: B , A , b , a, , η , p β_{ξ ]} with j e {Ο, . , . , }

OUTPUT: key

<- l

ID <- 1

fey - 0

for j = 0 to a do

ID <- (φ)_ιΒ key ^ (ke_{y +} ((G_u )_2b * ID)_2b )_2b

end for

return key

In this algorithm , if the middle A bits are not stored, then the division in the final line before the end-for would be by 2^b instead of 2^A+b (since A bits would not be stored).

The reduction modulo p can also be done efficiently if p is chosen to be

2^B + r where r is a small value.

We want to note that in this algorithm, the RAM requirements are very low, namely 2B + b + 1 . For practical values enabling the feature of credential verification, this would be 64 + 16 + 1 = 8 IB (classical security) or 96 + 32 + 1 = 129B (quantum security). For a very optimized implementation only requiring key agreement and using small identifiers, then this value could be just 2 * 4 + 4 + 1 = 13B .

Many small devices are becoming multi-core. High performance systems are multi-core. The good thing of the above algorithm is that it can easy run faster if the computation of the key is divided over s different cores j with j = 0,... , s - l . This may be done as follows:

• core j is assigned the evaluation of

coefficients, namely, from coefficient y a/s] to coefficient (J + l)|^~a/s^~|-l . Note that the last core might have lower load.

• before starting the computations, the identifiers (j>_k(x) are computed for k = 0, [a/s^~ - 1 ,2|^~a/s - 1 , ... , (s - 1 )[a/s^~ - 1 . If the function _Ιζ (x) is as defined in the previous section, this can be easily done by means of a doubling algorithm that keeps doubling the input value x .

• once those identifiers are computed, they are distributed to each core together with the coefficients that each core is in charge of. Then each core computes part of the key in parallel, but essentially computes with functions of the form (η^])_ρ with 0 < j < - 1 . The final key is computed as the addition of the keys obtained by each of the cores module 2^b .

Figure 5 shows a schematic flowchart for key sharing method (500) for a first network device (300) to determine a shared key with a second network device (350). The method comprises:

storing (502) a sequence of private key coefficients (372; {G^ _fe | k = 0 ... }) and a public global reduction integer (374, N) obtained from an external key material generation device arranged to configure at least the first and second network device for key sharing, the storage further storing a first identity number (310, A, ξ) for the first network device used by the key material generation device to generate the private key coefficients (372),

obtaining (504) a second identity number (355, η) of the second network device, the second network device being different from the first network device, and

substituting (506) the second identity number (η) into a sequence of mixing functions ({(p_k \k = 0 ... }) obtaining a sequence of mixing coefficients ({ø_¾ (??) \k = 0 ... a}),

computing (508) the sum (∑ _{=0 fe} ^■ 0_fe (η)) of multiple products of a private key coefficient (G^ _fe) of the sequence of private key coefficients with a corresponding mixing coefficient (ø_¾ (??)) of the sequence of mixing coefficients,

- reducing (510) the sum modulo the public global reduction integer (N), and deriving (512) the shared key from the reduced sum.

Figure 6 schematically shows a flowchart illustrating a key material generation method 600. Method 600 is arranged to configure a first network device (300) for sharing a shared key. Method 600 comprises:

- obtaining (602) in electronic form

a first root-key set of symmetric matrices (252, {R_k ^l \ i = 1 ... m}),

a second root-key set of reduction integers (254, {q_t \ i = 1 ... m}), with each symmetric matrix in the first root-key set there is associated a reduction integer of the second root-key set, and

- a public global reduction integer (256, N),

obtaining (604) in electronic form an identity number (310, ξ ) for the network device. The method further comprises computing for the network device a sequence of private key coefficients (372; {G^ _fe | k = 0 ... }) from the first and second root- key sets. This includes

substituting (606) the identity number (ξ ) into a sequence of mixing functions ({0_/Jfc = 0 ... a}) obtaining a sequence of mixing coefficients I ^ ⁼ 0 ... }).

The sequence of mixing coefficients is combined with each of the matrices to obtain a set of intermediate sequences.

for each symmetric matrix ({R_k ^l \ i = 1 ... m}), compute the matrix product of the symmetric matrix (R_k ^l ) with the sequence of mixing coefficients ({∑ ₌₀ ¾ Φ ( = 0 ... }), and reducing the result modulo the reduction integer associated with the symmetric matrix,

Figure 6 show the computation for three matrices at 608.1 , 608.2 and 608.3. These computations may be performed in parallel. In an embodiment more than 3 matrices may be used.

Method 600 further comprises

summing (610) the set of intermediate sequences and reduce modulo the public global reduction integer,

storing (612) the generated sequence of private key coefficients (372;

{ϋξ _k I k = 0 ... }) (229, 236) and the public global reduction integer (256, N) at the first network device.

Many different ways of executing the methods 500 and 600 are possible, as will be apparent to a person skilled in the art. For example, the order of the steps can be varied or some steps may be executed in parallel. Moreover, in between steps other method steps may be inserted. The inserted steps may represent refinements of the method such as described herein, or may be unrelated to the method. For example, some steps may be executed, at least partially, in parallel. Moreover, a given step may not have finished completely before a next step is started.

A method according to the invention may be executed using software, which comprises instructions for causing a processor system to perform method 500 or 600.

Software may only include those steps taken by a particular sub-entity of the system. The software may be stored in a suitable storage medium, such as a hard disk, a floppy, a memory, an optical disc, etc. The software may be sent as a signal along a wire, or wireless, or using a data network, e.g., the Internet. The software may be made available for download and/or for remote usage on a server. A method according to the invention may be executed using a bitstream arranged to configure programmable logic, e.g., a field-programmable gate array (FPGA), to perform the method.

It will be appreciated that the invention also extends to computer programs, particularly computer programs on or in a carrier, adapted for putting the invention into practice. The program may be in the form of source code, object code, a code intermediate source and object code such as partially compiled form, or in any other form suitable for use in the implementation of the method according to the invention. An embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the processing steps of at least one of the methods set forth. These instructions may be subdivided into subroutines and/or be stored in one or more files that may be linked statically or dynamically. Another embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the means of at least one of the systems and/or products set forth.

The embodiments described herein enable key agreement between two parties by having a TTP own global public parameters and private matrices R^l, the TTP deriving function local key material KM_A(x) for each party A, and any pair of parties being able to generate a common key from their secret functions and the identifier of the other party.

The inventors found that many other cryptographic systems may be improved by incorporating mixing functions. For example, by replacing bivariate polynomials with matrices and introducing mixing functions to combine them, improved Diffie-Hellman key agreement, may be made, e.g., based on patent application EP 13182342 (Aug. 30, 2013, incorporated herein by reference); improved public key public encryption, e.g., based on patent application N2013520 (Dutch filing, Sept. 24, 2014, incorporated herein by reference); improved digital signatures, e.g., based on patent application EP 13197623 (Dec. 17, 2013, incorporated herein by reference); improved Pseudo-random number generator (PR G) an stream ciphers based on computations over different finite fields, e.g., based on patent application EP 13157133 (Feb. 28, 2013, incorporated herein by reference).

For example, when creating a signature scheme, the private matrices R^l would serve as the private key, one sequence of private key coefficients (as above) would serve as the public key, and a signature consisting of another sequence of private key coefficients would be derived from the root key matrices. The advantage of using matrices and sequences of private key coefficients as defined include lower memory need because the public modulus N is much smaller, faster execution and increased difficulty of the underlying lattice problem.

When creating a DH-based key exchange, the first set of matrices and global parameters would be public parameters, each party in a DH exchange would pick a random secret number r used to derive a public sequence of private key coefficients that would be exchanged with the other party. Further one would compute the mixing functions for the secret number and compute the dot-product with the sequence of private key coefficients. A common key is obtained by evaluating the received sequence of private key coefficients from the other party with a sequence of mixing coefficients in the own randomly generated identifier.

When creating a public-key encryption scheme, the first set of matrices and global parameters would be public parameters, each party would have a secret key being a random secret number r used to derive a public key which is a sequence of private key coefficients. When another party wishes to send an encrypted message m, the party generates another secret number s, evaluates the public key by evaluating the mixing functions for secret number s and perform the dot-product with the public key to obtain an encryption key for m, and sends to the owner of the public key the encrypted message and a sequence of private key coefficients obtained from the first set of matrices.

The method used above to obtain each coefficient of a sequence of private key coefficients from a first set of matrices given an input identifier x and mixing functions 0_fe can be applied to create a pseudo random number generator. In this case, a number a + 1 of coefficients would be combined with the evaluation of 0_fe (x) for k = 0, ... , a given an input x₀ to obtain an ouput x . In general, given any x we can obtain another Xj_{+ 1} . In an embodiment, the a further sequence z_£ is derived from sequence x_t by applying a function g: g .Xi) = z_t. For example, g may be arranged for taking the least significant bit.

We further note, that the above scheme has been described for a single TTP containing a single set of global public parameters and private matrices, but the scheme can be also extended to work with multiple TTPs. In this case, there would be a single global set of public parameters but each TTP would own its own set of matrices. Given this

information, a node would receive a sequence of private key coefficients from each of the TTPs. These sequence of private key coefficients could be combined on the node so that the compromise of a TTP does not break the security of the whole system. A pair of devices would be able to obtain a common key as usual. The following clauses are not the claims, but relate to various embodiments of the invention. The Applicant hereby gives notice that new claims may be formulated to such clauses and/or combinations of such clauses and/or features taken from the description, during prosecution of the present application or of any further application derived therefrom. In the clauses references in parentheses refer to reference signs in drawings of embodiments or to formulas of embodiments, thus increasing the intelligibility of the clauses. These references are exemplary and shall not be construed as limiting the clause.

1. A first network device (300) arranged to determine a shared key with a second network device (350), the first network device comprising

an electronic storage (320) storing a sequence of private key coefficients (372; {ϋξ _fe I k = 0 ... a}) and a public global reduction integer (374, N) obtained from an external key material generation device arranged to configure at least the first and second network device for key sharing, the storage further storing a first identity number (310, A, ξ) for the first network device used by the key material generation device to generate the private key coefficients (372),

a communication unit (342) arranged to obtain a second identity number (355, η) of the second network device, the second network device being different from the first network device, and

a private key processing unit (330) arranged to

substitute the second identity number (η) into a sequence of mixing functions ({0_fe|/c = 0 ... a}) obtaining a sequence of mixing coefficients ({ >k ( l \k ⁼ 0 ... a}),

compute the sum (∑ _{=0 fe} ^■ 0_fe (η)) of multiple products of a private key coefficient (G^ _fe) of the sequence of private key coefficients with a corresponding mixing coefficient (ø_¾ (??)) of the sequence of mixing coefficients,

reduce the sum modulo the public global reduction integer (N), and derive the shared key from the reduced sum.

2. A key material generation device (200) arranged to configure a first network device (300) for sharing a shared key, the key material generation device comprising:

a key material obtainer (210) arranged to obtain in electronic form a first root-key set of symmetric matrices (252, {R_k ^l \ i = 1 ... m}), a second root-key set of reduction integers (254, {q_t \ i = 1 ... m}), with each symmetric matrix in the first root-key set there is associated a reduction integer of the second root-key set, and

a public global reduction integer (256, N),

- a network device manager (230) arranged to obtain in electronic form an identity number (310, ξ ) for the network device, and

a root-key processing unit (220) arranged to compute for the network device a sequence of private key coefficients (372; {G^ _fe | k = 0 ... }) from the first and second root- key sets by

- substituting the identity number (ξ ) into a sequence of mixing functions

({ø_/(· |/c = 0 ... }) obtaining a sequence of mixing coefficients ({4>_k(0 \k = 0■■■ ^a}),

obtaining a set of intermediate sequences by

for each symmetric matrix ({R_k ^l \i = 1 ... m}), compute the matrix product of the symmetric matrix (R_k ^l ) with the sequence of mixing coefficients ({∑₌₀ ¾ Φ ( = 0 ... }), and reducing the result modulo the reduction integer associated with the symmetric matrix,

summing the set of intermediate sequences and reduce modulo the public global reduction integer,

the network device manager being further arranged to electronically store the generated sequence of private key coefficients (372; {G^ _fe | k = 0 ... }) (229, 236) and the public global reduction integer (256, N) at the first network device.

3. A first network device as in Clause 1 or a key material generation device (200) as in Clause 2,

- wherein at least a first mixing function (φ_α) and a second mixing function

(0_£,) of the sequence of mixing functions have a comparable range, wherein a comparable range is defined as the quotient of a first maximum (m_a) and a second maximum (m_b) being between a constant (c) and one over the constant (1/c; - <— < c), the first maximum being the maximum (m_a = max{(0_a) (x)}) of the first mixing function (φ_α) and the second maximum being the maximum (m_b = max{(0_il) (x)}) of the second mixing function (ø_¾), said constant (c) being less than 2¹⁶. 4. A first network device as in any one of the preceding clauses, or a key material generation device (200) as in any one of the preceding clauses, wherein there exist a comparable range integer (D) and a further constant (c') for the sequence of mixing functions such that the maximum (m_a = max{(0_a) (x)}) of each mixing function (φ_α) is

- less than two to the power of the comparable range integer (m_a < 2°), and larger or equal than two to the power of the comparable range integer minus the further constant (c , 2 < m_a),

wherein the further constant (c') is less than 16. 5. A first network device as in any one of the preceding clauses, or a key material generation device (200) as in any one of the preceding clauses, wherein the sequence of mixing functions are such that for any two identify numbers the two sequences of mixing coefficients ({φ_¾( \k = 0 ... a}) obtained by substituting said two identify numbers into the sequence of mixing functions ({0_fe|/c = 0 ... a}) are different.

6. A first network device as in any one of the preceding clauses, or a key material generation device as in any one of the preceding clauses wherein the sequence of mixing functions are functions of an input (x),

the sequence of mixing functions are powers of the input (x) modulo a prime (p) ({(P_k = \k = 0 ... a}), or

the sequence of mixing functions are powers of the input (x) modulo a prime (p) and further modulo a power of two ({ø_¾· = ((x^{k + 1} )_p )₂B \k = 0 ... }), or

the sequence of mixing functions is obtained from a cryptographic pseudorandom number generator seeded with the input (x) and an index identifying the mixing function (k), ({ø_¾. = H(x\ \k) \k = 0 ... }), for example, the cryptographic pseudo-random number generator is a hash function, or

the sequence of φ₀ (x), 0_! (x), ... , φ_α (x) are ( + 1) times the comparable range integer (D) generated by a cryptographic pseudo-random number generator seeded with input x

7. A first network device as in any one of the preceding clauses, or a key material generation device as in any one of the preceding clauses wherein the sequence of mixing functions are functions of an input (x), mixing functions (φι (x) ) of the sequence of mixing functions are composed of an inner function (f_t (x)) and a modulo operation.

8. A first network device as in any one of the preceding clauses, or a key material generation device as in any one of the preceding clauses,

wherein the public global reduction integer (374, N) has less than ( + 1)B + b bits, wherein a + 1 is the number of private key coefficients in the sequence of private key coefficients, the first and second identity numbers being B bits long, the shared key being b bits long,

more in particular wherein the public global reduction integer (374, N) has less than 2B + b + (a— 2)B bits, and

more in particular wherein the public global reduction integer (374, N) has at least B + 1 bits and less than 3B + b bits.

9. A first network device as in any one of the preceding clauses, or a key material generation device as in any one of the preceding clauses, wherein

each reduction integer of the reduction integers (254, {q_t \ i = 1 ... m}) is q_t = N - 2^ύβ for some integers β. with 1 < β_ί≤ 2^A .

10. A first network device (300) as in any one of Clauses 1 and 3-9, wherein

the communication unit (342) is further arranged to receive key-reconciliation data from the second network device, the first network device comprising a key- reconciliation unit (336) arranged to modify the reduced sum to conform to the received key- reconciliation data, the shared key being derived from the modified reduced sum,

or

the first device comprises a key-reconciliation unit (336) arranged to compute key-reconciliation data from the reduced sum, the communication unit (342) being further arranged to send the key-reconciliation data to the second device.

1 1. A key material generation device as in any one of Clauses 2-9, wherein

the reduced summations of the set of intermediate sequences have a most significant part, a middle significant part, and a least significant part, the root-key processing unit being arranged to discard the middle significant parts before obtaining the sequence of private key coefficients.

12. A key sharing method (500) for a first network device (300) to determine a shared key with a second network device (350), the method comprising

storing (502) a sequence of private key coefficients (372; {G^ _fe | k = 0 ... }) and a public global reduction integer (374, N) obtained from an external key material generation device arranged to configure at least the first and second network device for key sharing, the storage further storing a first identity number (310, A, ξ) for the first network device used by the key material generation device to generate the private key coefficients (372),

obtaining (504) a second identity number (355, η) of the second network device, the second network device being different from the first network device, and

substituting (506) the second identity number (η) into a sequence of mixing functions ({(p_k \k = 0 ... }) obtaining a sequence of mixing coefficients ({ø_¾ (??) \k = 0 ... a}),

computing (508) the sum (∑ _{=0 fe} ^■ 0_fe (η)) of multiple products of a private key coefficient (G^ _fe) of the sequence of private key coefficients with a corresponding mixing coefficient (ø_¾ (??)) of the sequence of mixing coefficients,

- reducing (510) the sum modulo the public global reduction integer (N), and deriving (512) the shared key from the reduced sum.

13. A key material generation method (600) arranged to configure a first network device (300) for sharing a shared key, the key material generation method comprising:

- obtaining (602) in electronic form

a first root-key set of symmetric matrices (252, {R_k ^l \ i = 1 ... m}),

a second root-key set of reduction integers (254, {q_t \ i = 1 ... m}), with each symmetric matrix in the first root-key set there is associated a reduction integer of the second root-key set, and

- a public global reduction integer (256, N),

obtaining (604) in electronic form an identity number (310, ξ ) for the network device, and computing for the network device a sequence of private key coefficients (372; {ϋ_{ξ k} I k = 0 ... }) from the first and second root-key sets by

substituting (606) the identity number (ξ ) into a sequence of mixing functions ({ø_/(· |/c = 0 ... }) obtaining a sequence of mixing coefficients ({4>_k(0 \k = 0■■■ ^a}), - obtaining a set of intermediate sequences by

for each symmetric matrix ({R_k ^l \i = 1 ... m}), compute (608.1; 608.2; 608.3) the matrix product of the symmetric matrix (R_k ^l ) with the sequence of mixing coefficients ({∑y=o R_fc Φ_] ( ⁼ 0■■■ a}), and reducing the result modulo the reduction integer associated with the symmetric matrix,

- summing (610) the set of intermediate sequences and reduce modulo the public global reduction integer,

storing (612) the generated sequence of private key coefficients (372;

{ϋ_{ξ k} I k = 0 ... }) (229, 236) and the public global reduction integer (256, N) at the first network device.

14. A computer program (1020) comprising computer program instructions arranged to perform the method of clause 12 or 13 when the computer program is run on a computer. 15. A computer readable medium (1000) comprising the computer program ( 1020) as in clause 14.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative embodiments.

In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. Use of the verb "comprise" and its conjugations does not exclude the presence of elements or steps other than those stated in a claim. The article "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

List of Reference Numerals in figures 1, 2a, 3a, 3b

100,102 a key sharing system

110 a personalization device

200 a key material generation device

210 a key material obtainer

220 a root-key processing unit

222 a mixing unit

224 a modular multiplication unit

226 an addition unit

228 sum of a set of sequences

229 sequence of private key coefficients

230 a network device manager

232 an identity number message

234 a public global reduction integer message

236 a sequence of private key coefficients message

238 a connection

250 a parameter set

252 a first root-key set of symmetric matrices

254 a second root-key set of reduction integers

256 a public global reduction integer

300 a first network device

310 an identity number

320 an electronic storage

330 a private key processing unit

332 a mixing unit

334 dot-product unit

336 a key-reconciliation unit

340 a key derivation device

342 a communication unit

345 a cryptographic unit

350 a second network device

355 an identity number

360 a third network device 370 a key material

372 a sequence of private key coefficients

374 a public global reduction integer

Claims

CLAIMS:

1. A first network device (300) arranged to determine a shared key with a second network device (350), the first network device comprising

an electronic storage (320) storing a sequence of private key coefficients (372) and a public global reduction integer (374) obtained from an external key material generation device arranged to configure at least the first and second network device for key sharing, the storage further storing a first identity number (310) for the first network device used by the key material generation device to generate the private key coefficients (372),

a communication unit (342) arranged to obtain a second identity number (355) of the second network device, the second network device being different from the first network device, and

a private key processing unit (330) arranged to

substitute the second identity number into a sequence of mixing functions obtaining a sequence of mixing coefficients,

compute the sum of multiple products of a private key coefficient of the sequence of private key coefficients with a corresponding mixing coefficient of the sequence of mixing coefficients,

reduce the sum modulo the public global reduction integer, and derive the shared key from the reduced sum.

2. A key material generation device (200) arranged to configure a first network device (300) for sharing a shared key, the key material generation device comprising:

a key material obtainer (210) arranged to obtain in electronic form a first root-key set of symmetric matrices (252),

a second root-key set of reduction integers (254), with each symmetric matrix in the first root-key set there is associated a reduction integer of the second root-key set, and a public global reduction integer (256),

a network device manager (230) arranged to obtain in electronic form an identity number (310) for the network device, and

a root-key processing unit (220) arranged to compute for the network device a sequence of private key coefficients (372) from the first and second root-key sets by substituting the identity number into a sequence of mixing functions obtaining a sequence of mixing coefficients,

obtaining a set of intermediate sequences by

- for each symmetric matrix, compute the matrix product of the symmetric matrix with the sequence of mixing coefficients, and reducing the result modulo the reduction integer associated with the symmetric matrix,

summing the set of intermediate sequences and reduce modulo the public global reduction integer,

- the network device manager being further arranged to electronically store the generated sequence of private key coefficients (372) (229, 236) and the public global reduction integer (256) at the first network device.

3. A first network device as in Claim 1,

- wherein at least a first mixing function and a second mixing function of the sequence of mixing functions have a comparable range, wherein a comparable range is defined as the quotient of a first maximum and a second maximum being between a constant and one over the constant, the first maximum being the maximum of the first mixing function and the second maximum being the maximum of the second mixing function, said constant being less than 2¹⁶.

4. A first network device as in any one of the preceding claims, wherein there exist a comparable range integer and a further constant for the sequence of mixing functions such that the maximum of each mixing function is

- less than two to the power of the comparable range integer, and

larger or equal than two to the power of the comparable range integer minus the further constant, wherein the further constant is less than 16.

5. A first network device as in any one of the preceding claims, wherein the sequence of mixing functions are such that for any two identity numbers the two sequences of mixing coefficients obtained by substituting said two identity numbers into the sequence of mixing functions are different.

6. A first network device as in any one of the preceding claims, wherein the sequence of mixing functions are functions of an input,

the sequence of mixing functions are powers of the input modulo a prime, or the sequence of mixing functions are powers of the input modulo a prime and further modulo a power of two, or

the sequence of mixing functions is obtained from a cryptographic pseudorandom number generator seeded with the input and an index identifying the mixing function, for example, the cryptographic pseudo-random number generator is a hash function, or

the sequence of mixing functions are obtained from a number of bits generated by a cryptographic pseudo-random number generator seeded with input x, wherein the number of bits is at least the number of mixing functions times the comparable range integer.

7. A first network device as in any one of the preceding claims, wherein the sequence of mixing functions are functions of an input,

mixing functions of the sequence of mixing functions are composed of an inner function and a modulo operation.

8. A key material generation device as in any one of the preceding claims,

wherein the public global reduction integer (374) has less than (a + 1)B + b bits, wherein a + 1 is the number of private key coefficients in the sequence of private key coefficients, the first and second identity numbers being B bits long, the shared key being b bits long,

more in particular wherein the public global reduction integer (374) has less than 2B + b + (a— 2)B bits, and

more in particular wherein the public global reduction integer (374) has at least B + 1 bits and less than 3B + b bits.

9. A key material generation device as in any one of the preceding claims, wherein

b each reduction integer of the reduction integers (254) is q_t = N— 2 β for some integers β_ί with 1≤ βί≤ 2^A .

10. A first network device (300) as in any one of Claims 1 and 3-9, wherein the communication unit (342) is further arranged to receive key-reconciliation data from the second network device, the first network device comprising a key- reconciliation unit (336) arranged to modify the reduced sum to conform to the received key- reconciliation data, the shared key being derived from the modified reduced sum, or

the first device comprises a key-reconciliation unit (336) arranged to compute key-reconciliation data from the reduced sum, the communication unit (342) being further arranged to send the key-reconciliation data to the second device.

11. A key material generation device as in any one of Claims 2-9, wherein

the reduced summations of the set of intermediate sequences have a most significant part, a middle significant part, and a least significant part, the root-key processing unit being arranged to discard the middle significant parts before obtaining the sequence of private key coefficients.

12. A key sharing method (500) for a first network device (300) to determine a shared key with a second network device (350), the method comprising

storing (502) a sequence of private key coefficients (372) and a public global reduction integer (374) obtained from an external key material generation device arranged to configure at least the first and second network device for key sharing, the storage further storing a first identity number (310) for the first network device used by the key material generation device to generate the private key coefficients (372),

obtaining (504) a second identity number (355) of the second network device, the second network device being different from the first network device, and

substituting (506) the second identity number into a sequence of mixing functions obtaining a sequence of mixing coefficients,

computing (508) the sum of multiple products of a private key coefficient of the sequence of private key coefficients with a corresponding mixing coefficient of the sequence of mixing coefficients,

reducing (510) the sum modulo the public global reduction integer, and deriving (512) the shared key from the reduced sum.

13. A key material generation method (600) arranged to configure a first network device (300) for sharing a shared key, the key material generation method comprising:

obtaining (602) in electronic form

a first root-key set of symmetric matrices (252),

- a second root-key set of reduction integers (254), with each symmetric matrix in the first root-key set there is associated a reduction integer of the second root-key set, and a public global reduction integer (256),

obtaining (604) in electronic form an identity number (310) for the network device, and

- computing for the network device a sequence of private key coefficients (372) from the first and second root-key sets by

substituting (606) the identity number into a sequence of mixing functions obtaining a sequence of mixing coefficients,

obtaining a set of intermediate sequences by

- for each symmetric matrix, compute (608.1; 608.2; 608.3) the matrix product of the symmetric matrix with the sequence of mixing coefficients, and reducing the result modulo the reduction integer associated with the symmetric matrix,

summing (610) the set of intermediate sequences and reduce modulo the public global reduction integer,

- storing (612) the generated sequence of private key coefficients (372) (229,

236) and the public global reduction integer (256) at the first network device.

14. A computer program (1020) comprising computer program instructions arranged to perform the method of claim 12 or 13 when the computer program is run on a computer.

15. A computer readable medium (1000) comprising the computer program ( 1020) as in claim 14.