Systems and methods for managing keys in a computer memory are described. In some embodiments, location addresses are determined for two key elements. A periodic time interval that is based on a time duration for performing a transaction involving a distance between the key elements is determined. One key element may be stored at a location address and then relocated to another location address after the periodic time interval has passed. In some embodiments, areas the computer memory may remain static during relocation of the key element.

A network gateway apparatus monitors Quic user datagram protocol (UDP) Internet Connection (QUIC) packets between a first device and a second device, extracts a version of the QUIC protocol and a connection identification from an unprotected portion of the protected header in response to detecting a QUIC packet having a protected header in use, determines a salt used in encryption of the protected header based on the version of the QUIC protocol, calculates a client initial secret based on the salt and the connection identification, determines an unprotected payload of the QUIC packet based on the client initial secret, a protected payload of the QUIC packet and the unprotected portion of the protected header, and extracts a server name indication (SNI) from the unprotected payload.

Various embodiments relate to a method and system for securely comparing a first and second polynomial, including: selecting a first subset of coefficients of the first polynomial and a second subset of corresponding coefficients of the second polynomial, wherein the coefficients of the first polynomial are split into shares and the first and second polynomials have coefficients; subtracting the second subset of coefficients from one of the shares of the first subset of coefficients; reducing the number of elements in the first subset of coefficients to elements by combining groups of / elements together; generating a random number for each of the elements of the reduced subset of coefficients; summing the product of each of the elements of the reduced subset of coefficients with their respective random numbers; summing the shares of the sum of the products; and generating an output indicating that the first polynomial does not equal the second polynomial when the sum does not equal zero.

A method of improving performance of a data processor comprising: in a field of characteristic 2 computing X.sup.Y by performing a series of: (i) multiplications of two different elements of the field; and (ii) raising an element of the field to a power Z wherein Z is a power of 2; wherein the number of multiplications (i) is at least two less than the number of ones (1s) in the binary representation of Y.

In various embodiments, a method for performing a lattice-based cryptographic operation is provided. The method includes obtaining a noise polynomial, a secret polynomial and a public polynomial, disguising at least one of the noise polynomial, the secret polynomial and the public polynomial by means of multiplying it with a random blinding polynomial, calculating the sum of the noise polynomial with the product of the public polynomial and the secret polynomial based on the disguised at least one polynomial, and determining a result of the lattice-based cryptographic operation based on the calculated sum of the noise polynomial with the product of the public polynomial and the secret polynomial.

Many-to-many cryptographic systems and methods are disclosed, including numerous industry applications. Embodiments of the present invention can generate and regenerate the same symmetric key from a random token. The many-to-many cryptographic systems and methods include a plurality of cryptographic modules in communication over a network. A cryptographic module is configured to encrypt data to be sent to other cryptographic modules and to decrypt data received from other cryptographic modules. The cryptographic module includes a key generator configured to use two or more inputs to reproducibly generate the symmetric key and a cryptographic engine configured to use the symmetric key for encrypting and decrypting data. Corresponding methods are also provided.

This disclosure describes systems on a chip (SOCs) that prevent side channel attacks (SCAs). An example SoC of this disclosure includes an engine configured to encrypt transmission (Tx) channel data using an encryption operation set configured with a first polynomial, and to decrypt encrypted received (Rx) channel data using a decryption operation set configured with a second polynomial different from the first polynomial. The SoC further includes a security processor configured to multiplex the encryption operation set against the decryption operation set with a varied sequence of selection inputs on a round-by-round basis to generate a mixed sequence of encryption rounds and decryption rounds, and to control the engine to encrypt the Tx channel data and decrypt the encrypted Rx channel data in a combined datapath according to the mixed sequence of encryption rounds and decryption rounds.

Embodiments of the invention relate to efficient methods for authenticated communication. In one embodiment, a first computing device can generate a key pair comprising a public key and a private key. The first computing device can generate a first shared secret using the private key and a static second device public key. The first computing device can encrypt request data using the first shared secret to obtain encrypted request data. The first computing device can send a request message including the encrypted request data and the public key to a server computer. Upon receiving a response message from the server computer, the first computing device can determine a second shared secret using the private key and the blinded static second device public key. The first computing device can then decrypt the encrypted response data from the response message to obtain response data.

An apparatus for more efficiently enabling secure access to an enclosure is described herein. The apparatus may include a wireless transmitter in a selectably opaque container, a wireless transceiver, a GPS receiver, an NFC transmitter and/or receiver, one or more hardware processors, and hardware memory. The hardware memory stores instructions for receiving a current location of the apparatus and comparing that location to a delivery address of the enclosure. As the location is within a certain range of the delivery address the apparatus sends a request to a cloud-based server for a hash digest masking an acceptable input for an access control mechanism associated with the enclosure. The apparatus receives the hash digest and forwards it to the access control mechanism via the wireless transmitter. Computer executable code for handling such tasks, and a cloud-based server for generating the hash digest, are also described herein.

Methods, apparatus, and computer program products for securing personally identifiable information include: identifying, present on a computer system, personally identifiable information (‘PII’); ranking the PII for a user identifiable by the PII; setting a time limit for the PII based on the rank; and responsive to the time limit elapsing, performing one or more actions to secure the PII.