Secure method for performing a modular exponentiation operation

• US 20040184604A1
• Filed: 04/30/2004
• Published: 09/23/2004
• Est. Priority Date: 08/10/2001
• Status: Abandoned Application

• Current Assignee: Gemplus (Thales SA)
• Original Assignee: Gemplus (Thales SA)
• Inventors: Joye, Marc, Villegas, Karine
• Application Number:
  US10/486,340
• Publication Number:
  US 20040184604A1
• Time in Patent Office: Days
• US Class Current: 380/30
• CPC Class Codes: G06F 2207/7242 Exponent masking, i.e. key masking, e.g. A**(e+r) mod n; (k+r).P
• CPC Class Codes: G06F 2207/7257 Random modification not requiring correction
• CPC Class Codes: G06F 7/723 Modular exponentiation G06F7/724, G06F7/727, G06F7/728 take precedence
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 9/002 Countermeasures against attacks on cryptographic mechanisms network architectures or network communication protocols for protection against malicious traffic H04L63/1441
• CPC Class Codes: H04L 9/302 involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes

Abstract

The invention concerns a secure method for performing an exponentiation operation which consists in carrying out an operation of type U=V{circumflex over ( )}W modulo X. U, V, X are integers, W is an integer used in the form of a number W* masked by a fractional masking parameter randomly selected at each execution of the method. The invention is applicable to smart cards.

Claims

1. A secure method for performing an exponentiation operation during which an operation of the type U=V{circumflex over ( 

)}W modulo X is performed, U, V, X being integer numbers, W being an integer number used in the form of a number W* masked by a masking parameter chosen randomly at each execution of the method, characterised in that the masking parameter is a fractional number.

2. A method according to claim 1, characterised in that the masking parameter is of the form R/K, where R is a random integer number and where K is an integer number that is a divisor of the number Φ

(X), Φ

being Euler'"'"'s totient function.

3. A method according to claim 2, characterised in that the number K and/or the number R are modified at each execution of the method.

4. A method according to claim 2 or claim 3, characterised in that the masked number W* is of the form W*={overscore (W)}+{overscore (R)}, {overscore (W)} being the default part of the result of the division of W by K, and {overscore (R)} being equal to the product of the masking parameter R/K and the number Φ

(X).

5. A method according to one of claims 2 to 4, characterised in that the result U is a function of (U*){circumflex over ( 

)}K modulo X, with U*=V{circumflex over ( 

)}W* modulo X.

6. Use of a secure method according to one of claims 1 to 5 in a cryptographic method.

7. Use of a secure method according to one of claims 1 to 5 in a cryptographic method implemented according to the Chinese Remainder Theorem, for masking a possibly derived key by a masking parameter chosen randomly at each execution of the method, the masking parameter being a fractional number.

8. Use of a secure method according to claim 7, characterised in that the cryptographic method is an RSA type method.

9. An electronic component comprising a calculation circuit for implementing a method according to one of claims 1 to 5.

10. An electronic component comprising means for implementing a cryptographic method using a method according to one of claims 1 to 6.

11. A smart card comprising an electronic component according to claim 9 or claim 10.