EP1994465A1

EP1994465A1 - Method of securing a calculation of an exponentiation or a multiplication by a scalar in an electronic device

Info

Publication number: EP1994465A1
Application number: EP07726722A
Authority: EP
Inventors: Marc Joye
Original assignee: Gemplus SA
Current assignee: Thales DIS France SA
Priority date: 2006-03-16
Filing date: 2007-03-08
Publication date: 2008-11-26
Also published as: US20090175455A1; US8065735B2; WO2007104706A1

Abstract

The invention relates to a method for calculating a multiplication of an element (P) of an additively denoted group (G) by a scalar (K). According to an embodiment of the invention, one carries out a step of initializing two registers R0 and R1, a step of iterating over the components ki of the scalar k, in which if ki equals 0, then one calculates 2. R1+ R0 and one replaces R1 by this value, and if ki equals 1, one calculates 2. R0 + R1 and one replaces R0 by this value. At the end of the algorithm, the value of the register R0 is then returned. This method possesses the advantage of carrying out a calculation of multiplying by a scalar by carrying out only doubling and adding operations of the type 2.A + B.

Description

METHOD FOR SECURING A CALCU L OF A

EXPONENTIATION OR MULTIPLICATION BY ONE

SCALER IN AN ELECTRONIC DEVICE

The present invention relates to a method of calculating an exponentiation or a multiplication by a scalar, with particular application in the field of cryptology.

The invention applies in particular to cryptographic algorithms implemented in electronic devices such as smart cards.

Many cryptographic algorithms are based on exponentiation calculations of the type y = x ^r , where x is an element of a set multiplicatively noted and r a predetermined number, which encode a value y. This is particularly the case with the RSA type algorithm (Rivest, Shamir and Adleman). The value y may correspond, for example, to an encrypted text or to a signed or verified data item.

There are different types of exponentiation algorithms. This is known in particular binary method of "squaring and multiplication" type, more usually known in the English terminology "square and multiply" (acronym SAM), the Yacobi method, called MM3 or the sliding windows method.

These algorithms must include suitable countermeasures against attacks aimed at discovering information contained and manipulated in processing performed by the computing device. In particular, countermeasures are provided against attacks called hidden channels, simple or differential. Simple or differential hidden channel attack is understood to mean an attack based on a measurable physical quantity from outside the device, and whose direct analysis (single attack) or statistical analysis (differential attack) makes it possible to discover information contained and manipulated in treatments performed in the device. These attacks can thus reveal confidential information. These attacks have been disclosed by Paul Kocher (Advances in Cryptology - CRYPTO '99, 1666 of Lecture Notes in Computer Science, pp. 388-397, Springer-Verlag, 1999). Among the physical quantities that can be exploited for these purposes are current consumption, the electromagnetic field ... These attacks are based on the fact that the handling of a bit, that is to say its treatment by a particular instruction has a particular imprint on the physical quantity considered according to its value.

The aforementioned exponentiation algorithms had to include countermeasures to prevent such attacks from flourishing.

An effective defense to differential type attacks is to randomize the inputs and / or outputs of the exponentiation algorithm used to compute y = x ^r . In other words, it is a question of making the operand x and / or the exponent r random.

With regard to simple type attacks, it is possible to secure these algorithms by deleting all the conditional branches to the value of the processed data or the connections by which a different operation is executed. If we take the example of the most commonly used method in public key cryptographic systems, the binary method, also called SAM (for "square and multiply"), two implementation variants exist, depending on whether bits of the number r are scanned from right to left or from left to right.

In the first case, for a scan from right to left, the SAM algorithm can be written in the following way:

Inputs of the algorithm: x, r = (r _m, _1, r _m , ₂ , ..., r ₀ ) in base 2. Output of the algorithm: y = x ^r . Temporary registers used: Ro, Ri- Initialisation: Ro <- 1 (neutral element of the multiplication); R ₁ <-x. For i = 0 to m-1, do:

If r, = 1, then R _o <- Ro-Ri Ri <- (R i) ² End to Return Ro.

In the second case for a scan from left to right, the SAM algorithm can be written as follows:

Inputs of the algorithm: x, r = (r _m -i, r _m ₂ , ..., r ₂ ) in base 2. Output of the algorithm: y = x ^r .

Temporary registers used: Ro-

Initialization: Ro <- 1 (neutral element of the multiplication);

For i = m-1 to 0, do:

Ro <- (Ro) ² If n = 1, then R _o <- Ro.x

End for

Return R ₀ . These algorithms, however, have the disadvantage of implementing a condition on the value of the bits r ,, which makes them sensitive to hidden channel attacks.

To secure these algorithms against simple-type hidden-channel attacks, the method generally used is to remove conditional branching at the value of the number r (the secret key), so that an algorithm can be obtained. constant code. The secure binary method thus becomes the "square and multiply always" method, or SMA algorithm, that is to say a method in which a multiplication and a squared elevation are systematically performed.

In the case of left-to-right scanning, the secure SMA algorithm can be written as follows:

Inputs of the algorithm: x, r = (r _m, _1, r _m , ₂ , ..., r ₀ ) in base 2. Output of the algorithm: y = x ^r . Temporary registers used: Ro, Ri Variable used: b

Initialization: Ro <- 1 (neutral element of the multiplication); For i = m-1 to 0, do:

Ro <- (Ro) ² b = 1-r,;

R _b <- R ₀ . x End to Return Ro.

In this algorithm, an unnecessary multiplication is performed, when the bit n of the number r is 0. The performance of the resulting secure algorithm in terms of number of multiplications to perform are therefore reduced.

In general, securing the exponentiation algorithms by adding dummy operations to simple type attacks affects the performance of these algorithms in a significant way.

In addition, algorithms that include dummy operations are sensitive to safe-error attacks. Indeed, by injecting a fault at a precise moment during the calculations, it is possible to detect if an operation is dummy or not, and thus to deduce a secret. This type of "safe-error" attack has, for example, been described in the publication by Messrs. Yen and Joye "Checking before output may be based on fault based cryptanalysis" in the I EEE journal "Transcations on Computers", 49 (9): 967-970, 2000.

Finally, it must be understood for the purposes of the application that the exponentiation calculations in multiplicative groups are equivalent to multiplications by a scalar in groups noted additionally. In the remainder of the present application, and unless otherwise indicated, an additive notation will be used, as used for example in elliptic curves. This notation should in no way be considered as a limitation to the invention.

The invention particularly aims to overcome the disadvantages of the prior art in calculating a multiplication by a scalar during cryptographic calculations, especially during a cryptographic key calculation. In particular, a first object of the invention is to provide a scalar multiplication calculation method which is relatively protected against single-channel hidden attacks and "safe-error" type attacks.

Another object of the invention is to provide a method of calculating the multiplication by a scalar that is unconditional.

Another object of the invention is to provide a scalar multiplication calculation method that is relatively efficient in terms of the number of operations.

Another object of the invention is to provide a scalar multiplication calculation method that is relatively efficient in terms of the types of operations to be implemented.

Another object of the invention is to provide a scalar multiplication calculation method that is relatively efficient in terms of used memory space.

Another object of the invention is to perform a multiplication calculation by a scalar by performing only type 2A + B doubling and adding operations.

At least one of these objects is achieved by the invention, which firstly relates to a method for calculating a multiplication of an element of a group that is additionally denoted by a scalar, said scalar being decomposed into a representation comprising a plurality of components, each of said components taking a component value from at least a first component value and a second component value, said method being intended to be implemented in an electronic device, said electronic device comprising at least one memory comprising at least a first register and a second register, said first register storing a first register value, said second register storing a second register value characterized in that said method comprises the steps of:

assigning to said first register a first initial register value as the first register value, said first initial register value depending on said element; assigning to said second register a second initial register value as a second register value, said second initial register value depending on said element;

performing an iteration over said plurality of components of said representation, said iteration comprising steps consisting of, for each of the components of said representation: when said component is equal to said first component value, calculating a first equal calculation value twice said first register value added to said second register value;

Assigning said first calculation value to said first register as the first register value; when said component is equal to said second component value,

Calculating a second calculation value equal to twice said second register value added to said first register value; Assigning said second calculation value to said second register as a second register value;

following said iteration, returning at least one register value among said first register value and said second register value.

In this way, at each iteration on the components of the representation of the scalar, only one of the two registers is modified. For this modified register, the register value, corresponding to the current value of the register at each iteration, is modified for example according to a formula of the type Rb <- 2.Rb + Rkj if kj is the binary value of the component of the representation during the iteration, b being 1 -kj. The operations performed at each step on registers Ro and Ri are therefore of the type 2.R ₀ + Ri or 2.Ri + R ₀ at each iteration. Thus, a multiplication is calculated using only doubling and adding operations at each iteration.

According to a particular embodiment making it possible to carry out only additions at each iteration, said memory may comprise a third register, said third register storing a third register value, and the aforementioned method may comprise the steps of: assigning to said third registering a third initial register value as a third register value, said second initial register value depending on said first initial register value and said second initial register value; said iteration comprising steps of: when said component is equal to said first component value, Calculating a first calculation value equal to said first register value added to said third register value;

Calculating a second calculation value equal to said second register value added to said third register value;

Assigning said second calculation value to said second register as a second register value; calculating a third calculation value equal to said first register value added to said second register value; assigning said third calculation value to said third register as a third register value.

According to this embodiment, a third register R2 is introduced, and the calculation at each iteration of the value 2.Ro + Ri (respectively 2.R1 + R ₀ ) is performed by an intermediate calculation of the type Ro + R2 (respectively Ri + R ₂ ), the register R ₂ keeping as third register value, the value R ₀ + Ri equal to the first register value added to the second register value. This avoids a doubling calculation during the iteration. This embodiment may be advantageous if only the addition operation is implemented in the electronic device on which the method according to the invention is implemented. Still in this embodiment, in order to take into account the parity of the scalar by which the element of the group is multiplied, said representation comprises an initial component taking an initial component value from a first initial component value and a second component value. initial component, and the aforementioned method may comprise, following said iteration, steps of:

when said initial component has an initial component value equal to said first initial component value; calculating a fourth calculation value equal to said first register value subtracted from a final value dependent on said element; assigning said fourth calculation value to said first register as the first register value.

According to the invention, it is possible to adjust the initial values of the registers for carrying out the multiplication. Thus, according to one embodiment, said group comprises a neutral element, and said first initial register value may be equal to said neutral element and said second initial register value may be equal to said element.

According to another embodiment of the invention, said first initial register value may be equal to said element and said second initial register value may be equal to said element, and said third initial register value may be twice that of said element.

The invention also relates to a cryptographic device for calculating a multiplication of an element of a group noted additionally by a scalar, said scalar being decomposed into a representation comprising a plurality of components each of said components taking a component value from at least a first component value and a second component value, wherein said device comprises calculating means and at least one memory, said memory comprising at least : a first register; a second register; and wherein said calculating means is adapted to perform the aforementioned process steps.

According to one embodiment, said memory may comprise a third register and said calculation means may be able to carry out the aforementioned method steps, especially when a third register is used.

The invention also relates to a smart card comprising a device as described above.

It also relates to a cryptographic system based on a cryptographic algorithm involving at least one calculation of a multiplication of an element of a group noted additionally by a scalar said calculation being performed by a device as described above.

The invention and the advantages derived therefrom will appear more clearly on reading the description which follows and the exemplary embodiments given purely by way of indication, with reference to the appended figures in which:

FIG. 1 is a flowchart of the main elements of an electronic device, for example a smart card, to implement the invention;

FIG. 2 represents a diagram of the method implemented in the calculation of a multiplication by a scalar according to a first embodiment of the invention; FIG. 3 represents a diagram of the method implemented in the calculation of a multiplication by a scalar according to a second embodiment of the invention.

FIG. 4 represents a general diagram of the method implemented in the present invention.

FIG. 1 represents, in block diagram form, an electronic device capable of performing multiplication calculations by a scalar. In the example, this device is a smart card for executing a cryptographic program.

To this end, the device 1 combines in a chip programmed computing means, composed of a central unit 2 operatively connected to a set of memories including: - a memory 4 accessible in read only, in the example of the type ROM mask also known as "mask Read-Only Memory" or "mask ROM",

an electrically reprogrammable memory 6, in the example of the EEPROM type (of the English "Electrically Erasable Programmable ROM"), and

a working memory 8 accessible for reading and writing, in the example of the RAM ("random access memory") type. This memory 8 comprises in particular the registers used by the device 1.

The executable code corresponding to the multiplication algorithm is contained in program memory. This code can in practice be stored in memory 4, read-only, and / or memory 6, rewritable.

The central unit 2 is connected to a communication interface 10 which ensures the exchange of signals vis-à-vis the outside and the supply of the chip.

This interface may include pads on the card for a so-called "contact" connection with a reader, and / or an antenna in the case of a so-called "contactless" card.

One of the functions of the device is to encrypt and decrypt confidential data respectively transmitted to and received from outside. These data may concern, for example, personal codes, medical information, accounting on banking or commercial transactions, or access authorizations to certain restricted services. Another function is the calculation of a digital signature or its verification.

For this purpose, the central unit 2 executes a cryptographic algorithm from programming data stored in the ROM mask 4 and / or EEPROM 6 portions.

The cryptographic algorithm can be based for example on an RSA algorithm (Rivest, Shamir and Adleman), which implies a modular exponentiation calculation of the type y = x ^r , where x is a predetermined value and r is an integer which is a key. The number y thus obtained is a piece of data encrypted, decrypted, signed or verified.

The number r (the key) is stored in a portion of memory writable 6, EEPROM type in the example.

When the exponentiation calculation device 1 is requested for an exponentiation calculation of the type y = x ^r , the central unit stores the number x, transmitted by the communication interface 10, to working memory 8, in a calculation register.

In a current embodiment, the central unit will read the key r contained in rewritable memory 6, for the temporary storage, the exponentiation calculation time, in a calculation register of the working memory. The central unit then launches the exponentiation or multiplication algorithm with a scalar according to the invention.

We now describe a first embodiment of a method of calculating a multiplication by a scalar according to the invention with reference to FIG.

According to this embodiment, the multiplication algorithm with a scalar is implemented as follows in pseudo language:

ALGORITHM 1.

Input of the algorithm: P, k = (k _t -i, k _t -2, ..., ko) 2.

Output of the algorithm: Q = k.P Temporary registers used: Ro, Ri

Initialization: R ₀ <-0 Ri <-P;

For j = 0 to t-1, do: b = 1-kj; R _b <- 2.R _b + R _kj

End to Return Ro.

In this way, at each iteration on kj, we calculate only one 5

doubling operation and an addition, without requiring a condition, unlike the "square and multiply" or "add and double" type algorithms of the prior art and without performing dummy operations.

Indeed, according to this algorithm, during the iteration, we calculate only either 2.R ₀ + Ri, or 2.Ri + R ₀ , and if kj is 1, we replace the value of Ro by 2.R ₀ + Ri, and, if kj is 0, we replace the value of Ri by 2.Ri + R ₀ .

The steps of this algorithm ALGORITHM 1 are illustrated schematically in FIG. 2. As illustrated in this figure, the registers Ro and Ri are initialized respectively with the values 0 and P. An iteration is then carried out on the binary decomposition of k. The values of the binary decomposition, 0 or 1, are stored for example in a temporary variable b equal to 1 -ki for each component ki of the scalar k. If b is 0, then calculate the value 2. Ro + Ri and replace Ro with this value. If b is 1, then calculate the value 2. Ri + Ro and replace Ri by this value.

As illustrated in FIG. 4 more generally, the method according to the invention thus comprises a step of initialization of two registers Ro and Ri, an iteration step on the components ki of the scalar k, in which if ki is 0, calculates 2.Ri + R ₀ and we replace Ri by this value and if ki is 1, we calculate 2.R ₀ + Ri and we replace Ro by this value. At the end of the algorithm, the value of the register Ro is then returned.

It is now shown that the algorithm proposed above makes it possible to perform a multiplication of an element P of a group by a number k. To do this, we will use the additive notation. In the calculations below, we will use the following mathematical operations:

- SU M (Ai, 0, n) denotes the sum for i ranging from 0 to n of A ,, ie n in current notation: SU M (A ₁ , 0, n) = χ ^ Λ- _t ;

* = O

the + sign is used to denote the addition in a group noted additionally or to designate the addition between two scalars;

the sign - is used to designate the subtraction in a group noted additionally or to designate the subtraction between two scalars;

- the sign ^* is used to designate a multiplication between two scalars;

the sign . is used to denote multiplication by a scalar in a group noted additionally. The notation k. P therefore denotes the sum P + P + ... + P k times;

- The notation k = (k _t- i, .., k _o ) 2 denotes the decomposition of a scalar k into binary in vector notation. This notation is equivalent to the notation in the form of a sum k = SU M (k _j ^* 2 ^J , 0, t-1);

the notation A <-a denotes the operation of assigning to the variable A the value a. It also refers to the operation of assigning to the register A, the value a.

Let G be an additive abelian group of neutral element 0. Let P be 7

in G, and k, an integer coded on t bits in binary. We therefore try to calculate, in this additive notation, the multiplication by a scalar Q = k.P, that is to say P + P + ... + P k times.

Let k = SUM (kj ^* 2 ^j , 0, t-1), with k, belonging to the set {0, 1}.

Then Q = SUM ((kj ^* 2 ^j) .P, 0, t-1) = SUM (kj.Bj, 0, t-1) with Bj = 2 ^j .P;

Let S _j = SUM (ki.Bi, 0, j) and T _j = B _{j +} i - S _j ;

With these notations, it comes: Sj = SUM (ki.Bi, 0, j) = kj.Bj + Sj-I = kj.CSj-i + Tj-i) + Sj-i = (1 + kj) .S _j .i + kj. Tj-I;

In the same way,

η = B _{j +} IS _j = 2.B _j - (k _j .B _j + S _j -i) = (2 - k _j ) .B _j - S _M = = (2 - kj) .T _H + ( 1 - kj) .S _H,

So, for all j's greater than or equal to 0, we have:

Sj = Sj-i if kj = O

2S = T _H + _j- if I k _j = 1;

and

T _j = S _j -i + 2.T _j- I if k _j = O

= T _j- I if k _j = 1;

Since Q = kP = S _t- i, this demonstrates that the algorithm ALGORITHM 1 returns the value of Q at the output. We also note that each iteration of the loop in j, the registers Ro and Ri respectively contain the values Sj and Tj.

The algorithm ALGORITH ME 1 above thus makes it possible to calculate the multiplication Q = k.P, and this only using operations of type 2.A + B in additive notation.

Other particular embodiments of the invention will now be described.

According to a second embodiment of the invention, an algorithm is provided that still only performs operations of type 2.A + B, but using only additions, and avoiding the use of computation of a doubling.

This results in an algorithm ALGORITHM 2 corresponding to a variant of the algorithm 1. This algorithm can be described as follows:

ALGORITHM 2

Input of the algorithm: P, k = (k _t -i, k _t -2, ..., ko) ₂ -

Output of the algorithm: Q = k.P

Temporary registers used: Ro, Ri, R2 Initialization: R _o <-P; Ri <P; R ₂ <-2P

For j = 1 to t-1, do: b = 1-kj; R _b <- R _b + R ₂

End for

Return R ₀ . The steps of this algorithm ALGORITHM 2 are illustrated schematically FIG. 3. As illustrated in this figure, first registers Ro, Ri and R2 are initialized respectively with the values P, P and 2.P. An iteration is then performed on the binary decomposition of k for k ranging from 1 to t-1. The values of the binary decomposition, 0 or 1, are stored for example in a temporary variable b equal to 1 -ki for each component ki of the scalar k. If b is 0, then calculate the value 2. R ₀ + Ri and replace Ro with this value. If b is 1, then calculate the value 2.R1 + Ro and replace Ri by this value. This calculation is performed via the register R2 to which a value equal to Ro ⁺ Ri is assigned. Thus, by calculating Ro + R2 or R1 + R2, only the calculation of the values 2. Ro ⁺ Ri or 2.Ri ⁺ Ro is carried out, in accordance with the invention. Finally, if k ₀ is 0, we replace at the end of the loop the value of Ro by Ro-P.

It is now shown that the algorithm ALGORITHM 2 proposed above makes it possible to perform a multiplication of an element P of a group by a scalar k. The previous notations are also used below.

By using these notations, it is known that Bj ₊ I = Sj + Tj The register R2 then an intermediate register serving to store a variable representative of this value B _{j +} i.

To prove that the algorithm ALGORITHM 2 realizes the computation of Q = kP, suppose that k is odd, that is to say that k _o = 1. It is also assumed that k is strictly less than the order of P in the additive group G.

Let kμi be the highest nonzero bit in the decomposition of k, that is, kμi = 1 and kj = O for j between I and t-1. In this case, since k is odd, the register Ro always contains odd multiples of P. In the same way, since Tj = 2 ^{j + 1} .P-Sj, the register Ri always contains odd multiples of P for j strictly lower. at 1-1. Finally, the register R2 always contains a multiple of P by a power of 2 for j strictly less than 1-1.

Thus, in the calculation of R _b <-Rb + R2, Rb is always different from R2 for j between 1 and I-2.

Similarly, in the calculation of R2 <-Ro ⁺ Ri, Ro is always different from Ri for j between 1 and I-2.

Finally, when j is equal to 1-1, the register Ro takes the value k. P, and is no longer modified for j between I and t-1.

The algorithm ALGORITHM 2 therefore makes it possible to calculate the value Q = k.P.

Finally, it should be noted that the initial evaluation of the value 2P to be stored in the register R2 may not require doubling. Indeed, the value 2.P can be precalculated or evaluated from the formula 2.P = (P + A) + (P-A) for an element A of the additive group G.

In this way, we can implement the algorithm ALGORITHM 2 without requiring doubling in additive notation, or squaring in multiplicative notation.

This notably makes it possible to save the implementation of the doubling in an electronic device, or to use the algorithm in an electronic device on which it would not be possible. implemented the doubling, but only the addition.

Note also that by construction, we have B _{j +} i = Sj + Tj = 2.Bj. This therefore makes it possible to implement the algorithm ALGORITH ME 2 by passing from the register R2 and using only the two registers R ₀ and R ₁ as in the algorithm ALGORITHME 1.

This provides an algorithm ALGORITHM 3 defined as follows:

ALGORITHM 3. Inputs of the algorithm: P, k = (kt-i, kt-2, ..., ko) 2.

Output of the algorithm: Q = k.P

Temporary registers used: Ro, Ri

Initialization: R ₀ <-0 Ri <-P;

For j = 0 to t-1, do: b = 1-kj; R _b <- 2. R _b End to Return Ro.

It is easily demonstrated that this algorithm allows the calculation of Q = kP using the formulas given for algorithm ALGORITHM 1 and the relation B _{j +} i = Sj + Tj = 2.Bj.

The description has been given in the context of an electronic device of the smart card type. However, it is clear that the teachings are applicable to all other applications, such as in computer terminals, network communication or other, and in any other electronic device that uses coding or decoding calculations.

Claims

REVEN DICATIONS

1. A method for calculating a multiplication of an element (P) of a n group (G) additionally denoted by a scalar (k), said scalar being decomposed into a representation ((k _t- i, ..., k ₀ ); (k _t- i, ..., ki)) comprising a plurality of components, each of said components taking a component value among e ns a first component value and a second component value, said method being intended to be implemented in an electronic device, said electronic device comprising at least one memory (8) comprising at least a first register (Ro) and a second register (Ri), a said first register storing a first register value, said second register storing a second register value characterized in that said method comprises steps of:

- assigning to said first register (Ro) a first initial register value (0) as the first register value, said first initial register value depending on said element; assigning to said second register (Ri) a second initial register value (P) as a second register value, said second initial register value depending on said element;

performing an iteration on said plurality of components of said representation, said iteration comprising steps consisting of, for each (ki) components of said representation: when said component (ki) is equal to said first component value, a first calculation value equal to twice said first register value added to said second register value; Assigning said first calculation value to said first register as the first register value; when said component (ki) is equal to said second component value,

Calculating a second calculation value equal to twice said second register value added to said first register value;

Assigning said second calculation value to said second register as a second register value;

2. The method according to claim 1, wherein said memory comprises a third register (R2), said third register storing a third register value, said method comprising the steps of: assigning said third register (R2) a third value; r of initial register (P) as a third register value, said second initial register value depending on said first initial register value and said second initial register value; said iteration comprising steps of: o when said component (ki) is equal to said first component value,

Calculating a first calcu l value (Ro + R2) equal to said first register value added to said third register value; Assigning said first calculation value to said first register as the first register value; when said component (ki) is equal to said second component value,

Calculating a second calculation value (R1 + R2) equal to said second register value added to said third register value;

Assigning said second calculation value to said second register as a second register value; calculating a third calculation value (Ro ⁺ Ri) equal to said first register value added to said second register value; assigning said third calculation value to said third register as a third register value.

The method according to claim 2, wherein said representation comprises an initial component taking an initial component value from a first initial component value and a second initial component value, and said method comprises, following said iteration, steps of at :

when said initial component has an initial component value equal to said first initial component value; calculating a fourth calculation value equal to said first register value subtracted from a final value dependent on said element; assigning said fourth calculation value to said first register as the first register value. 5

The method of claim 1, wherein said first initial register value is equal to the neutral element and wherein said second initial register value is equal to said element.

The method according to one of claims 2 to 3, wherein said first initial register value is equal to said element and wherein said second initial register value is equal to said element, and wherein said third initial register value is equal to double the said element

A cryptographic device for calculating a multiplication of an element (P) of a group that is additionally denoted by a scalar (k), said scalar being decomposed into a representation comprising a plurality of components ((k _t- , ..., k ₀ ); (k _t- i, ..., ki)), each of said components taking a component value from at least a first component value and a second component value, wherein said device comprises calculation means (2, 4, 6) and at least one memory (8), said memory (8) comprising at least: a first register (Ro); a second register (Ri); and wherein said calculating means (2, 4, 6) is adapted to perform the method steps of claim 1.

7. Device according to claim 6, wherein said memory comprises a third register and wherein said calculating means are able to carry out the method steps according to one of claims 1 to 5.

A chip card comprising a device according to one of claims 6 or 7.

Cryptographic system based on a cryptographic algorithm involving at least one calculation of a multiplication of an element (P) of an additively-valued group by a scalar (k), said calculation being carried out by a device according to one of claims 6 or 7.