DE102010064578B3 - Cryptography processor, smart card and method of calculating a result of exponentiation - Google Patents

Abstract

A cryptographic processor (100) for calculating a result of an exponentiation of a base value with an exponent (E) modulo a modulus value (N) for encrypting or decrypting data, comprising: a random number generator (110) adapted to generate a random number To produce (R); and a processor (120) arranged to calculate a sum of the base value (B) by a multiple of the modulus value (N) to obtain a random base value (BR), the multiple of the modulus value (N) of the Random number (R) depends, and wherein the processor (120) is adapted to calculate the result of the exponentiation based on the random base value (BR), wherein the random number generator (110) is adapted to the random number (R) with a predefined Bit length, where the predefined bit length of the random number (R) is at least equal to a number of bits of the exponent (E) for which the calculation of the associated intermediate results is based on the same random base value (BR), the processor (120) is designed to calculate the intermediate results for all bits of the exponent (E) based on different random base values (BR), the intermediate results of a predefined number of bits of the Ex compute components (E) based on a same random base (BR) or calculate the intermediate results of a random number of bits of the exponent (E) based on a same random base (BR), the processor (120) being adapted to to calculate the random base value (BR), shift the modulus value (N) in its binary representation to the left by the bit length of the random number (R).

Description

Embodiments according to the invention relate to cryptography systems and in particular to a cryptography processor, a smart card and a method for calculating a result of an exponentiation of a base value with an exponent modulo a module value for encrypting data.

Today, electronic data is transmitted every day. Often this also applies to sensitive information, for example, business or personal data. For such data, secure transmission is extremely important. Accordingly, encryption and decryption techniques are used to protect this data from unwanted access.

However, unwanted persons could attempt to decrypt the secured data or, for example, a private key used to encrypt the data. For example, attackers may attempt to collect page channel information (eg, power usage information, electromagnetic information, or error information) from a device that is currently encrypting the data. Therefore, it is of great interest to develop cryptographic systems that are as secure as possible against attacks.

From the DE 199 63 407 A1 For example, a portable data carrier with a semiconductor chip is known, wherein data that is used several times for a calculation is alienated with different functions, which is implemented in the form of an encryption by means of modulo operations. For each alienation, a factor is added to a message consisting of the product of the modulus and a value that can change with each use.

From the GB 2 399 904 A For example, a data processing unit for performing a modular exponentiation operation of the form m ^d mod N is known in which the base is changed prior to performing the operation such that the result of the modulus operation is not compromised.

It is the object of the present invention to provide a cryptography concept which makes it possible to increase the security when encrypting or decrypting data.

For example, encryption may be by the Rivest-Shamir-Adleman (RSA) algorithm. The RSA method is an asymmetric crypto concept that can be used for both encryption and digital signatures. It uses a key pair consisting of a private key used to decrypt or sign data and a public key that encrypts or verifies signatures. The private key is kept secret and can not be obtained from the public key or only with extremely high expenditure. Decisive in this method is the calculation of an exponentiation of a base value with an exponent modulo a modulus value to encrypt or decrypt data.

This object is achieved by a cryptographic processor according to claim 1, an apparatus according to claim 12 or a method according to claim 13.

An embodiment according to the invention provides a cryptographic processor for calculating a result of an exponentiation of a base value with an exponent modulo of a module value for encrypting or decrypting data comprising a random number generator and a processor. The random number generator is designed to generate a random number. Further, the processor is configured to calculate a sum of the base value by a multiple of the modulus value to obtain a random base value. The multiple of the module value depends on the random number. In addition, the processor is configured to calculate the result of the exponentiation based on the random base value. The random number generator is designed to generate the random number with a predefined bit length. The predefined bit length of the random number is at least equal to a number of bits of the exponent for which the calculation of the associated intermediate results is based on the same random base value. The processor is configured to calculate the intermediate results for all bits of the exponent based on different random bases, calculate the intermediate results of a predefined number of bits of the exponent based on a same random base, or the intermediate results of a random number of bits of the exponent based on to calculate a same random base value. The processor is designed to shift the modulus value in its binary representation by the bit length of the random number to the left to calculate the random base value

Embodiments according to the invention are based on the core idea of adding a random component to the base value of the exponentiation. However, this can not be done in any way, since the underlying represents the data to be encrypted or decrypted and this information should not be lost. However, any multiple of the modulus value may be added to the baseline, as this multiple can be easily removed by later applying the modulo function to the modulus value. By using the random base value, both the base value itself and the exponent of attacks such As performance analyzes are obfuscated. As a result, the security of encryption and decryption of data can be significantly increased in a simple manner.

In some embodiments according to the invention, the random base value is obtained by multiplying the modulus value by the random number and then adding the base value. As a result, the inventive concept can be realized in a very simple manner.

In some other embodiments according to the invention, the random number generator generates a random number having a predefined bit length. By the bit length of the random number, for example, the strength of the randomness of the random base value can be determined.

Some embodiments according to the invention relate to a chip card with a cryptographic processor according to the described concept.

Embodiments according to the invention are explained below with reference to the accompanying figures.

Show it:

1 a block diagram of a cryptography processor;

2 a block diagram of a smart card; and

3 a flowchart of a method for calculating a result of an exponentiation.

Hereinafter, the same reference numerals are used in part for objects and functional units having the same or similar functional properties. Furthermore, optional features of the various embodiments may be combined with each other or interchangeable.

1 shows a block diagram of a cryptographic processor 100 for calculating a result of an exponentiation of a base value with an exponent modulo for encrypting or decrypting data according to an embodiment according to the invention. The cryptography processor 100 includes a random number generator 110 and a processor 120 , The random number generator 110 is with the processor 120 and generates a random number R. The processor 120 calculates a sum of the base value B at a multiple of the modulus value N to obtain a random base value B _R. The multiple of the modulus value N depends on the random number R. Furthermore, the processor calculates 120 the result of the exponentiation, based on the random base value B _R.

By adding a multiple of the modulus value N as a function of the random number R to the base value B, a random base value B _R can be generated, whereby the exponentiation of the base value B against attacks such. B. Performance analysis attacks, can be obscured. Nevertheless, the correct result (and, for example, the original base value B) can easily be recovered at any time by applying the modulo function (mod) with the modulus N to the random base B _R. This can easily increase the security of encryption or decryption of data.

The base value B, the exponent E, the modulus value N and the random number R are integers which are, for example, for processing by the cryptography processor 100 present in binary representation.

In this context, the base value may represent data to be encrypted or encrypted data, and the result of the exponentiation modulo of the module value may represent encrypted data or decrypted data, depending on whether the cryptographic processor 100 used to encrypt or decrypt data, as in 1 indicated.

By the described concept, for example, the central arithmetic operation of the RSA method (B ^ E) mod N to encrypt and decrypt data more securely against attacks.

The random number generator 110 may be a true random number generator, the random numbers, for example based on thermal noise, or a pseudo-random number generator, the random numbers z. B. generated based on a deterministic generating functions.

The random number generator 110 and the processor 120 For example, they may be independent hardware units, part of a computer, microcontroller or smart card processor, as well as computer programs or software products for use on computers, microcontrollers, or smart card processors.

Both the calculation of the random base value B _R and the calculation of the exponentiation of the base value B with the exponent E can take place in different ways.

For example, the random base value B _{R may be} from the processor 120 by a multiplication of the modulus value N with the random number R and a subsequent addition of the base value B are obtained. Alternatively, however, a random base value B _R can also be calculated in another way, for example, the memory requirement of the cryptography processor 100 to reduce, as will be shown later.

The calculation of the result of the exponentiation of the base value B with the exponent E can, for. Example, be calculated by a sequential calculation of an intermediate result ZE for each bit of the exponent E. That is, the exponentiation can be carried out, for example, by calculating intermediate results for each bit of the exponent E, using an intermediate result ZE of a previously considered bit of the exponent E for the calculation of the intermediate result ZE of a subsequent bit of the exponent E. An example of such a procedure is a quadrature and multiply exponentiation, as generally expressed as follows. ZE = ZE · ZE mod N ZE = ZE · B _R mod N, if E _i = 1

In other words, the processor 120 For example, to calculate the intermediate result ZE of a bit E _{i of} the exponent E, multiply an intermediate result ZE of a preceding bit E _i -1 and calculate the result modulo the modulus value N to obtain the intermediate result for the current bit E _{i of} the exponent E. if the bit E _{i of} the exponent has a first value (0 or 1, depending on the logic used). Otherwise, the processor can 120 in addition multiply the result of the multiplication of the intermediate result ZE of the preceding bit E _i + 1 with itself modulo the modulus value N with the random base value B _R and calculate the result modulo the modulus value N to the intermediate result ZE for the bit E _{i of} the exponent E when the bit E _{i of} the exponent E has a second value (1 or 0). Depending on the implementation of the processor 120 For example, a positive logic (eg, a binary exponent of 1010, represents the decimal number 10) is used so that multiplication by the random base B _{R is} performed when the bit E _{i of} the exponent E is equal to 1. However, an implementation with negative logic (eg, an exponent with the bit sequence 0101 represents the decimal number 10) is also conceivable, so that the random base value B _{R is} taken into account when the bit E _{i of} the exponent E is equal to 0.

In the example described, the result of exponentiation is calculated based on left-to-right exponentiation. However, algorithms with right-to-left exponentiation may also be used. An RSA eponentiation with scan direction (scan direction) of the right-to-left exponent does not have the disadvantage that the multiply operation always takes place with the same basis. However, one can also apply the concept described to a right-to-left exponentiation in order to achieve additional obfuscation, but the great advantage as in the case of left-to-right exponentiation is not given here. However, with respect to the right-to-left exponentiation, an additional obfuscation of the base B can be made possible as an advantage of the disclosure of the invention, and less memory may be required since in the case of right-to-left exponentiation the original B is no longer present, however, in the case of left-to-right exponentiation using the inventive concept.

The random number generator 110 generated random number R may have any number of bits. This bit length of the random number R can be predefined, and can be a measure of the randomness of the random base value B _R. In other words, by specifying the length of the random number R, a balance can be made between the gain in security and the additional computational outlay. The random number generator 110 then generates a random number R with the predefined bit length.

The predefined bit length can be selected, for example, at least as great as a number of bits of the exponent E for the calculation of the associated intermediate results of the same random base value B _R is used.

In other words, the same random base value B _R may be used in considering all the bits of the exponent E, a predefined number of bits of the exponent E, a random number of exponent E bits or only for every 1 bit of the exponent E. For example, it would be sufficient to generate a random number with a bit length of only one bit, if for each bit of the exponent E a new random base value B _{r is} calculated.

In other words, the processor can, for. For example, calculate the intermediate results for all bits of the exponent E based on different random base values B _R , the intermediate results of a predefined number of bits (eg, for each 8 bits, 16 bits, 32 bits or more) of the exponent E based thereon calculate random base value B _R, calculate the intermediate values of a random number of bits (eg, based on another random number) of the exponent E based on the same random base value B _R , or the intermediate results for all bits of the exponent E based on the same random base value B Calculate _R Also at this point, by choosing the predefined number of bits of the exponent for which the same random base value B _R is used, a compromise between the gain in security and additional computational effort can be made.

Some embodiments according to the invention relate to a reduction of the memory requirements of the cryptographic processor. A memory requirement reduction can be effected, for example, by the base value B not being stored during the calculation of the exponentiation of the base value B with the exponent E, but later being recovered from the random base value B _R. This is a trivial task if only one random base B _{R is used} for all the bits of the exponent E. If at least two different random base values B _R based on two different random numbers R are used for different bits of the exponent E, then the original base value B can nevertheless be retrieved from the last used random base value B _R , for example if a previously used random number is stored. If the random number R is smaller than the base value B (eg 16-bit random number and 1024-bit base value), this can save a considerable amount of storage space, which is of interest for cryptography processors for card applications, among other things.

For this purpose, the processor can, for example, compare a current random number R with a previously used random number R in order to add, depending on the comparison of the random numbers for each bit of the current random number R, a multiple of the modulus value N corresponding to the position of the respective bit of the random number R to the base value B. , subtract from the underlying B or leave the base value unchanged for the respective bit of the random number. The processor may begin with the most significant bit or least significant bit of the random numbers. If, for example, the comparison of two bits of the random numbers shows that the two bits are the same, then the base value or subsequently a base value that has already been changed by adding a multiple of the modulus value N is left unchanged. Alternatively, for example, if the bit of the previous random number to be compared is 0 and the bit of the current random number to be compared is a multiple of the modulus N corresponding to the position of the respective bit of the random number R, the base value B or already a multiple of the modulus value Added changed base value. In the other case, if the bit of the previous random number to be compared is 1 and the bit of the current random number to be compared is 0, a multiple of the modulus N corresponding to the position of the respective bit of the random number will be equal to or greater than the base value B N changed base value deducted. Depending on the concrete implementation, this can also be realized in reverse.

As a result, with the aid of the last random number R used after the calculation of the exponentiation of the base value B with the exponent E, the original base value B can be recovered.

After considering each bit of the current random number R, a new random base B _{R is} present. For the implementation of the calculation of the random base value B _R , it may be necessary to shift the modulus value N by the bit length of the random number R to the left.

In some embodiments according to the invention, after calculating the exponentiation of the base value B with the exponent E, an end reduction is performed. The final reduction takes place, for example, by the application of the modulo function with the modulus value N to the result of the exponentiation. In other words, after calculating the result of the exponentiation, the processor can make an end reduction by calculating the modulo of the result of the exponentiation with the modulus value N to obtain the result of exponentiation of the base value B with the exponent E modulo of the modulus value N.

In the following, a concrete example will be described in detail. The example shows an application of the inventive concept for the central arithmetic operation in an RSA algorithm using a quadrature and multiply method.

It shows a concealment or randomization of the base value B in an RSA, square-and-multiply exponentiation calculation, so that during the actual RSA calculation the base value B always assumes a different value ,

An RSA Square-and-Multiply (quadrature and multiply) algorithm computes a modular exponentiation of an exponent E to a base B modulo N. (B ^ E) mod N

The calculation is done so that the exponent is bit scanned (scanned) and always a square operation (quadrature operation) is performed for each bit, and if bit 1 is additionally a multiply operation.

The quadrilling operation is a modular multiplication of a continuous intermediate result with itself.

The multiply operation is a modular multiplication of a continuous intermediate result with the base B.

The following is an example of a known quadrature and multiply algorithm (with numbers in hexadecimal notation):
Base B = 0x03
Exponent E = 0x31 = 110001 (binary), scanned (scanned) from MSB (most significant bit) to LSB (least significant bit, least significant bit)
Module N = 0x17
Running intermediate result Z = 0x01
1.bit = 1
Quadrangle: Z = Z * Z mod N = 0x01 * 0x01 mod 0x17 = 0x01
Multiply: Z = Z * B mod N = 0x01 * 0x03 mod 0x17 = 0x03
2.bit = 1
Quadrangle: Z = Z * Z mod N = 0x03 * 0x03 mod 0x17 = 0x09
Multiply: Z = Z · B mod N = 0x09 · 0x03 mod 0x17 = 0x04
3rd bit = 0
Quadrangle: Z = Z * Z mod N = 0x04 * 0x04 mod 0x17 = 0x10
4.bit = 0
Quadrangle: Z = Z * Z mod N = 0x10 * 0x10 mod 0x17 = 0x03
5.bit = 0
Quadrangle: Z = Z * Z mod N = 0x03 * 0x03 mod 0x17 = 0x09
6.bit = 1
Quadratic: Z = Z · Z mod N = 0x09 · 0x09 mod 0x17 = 0x0C
Multiply: Z = Z · B mod N = 0x0C · 0x03 mod 0x17 = 0x0D
Result: Z = (0x03 ^ 0x31) mod 0x17 = 0x0D

While in the quadratic operation the multiplicand and the multiplier always have different content when it comes to the modular multiplication, in the multiply operation only the multiplier is different, but the multiplicand is always the same base value B. This behavior can vary depending on lead to a leakage current (leakage) to the underlying hardware arithmetic unit that one can differentiate the quadrature from the multiplication operation on the basis of the power consumption.

An RSA exponentiation calculation can be realized with different algorithms. A well-known algorithm is known here under the name Montgomery-Ladder (Montgomery ladder). The problem does not exist with this algorithm, since both multiplier and multiplier are always different from bit to bit in both the square and multiplier operations.

However, an RSA Montgomery-Ladder exponentiation is much slower (about 33%) than a quadrature-and-multiply solution, as can be realized according to the inventive concept.

The idea of the invention is to randomize the base value B during the quadrature-and-multiply RSA exponentiation in order to counteract a possible weakness of the hardware arithmetic unit. In the following example, the base value B is further randomized, ie changed, every 16 bits of the exponent. For a 1024-bit RSA exponentiation, this means that the exponent is changed (1024/16 = 64) times, making it more difficult for a possible attack scenario. The randomization strength of the on-the-fly base value randomization is 16-bit in this example.

In general, however, the described concept can also be adapted so that the randomization of all n-bits of the exponent is made with a randomization power of m-bits.

The described concept can make a hardware arithmetic unit, which offers an opportunity for attack, much safer.

Compared to a Montgomery-Ladder exponentiation, the solution proposed here is up to (33 - n) percent faster.

This can be made possible by the described randomization of the base value during the exponentiation. The new RSA exponentiation can, for. Quad-and-multiply-with-changing-base.

In the following, for a better understanding, a standard implementation of a quadrature and multiply algorithm without countermeasures is compared with a possible implementation according to the invention. A secure exponentiation routine needs countermeasures. However, to demonstrate the invention, a simple quadrature and multiply function is used here.

The following is an example of a program code for calculating the exponentiation without concealment by a random number. Here, cl_e represents the exponent and the base value is stored in register CR0 and the modulus value in register N. The algorithm implements a left-to-right exponentiation that starts with the most significant bit.

In comparison, an implementation according to the inventive concept is shown below. The base value, the exponent, the module value and the predefined bit length of the random number are passed to the function. The exponent is passed by cl_e, the base value is initially stored in register CR0, the modulus value in register N and the predefined bit length of the random number as variable _Datenlänge_.

The current random number is stored by the variable RND and the previous random number by the variable OLDRND.

Next, preparations are made for the random number consideration by extending the base value 16 bits, but keeping its value and shifting the modulus 16 bits to the left, which corresponds to a multiplication by 2 ¹⁶ . In this case, the function Exch exchanges the contents of the two subsequently designated registers and the function Srh shifts the contents of the first-mentioned register by the number of bits in the second-mentioned register or in the second-mentioned variable.

Next, for each 16 bits (16 bit is specified by the variable data length, but can also be chosen arbitrarily different) calculated a new random base value. This corresponds to the aforementioned example where a predefined number of bits of the exponent is set, for each of which the same random base value is used. Alternatively, for example, a random number of bits of the exponent may also be chosen here, for which the same random base value is used, for all bits of the exponent the same random base value is used or for each bit of the exponent a new random base value is calculated. In this example, the random base value is changed every 16 bits of the exponent. If the number of bits of the exponent is not divisible by 16, then a random base is computed for the remainder, less than 16 bits of the exponent. As already mentioned, the calculation of the random base value can be calculated, for example, by a multiplication of the random number by the modulus value and a subsequent addition to the base value. In the present example, a memory saving alternative is shown in which a new random base is calculated from the previous random base and its generating random number. In this case, depending on a comparison of the preceding random number and the current random number, the preceding random base value is changed (addition or subtraction of a multiple of the modulus value) or left unchanged. This is described in detail below.

After computing the random base value, the quadrature and multiply algorithm is performed using the random base value for those bits of the exponent that use the same random base value, which is 16 bits in the present example (except for the last or first bits of the exponent less than 16 bits). The function MultN_C_C_ (C) performs a multiplication of the value in register C with itself, then applies the modulo function with the module value in the register N and stores the result again in register C.

Thereafter, a retrieval of the original base value based on the most recently used random number and a retrieval of the original modulus value by a shift to the left to the number of bits of the random number.

Finally, the result of the exponentiation is finally reduced by the application of the modulo function with the module value N. This is carried out by the function EndRed_Z_Z_ (N).

By the example shown z. For example, a flying randomization of a base value may be realized in an RSA quadrature and multiplier algorithm, which may be called, for example, a quadrature and multiply-by-base-base algorithm.

An alternative solution, instead of randomizing the base value to randomize all 16-bits, could perform randomization of all n bits, n [1, exponent bit length]. Also a randomization with a variable interval is conceivable, d. H. B is not randomized to all n-bits but the distance is chosen randomly.

Another alternative is the number of randomized bits, ie the randomization strength. In the above example it was randomized here with 16-bit, but this value can take other values, eg. b. 32-bit or 10-bit.

For implementing the inventive concept, for example, a processor having a long-range arithmetic logic unit may be used which includes at least one base value register for initially storing the base value (eg, in the implementation previously CR0), a modulus value register for initially storing the modulus value (eg Nm of the previously described implementation) and a result register for storing the result of the exponentiation (eg Z in the previous implementation).

In general, the inventive concept can also be realized as an apparatus for calculating a result of exponentiation of a base value with an exponent modulo a modulus value for encrypting or decrypting data, with a random number generating device and a device for calculating the result of the exponentiation. The random number generating device is configured to generate a random number, and the exponentiation result calculating device is configured to calculate a sum of the base value (B) at a multiple of the modulus value (N) by a random base value (B _R ). The multiple of the modulus value (N) depends on the random number (R). Further, the exponentiation result calculating apparatus is configured to calculate the result of the exponentiation based on the random base value (B _R ).

Some embodiments according to the invention relate to an application of a cryptography processor according to the invention in a smart card. 2 shows a block diagram of a smart card 200 as an embodiment according to the invention. The chip card 200 includes a random number generator 110 and a processor 120 which also, for example, in 1 shown and described. In addition, the smart card has 200 a memory 230 and an input-output interface (I / O interface) 240 on. The input-output interface 240 , the memory 230 and the random number generator 110 are with the processor 120 connected. The memory 230 can from the processor 120 data to be encrypted, data decrypted by the processor, the exponents of exponentiation (eg, as a private key), intermediate results or other variables or parameters, and these to the processor 120 provide. The input-output interface 240 For example, it can receive data to be encrypted and to the processor 120 forward or encrypted data from the processor 120 received and transmitted to a recipient. This can be done both wired and wireless.

Such smart cards can be used, for example, as cash cards, sim cards for telephones, cards for identification or decoder cards for pay TV applications.

3 shows a flowchart of a method 300 for calculating a result of an exponentiation of a base value with an exponent modulo a module value for encrypting data according to an embodiment according to the invention. The procedure 300 includes generating 310 a random number, a calculation 320 a sum of the base value with a multiple of the modulus value to obtain a random base value, and a calculation 330 , the result of exponentiation based on the random base value. The multiple of the module value depends on the random number.

Optionally, the procedure 300 include further steps that correspond to features that z. B. in connection with the previously described cryptographic processor or generally the inventive concept have been described.

According to a first aspect, a cryptography processor for calculating a result of exponentiation of a base value with an exponent modulo a module value for encrypting or decrypting data comprises: a random number generator adapted to generate a random number and a processor adapted to calculate a sum of the base value by a multiple of the modulus value to obtain a random base value, wherein the multiple of the modulus value depends on the random number. The processor is configured to calculate the result of the exponentiation based on the random base value.

According to a second aspect, in a cryptographic processor according to the first aspect, the processor is adapted to obtain the random base value by multiplying the modulus value by the random number and then adding the base value.

According to a third aspect, in a cryptographic processor according to the first or second aspect, the processor is adapted to calculate the result of the exponentiation by calculating an intermediate result for each bit of the exponent.

According to a fourth aspect, in a cryptographic processor according to the first to third aspects, the random number generator is adapted to generate the random number having a predefined bit length.

According to a fifth aspect, in a cryptographic processor according to the fourth aspect, the predefined bit length of the random number is at least equal to a number of bits of the exponent for which the calculation of the associated intermediate results is based on the same random base value.

According to a sixth aspect, in a cryptographic processor according to the third to fifth aspects, the processor is adapted to calculate the intermediate results for all bits of the exponent based on different random bases, the intermediate results of a predefined number of bits of the exponent based on a same random one Calculate the base value, calculate the intermediate results of a random number of bits of the exponent based on a same random base value, or calculate the intermediate results for all bits of the exponent based on the same random base value.

According to a seventh aspect, in a cryptographic processor according to the third to sixth aspects, the processor is configured to multiply an intermediate result of a previous bit by itself to calculate the intermediate result of a bit of the exponent, and to calculate the result modulo the modulus value Obtaining an intermediate result for the current bit of the exponent when the bit of the exponent has a first value, and wherein the processor is adapted to additionally modulate the result of multiplying the intermediate result of the previous bit by itself Multiply the modulus value with the random base value and calculate the result modulo the modulus value to obtain the intermediate result for the current bit of the exponent if the bit of the exponent has a second value.

According to an eighth aspect, in a cryptographic processor according to the first to seventh aspects, the processor is adapted to compare a current random number with a previously used random number, the processor being adapted to calculate, in dependence on the comparison of the random numbers for each bit of the current one Random number either to add a multiple of the modulus value corresponding to the significance of the respective bit of the random number to the underlying or a previously used random basis, deduct it from the underlying or a previously used random basis, or unchanged to the underlying or a previously used random basis for the respective bit to calculate a random base value.

According to a ninth aspect, in a cryptographic processor according to the first to eighth aspects, the processor is adapted to shift the modulus value in its binary representation by the bit length of the random number to the left to calculate the random base value.

According to a tenth aspect, in a cryptography processor according to the first to ninth embodiments, the processor is configured to calculate the result of the exponentiation based on a quadrature and multiply exponentiation.

According to an eleventh aspect, in a cryptographic processor according to the first to tenth aspects, the processor is adapted to calculate the result of exponentiation based on left-to-right exponentiation.

According to a twelfth aspect, in a cryptographic processor according to the first to eleventh aspects, the processor is adapted to perform a final reduction by calculating the modulo of the result of the exponentiation with the modulus value after the exponentiation calculation, to calculate the result of the exponentiation of the base value with the exponent modulo of the module value.

According to a thirteenth aspect, in a cryptographic processor according to the first to twelfth aspects, the processor comprises a base value register, a modulus value register and a result register, the base value register being adapted to store the base value, the modulus value register being adapted to supply the modulus value and wherein the result register is adapted to store the result of exponentiation of the base value with the exponent modulo of the modulus value.

According to a fourteenth aspect, in a cryptographic processor according to the first to thirteenth aspects, the base value represents data to be encrypted, and the result of the exponentiation of the base value with the exponent modulo of the modulus value represents encrypted data or the base value represents encrypted data and the result of the exponentiation of the base value with the exponent modulo of the module value represents decrypted data.

According to a fifteenth aspect, a smart card includes a cryptographic processor according to any one of the first to fourteenth aspects.

According to a sixteenth aspect, an apparatus for calculating a result of exponentiation of a base value with an exponent modulo a module value for encrypting or decrypting data, comprising: a random number generating means configured to generate a random number, and an exponentiation result calculating apparatus configured to calculate a sum of the base value by a multiple of the modulus value to obtain a random base value, wherein the multiple of the modulus value depends on the random number. The exponentiation result calculating apparatus is configured to calculate the result of the exponentiation based on the random base value.

According to a seventeenth aspect, a method for calculating a result of exponentiation of a base value with an exponent modulo a module value for encrypting or decrypting data, comprises the steps of: generating a random number, calculating a sum of the base value by a multiple of the module value by a random one Obtaining the base value, wherein the multiple of the modulus value depends on the random number, and calculating the result of the exponentiation based on the random base value.

According to an eighteenth aspect, a computer program comprises a program code for performing a method according to the seventeenth aspect when the computer program runs on a computer or microcontroller.

Although some aspects have been described in the context of a device, it will be understood that these aspects also constitute a description of the corresponding method, so that a block or a component of a device is also to be understood as a corresponding method step or as a feature of a method step. Similarly, aspects described in connection with or as a method step also represent a description of a corresponding block or detail or feature of a corresponding device.

Depending on particular implementation requirements, embodiments of the invention may be implemented in hardware or in software. The implementation may be performed using a digital storage medium, such as a floppy disk, a DVD, a Blu-ray Disc, a CD, a ROM, a PROM, an EPROM, an EEPROM or FLASH memory, a hard disk, or other magnetic disk or optical memory are stored on the electronically readable control signals that can cooperate with a programmable computer system or cooperate such that the respective method is performed. Therefore, the digital storage medium can be computer readable. Thus, some embodiments according to the invention include a data carrier having electronically readable control signals capable of interacting with a programmable computer system such that one of the methods described herein is performed.

In general, embodiments of the present invention may be implemented as a computer program product having a program code, wherein the program code is operable to perform one of the methods when the computer program product runs on a computer. The program code can also be stored, for example, on a machine-readable carrier.

Other embodiments include the computer program for performing any of the methods described herein, wherein the computer program is stored on a machine-readable medium.

In other words, an embodiment of the method according to the invention is thus a computer program which has a program code for performing one of the methods described herein when the computer program runs on a computer. A further embodiment of the inventive method is thus a data carrier (or a digital storage medium or a computer-readable medium) on which the computer program is recorded for carrying out one of the methods described herein.

A further embodiment of the method according to the invention is thus a data stream or a sequence of signals, which represent the computer program for performing one of the methods described herein. The data stream or the sequence of signals may be configured, for example, to be transferred via a data communication connection, for example via the Internet.

Another embodiment includes a processing device, such as a computer or a programmable logic device, that is configured or adapted to perform one of the methods described herein.

Another embodiment includes a computer on which the computer program is installed to perform one of the methods described herein.

In some embodiments, a programmable logic device (eg, a field programmable gate array, an FPGA) may be used to perform some or all of the functionality of the methods described herein. In some embodiments, a field programmable gate array may cooperate with a microprocessor to perform one of the methods described herein. In general, in some embodiments, the methods are performed by any hardware device. This may be a universal hardware such as a computer processor (CPU) or hardware specific to the process, such as an ASIC.

The embodiments described above are merely illustrative of the principles of the present invention. It will be understood that modifications and variations of the arrangements and details described herein will be apparent to others of ordinary skill in the art. Therefore, it is intended that the invention be limited only by the scope of the appended claims and not by the specific details presented in the description and explanation of the embodiments herein.

Claims (14)

Cryptography processor ( 100 ) for calculating a result of an exponentiation of a base value with an exponent (E) modulo a module value (N) for encrypting or decrypting data, comprising: a random number generator ( 110 ) designed to generate a random number (R); and a processor ( 120 ) calculated to calculate a sum of the base value (B) by a multiple of the modulus value (N) to obtain a random base value (B _R ), where the multiple of the modulus value (N) is a random number (R) depends and the processor ( 120 ) is calculated to calculate the result of the exponentiation based on the random base value (B _R ), wherein the random number generator ( 110 ) is designed to generate the random number (R) with a predefined bit length, wherein the predefined bit length of the random number (R) is at least equal to a number of bits of the exponent (E) for which the calculation of the associated intermediate results on the same random base value (B _R ), whereby the processor ( 120 ) to calculate the intermediate results for all the bits of the exponent (E) based on different random base values (B _R ), the intermediate results of a predefined number of bits of the exponent (E) based on a same random base value (B _R ) calculate or calculate the intermediate results of a random number of bits of the exponent (E) based on a same random base value (B _R ), the processor ( 120 ) is adapted to shift the modulus value (N) in its binary representation to the left by the bit length of the random number (R) in order to calculate the random base value (B _R ). A cryptographic processor according to claim 1, wherein the processor ( 120 ) is adapted to obtain the random base value (B _R ) by multiplying the modulus value (N) by the random number (R) and then adding the base value (B). A cryptographic processor according to any one of the preceding claims, wherein the processor ( 120 ) to calculate the result of the exponentiation by calculating an intermediate result for each bit of the exponent. A cryptographic processor according to claim 3, wherein the processor ( 120 ) to multiply an intermediate result of a preceding bit by itself to calculate the intermediate result of a bit of the exponent (E), and calculate the result modulo the modulus value (N) to obtain the intermediate result for the current bit of the exponent (E) when the bit of the exponent (E) has a first value, and wherein the processor ( 120 ) is arranged to additionally multiply the result of the multiplication of the intermediate result of the preceding bit by itself modulo the modulus value (N) with the random base value (B _R ) and to calculate the result modulo the modulus value (N) to obtain the intermediate result for to obtain the current bit of the exponent (E) if the bit of the exponent (E) has a second value. A cryptographic processor according to any one of claims 1 to 4, wherein the processor ( 120 ) is adapted to compare a current random number (R) with a previously used random number, the processor ( 120 ) is adapted to determine, in dependence on the comparison of the random numbers for each bit of the current random number, either a multiple of the modulus value (N) corresponding to the position of the respective bit of the random number (R), the base value (B) or a previously used random base value (B _R) add (from baseline or to have a base value previously used, random B) (B _R) to deduct or the base value (B) or a base value previously used, random (B _R) unchanged for the bit to a random underlying (B _R ). A cryptographic processor according to any one of claims 1 to 5, wherein the processor ( 120 ) to calculate the result of the exponentiation based on a quadrature and multiply exponentiation. A cryptographic processor according to any one of claims 1 to 5, wherein the processor ( 120 ) to calculate the result of exponentiation based on left-to-right exponentiation. A cryptographic processor according to any one of claims 1 to 7, wherein the processor ( 120 ) is designed, after the calculation of the result of the exponentiation, to carry out a final reduction by calculating the modulo of the result of the exponentiation with the modulus value (N) to obtain the result of the exponentiation of the base value (B) with the exponent (E) modulo the modulus value ( N). A cryptographic processor according to any one of claims 1 to 8, wherein the processor ( 120 ) comprises a base value register, a modulus value register and a result register, the base value register being adapted to store the base value (B), the modulus value register being adapted to store the modulus value (N) and the result register being adapted to carry the Store result of the exponentiation of the base value (B) with the exponent (E) modulo the modulus value (N). A cryptographic processor according to any one of claims 1 to 9, wherein the base value (B) represents data to be encrypted, and the result of the exponentiation of the underlying (B) with the exponent (E) modulo the modulus value (N) represents encrypted data or the underlying ( B) represents encrypted data and the result of the exponentiation of the base value (B) with the exponent (E) modulo the modulus value (N) represents decrypted data. Chip card with a cryptographic processor according to one of claims 1 to 10. Apparatus for calculating a result of exponentiation of a base value with an exponent modulo a modulus value for encrypting or decrypting data, comprising: means for generating a random number adapted to generate a random number; and an exponentiation result calculating means configured to calculate a sum of the base value (B) by a multiple of the modulus value (N) to obtain a random base value (B _R ), wherein the multiple of the modulus value (B) N) is dependent on the random number (R), and wherein the means for calculating the result of the exponentiation is arranged to calculate the result of the exponentiation based on the random base value (B _R ), the apparatus being adapted to generate a random number to generate the random number (R) with a predefined bit length, wherein the predefined bit length of the random number (R) is at least equal to a number of bits of the exponent (E) for which the calculation of the associated intermediate results on the same random base value ( B _R ), wherein means for calculating the result of the exponentiation is arranged to calculate the intermediate results for all bits of the Expo calculate (E) based on different random base values (B _R ), calculate the intermediate results of a predefined number of bits of the exponent (E) based on a same random base value (B _R ), or the intermediate results calculates a random number of bits of the exponent (E) based on a same random base value (B _R ), and wherein the means for calculating the result is adapted to calculate the random base value (B _R ) the modulus value (N) in its binary representation to shift the bit length of the random number (R) to the left. Procedure ( 300 ) for calculating a result of an exponentiation of a base value with an exponent modulo a module value for encrypting or decrypting data, comprising the steps of: generating ( 310 ) a random number with a predefined bit length; To calculate ( 320 ) a sum of the base value with a multiple of the modulus value to obtain a random base value, wherein the multiple of the modulus value depends on the random number; and calculating ( 330 ) of the result of the exponentiation based on the random base value, wherein the predefined bit length of the random number (R) is at least equal to a number of bits of the exponent (E) for which the calculation of the associated intermediate results on the same random base value (B _R ) wherein, to calculate the intermediate results for all the bits of the exponent (E) based on different random base values (B _R ), the intermediate results of a predefined number of bits of the exponent (E) are calculated based on a same random base value (B _R ) or the intermediate results of a random number of bits of the exponent (E) are calculated on the basis of a same random base value (B _R ), wherein for the calculation of the random base value (B _R ) the modulus value (N) is multiplied by the bit length of the random number in its binary representation (R) is moved to the left. Computer program with a program code for performing a method according to claim 13, when the computer program runs on a computer or microcontroller.

Images