EP1639450A1

EP1639450A1 - Method for countermeasuring in an electronic component

Info

Publication number: EP1639450A1
Application number: EP04741817A
Authority: EP
Inventors: Marc Joye
Original assignee: Gemplus Card International SA; Gemplus SA
Current assignee: Gemplus SA
Priority date: 2003-06-18
Filing date: 2004-06-17
Publication date: 2006-03-29
Also published as: FR2856538A1; WO2004111833A1; FR2856538B1; US20070121935A1

Abstract

The invention relates to a method for countermeasuring in an electronic component while using a public key cryptographic algorithm. The invention involves the use of a public key cryptographic algorithm containing an exponentiation calculation y=g^d, in which g and y are elements of specified group G noted in a multiplicative manner and d is a predetermined number.

Description

COUNTER-MEASUREMENT METHOD IN AN ELECTRONIC COMPONENT

The present invention relates to a countermeasure method in an electronic component implementing a public key encryption algorithm. In the classic model of secret key cryptography, two people wishing to communicate via an insecure channel must first agree on a secret encryption key K. The encryption function and the decryption function use the same K key. The drawback of the secret key encryption system is that said system requires the prior communication of the K key between the two persons via a secure channel, before any encrypted message is received. be sent through the unsecured channel. In practice, it is generally difficult to find a perfectly secure communication channel, especially if the distance between the two people is significant. The term “secure channel” is understood to mean a channel for which it is impossible to know or modify the information which passes through said channel. Such a secure channel can be produced by a cable connecting two terminals, owned by the two said people. The concept of public key cryptography was invented by Whitfield Diffie and Martin Hellman in 1976

(IEEE Transactions on Information Theory, volume 22, number 6, pages 644-654, 1976). Public key cryptography solves the problem of distributing keys across an insecure channel. The principle of public key cryptography is to use a key pair, a public encryption key and a private decryption key. It must be computationally infeasible to find the private decryption key from the public encryption key. A person A wishing to communicate information to a person B uses the public encryption key of person B. Only person B has the private key associated with his public key. Only person B is therefore capable of deciphering the message addressed to him.

The difficult computational problem considered by Diffie and Hellman is the resolution of the discrete logarithm in the multiplicative group of a finite field. It is recalled that in a finite body, the number of elements of the body is always expressed in the form q ^A n, where q is a prime number called the characteristic of the body and n is an integer. A finite field having q ^A n elements is noted GF (q ^A n). In the case where the integer n is equal to 1, the finite field is said to be prime. A body has two groups: a multiplicative group and an additive group. In the multiplicative group, the neutral element is noted 1 and the group law is noted multiplically by the symbol. and is called multiplication. This law defines the exponentiation operation in the multiplicative group G: given an element g belonging to G and an integer d, the result of the exponentiation of g by d is the element y such that y = g ^d = ggg g (d times) in the group G. We also recall that the order of a group G is the number of its elements and that the order of an element g in G is the most positive integer e such g ^Λ e = l in G. An important property on the order of the elements of a group is given by the the

Lagrange theorem: the order of an element always divides the order of its group.

The problem of the discrete logarithm in the multiplicative group G of a finite field consists in finding, if it exists, an integer d such y = g ^Λ d in G, given two elements y and g belonging to G.

Another advantage of public key cryptography over secret key cryptography is that public key cryptography allows authentication by the use of electronic signature.

The first public key encryption scheme was developed in 1977 by Ronald Rivest, Adi Shamir and Léonard Adleman (Communications of the ACM, volume 21, number 2, pages 120-126, 1978), who invented the system RSA encryption. The security of RSA is based on the difficulty of factoring a large number which is the product of two prime numbers. The RSA encryption system is constructed in the multiplicative group G of the ring Z / (nZ) obtained by quoting the ring of integers Z by the ring nZ where n is a large integer which is the product of prime numbers p and Q. The RSA problem in this group G consists in finding, if there exists, an element m of G such that c = m ^A e in G, given an element c of G and an integer e relatively prime with the order of the group G.

Since then, numerous public key encryption systems have been proposed, the security of which is based on various computational problems: (this list is not exhaustive).

Merkle-Hellman backpack: This encryption system is based on the difficulty of the problem of the sum of subsets. McEliece: This encryption system is based on the theory of algebraic codes. It is based on the problem of decoding linear codes. - El Gamal:

This encryption system is based on the difficulty of the discrete logarithm in a finite body.

Elliptical curves:

The elliptic curve encryption system constitutes a modification of existing cryptographic systems to apply them to the domain of elliptic curves.

rr '• use of elliptic curves in cryptographic systems was proposed independently by Victor Miller (Advances in Cryptology - CRYPTO '85, volume 216 of Lecture Notée? in Computer Science, Springer-Verlag, 1986) and Neal Koblitz {Mathematics of Computation, volume 48, number 177, pages 203-209, 1987) in 1985. The real applications of elliptic curves were considered in the early 1990s. The advantage of cryptographic systems based on elliptic curves is that they provide equivalent security. to other cryptographic systems but with smaller key sizes. This gain in key size implies a reduction in memory requirements and a reduction in calculation times, which makes the use of elliptical curves particularly suitable for smart card type applications. For the record, an elliptical curve on a finite field GF (q ^A n) is the set of points (X _/ -y) belonging to GF (q ^Λ n) satisfying the equation: y ^A 2 + aixy + a ₃ y = x ^Λ 3 + a _∑ x ^A 2 + a ₄ x + a ₅ , with ai in GF (q ^A n) and from point to infinity 0. Any elliptic curve defined on a body can be expressed in this form .

The set of points (x, y) and the point at infinity form an abelian group, in which the point at infinity is the neutral element and in which the group operation is the addition of points, denoted + and given by the well-known rule of the secant and the tangent (see for example “Elliptic Curve Public Key Cryptosystems” by Alfred Menezes, Kluwer, 1993). In this group, the pair (x, y), where the abscissa x and the ordinate y are elements of the body GF (q ^Λ n), forms the affine coordinates of a point P of the elliptic curve.

The point addition operation makes it possible to define an exponentiation operation on an elliptical curve: given a point P belonging to an elliptical curve and an integer d, the result of the exponentiation of P by d is the point Q such that Q = d * P = P + P + ... + P (d times). In the case of elliptic curves, in order to insist on the additive notation, the exponentiation is also called scalar multiplication.

The security of cryptographic algorithms on elliptic curves is based on the difficulty of the problem of the discrete logarithm in the group G formed by the points of an elliptic curve, said problem consisting in starting from two points Q and P belonging to G, to find , if it exists, an integer d such that Q = d * P. the

There are many cryptographic algorithms built on a group G. Thus, it is possible to implement algorithms ensuring authentication, confidentiality, integrity control and key exchange.

A common point with most cryptographic algorithms built on a group G is that they include as an parameter an element g belonging to this group. The private key is an integer d chosen randomly. The public key is an element y such that y = g ^Λ d. These cryptographic algorithms generally involve an exponentiation in the calculation of an element z = h ^A where d is the secret key and h is an element of group G. In the paragraph below, an encryption algorithm based on the problem of the discrete logarithm in a group G, noted multiplicatively. This scheme is analogous to the encryption scheme of El Gamal. Let be a group G and an element g in G. The public encryption key is γ = g ^Λ d and the private decryption key is d. A message m is encrypted as follows:

The person wishing to communicate information, called an encryptor, chooses an integer k randomly and calculates the elements h = g ^A k and z = y ^Λ k in the group G, and c = R (z) θ m where R is a function applying the elements of G on all messages and ® denotes the operator of the exclusive OR. The number corresponding to m is the pair (h, c).

The person for whom the cipher is intended, called a decipherer, who has the secret key to decipher m by calculating: z '= h ^Λ d = g ^Λ (kd) = y ^Λ k and m = R (z') Θ c. To carry out the exponentiations necessary in the calculation methods described above, several algorithms exist: - left-right binary exponentiation algorithm; algorithm with addition or addition-subtraction chains; exponentiation algorithm k-ary left-right _/ exponentiation algorithm in signed representation of the exponent.

These algorithms are detailed in chapter 14 of “Handbook of Applied Cryptography” by A. J. Menezes, P.C. van Oorschot and S.A. Vanstone, CRC Press, 1997. This list is not exhaustive.

The simplest and most used algorithm is the left-right binary exponentiation algorithm.

The left-right binary exponentiation algorithm takes as input an element g from a group G and an exponent d. The exponent d is noted d = (d (t), d (t- l), ..., d (0)), where (d (t), d (tl), ..., d (0 )) is the binary representation of d, with d (t) the most significant bit and d (0) the least significant bit.

The algorithm returns the element y = g ^A d in group G as an output.

The left-right binary exponentiation algorithm has the following 3 steps:

1) Initialize register A with the neutral element of

G 2) For i going from t to 0 execute: 2a) Replace A with A ^Λ 2 2b) If d (i) = l replace A with A. g 3) Return A. The left-right k-ary exponentiation algorithm takes as input an element g of a group G and an exponent d noted d = (d (t), d (tl), ..., d (0)) , where (d (t), d (t- 1), ..., d (0)) is the k-ary representation of d, i.e. each digit d (i) of the representation of d is an integer between 0 and 2 ^Λ kl for an integer k> l, with d (t) the most significant digit and d (0) the least significant digit. The algorithm returns the element y = g ^A d in group G as an output and includes the following 4 steps: 1) Precalculations: la) Set gi = g Ib) If k> 2, for i going from 2 to (2 ^A kl): calculate gi = g ^A i 2) Initialize register A with the neutral element of

G

3) For i going from t to 0 execute: 3a) Replace A by A ^Λ (2 ^Λ k)

3b) If d (i) is non-zero, replace A with A.gi 4) Return A.

In the case where k is equal to 1, we notice that the left-right k-ary exponentiation algorithm is none other than the binary left-right exponentiation algorithm.

The left-right k-ary exponentiation algorithm can be adapted to take as input a signed representation of the exponent d. The exponent d is given by the signed k-ary representation (d (t), d (tl), ..., d (0)) in which each digit d (i) is an integer between - (2 ^Λ kl) and 2 ^Λ kl for an integer k≥l, with d (t) the most significant digit and d (0) the least significant digit. Step 3b of the previous algorithm is then replaced by: 3b ') If d <±) is strictly positive, replace A with A.gi; and if d (i) is strictly negative, replace A by A. (gi) ^Λ (-l)

This adaptation is particularly interesting when the inverse of the elements g _if denoted (gi) ^A (-l), is easy or inexpensive to calculate. This is for example the case in group G of the points of an elliptical curve. In the case where the inverse of the elements gi is not easy or too costly to calculate, their value is precalculated.

In certain situations, the product of two exponentiations, of the type (g ^A d). (h ^A e) in a group G where g and h are elements of G and d and e two integers whose respective binary representations are

(d (t), d (tl), ..., d (0)) and (e (t), e (tl), ..., e (0)), must be calculated. This is particularly the case in the verification of a DSA digital signature. Rather than calculating each exponentiation g ^Λ d and h ^A e separately and then evaluating the product, the left-right binary exponentiation algorithm can be extended to calculate the double exponentiation (g ^A d). (h ^Λ e) in G as follows:

1) Initialize register A with the neutral element of

G

2) For i going from t to 0 execute: 2a) Replace A by A ^A 2

2b) If d (i) = l replace A with A. g 2c) If e (i) = l replace A with A. h

3) Return A. The advantage of this method is that the number of multiplications for the calculation of (g ^A d). (h ^A e) is reduced compared to two successive applications of the left-right binary exponentiation algorithm. An improvement in speed of the previous algorithm consists in precomputing the element u = gh in G. Thus, the algorithm of binary double exponentiation for the computation of (g ^A d). (h ^Λ e) in G can be written:

1) Pre-calculation: la) Calculate u = g.h

2) Initialize register A with the neutral element of

G

3) For i going from t to 0 execute: 3a) Replace A by A ^A 2 3b) If d (i) = l and e (i) = 0 replace A with A. g 3c) If d (i) = 0 and e (i) = l replace A with Ah 3c) If d (i) = l and e (i) = l replace A with Au

4) Return A.

The previous double binary exponentiation algorithm is generalized by taking as input g and h elements from a group G and exponents d and e given respectively by the k-ary representations d = {d (t), d (tl) , ..., d (0)) and e = (e {t), e (tl), ..., e (0)), for an integer k≥l. The algorithm returns the element y = (g ^A d) as an output. <h ^A e) in group G and includes the following 4 steps:

1) Pre-calculations: a) Ask Ib) If k> 2, for i going from 2 to (2 ^A kl): calculate gi = g ^A i and hi = h ^Λ i

2) Initialize register A with the neutral element of G

3) For i going from t to 0 execute: 3a) Replace A by A ^Λ (2 ^Λ k)

3b) If d (i) is non-zero, replace A with A.gi 3c) If e (i) is non-zero, replace A with A.hi 4) Return A.

If the exponents e and d are given in k-ary representation signed by d = (d (t), d (tl), ..., d (0)) and e = (e (t), e (t- 1), ..., e (0)), steps 3b and 3c of the previous algorithm are then replaced by:

3b ') If d {i) is strictly positive, replace A by A.gi; and if d (i) is strictly negative, replace A by A. (gi) ^Λ (-l)

3c ') If e (i) is strictly positive, replace A with A.hi; and if e (i) is strictly negative, replace A by A. (hi) ^A (-1)

Remarkably, the double exponentiation algorithm corresponding to the case k = l in the previous algorithm where the exponents d and e are given in signed binary representation is particularly interesting for applications of the elliptic curve type in a card-type environment. puce because the reverse of an element is inexpensive and the memory requirements are reduced. Many variants according to this particular case of k = l are presented in a technical report by Jérôme Solinas

(Technical report CORR-2001-41, CACR, University of

Waterloo, Canada). This list of double exponentiation algorithms is not exhaustive.

The exponentiation and double exponentiation algorithms described above are given in the

multiplicative notation; in other words, the group law of group G is noted. (multiplication). These algorithms can be given in additive notation by replacing the multiplications by additions; in other words, the group law of group G is denoted + (addition). This is for example the case of the group of points of an elliptical curve which is most often given in additive form.

It appeared that implementation on a smart card of a public key cryptographic algorithm built on a group G was vulnerable to attacks consisting of a differential analysis of a physical quantity making it possible to find the secret key. These attacks are called DPA type attacks, acronym for Differential Power Analysis and were notably unveiled by Paul Kocher (Advances in Cryptology - CRYPTO '99, volume 1966 of Lecture Notes in Computer Science, pages 388-397, Springer-Verlag, 1999 ). Among the physical quantities which can be exploited for these purposes, one can quote the current consumption, the electromagnetic field, ... These attacks are based on the fact that the manipulation of a bit, ie its processing by a particular instruction, has a particular imprint on the physical quantity considered according to its value.

In particular, when an instruction manipulates data of which a particular bit is constant, the value of the other bits may vary, the analysis of the current consumption linked to the instruction shows that the average consumption of the instruction is not not the same depending on whether the particular bit takes the value 0 or 1. The DPA type attack therefore makes it possible to obtain additional information on the intermediate data manipulated by the microprocessor of the electronic component when executing a cryptographic algorithm. This additional information can in certain cases make it possible to reveal the private parameters of the cryptographic algorithm, making the cryptographic system vulnerable.

An effective counter to DPA attacks is to randomize the inputs of the exponentiation algorithm used to calculate y = g ^A d. In other words, it is a question of making the exponent d and / or the element g random. In additive notation, in the calculation of Q = d * P, it is a question of making the exponent d and / or the element P random.

Countermeasure methods applying this principle are known.

In particular, a countermeasure method consists in masking the exponent d in the calculation of y = g ^A d in a group G by replacing d by d + rq where r is a random integer and q is the order of the element g in the group G. A variant of this countermeasure consists in replacing d by d + rq where r is a random integer and q is a multiple of the order of the element g in the group G; by Lagrange's theorem, a current choice for this multiple is the order of the group G. The value of y = g ^A d in G is then obtained by calculating y = g ^A d 'with d' = d + rq This countermeasure is notably described in an article by Jean-Sébastien Coron (Cryptography Hardware and Embedded Systems, volume 1717 of Lecture Notes in Computer Science, pages 292-302, Springer-Verlag, 1999) in the case where G is the group of points of an elliptical curve defined on a finite body. The disadvantage of the previous countermeasure is that it requires knowledge of the order of the element g in group G or a multiple of this order. In many situations, this value is unknown and too expensive or impossible to calculate. Another disadvantage appears when the exponent d is replaced by d + rq where q is a relatively large multiple of the order of the element g in group G because the additional cost generated by the masking becomes prohibitive. Another countermeasure method, notably described in an article by Christophe Clavier and Marc Joye (Cryptography Hardware and Embedded Systems, volume 2162 of Lecture Notes in Computer Science, pages 300-308, Springer-Verlag, 2001) consists in writing the 'exponent d in the form d = (dr) + r where r is a random integer and then evaluate y = g ^A d in group G as the product of the two exponentiations g ^A (dr) and g ^A r in G Unlike the countermeasure described above, this countermeasure does not require the value of the order of g in G or one of its multiples. A variant consists in drawing a random integer r and writing d in the form with d ₂ equal to the default value of the integer division of d by r and di equal to the rest of said division. The calculation of y = g ^A d in group G is then evaluated as the product of the two exponentiations g ^A di and h ^A d ₂ with h = g ^A r in G. The disadvantage of this type of countermeasure is that several exponentiations are necessary for the calculation of y = g ^A d in G.

An object of the present invention is a countermeasure method, in particular with respect to attacks of the DPA type.

Another object of the invention is a countermeasure method which is easy to implement. The idea underlying the invention is to make the exponent d random by expressing it randomly in the form where di, d∑ and s are integers and then calculate the exponentiation y = g ^A d in the group G by a double exponentiation algorithm.

The invention therefore relates to a countermeasure method in an electronic component implementing a public key cryptographic algorithm, comprising an exponentiation calculation of type y = g ^Λ d where g and y are elements of the determined group G noted multiplicatively and d is a predetermined number, characterized in that it comprises a first masking step for randomly expressing the exponent d in the form where di, d2 and s are integers and a second step to calculate the value of y = g ^A d in G by any type of double exponentiation algorithm (g ^A di). (h ^Λ d ₂ ) with h = g ^Λ s in G. This process applies in the same way if the group G is noted additively.

Other characteristics and advantages of the invention are presented in the following descriptions, made with reference to particular embodiments.

We have seen that the simplest exponentiation algorithm in a group G is the binary left-right exponentiation algorithm. Similarly, the simplest double exponentiation algorithms are given by the various extensions of the left-right binary exponentiation algorithm. Therefore let g be an element of a group G and be of an exponent. Thus, a countermeasure method according to the invention can be written as follows:

1) Masking of d: la) Expressing d randomly in the form of d = d ₂ .s + di where di, d2 and s are integers Ib) Let and (d ₂ (t), d ₂ (t- 1), ..., d2 (0)) the respective binary representations of di and d ₂

2) Double exponentiation:

2a) Define (calculate) the element h = g ^A s in G

2b) Initialize the register A with the neutral element of G 2c) For i going from t to 0 execute: 2cl) Replace A by A ^Λ 2 2c2) If di (i) = l replace A by A. g 2c3) If d ₂ (i) = l replace A with A. h 2c4) Return A.

Remarkably, this method masks the exponent d and only requires at most three multiplications in G per iteration in step 2). This number of multiplications in G is reduced to two in the case where the product of g and h is precomputed. The following countermeasure method is thus obtained:

1) Masking of d: la) Expressing d randomly in the form of d = d ₂ .s + di where di, d ₂ and s are integers Ib) Let (di (t), di (t-1), ..., d _x (0)) and (d ₂ (t), d ₂ (t- 1), ..., d ₂ (0)) the respective binary representations of di and d ₂

2) Double exponentiation:

2a) Define (calculate) the element h = g ^A s in G the

2b) Precompute u = g.h in G

2c) Initialize the register A with the neutral element of G

2d) For i going from t to 0 execute: 2dl) Replace A by A ^A 2

2d2) If di (i) = l and d ₂ (i) = 0 replace A with A. g 2d3) If and d ₂ (i) = l replace A with A. h 2d4) If di {i) = l and d ₂ (i) = l replace A with Au 2d5) Return A.

Another interesting application of the invention relates to exponentation in the group G of the points of an elliptic curve defined on a finite field GF (q ^Λ n). In this group G, denoted additively, the inversion of a point P, denoted -P, is an inexpensive operation so that it is interesting to represent the exponents in a signed manner. Let there therefore be a point P in the group G of the points of an elliptic curve defined on a finite field GF {q ^Λ n) and an exponent d. Thus, a countermeasure method according to the invention applied to the group of points of an elliptical curve on a finite body GF (q ^A n) can be written as follows:

1) Masking of d: la) Expressing d randomly in the form of d = d ₂ .s + di where di, d ₂ and s are integers Ib) Let (d ₁ (t) _r d ₁ (tl), ..., d ₁ (0)) and (d ₂ <t), d ₂ (t- 1),.,., d ₂ (0)) of the signed binary representations for di and d ₂ 3) exponentiation:

2a) Define (calculate) the point R = s * P in G

2b) Initialize a register A with the neutral element of G 2c) For i going from t to 0 execute: 2cl) Replace A by 2 * A

2c2) If di (i) is non-zero replace A by A +

Ci ₁ (I) * P

2c3) If d ₂ (i) is non-zero replace A by A + d ₂ (i) * R

2c4) Return A.

In general, the countermeasure method applies to any double exponentiation algorithm in a group G, noted in a multiplicative or additive manner.

A preferred embodiment for expressing the exponent d randomly in the form .d = d2. s + di where di, d ₂ and s are integers in step la in the above countermeasures consists of choosing a random integer s and taking d ₂ equal to the default value of the integer division d by s and di equal to the rest of said division. Another preferred embodiment for expressing the exponent d randomly in the form d = d ₂ .s + di where di, d ₂ and s are integers in step la in the countermeasuring methods above. above is to choose a random integer di, set s to the value 1 and take d ₂ equal to the difference of d and d _x .

Claims

1. Countermeasure method in an electronic component using a public key cryptographic algorithm, comprising an exponentiation calculation of type y = g ^Λ d where g and y are elements of the determined group G noted in a multiplicative manner and d is a predetermined number, characterized in that it comprises a first masking step for randomly expressing the exponent d in the form d = d2. s + di where di, d ₂ and s are integers and a second step to calculate the value of y = g ^A d in G by any type of double exponentiation algorithm (g ^Λ di). (h ^A d ₂ ) with h = g ^A s in G.

2. A countermeasure method according to claim 1, characterized in that group G is scored additively.

3. Countermeasure method according to claim 1, characterized in that the method comprises the following steps: 1) Masking of d: la) Expressing d randomly in the form of d = d ₂ .s + di where di, d ₂ and s are integers

Ib) Let (d _x (t), di (t-1), ..., di (0)) and (d ₂ (t), d ₂ (t-1), ..., d ₂ (0 )) the respective binary representations of di and d ₂ 2) Double exponentiation:

2a) Define (calculate) the element h = g ^Λ s in

G 2b) Initialize register A with the neutral element of G

2c) For i going from t to 0 execute:

2cl) Replace A with A ^A 2 2c2) If di (i) = l replace A with A. g

2c3) If d ₂ (i) = l replace A with Ah

2c4) Return A.

4. Countermeasure method according to claim 1, characterized in that the method comprises the following steps: 1) Masking of d: la) Expressing d randomly in the form of d = d ₂ .s + dχ where di, d2 and s are integers Ib) Let (d _x (t), di (t-1), ..., di (0)) and

(d ₂ (t), d2 (t-1), ..., d ₂ (0)) the respective binary representations of di and d ₂ 2) Double exponentiation:

2a) Define (calculate) the element h = g ^Λ s in G

2b) Precompute u = g.h in G 2c) Initialize register A with the neutral element of G

2d) For i going from t to 0 execute: 2dl) Replace A by A ^A 2

2d2) If di (i) = l and d ₂ (i) = 0 replace A with A. g

2d3) If di (i) = 0 and d ₂ (i) = l replace A with Ah 2d4) If di (i) = l and d ₂ (i) = l replace

A by A.u

2d5) Return A.

5. Countermeasure method according to claim 2, characterized in that the method comprises the following steps:

1) Masking of d: la) Expressing d randomly in the form where di, d ₂ and s are integers Ib) Let (dα (t), di (t-1), ..., di (0)) and (d ₂ (t), d ₂ (t-1) , ..., d ₂ (0)) of the binary representations signed for di and d ₂ 2) exponentiation:

2a) Define (calculate) the point R = s * P in G

2b) Initialize a register A with the neutral element of G 2c) For i going from t to 0 execute:

2cl) Replace A by 2 * A 2c2) If di (i) is non-zero replace A by A + d ₅ (i) * P

2c3) If d ₂ (i) is non-zero replace A by A + d ₂ (i) * R

2c4) Return A.

6. Countermeasure method according to any one of the preceding claims, characterized in that, in the first masking step, the expression of the exponent d randomly in the form d = d ₂ .s + di where di, d ₂ and s are integers, consists in choosing a random integer s and in taking d ₂ equal to the default value of the integer division of d by s and di equal to the rest of said division.

7. Countermeasure method according to any one of claims 1 to 5, characterized in that the expression of the exponent d randomly in the form where di, d ₂ and s are integers _r consists of choosing a random integer di, setting s to the value 1 and taking d ₂ equal to the difference of d and di.

Electronic component implementing the method according to any one of the preceding claims.