JP4713490B2 - Method for masking computation of plaintext message retrieved from ciphertext message and apparatus for masking ciphertext message - Google Patents

Description

  The present invention relates to the field of cryptography, and in particular to encryption algorithms and devices intended to be secured against physical attacks, such as smart cards that use public key cryptosystems. .

  Cryptographic masking methods are indicated by the reference Douglas Stinson, “Cryptography, Theory and Practice”, CRC Press, 1995 (herein “Stinson”). It is described in. A description of non-intrusive attack techniques and secret moduli masking is given in US Pat. No. 5,991,415 to Shamir (shown herein as “Shamir”). It is disclosed. Masking methods are further described in US Pat. No. 6,298,442 (indicated herein as “Kocher”) to Kocher et al., And Joe et al. International Patent Application Publication No. WO03014916 (denoted herein as “Joy”).

  Montgomery arithmetic was first mentioned by Peter Montgomery in "Modular Multiplication Without Trial Division", Mathematics of Computation, 44 (1985). A Montgomery arithmetic method and apparatus is disclosed in US Pat. No. 6,185,596 (denoted herein as “596”).

  The disclosure content of all publications mentioned in the above specification and the publications cited therein are hereby incorporated by reference.

  Many public key cryptosystems use modulo exponentiation, and a common operation in such cryptosystems is to power a message. For example, encryption may involve raising the plaintext message to a public exponent and cryptanalysis may involve raising the ciphertext to a private (secret) exponent. As used herein, the term “message” means any input to an encryption algorithm for purposes including, but not limited to, encryption, decryption, digital signature, authorization, and authentication. As used herein, the terms “private” and “secret” mean information related to the private key of a public key cryptosystem.

  Known methods for performing powers include iterating squares with selective multiplication corresponding to the “1” bits of the exponent. A device that uses this or a similar method to perform a power raises the device (non-infringingly) during the power process so that the secret index is read by various physical means such as power consumption monitoring. May not be secured because it may be monitored by For example, selecting a message to be a specific value ("selective message attack") can force the device to consume a detectable power difference when performing multiplication operations during powers And this detectable difference may reveal the location of the “1” bit of the secret exponent. There are many known methods of power analysis that allow a secret key to be extracted from an encryption device. Therefore, this device's vulnerability to selective message attack based on power analysis is a security risk factor. In addition to power analysis, there are other non-intrusive approaches to attacking devices that are intended to be secured, including detection of radiation emitted from the device. These methods can rely on any externally detectable and measurable physical phenomenon that reveals the information from which the secret key value can be estimated.

  Various techniques have been used to disguise or hide the internal operations of such devices. A known technique is to perform a dummy operation that produces a similar physical effect (such as power consumption or radiated emissions), but the result of this dummy operation is easily discarded or affects the output. Not give. However, by analyzing the selection message attack, it is possible by calculation to identify the inserted dummy operation and thereby determine the secret key information, despite the use of the dummy operation.

  In order to thwart the selective message attack strategy, no significant computation is performed directly on the message itself, but rather on the intermediate value obtained from the message, preferably by a message masking function with random input. It is considered best to perform calculations. Of course, this requires that the effect of this masking function be removable from the result.

The referenced ElGamal system is used as follows.
That is, a is a secret key known only to the recipient of the encrypted message, x is a message to be sent encrypted by the sender of the system, and an element known to the public , P is the modulus, α is exponential, and the recipient's public key β is given as β = α ^a mod p.

The sender prepares and sends y ₁ and y ₂ in secret,
y ₁ = α ^k mod p, where k is a random masking index generated by the sender,
y ₂ = xβ ^k mod p = xα ^ak and message x is multiplied by the recipient's public key.

Then, using the sent messages y ₁ , y ₂ , the recipient:
M ₁ = y ₁ ^a = α ^ak mod p, y ₁ is ^raised to a power of a (recipient secret).
M ₂ = M ₁ ⁻¹ mod p = (α ^ak ) ⁻¹ mod p = (α ^ak ) ^{p −2} mod p, the receiver inverts M ₁ .
M ₃ = y ₂ M ₂ = x (α ^ak ) (α ^ak ) ⁻¹ mod p = x, retrieved masked message.

  Note that the recipient does not know the secret random mask. The resources consumed by both the receiver and sender consist of two powers, and this is typically a redundant operation in both cases.

The reciprocal powers is also the reciprocal. For example,
5 ^* 9 mod 11≡ ⁰ 1, therefore, 5 and 9 is the inverse modulo 11.
(5 ⁷ mod 11) ≡3; and ((5 ⁻¹ ) ⁷ ) mod 11) ≡ (9 ⁷ mod 11) ≡4
(3 ^* 4) mod 11≡1; therefore, 3 and 4 are also reciprocals modulo 11.

  Some commonly used methods to improve computational efficiency also reduce security risk factors by effectively performing computations on the function of the message rather than on the message itself. Will work. In particular, it is known in the art that the use of Montgomery operations can increase the speed of multiplication by eliminating the need to perform division operations after multiplication to obtain a modulo remainder. is there. For reliable security protection, it is desirable to use yet another masking technique based on Montgomery operations that is applied to the message itself and whose sole purpose is to thwart selective message attacks.

  Masking techniques may include Shamir's method, which converts the prime modulus into a composite modulus, thereby changing the size and secret exponent of the machine operand. However, Shamir's method assumes that the user has knowledge of the prime factor of the cryptographic modulus, which may not be the case. In addition, changing the size of the operands has a significant adverse effect on performance on most hardware devices. Some other protection methods against attacks may not be effective. For example, Joye demonstrates the ineffectiveness of the use of the joint index suggested in Kocher.

According to a first aspect of the invention, a method for masking the computation of a plaintext message retrieved from a ciphertext message with a secret exponent d modulo a binary modulus N having n bits, the random integer x being Using a random integer generator for generating; using a mask generator for calculating a mask equal to the number 2 ^nx mod N; and the ciphertext message and the mask modulo the binary modulus N Calculating a product and using a modulo processor to power the product by an exponent d modulo the binary modulus N to calculate a masked message; and the number 2 ^−nxd mod N Use message retriever generator to calculate equal message retriever And using the modulo processor to calculate the retrieved plaintext message as a product of the masked message and the message retriever. Is done.
According to a second aspect of the present invention, an apparatus for masking the ciphertext message input to an encryption device that works to power a ciphertext message with an exponent d modulo a binary modulus N having n bits A modulo processor that calculates the product of two numbers modulo the binary modulus N and that modulo the binary modulus N and raises the number to the power of d, and a random integer that generates a random integer x A generator and the modulo processor compute the product of the ciphertext message and the mask modulo the binary modulus N, and modulo the binary modulus N and an exponent d to compute the masked message to power the product, the calculated mask equal to the number 2 ^nx mod N modulo processor A mask generator which serves to feed the said mask, said modulo processor, to calculate the product of the masked message to compute the plaintext message and the message retriever, the number ² -nxd mod N An apparatus is provided comprising: a message retriever generator that calculates an equal message retriever and serves to feed the message retriever to the modulo processor.
The preferred embodiment of the present invention further masks the message in a manner that allows the raised message to be easily recovered without having to perform an inversion operation and without having to know the prime factor of the encryption modulus. By seeking to provide a method and apparatus for enhancing the natural masking of Montgomery expressions.

A preferred embodiment of the present invention is for randomly masking incoming messages to a secure device to prevent selective message attacks that are intended to reveal secret key information such as secret exponents. Novel methods and apparatus are provided. The purpose of the preferred embodiment of the present invention is to achieve this masking without degrading performance and using minimal resources, especially without having to generate modulo multiplicative inverses. It is to be. The preferred embodiment of the present invention uses the natural attribute of Montgomery operations in a novel way to maintain masked retrieval without the need to explicitly generate the reciprocal. In particular, there exists a natural Montgomery reciprocal 2 ^-n , where n is the number of bits of the modulus, and, according to a preferred embodiment of the present invention, constructs a new mask from this natural Montgomery reciprocal 2 ^-n Is possible.

  The use of the method or device of the preferred embodiment of the present invention does not preclude the use of other protection methods or devices that are effective to protect against attacks, and typically serves to enhance such methods. To do.

  The preferred embodiment of the present invention is particularly advantageous for masking Diffie-Hellman key exchange powers, DSS reciprocals of random numbers, and RSA-type decryption with user secret keys for complex moduli.

Accordingly, a preferred embodiment of the present invention provides a method for masking a ciphertext message that is input to a device that serves to power the ciphertext message with a secret exponent d modulo the binary modulus N, and this binary modulus. N has n bits and the method includes using the natural Montgomery reciprocal 2 ^-n to generate the mask. In addition, in a preferred embodiment of the present invention, there is also provided an apparatus for masking a ciphertext message that is input to an apparatus that serves to power the ciphertext message with a secret exponent d modulo the binary modulus N; The binary modulus N has n bits, and the apparatus includes a mask generator that serves to generate a mask from the natural Montgomery inverse 2- ⁿ .

Furthermore, a preferred embodiment of the present invention provides a method for masking a ciphertext message input to a device that serves to power the ciphertext message with a secret exponent d modulo the binary modulus N, and this binary modulus. N has n bits, and the method includes (a) generating a random integer x, (b) calculating a mask equal to the number 2 ^nx mod N, and (c) the number 2 compute a message retriever equal to ^-nxd mod N; (d) multiply the ciphertext message by a mask to form a product; and (e) form a masked power message. In order to form the retrieved plaintext message, the product is raised to the power of the secret exponent d modulo the binary modulus N, and (f) And a multiplying the message retriever to click has been power message.

Furthermore, according to a preferred embodiment of the present invention, there is also provided an apparatus for masking a ciphertext message input to an apparatus that serves to power the ciphertext message with a secret exponent d modulo the binary modulus N. Has n bits, and this device serves to (a) compute the product of two numbers modulo the binary modulus N and power the number modulo the binary modulus N A modulo processor, (b) a random integer generator for generating a random integer x, and (c) a modulo processor computes the product of the ciphertext message and the mask modulo the binary modulus N, and the mask So that the product is raised to an exponent d modulo the binary modulus N A mask generator that serves to feed the mask modulo processor computes the mask equal to the number 2 ^nx mod N, the (d) modulo processor, in order to form a plaintext message, masked message and message retriever A message ^{retriever generator that operates} to calculate a message ^retriever equal to 2 ^−nxd mod N and to send the message ^{retriever to the} modulo ^processor so as to calculate a product with the ^retriever .

  Hereinafter, the present invention will be described with reference to the accompanying drawings for illustration only.

Security issues are selected without exposing or leaking d or N completely or partially by radiation, measured transient current consumption, or other non-intrusive physical means Message power M _i ^d mod N, where each M _i is a message, d is a secret exponent, and N is an n-bit modulus. It is understood that numbers are expressed in binary form.

This device contains both N and d. Typically, the attacker has knowledge of N and wants to know the 1 and zero sequence of secret d. In a selective message attack, an attacker typically tries one or many M _i to form a detectable exponential sequence.

A prior art Montgomery modulo processor is shown in the simplified block diagram of FIG. The central element of the processor is a multiplexer 140, which is selected from one of the addend 110 containing only A, the addend 120 containing only N, and the addend 130 containing the sum A + N. The input is received from generator 150 to sum the input addend B with the added addend. It must be pointed out that since this operation is always a mod N operation, adding N to an arbitrary amount does not change the congruence of the result. However, since N is typically odd (in practical applications), the least significant bit of N will typically be set. A unique feature of Montgomery arithmetic is that the arithmetic is manipulated so that the result is a number multiplied by 2 ⁿ . Doing so eliminates the need to divide the result for modulo reduction. In each part of this operation, the input addend B and the input addend A are examined to determine the least significant bit of their sum. If A is even (the least significant bit is zero), A + N will be odd (the least significant bit is 1) and vice versa. Thus, multiplexer 140 is set to select which input is required to make sum A + B even (the least significant bit is zero) when sent to carry save adder 160. It is possible.

  This mask according to the preferred embodiment of the present invention distinguishes between multiplications by different powers of the message so that an attacker cannot distinguish between multiplication and square calculations, or in fact. Configured to conceal and conceal externally visible physical effects such as radiation and current consumption during the multiplication and squaring process by balancing statistics so that it is impossible to ing.

The basic Montgomery modulo multiplication function includes:
H = 2 ²ⁿ mod N (1)
Is the Montgomery retrieval transformation constant. Typically, H is calculated using a remainder division. However, in applications where Montgomery multiplication is more efficient than division, H may be calculated as
H1 = 2 ^{(n + n / 2)} ,
H = P (H1 · H1) N = 2 ^{(n + n / 2)} · 2 ^{(n + n / 2)} · 2 ^-n mod N = 2 ²ⁿ
It is.

When the above-described method is used, H1, H2,. . . Can be used iteratively as follows, where x is an integer:
Hx = 2 ^{(n + n / (2∧x))} ,
On the other hand, (x> 0),
H (x−1) = P (Hx · Hx) N = 2 ^{(n + n / x)} · 2 ^{(n + n / x)} · 2 ⁻ⁿ mod N = 2 ^{(n + n / (2∧ (x -1))} ,
Finally, H = 2 ^{(n + n)} = 2 ²ⁿ mod N.

Montgomery operator in the P field P (x · y) N = x · y · 2 ⁻ⁿ mod N (2)
Introduces a “Montgomery parasite” 2− ⁿ mod N at each P-field Montgomery square or multiplication.

The H constant of equation (1) is used to generate an easily retrieveable Montgomery multiplier for message M;
A = P (M · H) N = M · 2 ²ⁿ · 2 ⁻ⁿ mod N = M · 2 ⁿ (3)
A, H, and the subsequent result are n-bit operands.

Performing the multiplication by P field, both operands ^{A '= A · 2 n mod} N and operand ^{B' = B · 2 n mod} N is, 2 ⁿ mod N is pre-multiplied according to Equation (3) Montgomery Operand
P (A ′ · B ′) N = A · B · 2 ⁿ mod N (4)
It is.

The calculation of X, A = M · ^{2n to} the d-th power of Montgomery,
X ((A) ^d ) N = X ((M · 2 ⁿ ) ^d ) N = (M) ^d · 2 ⁿ mod N (5)
and,
The retrieval of the operands from the P field of the Montgomery power result for a modulo natural integer field is
P ((M) ^d · 2 ⁿ ) · (1)) N = M ^d · 2 ⁿ · 1 · 2 ⁻ⁿ mod N = M ^d mod N (6)
It is.

In the following, a 2 ^nx mod N mask is typically used to mask the value of an operand while performing a power using a conventional or Montgomery method.

Conventional Montgomery operations typically begin by taking the message M and Montgomery multiplying H = 2 ²ⁿ mod N as in equation (3). In the preferred embodiment of the present invention, a message is prepared for a power and masked by 2 ^xn mod N, where x is a random number. In contrast, the prior art mask is simply the random number x itself. However, as mentioned above, this means that the factor ^xd appears in the power result and must be removed by multiplying by the reciprocal x- ^d . This requires that the reciprocal x ⁻¹ can be calculated. However, the novel mask 2 ^xn mod N of the preferred embodiment of the present invention is typically easily removed without computing the reciprocal of the random number x.

  In the preferred embodiment of the invention, this mask is typically precomputed at the initial setup of the secure device. In addition, the mask can be restored at each reset of the device if required by the user's policy. As mentioned above, the use of the preferred embodiment of the present invention does not eliminate or interfere with other security protection methods such as dummy inserts.

  This idea is easily demonstrated by Montgomery arithmetic.

For example, select d = 7 and find M ⁷ mod N in the masked sequence masked by the random number x = 2.

Instead of calculating in a normal Montgomery operation, M is multiplied by a 2 ^× n mod N mask. This final Montgomery power can be masked and retrieved by a masked reciprocal that is easily derived, eg,
(A) Generate H ² = 2 ⁴ⁿ mod N − (in this case, x = 2) by divide by division or using intellectual property Montgomery method;
(B) Prepare a masked message to generate the mask 2 ^xn and for this message an inverted 2 ^-yn mod N can be generated;
P (M · H ² ) N = M · 2 ⁴ⁿ · 2 ⁻ⁿ mod N = M · 2 ³ⁿ = A (7)
(C) Perform A Montgomery power on A using the Chandah-sutra method. Chang Doha Sutra exponentiation is, Donald eggplant due to (Donald Knuth) "computer programming techniques (The Art of Computer ^{programming)", 2 nd Edition, Volume 2,} Addison Wesley, 1981 ( herein shown as "Knuth") Page 441.

P (A · A) N = P (A ₁ ² ) N = M · 2 ³ⁿ · M · 2 ³ⁿ · 2 ^-n mod N = M ² · 2 ⁵ⁿ mod N (8),
P (P (A ₁ ² ) N · A) N = P (A ₂ ³ ) N = M ³ · 2 ⁵ⁿ · 2 ³ⁿ · 2 ⁻ⁿ = M ³ · 2 ⁷ⁿ (9),
P ((P (A ₂ ³ ) N) · (P (A ₂ ³ ) N)) N = P (A ₃ ⁶ ) N = M ³ · 2 ⁷ⁿ · M ³ · 2 ⁷ⁿ · 2 ^-n mod N ( 10)
P ((P (A ₂ ³ ) N) · (P (A ₂ ³ ) N)) N = M ⁶ · 2 ¹³ⁿ mod N (11)
P ((P (A ₃ ⁶ ) N) · A) N = P (A ₄ ⁷ ) N = M ⁶ · 2 ¹³ⁿ · M · 2 ³ⁿ · 2 ^-n mod N (12)
P ((P (A ₃ ⁶ ) N) · A) N = M ⁷ · 2 ¹⁵ⁿ mod N (13)

Preferably, the retrieval mask generation is based on Montgomery parasite 2 ^-n mod N, which is obtained by a single Montgomery multiplication,
P (1 · 1) N = 2 ⁻ⁿ mod N (14)
And then, typically, a similar power procedure raises this mask retrieval value to ^2-14n mod N = Y.

Next, retrieval from the P-field and removal of the mask are typically performed in a single Montgomery multiplication of exponential time Y,
M ⁷ mod N = P ((M ⁷ · 2 ¹⁵ⁿ ) · 2 ⁻¹⁴ⁿ ) N = M ⁷ · 2 ⁿ · 2 ⁻ⁿ mod N (15)
It is.

  This indicates that even when e (encryption index) is not known, the decryption sequence of the selected message is typically generated without knowledge of the N tortient functions.

In general, if the exponent multiplier x is greater than 90 in a 2 ^xn mod N random mask, the attacker can either derive the mask to perform a selective message attack or form a selective message with the random mask. It is impossible.

  Montgomery mask method for devices with limited Montgomery capability or extended Euclidean inverse.

  FIG. 2 is a flow diagram illustrating a preferred sequence for preparing a Montgomery mask and message retriever according to the first embodiment of the present invention.

In step 210, a secret exponent d and an n-bit modulus N are input, where d and N are integers, and H is calculated according to equation (1). H ^1/2 = 2 ⁿ mod N is calculated by a single integer subtraction,
2 ⁿ -N≡2 ⁿ mod N (16)
It is.

Then, in step 220, H ^−1/2 is calculated and, as in equation (14) above,
H ^−1/2 = 2 ⁻ⁿ mod N≡P (1 · 1) N = 2 ⁻ⁿ mod N
It is.

In step 230, a secret number x is generated. If a thorough search to reveal secret x requires a work factor of 2 ⁹⁰ , x is preferably at least 90.

In step 250, the mask reciprocal K ₁ is calculated,
K ₁ = 2 ^nx mod N = (2 ⁿ ) ^x mod N (17)
It is.

In step 260, the message retriever K ₂ is calculated,
K ₂ = 2 ^−nxd mod N = ((2 ⁻ⁿ ) ^x ) ^d mod N (18)
It is.

K ₁ and K ₂ may be updated by x ′ as needed, as follows:
K ₁ '= ((K ₁ ) mod N) ^x ' mod N (19)
K ₂ '= ((K ₂ ) mod N) ^x ' mod N (20)
Where x ′ is typically a small positive integer chosen at random.

FIG. 3 shows a sequence of use of a Montgomery mask for an input message according to a second embodiment of the present invention for performing a masked power resistant to a selected message attack on ciphertext C. In this case, d, N, K ₁ , K ₂ can be used (eg, in a storage device).

  In step 310, the ciphertext C is input, and C mod N can be calculated from the ciphertext C.

In step 320, N, d, K ₁ , K ₂ are input (eg, from a storage device).

In step 330, A ₁ = C ^* K ₁ mod N is calculated to obtain the ciphertext masked by modulo multiplication.

In step 340, A ₂ = A ₁ ^d mod N is calculated. Masked modulo power = (C ^* K ₁ ) ^d mod N = M ^* 2 ^nxd mod N
It is.

In step 350, the plaintext M is retrieved.
M = C ^d mod N = A ₂ ^* K ₂ mod N = ((C ^d ) (2 ^ndx )) (2 ^−ndx ) mod N

The only resources added are the n-bit constants K ₁ and K ₂ to be stored in the storage device.

  Masked Montgomery power in a preferred apparatus embodiment.

H = 2 ²ⁿ mod N can be calculated by modulo division.

H ^−1/2 = 2 ⁻ⁿ mod N≡P (1 · 1) N = ((1 · 1) 2 ⁻ⁿ ) mod N, 2 ⁿ mod N

Assuming that a work factor of 2 ⁹⁰ is appropriate for conducting an exhaustive search to reveal secret x, x = secret random number, 2 ≦ x ≦ 95, preferably 90 ≦ x. Then, to precalculate K ₁ ,
M ₁ = X ((H) ^x ) N = X (2 ⁿ · 2 ⁿ ) ^x = 2 ^nx · 2 ⁿ mod N,
K ₁ = P (H · M ₁ ) N = 2 ²ⁿ · 2 ⁿ · 2 ^nx · 2 ⁿ · 2 ^-n mod N = 2 ^nx · 2 ²ⁿ mod N
It is.

Note that when precalculating K ₂ , 2 ⁻ⁿ · 2 ⁿ mod N = 1 mod N.

M ₂ = X (1 ^x ) N = X ((2 ⁻ⁿ · 2 ⁿ ) ^x ) N = 2 ^−nx · 2 ⁿ
M ₃ = X ((M ₂ ) ^d ) N = X ((2 ^−nx · 2 ⁿ ) ^d ) N = 2 ^−nxd · 2 ⁿ
K ₂ = P (M ₃ · 1) N = 2 ^−nxd mod N

K ₁ and K ₂ are typically updated by x ′, which is a small positive integer.
K ₁ <-K ₁ '= ((K ₁ ) mod N) ^x ' mod N
M ₄ = X ((M ₃ ) ^x ′) N = X (((2 ^−nx · 2 ⁿ ) ^d ) ^x ′) N = 2 ^−nxx ′ ^d · 2n
K ₂ <-K ₂ '= P (M ₄ ^.1 ) N = 2 ^-nxx ' ^d mod N

FIG. 4 shows a Montgomery function operable on a modulo multiplier to perform a masked power resistant to a selected message attack on the selected ciphertext and calculate C ^d mod N FIG. 6 is a flowchart showing a sequence of using a Montgomery mask for an input message in the third embodiment of the present invention. Perform the following operation.

In step 410, an unmasked ciphertext message C is input or generated. At step 420, inputting the secret exponent d, the n-bit modulus N, the mask K _1, and a message retriever K _2. These are then calculated to give details.

In step 430, a Montgomery mask for the ciphertext is calculated,
A ₁ = P (C · K ₁ ) N = (C · 2 ^nx ) · 2 ⁿ mod N
It is.

In step 440, the Montgomery mask index is calculated,
A ₂ = P (((C · 2 ^nx ) · 2 ⁿ ) ^d ) N = C ^d · 2 ^nxd · 2 ⁿ mod N
It is.

Step 450 retrieves the results from the Montgomery P-field,
C ^d mod N = P ((A ₂ · K ₂ )) N = P ((C ^d · 2 ^nxd · 2 ⁿ ) (2 ^−nxd )) N
It is.

From the viewpoint of security protection, K ₁ and K ₂ are generally updated as described above.

  This masked power eliminates the generation of H before each power and typically saves 4% of the process time with the same number of multiplications and squares.

  FIG. 5 illustrates a simple apparatus for message masking and retrieving according to a fourth embodiment of the present invention that can be used with any suitable method, such as the method illustrated in FIG. FIG. Modulo processor 510 receives modulus 520 and index 530. Random number generator 540 provides random integers to mask generator 550 and message retriever generator 560. A ciphertext message 570 is input to the modulo processor 510 and the modulo processor 510 outputs a plaintext message 580. In another embodiment of the invention, modulo processor 510 performs modulo operations in a conventional manner. However, in yet another embodiment of the present invention, modulo processor 510 performs a Montgomery operation.

  Although the present invention has been described with respect to a limited number of embodiments, it will be understood that many variations and modifications and other applications of the present invention may be made.

  It will be appreciated that the software components of the present invention may be implemented in ROM (Read Only Memory) form if desired. This software component may generally be implemented in hardware using conventional techniques, if desired.

  It is understood that the various features of the invention described in the context of separate embodiments for ease of understanding may be implemented in combination in a single embodiment. On the contrary, the various features of the invention described in the context of a single embodiment for simplicity are implemented separately or in any suitable subcombination. May be.

  It will be appreciated by persons skilled in the art that the present invention is not limited to what has been particularly shown and described herein. Rather, the scope of the present invention is defined only by the claims.

1 is a simplified block diagram of a prior art Montgomery modulo processor. FIG. 4 is a flowchart illustrating a sequence for preparing a Montgomery mask and a message retriever according to a preferred embodiment of the present invention. 3 is a flow diagram illustrating a sequence for using the Montgomery mask of FIG. 2 for an incoming message according to a preferred embodiment of the present invention. 3 including using a Montgomery mask for the incoming message using a Montgomery function operable on the Montgomery modulo multiplier shown in FIG. 1 or FIG. 5 according to a preferred embodiment of the present invention. It is a flowchart which shows the preferable example of this method. FIG. 2 is a simplified block diagram of an apparatus for masking and retrieving messages according to a preferred embodiment of the present invention.

Claims (3)

A method of masking the computation of a plaintext message retrieved from a ciphertext message with a secret exponent d modulo a binary modulus N having n bits, comprising:
Using a random integer generator to generate a random integer x;
Using a mask generator to calculate a mask equal to the number 2 ^nx mod N;
A module for computing the product of the ciphertext message and the mask modulo the binary modulus N, and for raising the product by an index d modulo the binary modulus N to compute the masked message Using a processor,
Using a message ^retriever generator to calculate a message ^retriever equal to the number 2 ^−nxd mod N;
Using the modulo processor to calculate the retrieved plaintext message as a product of the masked message and the message retriever . an apparatus for masking the ciphertext message input to an encryption device which serves to power the ciphertext message with an exponent d modulo a binary modulus N having n bits,
A modulo processor that computes the product of two numbers modulo the binary modulus N and that works to power the number d modulo the binary modulus N;
A random integer generator for generating a random integer x;
The modulo processor calculates a product of the ciphertext message and the mask modulo the binary modulus N, and calculates the product by an index d modulo the binary modulus N to calculate a masked message. A mask generator that operates to calculate a mask equal to the number 2 ^nx mod N to power and send the mask to the modulo processor;
The modulo ^processor calculates a message ^retriever equal to the number 2 ^−nxd mod N so as to calculate a product of the masked message and the message ^retriever to calculate a plaintext message; and A message retriever generator operative to feed a message retriever to the modulo processor. The apparatus of claim 2 , wherein the modulo processor is a Montgomery modulo processor.

Images