US20170207918A1  Cryptography on an elliptical curve  Google Patents
Cryptography on an elliptical curve Download PDFInfo
 Publication number
 US20170207918A1 US20170207918A1 US15/178,528 US201615178528A US2017207918A1 US 20170207918 A1 US20170207918 A1 US 20170207918A1 US 201615178528 A US201615178528 A US 201615178528A US 2017207918 A1 US2017207918 A1 US 2017207918A1
 Authority
 US
 United States
 Prior art keywords
 term
 point
 x1
 calculating
 x2
 Prior art date
 Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
 Abandoned
Links
 238000004364 calculation methods Methods 0 abstract claims description 33
 230000000875 corresponding Effects 0 claims description 6
 230000015654 memory Effects 0 description 4
 239000000047 products Substances 0 description 4
 230000001131 transforming Effects 0 description 4
 238000004422 calculation algorithm Methods 0 description 3
 238000000034 methods Methods 0 description 2
 230000002829 reduced Effects 0 description 2
 238000007792 addition Methods 0 description 1
 238000004458 analytical methods Methods 0 description 1
 238000010276 construction Methods 0 description 1
 230000014509 gene expression Effects 0 description 1
 238000003780 insertion Methods 0 description 1
 230000001603 reducing Effects 0 description 1
 238000006722 reduction reaction Methods 0 description 1
Images
Classifications

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
 H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
 H04L9/002—Countermeasures against attacks on cryptographic mechanisms
 H04L9/005—Countermeasures against attacks on cryptographic mechanisms for timing attacks

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
 H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
 H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyperelliptic curves

 G—PHYSICS
 G06—COMPUTING; CALCULATING; COUNTING
 G06F—ELECTRIC DIGITAL DATA PROCESSING
 G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
 G06F7/60—Methods or arrangements for performing computations using a digital nondenominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and nondenominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
 G06F7/72—Methods or arrangements for performing computations using a digital nondenominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and nondenominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
 G06F7/724—Finite field arithmetic
 G06F7/725—Finite field arithmetic over elliptic curves

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
 H04L9/002—Countermeasures against attacks on cryptographic mechanisms
Abstract
A cryptographic calculation includes obtaining a point P(X,Y) from a parameter t on an elliptical curve Y^{2}=f(X); and from polynomials X1(t), X2(t), X3(t) and U(t) satisfying: f(X1(t))·f(X2(t))·f(X3(t))=U(t)^{2 }in Fq, with q=3 mod 4. Firstly a value of the parameter t is obtained. Next, the point P is determined by: (i) calculating X1=X1(t), X2=X2(t), X3=X3(t) and U=U(t); (ii) if the term f(X1)·f(X2) is a square, then testing whether the term f(X3) is a square in Fq and if so calculating the square root of f(X3) in order to obtain the point P(X3); (iii) otherwise, testing whether the term f(X1) is a square and, if so, calculating the square root of f(X1) in order to obtain the point P(X1); (iv) otherwise, calculating the square root of f(X2) in order to obtain the point P(X2). This point P is useful in a cryptographic application.
Description
 This application is a continuationinpart of copending U.S. patent application Ser. No. 14/261,959, filed Apr. 25, 2014 which claims the benefit of U.S. Pat. No. 8,718,276 issued May 6, 2016, which is a 371 filing from PCT/FR2010/051190 (published as WO 2010/146302) filed Jun. 5, 2010 which claims the benefit of French Application for Patent No. 0954053 filed Jun. 16, 2009, the disclosure of which are hereby incorporated by reference.
 The present invention relates to message cryptography based on the use of points on an elliptical curve, and more particularly said cryptography of a deterministic nature.
 In order to apply a cryptographic calculation to a message, conventionally algorithms are employed for inserting arbitrary values into mathematical structures. For this purpose, the elliptical curves are mathematical structures that are able to facilitate the application of such cryptographic calculations and at the same time save space in memory relative to the use of other cryptographic calculations.
 However, efficient algorithms for inserting arbitrary values using elliptical curves are probabilistic. Consequently, the application time of these algorithms is not constant, it depends on the message to be encoded. Thus, if an attacker determines different application times of the algorithm applied, he can obtain information about the coded message.
 In order to mask the time taken by a probabilistic insertion algorithm, it is possible to provide the addition of unnecessary steps in this algorithm so that its application always extends over a period of time of identical length, regardless of the message processed.
 A point P of an elliptical curve is defined by its abscissa X and its ordinate Y, X and Y satisfying the following equation:

f(X)=Y ^{2} (1) 
 where f(X) is the polynomial f(X)=X^{3}+aX+b
 A family of polynomials is known, which satisfy Skalba's equality which makes it possible to determine such a point on an elliptical curve, as defined in the document ‘Construction of Rational Points on Elliptic curves over finite fields’ by Andrew Shallue and Christiaan van de Woestijne.
 Polynomials X1(t), X2(t), X3(t) and U(t) satisfy Skalba's equality if they satisfy the following equation:

f(X _{1}(t))·f(X _{2}(t))·f(X _{3}(t))=U ^{2}(t) (2) 
 where f is the function that defines the elliptical curve under consideration, and
 where t is a parameter.
 The polynomials that satisfy Skalba's equality can take two parameters u and t. In this case, Skalba's equality is written:

f(X1(t,u))·f(X2(t,u))·f(X3(t,u))=U ^{2}(t,u)  Equations of this type can be used with two parameters u and t. However, in the proposed applications, we can advantageously envisage setting u, or alternatively setting t, at any value. Thus, the value of a single parameter remains to be chosen.
 Given selected parameters t and u, it is noted that X1=X1(t,u), X2=X2(t,u), X3=X3(t,u), U=U(t,u), where X1, X2, X3 and U are elements of Fq. This equation (2) signifies that at least one of the values f(X1), f(X2) and f(X3) corresponds to a squared term in the finite field Fq.
 Then, once the squared term in Fq, f(Xi), is identified, we can then obtain a point on the elliptical curve P(Xi,
f(Xi) .  Calculation of
f(Xi) can be performed by means of an exponentiation calculation when the characteristic q of the field Fq satisfies: 
q=3 mod 4  In this case, it is known that:

√{square root over (f(X _{i}))}=f(X _{i})^{(q+1)/4} (3)  In order to determine a point on the elliptical curve (1), it is therefore necessary to determine which value among the three values f(X1), f(X2) and f(X3) corresponds to a squared term in the finite field Fq. For this purpose we could envisage checking firstly whether the term f(X1) is a squared term in the finite field Fq, then, if it is not the case, apply this same check to the term f(X2), and finally if this is still not so, check the term f(X3) similarly. However, following this procedure, determination of a point on the elliptical curve does not always take the same time, since this determination is executed more quickly if the first term tested is a squared term than if only the third term is a squared term.
 A potential attacker could make use of this difference in elapsed time to determine a point on the elliptical curve for breaking the secret linked to the parameter that enabled this point to be generated. Now, in the field of cryptography, these parameters must remain secret.
 These parameters can in particular correspond to passwords. Thus, it is important that determination of these points does not in itself supply information that makes it possible to break the secret of the parameter, and accordingly, attacks based on an analysis of the elapsed time for determining a point on the curve are to be avoided.
 To overcome this disadvantage, it would be possible to check the three terms f(Xi) systematically for i in the range from 1 to 3. Thus, the time for determining a point on the curve would no longer be a function of the point determined.
 However, checking whether a term of equation (2) is a squared term in the finite field Fq is a complex operation in particular employing an exponentiation, which is costly in execution time. In the case when we wish to determine a point on an elliptical curve on the basis of Skalba's equalities, while performing these determinations in a constant time, four operations of exponentiation are required in the case described above, one exponentiation per check of each of the terms of Skalba's equation (2) and one exponentiation for calculating the square root, as described in equation (3).
 The present invention aims to improve this situation.
 A first aspect of the present invention proposes a method of execution of a cryptographic calculation in an electronic component (As used herein, “electronic component” is defined as a general purpose or dedicated computer programmed to execute instructions which perform the cryptographic calculation described in detail below comprising a step of obtaining a point P(X,Y) starting from at least one parameter t, on an elliptical curve satisfying the equation:

Y ^{2} =f(X); and  starting from polynomials X1(t), X2(t), X3(t) and U(t) satisfying Skalba's equality:

f(X1(t))·f(X2(t))·f(X3(t))=U(t)^{2 } 
 in the finite field Fq, regardless of the parameter t, q satisfying the equation q=3 mod 4;
 said method comprising the following steps:

 /1/ obtain a value of the parameter t;
 121 determine point P by executing the following substeps:
 /i/ calculate X1=X1(t), X2=X2(t), X3=X3(t) and U=U(t)
 /ii/ if the term f(X1)·f(X2) is a squared term in the finite field Fq then test whether the term f(X3) is a squared term in the finite field Fq and calculate the square root of the term f(X3), point P having X3 as abscissa and the square root of the term f(X3) as ordinate;
 /iii/ otherwise, test whether the term f(X1) is a squared term in the finite field Fq and in this case, calculate the square root of the term f(X1), point P having X1 as abscissa and the square root of the term f(X1) as ordinate;
 /iv/ otherwise, calculate the square root of the term f(X2), point P having X2 as abscissa and the square root of the term f(X2) as ordinate;
 131 use said point P in a cryptographic application of encryption or hashing or signature or authentication or identification.
 Thanks to these arrangements, it is possible to determine a point on an elliptical curve in a manner suitable for use in the field of cryptography, since on the one hand this determination takes the same time regardless of the input parameter t and on the other hand it is efficient as the number of demanding operations is reduced.
 This determination takes a constant time that does not depend on the input parameter or parameters. In fact, even if this method offers different processing options depending on the term that corresponds to a squared term in Skalba's equality, the same number of operations of the same type is performed regardless of the point on the curve that is determined. More precisely, regardless of the point on the curve that is determined, the following list of operations is executed:

 test for a squared term in Fq;
 determination of a square root.
 Therefore it is not possible to launch an attack of the ‘timing attack’ type.
 Moreover, this determination is efficient since the number of costly operations employed is limited. In fact, it is possible to check whether one of the three terms of Skalba's equation (2) is a squared term in the finite field Fq, by using at most two operations of the exponentiation type. More precisely, it should be noted that, in one embodiment of the present invention, the test for a squared term corresponds to an exponentiation, which is the most demanding operation to be employed in the present context.
 At step /2//ii/, it is necessary to decide whether the term Ro:

R _{0} =f(X _{1})·f(X _{2})  is a squared term.
 This step can correspond to a test for a squared term, which employs an additional exponentiation, or it can be based on a precalculated value obtained from an earlier calculation in the case when a polynomial satisfying Skalba's equality corresponds to a term that can never be a squared term. In the latter case, which is presented in the following sections, application of a method advantageously requires just one exponentiation. But in the worst case, application of a method according to one embodiment of the present invention corresponds to two exponentiations, one for the test for a squared term applied to Ro, and another exponentiation for the test for a squared term applied either to f(X3) or to f(X1).
 During execution of such calculations according to one embodiment of the present invention, the time taken for carrying out the operations other than an exponentiation is negligible relative to the time taken by the application of an exponentiation. Now, owing to the characteristics of the present invention, instead of four exponentiations, as described previously in a conventional case, two exponentiations are required at most. Such a reduction in the number of exponentiations is very advantageous.
 In one embodiment of the present invention, at step /2//ii/, the following steps are executed:

 calculate R1 such that:

RI=(f(X1)·f(X2))^{q+1/4 } 
 if Ri^{2 }is equal to f(X1)·f(X2), then decide that the term f(X1)·f(X2) is a squared term in field Fq;
 At step /2//iii/, it is tested whether the term f(X1) is a squared term in the finite field Fq according to the following steps:

 calculate R2′ such that:

${R}_{2}^{\prime}={f\ue8a0\left({X}_{1}\right)}^{q1\frac{q+1}{4}}$ 
 calculate R3′ such that:

R′ _{3} =R′ _{2} ^{2 } 
 calculate R4′ such that:

R′ _{4} =R′ _{3} ·f(X _{1})  if R4′ is not equal to 1, at step /2//iv/, the square root of f(X2) is obtained according to the following equation:

√{square root over (f(X _{2}))}=R _{1} ·R′ _{2 }  This embodiment is general and can easily be applied to the whole family of polynomials that satisfy Skalba's equality. It should be noted that, ingeniously, in the case when the squared term in Skalba's equality (2) is f(X2), i.e. the last term to be checked of the three terms of Skalba's equality, it is not necessary to perform a new exponentiation of the type

${f\ue8a0\left({X}_{1}\right)}^{q1\ue89e\frac{q+1}{4}.}$  In fact, the term R2′ can be used advantageously to obtain the square root of the term f(X2). It is thus guaranteed that only two exponentiations at most are employed during execution of a method according to one embodiment of the present invention.
 In one embodiment of the present invention, the polynomials satisfying Skalba's equation in X and Y are expressed in Jacobian coordinates in X′, Y′ and Z such that:

X′=X·Z ^{2 } 
Y′=Y·Z ^{3 }  and the operations of inversion are transformed into operations of multiplication.
 The transformation into Jacobian coordinates makes it possible to transform the inversions into multiplications, when the term Z is correctly selected.
 In one embodiment of the present invention, the polynomials that satisfy Skalba's equality are expressed in Jacobian coordinates, according to which the point P(X,Y) is written P(X′,Y′,Z) such that:

X′=X·Z ^{2}, 
Y′=Y·Z ^{3 }  where the function f is written fz(X′) and satisfies:

fz(X′)=X′ ^{3} +a·X′·Z ^{4} +b·Z ^{6 }  with the elliptical curve satisfying the equation:

y·2=fz(X′)  and the polynomials satisfying Skalba's equality expressed in Jacobian coordinates are X1(t), X′2(t), X′3(t), Z(t) and U′(t) and satisfy Skalba's equality in Jacobian coordinates:

U′(t)^{2}=fzct)(X\(t))·fzct)(X′ _{2}(t))·fzct)(X′ _{3}(t))  with Z(t) determined in such a way that the operations of inversion are transformed into operations of multiplication.
 Here it is a question of applying a transformation in Jacobian coordinates to the Ulas polynomials satisfying Skalba's equality, as stated previously. In this case, it is possible to limit the number of exponentiations to two, and at the same time eliminate any calculation of inversion, while ensuring execution in a constant time of a determination of a point P on the elliptical curve.
 In one embodiment, the polynomials that satisfy Skalba's equality are such that it is possible to set the value of X3(t) for any possible t, such that f(X3(t)) is never a squared term in Fq,
 in which, at step /2//ii/, the term f(X1)·f(X2) is not a squared term in the finite field Fq,
 in which, at step /2//iii/, it is tested whether the term f(X1) is a squared term in the finite field Fq according to the following steps:

 calculate R2′ such that:

R;=f(XI)^{q+1/q−1−4 } 
 calculate R3′ such that:

R′ _{3} =R′ _{2} ^{2 } 
 calculate R4′ such that:

R′ _{4} =R′ _{3} ·f(X _{1})  in which, if R4′ is not equal to 1, at step /2//iv/, the square root of f(X2) is obtained according to the following equation:

√{square root over (f(X _{2}))}=R _{1} ·R′ _{2 } 
 where RI=(f(XI)·f(X_{2}))^{q+1/4 }
 in which R1 is obtained beforehand from the following equation:

${R}_{1}={\left(I\ue8a0\left(X\right).f\ue8a0\left({X}_{2}\right)\right)}^{\stackrel{q+1}{4}}=U.{f\ue8a0\left(u\right)}^{\underset{4}{q1q+1}}$  Thus, in a particular case, it is possible to limit the number of exponentiations to be performed even further by using a particular family of polynomials, such that it is possible to set the value of X3(t) for any possible t, such that f(X3(t)) is never a squared term in Fq. The family of Ulas polynomials as described in the document ‘Rational points on certain hyperelliptical curves over finite fields’ by Macie Ulas, dated 11 Jun. 2007 can advantageously be used here.
 For such a family of polynomials that satisfy Skalba's equality, we can write:

${{X}_{l}\ue8a0\left(t,u\right)=j\}}_{a}[\underset{{t}^{4}\ue89ef\ue8a0\left(u\right)+{t}^{2}\ue89ef\ue8a0\left(u\right)}{l+1J}\ue89e\text{}\ue89e{X}_{2}\ue8a0\left(t,u\right)={t}^{2}\ue89ef\ue8a0\left(u\right)\ue89e{X}_{1}\ue8a0\left(t,u\right)\ue89e\text{}\ue89e{X}_{3}\ue8a0\left(t,u\right)=u\ue89e\text{}\ue89eU\ue8a0\left(t,u\right)={t}^{3}\ue89e{f\ue8a0\left(u\right)}^{4}\ue89ef\ue8a0\left({X}_{1}\ue8a0\left(t,u\right)\right)$ 
 where f(u)=u^{3}+au+b where a and b are elements of Fq such that their product is not zero.
 These polynomials can be used advantageously in determining a set value of the parameter u such that f(X3)=f(u) is not a squared term in Fq,
 Thus, at step /2//ii/, the term f(X_{1})·f(X_{2}) is not a squared term in the finite field Fq, then, at step /1//iii/, it is tested whether the term f(X_{1}) is a squared term in the finite field Fq according to the following steps:

 calculate R_{2}′ such that:

R=f(X1)^{q+1/q−1−4 } 
 calculate R3′ such that:

R′ _{3} =R′ _{2} ^{2 } 
 calculate R4′ such that:

R′ _{4} =R′ _{3} ·f(X _{1})  Then, if R_{4′ }is not equal to 1, at step /1//iv/, the square root of f(X_{2}) is obtained according to the following equation:

√{square root over (f(X _{2}))}=R _{1} ·R′ _{2 } 
 where R_{1}=(f(X_{1})·f(X_{2}))^{q+1/4 }
 R1 can advantageously be obtained beforehand according to the following equation:

$R\ue89e\phantom{\rule{0.3em}{0.3ex}}\ue89e1={\left(f\ue8a0\left(X\right)\xb7f\ue8a0\left({X}_{2}\right)\right)}^{\frac{q+1}{4}}=U\xb7{f\ue8a0\left(u\right)}^{q1\frac{q+1}{4}}$  In particular, the term

${f\ue8a0\left(u\right)}^{q1\frac{q+1}{4}}$  can be calculated in advance. This is possible as f(u) is also calculated in advance. In this particular case of polynomials that satisfy Skalba's equality, it is therefore possible not to have to perform the exponentiation relating to the calculation of (f(X_{1}(t))·f(X_{2}(t)))^{q+1/4 }during application of the method, but just the multiplication

$U\ue8a0\left(t\right)\xb7{\left(f\ue8a0\left(u\right)\right)}^{q1\frac{q+1}{4}}.$  Thus, application of such a method then corresponds to a single exponentiation, that of the calculation of

${R}_{2}^{\prime}={f\ue8a0\left({X}_{1}\right)}^{q1\frac{q+1}{4}}.$  In this context, these particular polynomials are expressed in Jacobian coordinates according to which the point P(X,Y) is written P(X′,Y′,Z) such that:

X′=X·Z ^{2}, 
Y′=Y·Z ^{3 }  where the function f is written fz(X′) and satisfies:

fz(X′)=X′ ^{3} +a·X′·Z ^{4} +b·Z ^{6 }  with the elliptical curve satisfying the equation:

y·2=fz(X′)  where the polynomials that satisfy Skalba's equality expressed in Jacobian coordinates are X′_{1}(t), X′2(t), Z(t) and U′(t) and satisfy Skalba's equality in Jacobian coordinates:

U′(t)^{2} =fzctJ(X\(t))·fzctJ(X′ _{2}(t))·(X _{3}(t))  and where Z(t) is determined in such a way that the operations of inversion are transformed into operations of multiplication.
 At step /1/, the value of the parameter t can be obtained as a function of a password or an identifier. It is thus possible to envisage using the password directly or a derivative of the password as parameter.
 In one embodiment of the present invention, the cryptographic application is an application of authentication or identification by a checking entity, and
 at step /1/, the following steps are executed:

 /a/ generate a random value;
 /b/ obtain an encrypted value by encrypting said random value based on an encryption function using an encryption key determined from a password or identifier corresponding to the parameter; and
 /c/ transmit the encrypted value to the checking entity.
 By following this procedure, the checking entity is able to obtain the random value as a function of the encrypted value received from the password. Then it recovers the value of the parameter t by applying a suitable function.
 A second aspect of the present invention proposes an electronic device comprising suitable means for applying a method of execution of a cryptographic calculation according to the first aspect of the present invention.
 Other aspects, aims and advantages of the invention will become clear on reading the description of one of its embodiments.
 The invention will also be better understood with the aid of the following figures:

FIG. 1 shows the main steps of a method of execution of a cryptographic calculation according to one embodiment of the present invention; 
FIG. 2 shows a method of execution of a cryptographic calculation in detail according to one embodiment of the present invention; 
FIG. 3 shows a method of execution of a cryptographic calculation in detail according to one embodiment of the present invention in the particular case of Ulas polynomials; 
FIG. 4 shows the processing steps performed by an electronic component used to execute the cryptographic calculation according to one embodiment of the present invention; 
FIG. 5 is a block diagram showing the elements of an electronic component used to perform the processing shown inFIGS. 14 . 
FIG. 1 shows the main steps of a method of execution of a calculation according to one embodiment of the present invention.  These main steps are suitable for determining a point on an elliptical curve with the aim of using said point in a cryptographic application. A cryptographic calculation of this kind can be executed in an electronic component in a secure manner, i.e. without the determination of this point giving any information on the point determined.
FIGS. 4 and 5 provide further details regarding the processing performed by the electronic component (FIG. 4 ), and the elements used to implement the electronic component (FIG. 5 ).  This calculation comprises, in a finite field Fq, where q is equal to 3 mod 4, a step of obtaining a point P(X,Y) on an elliptical curve satisfying the equation:

Y ^{2} =f(X)  A point P(X,Y) has its abscissa X which corresponds to one of X1(t), X2(t) and X3(t), for a value of t obtained, such that:

f(X _{1}(t))·f(X _{2}(t))·f(X _{3}(t))=U ^{2}(t) (2)  where X1(t), X2(t), X3(t) and U(t) are polynomials satisfying Skalba's equation in the finite field Fq.
 More precisely, the polynomials that satisfy Skalba's equality, as defined in the document ‘Rational points on certain hyperelliptic curves over finite fields’ by Maciej Ulas, dated 11 Jun. 2007 are functions of two parameters u and t. In the context of the present invention, one of the parameters can advantageously be set and consequently the polynomials satisfying Skalba's equation are then functions of a single parameter t.
 In order to determine a point on the curve, we try to determine, for given input parameters u and t, those among the values X1=X1(t,u), X2=X2(t,u), X3=X3(t,u) that correspond to a squared term in the finite field Fq. For this purpose, application of two different processings is advantageously envisaged depending on whether or not the term f(X1)·f(X2) is a squared term in the finite field Fq.
 At an initial step 100, the parameter t is taken into account and we calculate:

Xi=Xi(t) for i between 1 and 3, 
and 
U=U(t)  At a step 11, we decide whether this product f(X1)·f(X2) is a squared term. This decision can be based on previous calculations or can be based on a check during application of the method. If the term f(X1)·f(X2) is a squared term then the term f(X3) is also a squared term. In this case it is envisaged to calculate the square root of the term f(X3), at a step 12. At a step 16, the point P thus determined has X3 as abscissa and Y3 as ordinate satisfying the following equation:

Y _{3}=√{square root over (f(X _{3}))}  It should be noted that if the product f(X1)·f(X2) is a squared term, it follows that the term f(X3) is also a squared term. However, in order to keep determination of a point on the elliptical curve to a constant time, application of a test 10 is envisaged, so as to check that the term f(X3) is actually a squared term. This test 10 makes it possible to guarantee application of the method according to one embodiment of the present invention in a constant time.
 In the other case, i.e. when the term f(X1)·f(X2) is not a squared term, we can deduce from this that either f(X1), or f(X2) is a squared term. We can therefore envisage checking, firstly, whether the term f(X1) is a squared term at a step 13. If the test is positive, its square root is then calculated at a step 14 in order to obtain the abscissa of the point P:

Y _{1}=√{square root over (f(X _{1}))}  At a step 17, we then obtain the point P which has X1 as ordinate and Y1 as abscissa.
 If the test at step 13 is negative, it can then be deduced from this that the term f(X2) is a squared term. Consequently, at a step 15 we obtain the abscissa Y2 of a point P on the elliptical curve according to the equation:

Y _{2}=√{square root over (f(X _{2}))}  A point P(X2, Y2) of the curve can thus be supplied at a step 18.
 It should be noted that reaching steps 16, 17 or 18 for obtaining a point on the elliptical curve according to one embodiment of the present invention requires similar operations. Thus, regardless of the input parameters t and u, it is not possible to launch an attack on the basis of the time elapsed.
 The point P(Xi,Yi), for an i between 1 and 3, can then be used advantageously in a cryptographic application of encryption or hashing or signature or authentication or identification, since its determination has not supplied any element that can break its secret.
 In the field Fq, q corresponding to 3 mod 4, it is possible to check whether a term is a squared term in various ways. The tests for a squared term such as tests 10 and 13 in
FIG. 1 can be performed as follows. In one embodiment of the present invention, when trying to determine whether a term A is a squared term in Fq, the following steps can be executed: 
$\begin{array}{cc}{W}_{1}=\frac{1}{{A}^{\frac{q+1}{4}}}={A}^{q1\frac{q+1}{4}}& \left(i\right)\\ {W}_{2}={W}_{1}^{2}& \left(\mathrm{ii}\right)\\ {W}_{3}={W}_{2}\xb7A& \left(\mathrm{iii}\right)\end{array}$  Finally, if term A is a squared term then:

 W1 corresponds to the reciprocal of the square root of A, i.e. //JA, since an exponentiation at (q−1) corresponds to an inversion and an exponentiation at (q+1)/4 corresponds to a square root in the finite field Fq;
 W2 corresponds to the inverse of A; and
 W3 corresponds to the value 1.
 Thus, when W3 is equal to the value 1, it is concluded from this that the term A is a squared term in the finite field Fq. If A is not a squared term then W3 is not equal to 1.

FIG. 2 illustrates the implementation of a method of execution of a calculation according to one embodiment of the present invention.  In one embodiment of the present invention, at a step 201, the following multiplication is performed:

Ro=f(X1)·f(X2) 
 Then it is checked whether this term Ro is a squared term by applying steps (iv) and (v). Thus, at a step 202, we calculate: R−R(q+1)14
 Then, at step 203, we determine whether the following equation is satisfied:

R _{1} ^{2} =R _{0} (v)  It is decided whether the term Ro, equal to f(X1)·f(X2), is a squared term or not. In the case where the term Ro is a squared term, a test is applied with the aim of determining whether the term f(X3) is a squared term. The result of the latter test is known beforehand since if Ro is a squared term, then this test is positive. However, for the purpose of ensuring a constant time, it is advisable to apply it according to steps (i) to (iii).
 Thus, at a step 204, the following calculation is performed:

R2=f(X3)(q−1−(q−1/4  Here, R2 corresponds to calculation of the reciprocal of the square root of f(X3), in the case when f(X3) is a squared term.
 Then, at a step 205, the following equation is calculated:

R _{3} =R _{2} ^{2 }  Here, R3 corresponds to the inverse of f(X3).
 Then, at a step 206, R3 is multiplied by the term f(X3), obtaining a term R4. As we know that f(X3) is a squared term, we also know that the term R4 is equal to 1. These steps 205 and 206 are employed in order to guarantee determination of a point P on the elliptical curve in a constant time.
 At a step 207, it is therefore tested whether the term R4 corresponds to 1. In the present case, this test is always positive, since it follows from test 203.
 Then, at a step 208, the following calculation is performed:

Rs=R2·f(X3)  Here, a point P on the curve is obtained which has X3 as abscissa and, as ordinate, the square root of f(X3), i.e. the value Rs.
 In the case when, at step 11, it is decided that the term f(X1)·f(X2) is not a squared term, then either the term f(X1) or the term f(X2) is a squared term.
 Next it is a matter of determining which of these two terms f(X1) and f(X2) corresponds to a squared term.
 For this purpose, operations similar to those described previously are carried out, except that in this case, the term f(X1) need not be a squared term.
 At a step 211, the following equation is calculated:

R′2=f(X1)q−1−(q+1/4  In the case when f(X1) is a squared term, R′2 corresponds to the value of the reciprocal of the square root of f(X1) as described for step (i). Then this lastmentioned term is squared, at a step 212:

R′ _{3} =R′ _{2} ^{2 }  in order to obtain the inverse of f(X1) in the case when f(X1) would be a squared term.
 Thus, on multiplying R3′ by the term f(X1), we obtain R4′ at a step 213, which has the value 1 if the term f(X1) is actually a squared term. In this case, the test carried out at a step 214, during which the term R4′ is compared with the value 1, is positive.
 Then, the following calculation is performed at a step 215:

R's=R′2·f(X1)  The term R's then corresponds to f(X1).
 A point P on the curve is obtained with X1 as abscissa and R's as ordinate.
 In the case when test 214 is negative, the term f(X1) is not a squared term. Then, it follows from this that the squared term in Skalba's equation (2) is the term f(X2). In this case, at a step 216, the following calculation is performed:

R″ _{5} =R _{1} ·R′ _{2 }  It should be noted that the above equation makes it possible to obtain advantageously the square root of f(X2) but without carrying out an operation of exponentiation such as that carried out at step 204 or also at step 211. In fact, here it is, ingeniously, a matter of performing a multiplication instead of an exponentiation.
 We then obtain Rs″, which corresponds to the term f(X2), supplied at a step 216. Thus, a point P on the elliptical curve has been determined which has X2 as abscissa and Rs″ as ordinate.
 In the embodiment described previously with reference to
FIG. 2 , regardless of the determination of point P, i.e. whether this determination is based on the value X1 or X2 or X3, similar calculations are employed, thus ensuring determination of a point on the elliptical curve in a constant time.  More precisely, two operations of exponentiation are employed, one exponentiation at step 202 and another exponentiation at step 204 or 211 depending on the result of test 203. Thus, it is no longer necessary to perform four exponentiations to determine a point on a curve in the context of Skalba polynomials in a constant time.
 In one embodiment of the present invention, it is possible to select polynomials that satisfy Skalba's equality in such a way that the polynomial f(X3(t)) can never correspond to a squared term whatever the value of t. In this case, Skalba's equation:

f(X _{1}(t))·f(X _{2}(t))·f(X _{3}(t))=U ^{2}(t) (2)  can be written in the form:

(f(X _{1}(t))·f(X _{2}(t))·f(X _{3}(t))^{q+1/4}=(U(t)2)^{q+1/4} =U(t)  then also in the form:

${\left(f\ue8a0\left({X}_{1}\ue8a0\left(t\right)\right)\xb7f\ue8a0\left({X}_{2}\ue8a0\left(t\right)\right)\right)}^{\frac{q+1}{4}}=\frac{U\ue8a0\left(t\right)}{{f\ue8a0\left({X}_{3}\ue8a0\left(t\right)\right)}^{\frac{q+1}{4}}}$  and also as:

$\begin{array}{cc}{\left(f\ue8a0\left({X\ue89e\phantom{\rule{0.3em}{0.3ex}}}_{1}\ue89e\left(t\right)\right)\xb7f\ue8a0\left({X}_{2}\ue8a0\left(t\right)\right)\right)}^{\frac{q+1}{4}}=U\ue8a0\left(t\right)\xb7({f\ue8a0\left({X}_{3}\ue8a0\left(t\right)\right)}^{q1\frac{q+1}{4}}& \left(4\right)\end{array}$  All these equations are only valid if the condition q=3 mod 4 is satisfied. Now, if the term

$({f\ue8a0\left({X}_{3}\ue8a0\left(t\right)\right)}^{q1\frac{q+1}{4}}$  of this lastmentioned equation corresponds to a set value, we are able to calculate the value of the term R_{1}=(f(X_{1})·f(X_{2}))^{q+1/4 }efficiently using the multiplication

$U\xb7({f\ue8a0\left({X}_{3}\ue8a0\left(t\right)\right)}^{q1\frac{q+1}{4}}.$  In this case, a point on the elliptical curve can be determined using just one operation of exponentiation, that corresponding to step 204 of test 10, or that corresponding to step 211 of test 13, as appropriate.
 These conditions can be fulfilled using for example a set of polynomials satisfying Skalba's equation as described in the document ‘Rational points on certain hyperelliptic curves over finite fields’ by Macie Ulas, dated 11 Jun. 2007. In this document, the polynomials satisfying Skalba's equation (2) are described:

${X}_{1}\ue8a0\left(t,u\right)=\frac{b}{a}\ue89e\left(1+\frac{1}{{t}^{4}\ue89ef\ue8a0\left(u\right)+{t}^{2}\ue89ef\ue8a0\left(u\right)}\right)$ ${X}_{2}\ue8a0\left(t,u\right)={t}^{2}\ue89ef\ue8a0\left(u\right)\ue89e{X}_{1}\ue8a0\left(t,u\right)$ ${X}_{3}\ue8a0\left(t,u\right)=u$ $U\ue8a0\left(t,u\right)={t}^{3}\ue89e{f\ue8a0\left(u\right)}^{4}\ue89ef\ue8a0\left({X}_{1}\ue8a0\left(t,u\right)\right)$ 
 where f(u)=u3+au+b
 where a and b are elements of Fq such that their product is not zero.
 Thus, by determining a value of u that is set and that does not correspond to a squared term in Fq, the value of R1 is then a set value that can be precalculated according to equation (4), for any determination of point P according to one embodiment of the present invention.

FIG. 3 illustrates a method of execution of a cryptographic calculation in detail according to one embodiment of the present invention in the particular case of Ulas polynomials, for a set polynomial X3(t,u) according to one embodiment of the present invention. In this case, steps 211 to 216 alone can be employed. If step 216 is executed, then the value R1 can be recovered from a memory area as it was calculated previously.  Accordingly, the number of exponentiations required for determining a point on the curve can be further reduced, to a single exponentiation, that which corresponds to test 10 or to test 13.
 In one embodiment of the present invention, the use of Jacobian coordinates is advantageously envisaged. This transformation to Jacobian coordinates makes it possible to transform the operations of inversion into operations of multiplication which are quicker and easier to apply. It should be noted that such an embodiment cannot be applied to all curves of the Skalba type, including to the particular case of Ulas curves.
 The equation of an elliptical curve:

X ^{3} +ax+b=Y2  can be written in Jacobian coordinates:

X′ ^{3} +aX′Z ^{4} +bZ ^{6} =Y′ ^{2 }  It should be noted that the coordinates of a point (X,Y) can be written in Jacobian coordinates (X′,Y′,Z′) such that:

X′=X·Z2 and 
Y′=Y·Z ^{3 }  We should therefore determine a polynomial Z(t,u) in such a way that the Jacobian coordinates X′, Y′ and Z can be written without inversion.
 In the following sections, this transformation into Jacobian coordinates is applied to a particular case, that of Ulas curves as described previously.
 In this context, any operation of inversion is eliminated by taking:

Z(t,u)=a(t ^{4} f(u)^{2} +t ^{2} f(u))  in which u is set.

 In fact, the Ulas polynomials can then be written in the following form in Jacobian coordinates:

X\(t,u)=−b·Z(t,u)(t ^{4} f(u)2+t ^{2} f(u)+1) 
X′ _{2}(t,u)=t ^{2} ·f(u)·X′ _{1}(t,u) 
X′ _{3}(t,u)=u  It should therefore be noted that there is no longer any inversion in Jacobian coordinates. As this operation can be as costly as an exponentiation, these coordinates permit a significant improvement in calculation time.
 Then, to obtain the Jacobian coordinate Y′, it is advisable to calculate U′(t,u), the equivalent of U(t,u) in Jacobian coordinates.
 In this context, in classical coordinates we have:

U(t,u)^{2} =f(X _{1}(t,u))·f(X _{2}(t,u)·f(X _{3}(t,u))  We can then write in Jacobian coordinates:

U(t,u)^{2} =f(X′ _{1}(t,u)/Z(t,u)2)·f(X′ _{2}(t,u)/Z(t,u)2)·f(X′ _{3}(t,u)/Z(t,u)2)  By writing:

fz(t)(X′)=X′ ^{3} +a·X′·Z(t)^{4} +b·Z(t)^{6} =Z ^{6} ·f( ) 
 we obtain the following equation:

Z ^{18}(t,u)·U(t,u)^{2}=(Z(t,u)^{9} ·U(t,u)^{2} =fz(t,u)(X′i(t,u)·fz(t,u)(X′ _{2}(t,u))·fz(t,u(X′ _{3}(t,u)) 
 Then:

U′(t,u)=Z(t,u)^{9} ·U(t,u) 

 where U′(t,u) is the expression of U(t,u) in Jacobian coordinates.

 In the case where it is considered that U(t,u) satisfies the equation:

U(t,u)=t ^{3} ·f(u)^{2}·/(X _{2}(t,u)) 
 we can then write:

U′(t,u)=t ^{3} ·f(u)2·fz(t,u)(X′ _{2}(t,u))Z(t,u)^{3 } 
 Skalba's equality becomes, in Jacobian coordinates:

U′(t,u)^{2} =JZ(t,u)(X\(t,u))·JZ(t,u)(X′ _{2}(t,u))·JZ(t,u)(X′ _{3}(t,u))  Nevertheless, as in the case of Ulas polynomials it is possible to require
 that X′3(t,u) is such that fz(t,u) (X′3(t,u) is never a square. In this case, we have:

U″(t,u)=t ^{3} ·f(u)2·fZ(t,u)(X′ _{2}(t,U)) 
 and the corresponding Skalba equality is:

U″(t,u)^{2} =fz(t,u)(X′i(t,u))·fz(X′ _{2}(t,u))·f(X′ _{3}(t,u))  The present invention can advantageously be implemented in any type of cryptographic calculation using elliptical curves. It can in particular be advantageous in protocols for authentication by password, such as PACE (Password Authenticated Connection Establishment). In this case, it allows an improvement in calculation performance, while not allowing any attack linked to the execution time of the cryptographic calculation.
 The electronic component used to perform a disclosed cryptographic calculation may be any type of general purpose or dedicated computer which has been programed to receive the necessary inputs, perform the desired calculations, and provide the resulting output. By way of example, such a computer could be in the nature of a controller, microcontroller, field programmable gate array (FPGA), or application specific integrated circuit (ASIC).
 The processing performed by such electronic computer includes obtention 411 of a password identifier t which is provided as an input to obtain a point P(X,Y) 413 which is then used to perform a cryptographic calculation using one of the abovedescribed cryptographic protocols according to one of the disclosed embodiments of an execution method according to the present invention.

FIG. 5 discloses an electronic component of the type which may be utilized in the present invention. The electronic component includes a memory 513, a calculator 515 and an interface 517. It is much as such memory, calculator and interface are well known components of the type implemented in known channel purpose or dedicated computers, no further details are necessary in order for a person having ordinary skill in the art to implement such electronic component.  The present invention can also be applied advantageously in the context of privacy protocols, such as those used for checking electronic identity documents, such as electronic passports.
Claims (6)
1. An electronic component configured to execute a cryptographic calculation and to obtain a point P(X,Y) from at least one parameter t, on an elliptical curve that satisfies the equation: Y^{2}=f(X) and from polynomials X_{1}(t), X_{2}(t), X_{3}(t) and U(t) satisfying the following Skalba equality: f(X1(t))·f(X2(t))·f(X3(t))=U(t)^{2 }in a finite field F_{q}, regardless of the parameter t, q satisfying the equation q=3 mod 4, wherein said electronic component is configured to:
obtain a value of the parameter t; and
determine the point P by:
(i) calculating X_{1}=X_{1}(t), X_{2}=X_{2}(t), X_{3}=X_{3}(t) and U=U(t)
(ii) if the term f(X1)·f(X2) is a squared term in the finite field Fq then testing whether the term f(X_{3}) is a squared term in the finite field Fq and calculating the square root of the term f(X_{3}), point P having X_{3 }as abscissa and the square root of the term f(X3) as ordinate;
(iii) otherwise, testing whether the term f(X_{1}) is a squared term in the finite field Fq and in this case, calculating the square root of the term f(X_{1}), point P having X_{1 }as abscissa and the square root of the term f(X_{1}) as ordinate;
(iv) otherwise, calculating the square root of the term f(X_{2}), point P having X_{2 }as abscissa and the square root of the term f(X_{2}) as ordinate;
wherein said electronic component is further configured to use said point P in a cryptographic application selected from the group consisting of encryption or hashing or signature or authentication or identification,
wherein the cryptographic calculation is an application of authentication or identification by a checking entity, and
wherein obtaining the value of the parameter t further comprises:
/a/ generating a random value;
/b/ obtaining an encrypted value by encrypting said random value based on an encryption function using an encryption key determined from a password or identifier corresponding to the parameter; and
/c/ transmitting the encrypted value to the checking entity.
2. The electronic component according to claim 1 , wherein in order to determine the point P said electronic component is further configured to:
calculate R_{1 }such that:
if R_{1} ^{2 }is equal to f(X1)·f(X_{2}), then decide whether the term f(X1)·f(X2) is a squared term in the field F_{q};
test whether the term f(X_{1}) is a squared term in the finite field F_{q }by:
calculating R_{2}′ such that:
calculating R_{3}′ such that:
R′ _{3} =R′ _{2} ^{2 }
R′ _{3} =R′ _{2} ^{2 }
calculating R_{4}′ such that:
R′ _{4} =R′ _{3} ·f(X _{1})
R′ _{4} =R′ _{3} ·f(X _{1})
if R_{4}′ is not equal to 1, obtain the square roof of the term f(X_{2}) from the following equation:
√{square root over (f(X _{2}))}=R _{1} ·R′ _{2}.
√{square root over (f(X _{2}))}=R _{1} ·R′ _{2}.
3. The electronic component according to claim 1 , wherein the polynomials that satisfy Skalba's equality are expressed in Jacobian coordinates according to which the point P(X,Y) is written P(X′,Y′,Z) such that:
X′=X·Z ^{2},
Y′=Y·Z ^{3 }
X′=X·Z ^{2},
Y′=Y·Z ^{3 }
wherein the function f is written f_{z}(X′) and satisfies:
f _{z}(X′)=X′ ^{3} +a·X′·Z ^{4} +b·Z ^{6 }
f _{z}(X′)=X′ ^{3} +a·X′·Z ^{4} +b·Z ^{6 }
with the elliptical curve satisfying the equation:
Y′ ^{2} =f _{z}(X′)
Y′ ^{2} =f _{z}(X′)
in which the polynomials that satisfy Skalba's equality expressed in Jacobian coordinates are X′_{1}(t), X′_{2}(t), X′_{3}(t), Z(t) and U′(t) and satisfy Skalba's equality in Jacobian coordinates:
U′(t)^{2} =f _{Z(t)}(X′ _{1}(t))·f _{Z(t)}(X′ _{2}(t))·f _{Z(t)}(X′ _{3}(t))
U′(t)^{2} =f _{Z(t)}(X′ _{1}(t))·f _{Z(t)}(X′ _{2}(t))·f _{Z(t)}(X′ _{3}(t))
and in which Z(t) is determined in such a way that the operations of inversion are transformed into operations of multiplication.
4. The electronic component according to claim 1 , wherein the polynomials that satisfy Skalba's equality are such that it is possible to set a value of X_{3}(t) for any possible t, such that f(X_{3}(t)) is never a squared term in Fq, and
wherein when determining the point P, the term f(X_{1})·f(X_{2}) is not a squared term in the finite field F_{q},
wherein determining the point P further comprises testing whether the term f(X_{1}) is a squared term in the finite field F_{q }by:
calculating R_{2}′ such that:
calculating R_{3}′ such that:
R′ _{3} =R′ _{2} ^{2 }
R′ _{3} =R′ _{2} ^{2 }
calculating R_{4}′ such that:
R′ _{4} =R′ _{3} ·f(X _{1})
R′ _{4} =R′ _{3} ·f(X _{1})
wherein, if R_{4}′ is not equal to 1, determining the point P further comprises obtaining the square root of the term f(X_{2}) according to the following equation:
Where
in which R1 is obtained beforehand from the following equation:
5. The electronic component according to claim 4 , wherein the polynomials that satisfy Skalba's equality are expressed in Jacobian coordinates according to which the point P(X,Y) is written P(X′,Y′,Z) such that:
X′=X·Z ^{2},
Y′=Y·Z ^{3 }
X′=X·Z ^{2},
Y′=Y·Z ^{3 }
where the function f is written f_{z}(X′) and satisfies:
f _{z}(X′)=X′ ^{3} +a·X·Z ^{4} +b·Z ^{6 }
f _{z}(X′)=X′ ^{3} +a·X·Z ^{4} +b·Z ^{6 }
with the elliptical curve satisfying the equation:
Y′ ^{2} =f _{Z}(X′)
Y′ ^{2} =f _{Z}(X′)
in which the polynomials that satisfy Skalba's equality expressed in Jacobian coordinates are X′1(t), X′2(t), Z(t) and U′(t) and satisfy Skalba's equality in Jacobian coordinates:
U′(t)^{2} =f _{Z(t)}(X′ _{1}(t))·f _{Z(t)}(X′ _{2}(t))·f(X _{3}(t))
U′(t)^{2} =f _{Z(t)}(X′ _{1}(t))·f _{Z(t)}(X′ _{2}(t))·f(X _{3}(t))
and in which Z(t) is determined in such a way that operations of inversion are transformed into operations of multiplication.
6. The electronic component according to claim 1 , wherein obtaining the value of the parameter t comprises obtaining the value of the parameter t as a function of a password or an identifier.
Priority Applications (6)
Application Number  Priority Date  Filing Date  Title 

FR0954053  20090616  
FR0954053A FR2946819B1 (en)  20090616  20090616  Cryptography on an elliptical curve. 
PCT/FR2010/051190 WO2010146302A2 (en)  20090616  20100615  Cryptography on a elliptical curve 
US201113377404A true  20111209  20111209  
US14/261,959 US20140314230A1 (en)  20111209  20140425  Cryptography on an elliptical curve 
US15/178,528 US20170207918A1 (en)  20090616  20160609  Cryptography on an elliptical curve 
Applications Claiming Priority (2)
Application Number  Priority Date  Filing Date  Title 

US15/178,528 US20170207918A1 (en)  20090616  20160609  Cryptography on an elliptical curve 
US15/671,064 US10027483B2 (en)  20090616  20170807  Cryptography on an elliptical curve 
Related Parent Applications (1)
Application Number  Title  Priority Date  Filing Date  

US14/261,959 ContinuationInPart US20140314230A1 (en)  20111209  20140425  Cryptography on an elliptical curve 
Related Child Applications (1)
Application Number  Title  Priority Date  Filing Date 

US15/671,064 Continuation US10027483B2 (en)  20090616  20170807  Cryptography on an elliptical curve 
Publications (1)
Publication Number  Publication Date 

US20170207918A1 true US20170207918A1 (en)  20170720 
Family
ID=59313913
Family Applications (2)
Application Number  Title  Priority Date  Filing Date 

US15/178,528 Abandoned US20170207918A1 (en)  20090616  20160609  Cryptography on an elliptical curve 
US15/671,064 Active US10027483B2 (en)  20090616  20170807  Cryptography on an elliptical curve 
Family Applications After (1)
Application Number  Title  Priority Date  Filing Date 

US15/671,064 Active US10027483B2 (en)  20090616  20170807  Cryptography on an elliptical curve 
Country Status (1)
Country  Link 

US (2)  US20170207918A1 (en) 
Family Cites Families (15)
Publication number  Priority date  Publication date  Assignee  Title 

AT325478T (en)  19980102  20060615  Cryptography Res Inc  Liquid resistant cryptographic process and device 
CA2243761C (en)  19980721  20091006  Certicom Corp.  Timing attack resistant cryptographic system 
JP3796993B2 (en)  19981222  20060712  株式会社日立製作所  Elliptic curve cryptography execution method and apparatus, and recording medium 
FR2796177B1 (en) *  19990709  20011012  Oberthur Card Systems Sas  Method of cryptography implemented between two entities exchanging information 
US7308096B2 (en)  20000530  20071211  Hitachi, Ltd.  Elliptic scalar multiplication system 
AU7927801A (en)  20000629  20020114  Oregon State  Elliptic curve cryptographic methods and apparatus 
JP2003085321A (en)  20010911  20030320  Sony Corp  System and method for contents use authority control, information processing device, and computer program 
JP4155929B2 (en)  20030122  20080924  株式会社リコー  Image encoding apparatus, encoding / decoding apparatus, image encoding method, encoding / decoding method, program, and storage medium 
EP1616405A1 (en)  20030424  20060118  Matsushita Electric Industrial Co., Ltd.  Apparatus to generate parameter for ntru, ntru decryption and encryption system, apparatus, method and program implementing said parameter generating unit 
EP1668818A2 (en) *  20031003  20060614  Matsushita Electric Industrial Co., Ltd.  Information transfer system, encryption device, and decryption device using elliptic curve cryptography 
KR101389100B1 (en)  20060609  20140425  베리사인, 인코포레이티드  A method and apparatus to provide authentication and privacy with low complexity devices 
US20100293379A1 (en)  20070531  20101118  Beijing Transpacific Ip Technology Development Ltd  method for secure data transmission in wireless sensor network 
US8117447B2 (en) *  20080110  20120214  Industrial Technology Research Institute  Authentication method employing elliptic curve cryptography 
US8225109B1 (en)  20080430  20120717  Netapp, Inc.  Method and apparatus for generating a compressed and encrypted baseline backup 
US8184803B2 (en) *  20081229  20120522  King Fahd University Of Petroleum And Minerals  Hash functions using elliptic curve cryptography 

2016
 20160609 US US15/178,528 patent/US20170207918A1/en not_active Abandoned

2017
 20170807 US US15/671,064 patent/US10027483B2/en active Active
Also Published As
Publication number  Publication date 

US20170359176A1 (en)  20171214 
US10027483B2 (en)  20180717 
Similar Documents
Publication  Publication Date  Title 

Goubin et al.  DES and differential power analysis the “Duplication” method  
Prouff et al.  Masking against sidechannel attacks: A formal security proof  
Ors et al.  PowerAnalysis Attack on an ASIC AES implementation  
US8804949B2 (en)  Method for protecting IC cards against power analysis attacks  
EP1050133B2 (en)  Leakresistant cryptographic method and apparatus  
Fouque et al.  The doubling attack–why upwards is better than downwards  
US7076656B2 (en)  Methods and apparatus for providing efficient passwordauthenticated key exchange  
US7639808B2 (en)  Elliptic curve cryptosystem apparatus, elliptic curve cryptosystem method, elliptic curve cryptosystem program and computer readable recording medium storing the elliptic curve cryptosystem program  
EP1262037B1 (en)  Portable data carrier provided with access protection by dividing up codes  
US20060285682A1 (en)  Authentication system executing an elliptic curve digital signature cryptographic process  
EP1320027B1 (en)  Elliptic curve cryptosystem apparatus, method and program  
Yen et al.  Power analysis by exploiting chosen message and internal collisions–vulnerability of checking mechanism for RSAdecryption  
US20100172493A1 (en)  Method and device for processing data  
Joye et al.  Hessian elliptic curves and sidechannel attacks  
Standaert et al.  The world is not enough: Another look on secondorder DPA  
US7065788B2 (en)  Encryption operating apparatus and method having sidechannel attack resistance  
JP3821631B2 (en)  Method and apparatus for scalar multiplication in elliptic curve cryptography, and storage medium  
US6298135B1 (en)  Method of preventing power analysis attacks on microelectronic assemblies  
Bauer et al.  Horizontal collision correlation attack on elliptic curves  
Hess et al.  Information leakage attacks against smart card implementations of cryptographic algorithms and countermeasures–a survey  
US8913739B2 (en)  Method for scalar multiplication in elliptic curve groups over prime fields for sidechannel attack resistant cryptosystems  
EP1134653B1 (en)  Information processing device, information processing method and smartcard  
JP5412274B2 (en)  Protection from side channel attacks  
WO2005008955A1 (en)  Tamperresistant encryption using individual key  
US7961874B2 (en)  XZelliptic curve cryptography with secret key embedding 
Legal Events
Date  Code  Title  Description 

STCB  Information on status: application discontinuation 
Free format text: EXPRESSLY ABANDONED  DURING PUBLICATION PROCESS 

AS  Assignment 
Owner name: IDEMIA IDENTITY & SECURITY, FRANCE Free format text: CHANGE OF NAME;ASSIGNOR:SAFRAN IDENTITY & SECURITY;REEL/FRAME:047529/0948 Effective date: 20171002 

AS  Assignment 
Owner name: SAFRAN IDENTITY & SECURITY, FRANCE Free format text: CHANGE OF NAME;ASSIGNOR:MORPHO;REEL/FRAME:048039/0605 Effective date: 20160613 