WO2002082257A1

WO2002082257A1 - Device for performing secure exponentiation calculations and use thereof

Info

Publication number: WO2002082257A1
Application number: PCT/FR2002/001233
Authority: WO
Inventors: Marc Joye
Original assignee: Gemplus
Priority date: 2001-04-09
Filing date: 2002-04-09
Publication date: 2002-10-17
Also published as: FR2823327B1; FR2823327A1

Abstract

The invention concerns a device for performing exponentiation calculations of the type R=x<e>, where k is an element of a set with multiplicative notation and e a predetermined number, comprising first exponentiation calculating means from a representation of a random addition-subtraction sequence C(a) representing a number a, to calculate Y=x<a> using a universal exponentiation algorithm, and second exponentiation calculating means using any particular exponentiation calculating algorithm to calculate Z=x<e-a>.

Description

DEVICE FOR CARRYING OUT SECURE EXPONENTIATION CALCULATIONS AND USING SUCH A DESPOSITIVE

The present invention relates to a device for calculating secure exponentiation, with application in particular in the field of cryptology where cryptographic algorithms are implemented in

5 electronic devices such as smart cards.

Many cryptographic algorithms are based on exponentiation calculations of the type R = x ^e , where x and e are predetermined numbers which code an R value. This is notably the case with the algorithm 10 of the RSA type (Rivest, Shamir and Adleman). The value R can correspond for example to an encrypted text, a signed or verified data ...

An electronic device designed to execute such an algorithm must contain on the one hand the executable part for raising x to the power of e, and on the other hand the values x and e.

There are different types of exponentiation algorithms. We know in particular the binary method of the type "squared and multiplication", more usually known under the English terminology "square and mul tiply" (English acronym SAM), the method of Yacobi, called M, M ³ , the sliding window method, etc.

These algorithms produce an addition chain

25 representative of the exhibitor e. There are several addition chains ^' representative of the exponent, each being a function of the exponent, of the algorithm of exponentiation used and the parameters of this algorithm.

These algorithms are quite complex and must include suitable countermeasures against attacks aimed at discovering information contained and manipulated in processing carried out by the computing device. In particular, countermeasures are provided against so-called hidden channel attacks, simple or differential. A simple or differential hidden channel attack is understood to mean an attack based on a measurable physical quantity from outside the device, the direct analysis of which (simple attack) or the analysis according to a statistical method (differential attack) allows discover information contained and manipulated in processing in the device. These attacks can thus allow the discovery of confidential information. These attacks were notably exposed by Paul Kocher {Advances in Cryptology - CRYPTO '99, vol. 1966 of Lectures Notes in Computer Science, pp. 388-397.

Springer-Verlag, 1999). Among the physical quantities which can be exploited for these purposes, one can cite the current consumption, the electromagnetic field

These attacks are based on the fact that the manipulation of a bit, that is to say its processing by a particular instruction has a particular imprint on the physical quantity considered according to its value.

The aforementioned exponentiation algorithms had to include countermeasures to prevent these attacks from thriving. For example, the "square and ultiply always" algorithm according to English terminology, and which means "always squaring and multiplying", is a secure variant of the algorithm, SAM (square and multiply) in which the operation was conditional on the value of the bit being processed, therefore allowing channel attacks hidden.

In the invention, we are interested in a particular exponentiation method, from an addition chain representing the exponent e, generated from an arbitrary exponentiation algorithm. According to this addition chain, exponentiation is carried out by means of a universal exponentiation algorithm, which consists of a succession of multiplications (general case). It will be recalled that on a set noted additively, such as elliptic curves, the exponentiation becomes, a scalar multiplication of the type Q = dP, where P and Q are elements of the set noted additively (elliptic curve) and d a scalar number . In this case, the universal algorithm allowing to calculate Q = d.P from an addition chain, consists of a succession of additions (on the set noted additively).

In the following, we place ourselves in the general, conventional case, which means that we will use the multiplicative notation, unless explicitly stated otherwise.

With the exponentiation method described, the addition chain is thus both a representation of the exponent e and a coding of the exponentiation algorithm ^{• from} which it results. The only executable part of the algorithm that allows exponentiation from this addition chain hard coded, in mask ROM memory. It consists of a succession of multiplications. This exponentiation algorithm is universal in the sense that it can be used with any addition chain generated by any exponentiation algorithm.

Such an exponentiation method from an addition chain offers many advantages over conventional exponentiation algorithms.

These advantages will be detailed later, after a more detailed presentation of this method.

This method of exponentiation is based on the addition chains or more generally, to ^'chains addition-subtraction.

An addition string of an exponent e is a sequence of numbers, the first of which is the number 1, each of the following numbers being equal to the sum of two previous numbers. The last number is equal to the exponent e itself.

An addition string for a number e is thus defined as the sequence C (e) = {e ⁽⁰⁾ , e ⁽¹⁾ , ..., e ^(r) } which satisfies the conditions:

(a) e ⁽⁰⁾ = 1, e ^(r) = e, and

(b) for all 1 <i <r, there exist j (i) and k (i) strictly less than i such that e ^{! l)} = e ^{(j <x))} +

((i) where r represents the length of the string.

- We can thus easily obtain R = x ^e by calculating, for i = 1 to r: xΛe ⁽ⁱ⁾ = xΛe ^{(j (i))} .xΛe ^{(k (i))} , where the symbol Λ means “exponent”. In the last round r, we calculate as follows: xΛe ^(r) = xΛe ^{(3 (r))} .xΛe ^{(k (r))} . Since e ^(r) = e (this is the last element in the chain), we have R = xΛe ^(r) .

Thus, at each step, a power of x is calculated corresponding to an intermediate exponent of the _. chain by performing a multiplication between two powers of x calculated in previous steps.

By performing r multiplications, we obtain the result of the exponentiation of x by e.

In practice, an addition chain is represented in the form of a sequence which defines for each element of the chain (except the first element of the chain, always equal to 1), the two preceding elements of the chain of which it is obtained, that is, for all i, the elements of the chain e ^{(j (:))} , e ^{(k (i>)} , by which we obtain an element following e ^x) of the chain. The exponentiation algorithm traverses the sequence which provides its inputs and outputs at each step, and which executes the corresponding multiplications. If we consider the ^• more general form of the chain ^' called addition-subtraction, each element e ⁽ⁱ⁾ of the sequence is equal to more or less a preceding element e ^{(j (α))} , more or less an element previous e ^({a " ⁿ . We can therefore take into account either an element or its opposite. In the representative sequence of the chain, we must then include for each element e (i), the sign of each of the elements e ^{( j (i))} and e ^{(k (1))} associated.

A variant of the addition chains, called a star chain, is an addition chain such that each element e ^(l) of the chain is equal to the immediately preceding element e ^(1-1) plus another preceding element e ^{(k (i))} . The sequence defining .comment is obtained each element of the chain is then shorter, since one of the two preceding elements is already known: it is the previous one.

Thus, in general, an addition-subtraction chain can be represented by a sequence of triplets (e ^(α> : e ^{(j (1>)} , e ^{! K (l))} ) or doublets or pairs

(e ⁾ : e ^{k (i)} ) _f in the particular case of star chains.

In a practical example, with an addition chain C (5) = (1,2,4,5) generated for the number 5, an associated sequence can be written. :

{(2: 1.1), (4: 2.2), (5: 4.1)}.

The exponentiation method described therefore requires the representation of the exponent in the form of a sequence of doublets (case of star chains) or triplets (general case of addition or addition-subtraction chains), this sequence defining the inputs / outputs of the universal exponentiation algorithm. However, replacing the representation of the exponent with a sequence of doublets and triplets is not advantageous from the point of view of the memory space necessary for their storage: each element of a doublet or triplet occupies as much space memory as the exhibitor.

By replacing each of the elements of the doublets or triplets of the sequence, by the register in which it is contained or must be written, this aspect is considerably improved. For example, if the exponentiation device has four registers, only two bits are necessary to represent (code) each of these registers. If each element of the representative sequence of the addition-subtraction chain is replaced by the register in which it is contained, the memory space required to store it is considerably reduced. The addition chain C (e) representative of the exponent e, is then represented by a sequence of registers, which we denote by T (e).

If we start from the general case of an addition chain

C (e) supplied for an exponent e: C (e) = {e ⁽⁰⁾ , e ⁽¹⁾ , ..., e ^(r) } with e (0) = 1 and e (r) = e, represented by a sequence of triplets of elements of this chain: E (e) = {(e ⁽ⁱ⁾ : e ^{(j (i))} , e ^{(k (i >>} ) i = ι to r}, with e 1 and e ⁽ⁱ⁾ = e ^{(3 (i))} + e ⁽⁽ⁱ⁾⁾ , we have seen that the universal exponentiation algorithm is written: in step i, calculate xΛe ⁽ⁱ⁾ = xΛe ^{(j (i))} .xΛe ^((i)!.

Assuming that xΛe ^{(j (l)>} and xΛe ^{(k <1))} are respectively contained in a first register R _α <i) and a second register Rβ (i), and that the result of the multiplication xΛe ⁽ⁱ⁾ is registered in a third register R ₇ (i), the execution of the universal exponentiation algorithm which results therefrom, consists in step i of calculation of the i th element e ^(α) of the addition chain, writing in the register R _{γ (} i) the result of the multiplication of the content of the register R _α tu by the content of the register Rβ (i>.

Thus, the addition chain of the exponent e can be represented by the following sequence of register triples: T (e) = {(γ (i): α (i), ^β (i))} i <i <r /> which means that Rγ (i) = Rα (i) -R ..) • By convention, the value e = l is represented by F (l) = {φ}.

From the above, we obtain the following universal exponentiation algorithm ^' (for e> l):

Initialize R _α (ij - x; Rβ (i) <- x for i = 1 to r, - execute

output R = ^' R ₇ ( _r ) • We note that R _α (i) and β (u are initialized with the value x, because the first term of each addition chain being 1, the second term is always e ^(1> = 2. We also note that we can have α (l) = β (l), and more generally α (i) = β (i). In the case where star chains are used , denoted C * (e), we have seen that the condition on the terms of the chain is written: e ⁽ⁱ⁾ = e ^(i_1) + e ^{(k (i))} .

Such a star chain C * (e), can therefore be represented by a sequence of pairs (doublets) of registers, by posing the condition α (i) = γ (il) for all 1 <i <r. In other words, the content of the register R _α (i> is equal to the content of the register Rγ (ii) calculated in the previous round.

The sequence of registers associated with a star chain is therefore given by:

T ^* (e) = {(γ (i): ^β (i))} i≤i≤r and the corresponding universal exponentiation algorithm is written:

Initialize R _{γ (0} ) <- x; Rβ (i) - x for i = 1 to r, execute

send at output R = R _γ ^' ( _r ) •

The use of star strings makes it possible to save memory space by approximately 1/3 compared to the addition strings represented by sequences of register triplets.

As already explained, the exponentiation method which has just been described can be applied to any type of exponentiation algorithm, this algorithm being coded in the resulting addition chain. In addition to the binary exponentiation algorithms, we can also use a k-ary type algorithm, or a chain division algorithm (so-called alter algorithm) to generate the addition chain. This list is not exhaustive.

In practice, the sequence of registers representative of the addition chain, and hence of the exponent, depends on the value of the exponent, on the exponentiation algorithm which generated the chain and on its configuration. In particular, it depends on the number of registers used in this algorithm and available in the exponentiation device.

To illustrate the different aspects of the exponentiation method which has just been exposed, let us take practical examples.

Let R = X ^e to be calculated, with e = 87.

In binary notation, e is written: e = (e _t -ι, ..-, e ₀ ) ₂ = (1, 0, 1, 0, 1, 1, 1) ₂ If we use as exponentiation algorithm , the binary method (SAM) of the exponent's scanning type from right to left, and use of two registers RO and RI. This algorithm is written in a well known way: RO <- 1; RI r- X for i = 0 to (t-1), execute if (e _± = 1), then RO - RO. RI

RI <- RI ² send at output R = _| R0.

With such an exponentiation algorithm, for e = 87 = (1, 0, 1, 0, 1, 1, 1) ₂ , we obtain the following chain of additions C _dg2 (87):

C _dg2 (87) = {l, 2,3,4,7,8,16,23,32,64,87} which 1 'can be represented by the sequence of registers R0 and RI: r _dg2 (87) = {(1: 1.1), (0: 0.1), (1: 1.1), (0: 0.1), (1: 1.1), (1: 1.1), ( 0: 0.1), (1: 1.1), (1: 1, 1), (0: 0, 1)}, where R0 and RI are both initialized at x.

The universal exponentiation algorithm receives at each step a corresponding triplet of registers of the sequence.

Thus, after initialization of the two registers R0 and _. RI at x,. The universal algorithm will successively carry out the following multiplications: RI <- RI. RI (RI then contains x ² ) R0 <- R0.R1 (R0 then contains x ³ ) RI - RI. RI (RI contains x ⁴ ) R0 - R0.R1 (R0 contains x ⁷ ) RI - RI. RI (RI contains x ⁸ ) RI <- RI. RI (RI contains x ¹⁶ ) R0 <- R0.R1 (R0 contains x ²³ ) RI - RI. RI (RI contains x ³² ) RI <r- RI. RI (RI contains x ⁶⁴ ) RO - R0.R1 (RO contains x ⁸⁷ )

The result of the exponentiation of x by e = 87 is given by the final content of RO.

Another sequence from the previous C _dg2 (87) addition chain may be obtained, using an additional register to code it. We can thus have the following sequence: ^• r ' _d g ₂ (87) == {(1: 0.0), (2: 0.1), (0: 1.1), (1: 0.2 ), (2: 0.0), (0: 2.2), (2: 0.1), (1: 0.0), (0: 1.1), (1: 0.2)} . It follows a different course of the universal exponentiation algorithm.

If we use a binary exponentiation algorithm with scanning the exponent's bits from left to right (SAM Square And Multiply algorithm), we obtain another string to represent the exponent e. In particular, with such an algorithm, we obtain star type addition chains.

Using the previous example with e = 87, we get the corresponding addition chain for e = 87:

C ^* _gd2 (87) = {1,2,4,5,10,20,21,42,43,86,87}. If there are two registers R0 and RI, a sequence of registers ^' associated with this star chain is written:

(0: 0), (0: 0), (0: 1), (0: 0), (0: 0), (0: 1), (0: 0), (0: 1), (0 : 0), (0: 1)}, where RO and RI are both initialized to x.

There follows yet another different course of the universal exponentiation algorithm. These different examples of generation of addition chains and sequences clearly show that these chains and sequences depend on the exponent, the exponentiation algorithm used and the settings, such as the number of exponentiation device registers used.

If the exponentiation algorithm used to generate the addition chain is implemented in a device initialization phase by external means, the exponent is no longer programmed in the rewritable memory of the exponentiation device , but the sequence of registers obtained. In other words, the exponentiation algorithm finds itself coded in the resulting sequence of registers.

This exponentiation method described is thus very flexible, since it makes it possible to code in the addition chain, any exponentiation algorithm, and that a simple reprogramming of the rewritable memory allows changes of 'algorithm and / or exponent changes.

This exponentiation method is also very fast: the number of multiplications to be performed is equal to the length of the addition chain. Now we know generate ^strings' of short additions to. appropriate exponentiation algorithm means, such as the alter division exponentiation algorithm. If we take as a comparison, the binary exponentiation algorithm with countermeasure ("square and multiply always"), - 21og ₂ nd multiplications are necessary for its execution. With the exponentiation method considered, we know how to reduce this number of operations to 1.251og ₂ è.

Finally, this exponentiation method has the advantage of being resistant to simple hidden channel attacks, unlike the usual exponentiation algorithms which must integrate countermeasures to resist these attacks.

In practice, in mask ROM memory is coded only the universal exponentiation algorithm, which is a simple multiplication algorithm which traverses the sequence of registers contained in rewritable memory, and for simply multiplying the elements given by it. This type of algorithm is very easy to program and the risks of programming errors in mask ROM memory are very low.

It will be noted that the exponentiation algorithms usually used are much more complex, including parameter settings and having to integrate countermeasures against simple or differential hidden channel attacks. These countermeasures increase the risk of programming errors in mask ROM. Indeed, the tests of the execution programs of these algorithms generally intervene only after their programming in mask ROM memory. If an error is found, in particular a configuration error, all of the ROM manufacturing masks are affected, and a new ROM must be produced. This implies significant industrial additional costs. In addition, the countermeasures implemented, if they are generally effective for attacks with hidden channels of the differential type, we have been able to show that they were less so for attacks with hidden channels of the simple type.

Thus, the exponentiation method which has just been described, based on the chains of addition- subtraction and using the universal exponentiation algorithm, offers many advantages over other exponentiation algorithms.

The practical implementation of this method requires the generation of an addition chain representing the exponent e, either in the form of a sequence E (e) of elements of this chain, or in the form of a sequence of registers T (e). This latter form is the most advantageous, since it requires little memory space.

In this method, we have seen that ^' the addition chain can be generated in a device personalization phase, by external means, then programmed into rewritable memory (EEPROM or FLASH EPROM for example). In the event of an error in the configuration of the exponentiation algorithm used to generate the addition chain, or in the event of a change in the exponent (change of key), it then suffices only to reprogram the memory re - writable.

However, the implementation of the method of calculating R = x ^e using the universal exponentiation algorithm supposes obtaining an addition chain representing the exponent, by means of an arbitrary exponentiation algorithm .

In the case of an RSA type cryptography algorithm, the exponent e represents a private key, determined for a given device (a smart card) in a personalization step. Thus, the addition chain (the sequence of registers) can be calculated in this same personalization step by means external to the device, then stored as such once and for all in the card, in. rewritable memory (EEPROM, Flash EPROM, ...). If we consider the field of application of the smart card, this supposes changes in the mode of production and putting into functionality of these cards, which is not desirable. In addition, the addition chain or the sequence which represents it occupies more space than the exponent itself, usually stored in binary form, which is a drawback, the size of the rewritable memory being generally limited. In practice, ^it turns out that the card providers that manage the personalization step does not favor the establishment of such a change. It can also be provided that the addition chain C (e) is calculated in a phase d. ' initialization of the device, by means of an exponentiation algorithm coded in the device, and then stored in working memory of RAM type. This supposes a manipulation of the exponent by the exponentiation algorithm, only once, for example when the device is powered up. However, the device can then be vulnerable to hidden channel attacks, in particular to simple hidden channel attacks. -The exhibitor, which generally represents a key, could then be discovered.

Thus, a problem linked to this exponentiation method lies in the generation of the addition chain representing the exponent e. An object of the invention is to solve this problem of generating the exponent's addition chain. In the invention, rather than calculating an addition chain representative of the exponent e, in the exponentiation device itself or by external means, it is provided that the device uses a random addition chain C ( a), which implicitly defines a number a, which is essentially random. The exponentiation method used to calculate R = x ^e then consists of:

- to perform a first exponentiation calculation Y = x ^a using the universal exponentiation algorithm applied to the random chain C (a); to perform a second exponentiation calculation Z = x ^e_a according to any arbitrary exponentiation algorithm.

The result of the exponentiation is then obtained by multiplying the numbers Y and Z: R = x ^a . x ^ea .

According to a first embodiment of the invention, the random chain is generated by means external to the device, and programmed in the device in a portion of rewritable memory.

According to a second embodiment, the random chain is generated by internal means, and stored in a portion of working memory. One can then advantageously provide for generating a new random chain each time the exponentiation device is requested for a new calculation. In addition, this methodology helps protect against differential hidden channel attacks.

With such a device, there is no longer any fear of attacks with hidden channels. Indeed, in the first computation, the exponent a which is manipulated is random; and in the second calculation, the exponent manipulated ea is also random. It can therefore be performed by a conventional exponentiation algorithm, without fear of hidden channel attacks.

In a variant, it is expected that the exponent ea is calculated using the universal exponentiation algorithm, after generation of an addition-subtraction chain representative of the exponent ea from any exponentiation algorithm . Indeed, ea not being known, because random, one can use it in any computation in general, without fearing the attacks with hidden channels. To calculate x ^ea , we must first calculate ea, so a. Remarkably, by using the universal exponentiation algorithm in additive notation (i.e. where the multiplication operation is replaced by an addition), we obtain a universal multiplication algorithm (scalar), which allows to calculate the value of a.

Starting from the sequence of registers

T (e) = {(γ (i): α (i), β (i))} i _≤ ≤ _r ,, this universal scalar multiplication algorithm is written:

Initialize R _α (i) - x; β (u - x for i = 1 to r, execute

At step r, we get

This scalar multiplication is applicable to the elements of a set noted additively, typically to points of an elliptical curve. In this case, R and x represent points on this curve.

Note that by initializing R _α (i) and Rβ (u to the value 1, that is to say to the value of the first element of the addition chain C (e), we obtain R _{γ (r)} = e.

In the invention, this property is used _. to calculate the random number a from the random string C (a).

Thus, the implementation of the exponentiation method based on the universal exponentiation algorithm is it easy, while ensuring a high degree of security of the device against attacks with hidden channels.

The invention therefore relates to a device intended to perform exponentiation calculations of the type R = x ^e where x is an • element of a set noted in a multiplicative manner and e a predetermined number, characterized in that it comprises first exponentiation calculation means from a representation of a random addition-subtraction chain C (a) representing a number a, to calculate Y = x ^a by the implementation of a universal exponentiation algorithm , and second exponentiation calculation means using any exponentiation algorithm to calculate Z = x ^e_a .

The invention and the advantages which ensue therefrom will appear more clearly on reading the following description of a preferred embodiment, given purely by way of nonlimiting example, with reference to the single figure in the appendix. This is a flowchart of the main elements of a device electronic, for example a smart card, making it possible to implement the invention.

FIG. 1 represents in the form of a block diagram a programmed device implementing this exponentiation method. In the example, this device is a smart card intended to execute a cryptographic program. To this end, the device 1 gathers in a chip means programmed for the execution of calculations, composed of a central unit (CPU) 2 functionally connected to a set of memories of which:

- a memory 4 accessible in read only, in the example of the mask ROM type, also known by the English name "mask read-only emory (mask ROM)", - a memory 6 electrically reprogrammable, in the example of the type EEPROM (from English "electrically erasable programmable ROM"), and

a working memory 8 accessible in read and write, in the example of the RAM type (from the English "random access memory"). This memory notably includes the registers used by the device 1.

In the following, program memory is called the memory which contains executable code. This code can in practice be contained in memory 4, accessible in read only, or in memory 6, rewritable.

In the example, the device 1 also comprises a random generator 9. The function of this random generator is to generate a random chain C (a). The central unit 2 is also connected to a communication interface 10 which ensures the exchange of signals vis-à-vis the outside and the supply of the chip. . This interface can include studs on the card for a so-called "contact" connection with a reader, and / or an antenna in the case of a so-called "contactless" card. One of the functions of the device 1 is to encrypt and decrypt confidential data respectively transmitted to and from outside. This data may relate, for example, to personal codes, medical information, accounting on bank or commercial transactions, authorizations to access certain restricted services, etc. Another function is to calculate a digital signature or verify it. To this end, the central unit 2 executes a cryptographic algorithm on the basis of programming data which, according to the invention, are stored in the mask ROM 4 ^′ and EEPROM 6 parts.

The cryptographic algorithm can be based for example on an algorithm ^• RSA (Rivert, Shamir and Adleman), which implies an exponentiation calculation of the type R = x ^e , where x is a predetermined value and e, an integer which is a key. The number R thus obtained constitutes encrypted, deciphered, signed or verified data.

In the device 1, the number x, transmitted by the communication interface 10, is stored in working memory 8.

The number e (the key) is stored in a rewritable memory portion 6, of the EEPROM type in the example. The universal exponentiation algorithm, that is to say an algorithm performing a succession of multiplications, is stored in a portion of the program memory 4. An arbitrary exponentiation algorithm is stored in another portion of the program memory 4. It can be a binary algorithm (SAM) or an algorithm of type M, M ³ , ...

According to the invention, the device for calculating exponentiation. solicited for an exponentiation calculation of type R = X ^e activates the random generator 9, to obtain the representation of a random addition-subtraction chain C (a). This random chain is representative of a number a, in essence, also random. It can be represented in the form of a sequence of elements E. (a). It is advantageously represented in the form of a sequence of registers T (a).

The representation of this random chain C (a) is stored in working memory 8 '. The device then performs

- a first exponentiation calculation Y = x ^a from the representation of the random addition-subtraction chain C (a) by implementing the universal exponentiation algorithm coded in program memory.

- a second exponentiation calculation Z = x ^e_a by implementing the arbitrary exponentiation algorithm coded in program memory. The result of the exponentiation R = x ^a is then equal to the multiplication of the respective results ^• first and second exponentiation calculation:

R = YZ = x ^a ^{.x e_a} . :

It will be noted that the universal exponentiation algorithm can be configured to treat the random sequence E (a) or T (a), like sequences of doublets or triplets of elements or registers.

The second exponentiation calculation Z = x ^e_a is carried out by implementing the arbitrary exponentiation algorithm. This arbitrary exponentiation algorithm can be used to directly calculate the exponentiation

Z = x ^ea . But it can also be used to generate a representation of addition-subtraction chain C (e- a). The computation of exponentiation Z = x ^ea is then carried out from the representation of this chain C (ea), by implementing the universal exponentiation algorithm.

To perform this second exponentiation calculation

Z = x ^{e ~ a} , a preliminary step of calculating the numerical value of the number a from the representation of the random chain C (a) is necessary.

This numerical value is advantageously obtained by using the universal multiplication algorithm, which allows, as indicated above, the (scalar) multiplication of elements of a set noted additively. We have seen that this algorithm derives from the universal exponentiation algorithm by replacing the succession of multiplication operations by a succession of addition operations. If we take an example in which the addition chain. C (a) is ^' represented as a sequence of registers _T (a): T (a) = {(γ (i): (i), β (i))} i _≤ i < _E , the universal scalar miletiplication algorithm is written:

Initialize R _α u) - x; Rβ (i) <- x for i = 1 to r, execute

Note that by initializing R _α (i) and Rβ (i) to the value 1, we obtain R _{γ (r} ) = a.

In a practical example, in which the device has two calculation registers RO and 10 Ri, it is assumed that the random generator is configured to generate a random sequence of 0 and 1, and that the universal scalar multiplication algorithm is configured to deal with register triples. 15 Let there be. following random sequence provided by generator 9:

(1,1,1,0,0,1,1,1,1,0,0,1,1,1,1,1,1,1,0,0,1,1,1,1,1 , 1, .1,0,0,1).

This sequence is read by the universal scalar multiplication algorithm as the following random register sequence:

T (a) = {(1: 1.1), (0: 0.1), (1: 1.1), (0: 0.1), (1: 1.1), (1: 1 , 1), (0: 0.1), (1: 1.1), (1: 1, 1), (0: 0, 1)}.

We have seen above that this sequence of registers ^' 25 is representative of the number 87.

The universal scalar multiplication algorithm processes at each step a corresponding triplet of registers of the sequence.

Thus, after initialization to 1 of the two registers 30 R0 and RI of the device, this universal algorithm will successively carry out the following additions: RI - Rl + Rl (RI then contains 2) RO - R0 + R1 (RO then contains 3) RI <- Rl + Rl (RI contains 4) RO r- R0 + R1 (RO contains 7) RI <- Rl + Ri (RI contains 8) RI <- Rl + Rl (RI contains 16) RO <- R0 + R1 (RO contains 23) RI - Rl + Rl (RI contains 32) RI r- Rl + Rl (RI contains 64) RO - R0 + R1 (RO contains 87)

The output result, contained here in the RO register ,. corresponds to the value of the number a.

The device then calculates the number (ea), by performing a simple subtraction. It will be noted that the universal exponentiation algorithm, for the calculation of Y = x, and the universal scalar multiplication algorithm, for the calculation of a, can process the representation of the random chain C (a) in sequence, parallel. The device 1 can then start the second exponentiation calculation Z = x ^ea .

It will be noted that in the invention, the arbitrary exponentiation algorithm coded in program memory does not have to include countermeasures with respect to hidden channel attacks, since knowledge of ea does not make it possible to completely find th , since the value of a, random, is protected.

An alternative embodiment of the invention relates ^• the generation mode a representation of the random string C (a). The device shown in FIG. 1 in fact comprises internal means 9 for generation of this random chain. In this case, it is possible to activate these generation means each time that the device 1 is requested for a new calculation of exponentiation R = x ^e . In another variant not shown, the random chain is generated by external means. In this case, these means are used in the personalization phase of the exponentiation device 1, and the representation of the random chain thus generated is then stored in rewritable memory 6.

We have seen that an addition-subtraction chain can be represented by a sequence of doublets or triplets of elements of the chain, or by a sequence of registers. The calculation device according to the invention must therefore be configured to process doublets or triplets of elements or registers. This configuration is the same for the universal exponentiation algorithm and the universal multiplication algorithm, which process the same string. This configuration results in the corresponding execution programs programmed in program memory.

This configuration also depends on the number of registers available in the device.

In the case where the second computation of exponentiation Z = x ^e_a uses the algorithm of exponentiatio. universal, it is expected that the arbitrary exponentiation algorithm is homogeneous with the implemented universal exponentiation algorithm. In other words, if the universal exponentiation algorithm is configured to handle doublets, and uses two registers, the arbitrary exponentiation algorithm is expected to generate star chains defined from two registers.

The random generator must also be configured to generate a sequence corresponding to a given length r of random chain. Preferably, being to hide the exponent e representing a secret key, the random generator is configured so that the numbers a and e are substantially the same size, to make impossible any determination of this exponent e by channel type attacks hidden.

In the particular case of an RSA type cryptography system, using the exponentiation device 1 to perform exponentiations of the R = x ^{e type} , where e represents a secret key of which a part of the most significant bits is known, provides that the random generator is configured so that the size of the number a is substantially equal to the size of the number e minus its known part. It will be understood that the invention lends itself to numerous variants of implementation. In particular, it can be provided that the random chain is a chain of additions, or advantageously, a star chain.

The description was given in the context of a processor integrated in a smart card. It is however clear that the lessons transpose to all other applications, such as in computer terminals, network communication or other, and in any other electronic device that uses coding or decoding calculations.

Claims

1. Device (1) intended to carry out exponentiation calculations of the type R == x ^e . where x is an element of a set noted in a multiplicative way and e a predetermined number, characterized in that it comprises first means of computation of exponentiation starting from a representation of a chain of random addition-subtraction C (a) representing a number a, to calculate Y = x ^a by the implementation of a universal exponentiation algorithm, and second exponentiation calculation means implementing any exponentiation algorithm to calculate Z = x ^e_a . _.

2. Device according to claim 1, characterized in that said exponentiation calculations are applied to elements of a set noted additively.

3. Device according to claim 1 or 2, characterized in that said second calculation means comprise means for generating a representation of an addition-subtraction chain representing the number ea, to calculate Z = x ^e_a from of said representation by implementing a universal exponentiation algorithm.

4. Device according to any one of the preceding claims 1 to 3, characterized .in that the universal exponentiation algorithm is contained in a portion of program memory of the frozen memory type coded by masking (4).

5. Device according to any one of the preceding claims 1 to 3 characterized in that the universal exponentiation algorithm is contained in a portion of program memory, of the rewritable memory type (6).

6. Device according to any one of the preceding claims, characterized in that it comprises internal means (9) for generating a representation of the random chain C (a).

7. Device according to claim 6, characterized in that the representation of the random chain C (a) is stored in a portion of working memory (8).

8. Device according to claim 7, characterized in that the means for generating (9) a representation of the random chain C (a) are activated at each new calculation of exponentiation of type R = x ^e .

9. Device according to any one of claims 1 to 4, characterized in that the representation of the random chain C (a) is provided to the device by external generation means, and stored in a portion of rewritable memory ( 6).

10. Device according to any one of the preceding claims, characterized in that said second calculation means are configured to calculate the numerical value of the number a from the representation of the random chain C (a), by implementing a universal multiplication algorithm.

11. Device according to the preceding claim, characterized in that said first and second calculation means are activated to perform in parallel the calculation of exponentiation x ^a and the calculation of the numerical value of the number a.

12. Device according to any one of the preceding claims, characterized in that the universal exponentiation algorithm is configured to process chains of the addition chain type.

13. Device according to any one of claims 1 to 11, characterized in that the universal exponentiation algorithm is configured to process chains of the star chain type.

14. Device according to any one of the preceding claims, characterized in that the universal exponentiation algorithm is configured to process strings represented in the form of a sequence of random registers.

15. Device according to any one of the preceding claims, characterized in that it is implemented in a cryptographic system based on a cryptographic algorithm involving at least one exponentiation calculation of the type R = xe.

16. Device according to the preceding claim, characterized in that the number e represents a secret key and in that the means for generating the random addition-subtraction chain are configured so that the lengths of a and of e are substantially the same.

17. Device according to claim 15, characterized in that the number e represents a secret key of which a part of the most significant bits is known and in that the means for generating the representation of the random addition-subtraction chain are configured so that the length of the number a is substantially equal to the length of the number e minus its known part.

18. Chip card, characterized in that it incorporates a device according to any one of claims 1 to 17.

19. Use of the device according to any one of claims 1 to 17 to carry out an exponentiation calculation, in particular in the execution of a cryptographic algorithm.