# US 10,372,886 B2 · Protecting the input/output of modular encoded white-box RSA/ECC

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,372,886 B2
- Document ID: US10372886B2
- Status: Granted
- Kind: B2
- Application number: 14/815,540
- Filed: 2015-07-31
- Published: 2016-11-10
- Granted: 2019-08-06
- Earliest claimed: 2015-05-05
- Assignees: NXP B.V.
- Applicants: NXP B.V.
- Inventors: Jan Hoogerbrugge; Wil Michiels
- Web page: https://patentgrep.com/patent/US10372886B2

## CPC

- G06F 21/14: against software analysis or reverse engineering, e.g. by obfuscation
- G06F 21/629: {to features or functions of an application}
- H04L 9/302: {involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes}
- H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves}
- G06F 21/1066: {Hiding content}
- H04L 2209/046: of operations, operands or results of the operations
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method of obscuring the input and output of a modular exponentiation function, including: receiving modular exponentiation parameters including an exponent e having N bits and a modulus m; generating randomly a pre-multiplier; calculating a post-multiplier based upon the pre-multiplier, exponent e, and modulus m; multiplying an input to the modular exponentiation function by the pre-multiplier; performing the modular exponentiation function; and multiplying the output of the modular exponentiation function by the post-multiplier, wherein multiplying an input to the modular exponentiation function by the pre-multiplier, performing the modular exponentiation function, and multiplying the output of the modular exponentiation function by the post-multiplier are split variable operations.

## Claims

### Claim 1

A computer system implemented method of obscuring an input and output of a modular exponentiation function, the method comprising:
receiving, by a processor of the computer system, modular exponentiation parameters including an exponent e having N bits and a modulus m;
generating randomly, by the processor, a pre-multiplier;
calculating, by the processor, a post-multiplier y=x−emod m, where y is the post-multiplier, x is the pre-multiplier, and the exponent e is a secret key,
multiplying, by the processor, the input to the modular exponentiation function by the pre-multiplier;
performing, by the processor, the modular exponentiation function; and
multiplying, by the processor, the output of the modular exponentiation function by the post-multiplier,
wherein the pre-multiplier and the post-multiplier are both split variable encoded values, wherein starting the modular exponentiation function with a pre-multiplier and ending the modular exponentiation function with a post-multiplier prevents the exponent e from appearing in isolation in a white-box implementation in the computer system, making the computer system more secure, and wherein multiplying the input to the modular exponentiation function by the pre-multiplier, performing the modular exponentiation function, and multiplying the output of the modular exponentiation function by the post-multiplier are split variable operations.

### Claim 2 (depends on 1)

The method of claim 1, wherein the modulus m is used as the modulus in the split variable operations.

### Claim 3 (depends on 1)

The method of claim 1, wherein split variables are determined using first and second secret splitting multiplicative values and a modulus value.

### Claim 4 (depends on 3)

The method of claim 3, wherein the split variables are further determined using a secret splitting additive value.

### Claim 5 (depends on 4)

The method of claim 4, wherein the split variable operations are arranged so that none of the splitting secret multiplicative values and the secret splitting additive value are observable to an attacker.

### Claim 6 (depends on 1)

The method of claim 1, wherein the method of obscuring the input and output of a modular exponentiation function further comprises obscuring software code in a compiler.