# US 11,115,210 B2 · Systems and methods for masking RSA operations > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,210 B2 - Document ID: US11115210B2 - Status: Granted - Kind: B2 - Application number: 16/039,014 - Filed: 2018-07-18 - Published: 2019-02-07 - Granted: 2021-09-07 - Earliest claimed: 2017-08-07 - Assignees: Maxim Integrated Products, Inc. - Applicants: Maxim Integrated Products, Inc. - Inventors: Yann Yves Rene Loisel; Frank Lhermet; Jeremy Dubeuf - Web page: https://patentgrep.com/patent/US11115210B2 ## CPC - H04L 9/302: {involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes} - G06F 21/602: {Providing cryptographic facilities or services} - G09C 1/00: Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00) - H04L 9/002: {Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441)} - H04L 9/0869: {involving random numbers or seeds} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - G06F 7/588: {Random number generators, i.e. based on natural stochastic processes} - G06F 2221/2143: Clearing memory, e.g. to prevent the data from being stolen - H04L 2209/046: of operations, operands or results of the operations - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G09C: CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY ## Abstract Presented are systems and methods for protecting secret data that is stored in memory to prevent unauthorized access and data manipulation. Various embodiments may be applied to hide or mask an RSA exponent used for public key cryptography and stored in a cryptographic hardware block that uses a non-erasable working memory for computations. In certain embodiments, masking RSA exponents is accomplished by a two-step process that combines a specifically calculated, random and secret value with the secret exponent. The random value is stored in an erasable memory, such that in case of attack, both the erasable memory and the non-erasable memory do not leak any embedded secrets. The additional expenditure of memory resources only insignificantly affects system performance. ## Claims ### Claim 1 A method for protecting confidential data, the method comprising: receiving a secret value and a random value; at a secure device, adding the random value to the secret value to obtain a masked value; storing the masked value in a non-secure memory, the non-secure memory being external to the secure device; using the masked value to compute an intermediate value; erasing the masked value from the non-secure memory, such that in the event of an attack neither one of the secret value and the random value can be recovered from the non-secure memory; loading an exponent value into the non-secure memory; and using the intermediate value and the exponent value to compute a final value. ### Claim 2 (depends on 1) The method according to claim 1, wherein the secret value and the random value are integers. ### Claim 3 (depends on 1) The method according to claim 1, further comprising, in response to a signal being received, erasing the secret value and the random value from the secure device. ### Claim 4 (depends on 3) The method according to claim 3, wherein the signal is indicative of one of at least one of a software attack and a hardware attack. ### Claim 5 (depends on 1) The method according to claim 1, wherein the exponent value has been generated such that a sum of the exponent value and the random value equals zero modulus φ(n), wherein n represents a public key. ### Claim 6 (depends on 5) The method according to claim 5, wherein the exponent value has a bit length that is half of the bit length of the random value. ### Claim 7 (depends on 5) The method according to claim 5, wherein the random value has the same bit length as the public key. ### Claim 8 (depends on 1) The method according to claim 1, wherein the random value has been generated by a random value generator. ### Claim 9 (depends on 1) The method according to claim 1, further comprising using the final value to calculate the secret value. ### Claim 10 (depends on 9) The method according to claim 9, wherein calculating the secret value comprises using an RSA operation. ### Claim 11 A system for protecting confidential data, the system comprising: one or more processors; and a non-transitory computer-readable medium or media comprising one or more sequences of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising: receiving a secret value and a random value; at a secure device, adding the random value to the secret value to obtain a masked value; storing the masked value in a non-secure memory, the non-secure memory being external to the secure device; using the masked value to compute an intermediate value; erasing the masked value from the non-secure memory, such that in the event of an attack neither one of the secret value and the random value can be recovered from the non-secure memory; loading an exponent value into the non-secure memory; and using the intermediate value and the exponent value to compute a final value from which the secret value may be derived. ### Claim 12 (depends on 11) The system according to claim 11, wherein the secret value and the random value are integers. ### Claim 13 (depends on 11) The system according to claim 11, further comprising, in response to a signal being received, erasing the secret value and the random value from the secure device. ### Claim 14 (depends on 13) The system according to claim 13, wherein the signal is indicative of one of at least one of a software attack and a hardware attack. ### Claim 15 (depends on 11) The system according to claim 11, wherein the exponent value has been generated such that a sum of the exponent value and the random value equals zero modulus φ(n), wherein n represents a public key. ### Claim 16 (depends on 15) The system according to claim 15, wherein the exponent value has a bit length that is half of the bit length of the random value. ### Claim 17 (depends on 15) The system according to claim 15, wherein the random value r has the same bit length as the public key. ### Claim 18 (depends on 11) The system according to claim 11, wherein the random value has been generated by a random value generator. ### Claim 19 (depends on 11) The system according to claim 11, further comprising using the final value to calculate a secret value. ### Claim 20 (depends on 19) The system according to claim 19, wherein calculating the secret value comprises using an RSA operation.