# US 11,121,882 B2 · Blinding techniques for protection of private keys in message signing based on elliptic curve cryptography > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,121,882 B2 - Document ID: US11121882B2 - Status: Granted - Kind: B2 - Application number: 16/521,995 - Filed: 2019-07-25 - Published: 2021-01-28 - Granted: 2021-09-14 - Earliest claimed: 2019-07-25 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Christopher Ronald Scott; Aaron Matthew Marks; Eric Young; Sean Francis Parkinson - Web page: https://patentgrep.com/patent/US11121882B2 ## CPC - H04L 9/3252: {using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes} - G06F 7/58: Random or pseudo-random number generators - H04L 9/002: {Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441)} - H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves} - H04L 9/3257: {using blind signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques are provided for protection of private keys in message signing based on elliptic curve cryptography. One method comprises obtaining a private key to generate a signature for a message; selecting a random integer as an internal private key in a predefined range based on an elliptic curve order; computing an internal public key as an elliptic curve point using a scalar multiply operation based on (i) the internal private key blinded using a random blinding value, (ii) an elliptic curve base point, and (iii) an inverse value for the random blinding value added to a result of the scalar multiply operation; generating a first signature portion based on the elliptic curve point; generating a second signature portion based on an inverse of the selected random integer generated from a message-dependent value and the first signature portion; and forming a signed message using the first and second signature portions. ## Claims ### Claim 1 A method, comprising: obtaining a private key of a message signer to generate a signature for a message; selecting a random integer as an internal private key in a predefined range based at least in part on an order of an elliptic curve; computing an internal public key as a point on the elliptic curve using (a) a scalar multiply operation based at least in part on (i) the internal private key blinded using a random blinding value and (ii) a base point of the elliptic curve, and (b) a first inverse value for the random blinding value added to a result of the scalar multiply operation; generating a first part of the signature for the message based at least in part on the point of the elliptic curve; generating a second part of the signature for the message based at least in part on a second inverse value of the selected random integer generated from a message-dependent value of the message and the first part of the signature; and forming a signed version of the message using the first part of the signature and the second part of the signature, wherein the method is performed by at least one processing device comprising a processor coupled to a memory. ### Claim 2 (depends on 1) The method of claim 1, wherein the predefined range based on the order of the elliptic curve is a range between 0 and the order minus one. ### Claim 3 (depends on 1) The method of claim 1, wherein the computing further comprises computing a next blinding value, iN, based on a doubling of a prior blinding value, iN−1; and computing a next blinding inverse value, IN, for the next blinding value based on a doubling of a prior blinding inverse value, IN−1. ### Claim 4 (depends on 3) The method of claim 3, wherein the computing further comprises blinding the internal private key based on an addition of the next blinding value, iN, to the internal private key. ### Claim 5 (depends on 1) The method of claim 1, wherein the generating the first part of the signature for the message based on the point of the elliptic curve applies an operation to an integer version of one coordinate of the point of the elliptic curve. ### Claim 6 (depends on 1) The method of claim 1, wherein the generating the second part of the signature for the message further comprises multiplying the first part of the signature by a private key of the message signer and adding a result to the message-dependent value of the message. ### Claim 7 (depends on 1) The method of claim 1, further comprising verifying the message by extracting one or more of the first part of the signature and the second part of the signature from the signed version of the message. ### Claim 8 (depends on 1) The method of claim 1, wherein the message-dependent value comprises one or more of a digest of the message and a hash of the message. ### Claim 9 A computer program product, comprising a tangible machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps: obtaining a private key of a message signer to generate a signature for a message; selecting a random integer as an internal private key in a predefined range based at least in part on an order of an elliptic curve; computing an internal public key as a point on the elliptic curve using (a) a scalar multiply operation based at least in part on (i) the internal private key blinded using a random blinding value and (ii) a base point of the elliptic curve, and (b) a first inverse value for the random blinding value added to a result of the scalar multiply operation; generating a first part of the signature for the message based at least in part on the point of the elliptic curve; generating a second part of the signature for the message based at least in part on a second inverse value of the selected random integer generated from a message-dependent value of the message and the first part of the signature; and forming a signed version of the message using the first part of the signature and the second part of the signature. ### Claim 10 (depends on 9) The computer program product of claim 9, wherein the computing further comprises computing a next blinding value, iN, based on a doubling of a prior blinding value, iN−1; and computing a next blinding inverse value, IN, for the next blinding value based on a doubling of a prior blinding inverse value, IN−1. ### Claim 11 (depends on 10) The computer program product of claim 10, wherein the computing further comprises blinding the internal private key based on an addition of the next blinding value, iN, to the internal private key. ### Claim 12 (depends on 9) The computer program product of claim 9, wherein the generating the first part of the signature for the message based on the point of the elliptic curve applies an operation to an integer version of one coordinate of the point of the elliptic curve. ### Claim 13 (depends on 9) The computer program product of claim 9, wherein the generating the second part of the signature for the message further comprises multiplying the first part of the signature by a private key of the message signer and adding a result to the message-dependent value of the message. ### Claim 14 (depends on 9) The computer program product of claim 9, wherein the message-dependent value comprises one or more of a digest of the message and a hash of the message. ### Claim 15 An apparatus, comprising: a memory; and at least one processing device, coupled to the memory, operative to implement the following steps: obtaining a private key of a message signer to generate a signature for a message; selecting a random integer as an internal private key in a predefined range based at least in part on an order of an elliptic curve; computing an internal public key as a point on the elliptic curve using (a) a scalar multiply operation based at least in part on (i) the internal private key blinded using a random blinding value and (ii) a base point of the elliptic curve, and (b) a first inverse value for the random blinding value added to a result of the scalar multiply operation; generating a first part of the signature for the message based at least in part on the point of the elliptic curve; generating a second part of the signature for the message based at least in part on a second inverse value of the selected random integer generated from a message-dependent value of the message and the first part of the signature; and forming a signed version of the message using the first part of the signature and the second part of the signature. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the computing further comprises computing a next blinding value, iN, based on a doubling of a prior blinding value, iN−1; and computing a next blinding inverse value, IN, for the next blinding value based on a doubling of a prior blinding inverse value, IN−1. ### Claim 17 (depends on 16) The apparatus of claim 16, wherein the computing further comprises blinding the internal private key based on an addition of the next blinding value, iN, to the internal private key. ### Claim 18 (depends on 15) The apparatus of claim 15, wherein the generating the first part of the signature for the message based on the point of the elliptic curve applies an operation to an integer version of one coordinate of the point of the elliptic curve. ### Claim 19 (depends on 15) The apparatus of claim 15, wherein the generating the second part of the signature for the message further comprises multiplying the first part of the signature by a private key of the message signer and adding a result to the message-dependent value of the message. ### Claim 20 (depends on 15) The apparatus of claim 15, wherein the message-dependent value comprises one or more of a digest of the message and a hash of the message.