Method for calculating a transition from a Boolean masking to an arithmetic masking

A key-derivation method, designed as a DH or ECDH key-derivation method or similar key-derivation method, comprising intrusion-resistant re-masking by a processor device of a value x to be kept secret from a first masking to a second masking, by carrying out a plurality of calculation steps, wherein the secret value x:

• exists in the first masking, before execution of the plurality of calculation steps, as a first representation xs masked with a first mask s according to a Boolean masking rule xs=x XOR s mod 2n, where 2n is a modulus of a first masking rule, where n is an integer, and
• in the second masking, after the execution of the plurality of calculation steps, exists as a second representation xr masked according to an arithmetic masking rule with a second mask r,
• wherein:
• sr=(x+r) mod (2m*p) or xr=(x−r) mod (2m*p), where (2m*p) is a modulus of a second masking rule and m is an integer greater than or equal to zero, where p has at least one prime divisor unequal to 2;
• and
• during the re-masking, at least one calculation step of the plurality of calculation steps is carried out by the processor device, in which a carry c1 is generated over 2n, the carry c1 being protected against intrusion attacks by masking or balancing the carry c1 by means of a random information item pm, and in a subsequent calculation step in which the carry c1 is intended for use, the masked carry C_pm or the balanced carry C is used instead of the carry c1;
• the method further comprising transmitting a key based on the value x from the processor device to another processing device.

A machine-readable document comprising an integrated circuit,

• and an interface for communication with a reader, wherein the integrated circuit is configured to perform intrusion-resistant re-masking of a value x to be kept secret from a first masking to a second masking, by carrying out a plurality of calculation steps, wherein the secret value x:
• exists in the first masking, before execution of the plurality of calculation steps, as a first representation xs masked with a first mask s according to a Boolean masking rule xs=x XOR s mod 2n, where 2n is a modulus of a first masking rule, where n is an integer, and
• in the second masking, after the execution of the plurality of calculation steps, exists as a second representation xr masked according to an arithmetic masking rule with a second mask r,
• wherein:
• xr=(x+r) mod (2m*p) or xr=(x−r) mod (2m*p), where (2m*p) is a modulus of a second masking rule and m is an integer greater than or equal to zero, where p has at least one prime divisor unequal to 2;
• during the re-masking, at least one calculation step of the plurality of calculation steps is carried out by the integrated circuit, in which a carry c1 is generated over 2n, the carry c1 being protected against intrusion attacks by masking or balancing the carry c1 by means of a random information item pm, and in a subsequent calculation step in which the carry c1 is intended for use, the masked carry C_pm or the balanced carry C is used instead of the carry c1;
• the integrated circuit configured to transmit a key based on the value x to the reader using the interface for communication.