Imbalanced montgomery ladder
AssigneeSafran Identity & Security
InventorsFrédéric Boulet, Victor Servant
Life of this patent
Estimating the term…
Abstract
The invention relates to a method for securing an electronic device (SC) against attacks via covert channels when the electronic device (SC) implements a Montgomery ladder for calculating the element A⊥A⊥. . . ⊥A where A appears k times. A designates an element of an Abelian group with a law ⊥, and k is a natural number. The method comprises a modified implementation of the Montgomery ladder. The invention also relates to a device (SC), a computer program and a storage medium arranged so as to implement such a method.
Claims8
A method for securing an electronic device (SC) against side-channel attacks when the electronic device (SC) implements a Montgomery ladder to calculate element A⊥A⊥ . . . ⊥A where A appears k times, A being an element of an Abelian group with a law ⊥ and k being a positive integer, the method comprising a modified implementation of the Montgomery ladder comprising:
- determining (DET_r1), by a determination circuit of the electronic device (SC), a first positive integer r1;
- calculating (CALC_R1), by a calculation circuit of the electronic device (SC), a first parameter R1=A⊥A⊥ . . . ⊥A where A appears r1 times;
- determining (DET_r2), by a determination circuit of the electronic device (SC), a second positive integer r2;
- calculating (CALC_R2), by a calculation circuit of the electronic device (SC), a second parameter R2=A⊥A⊥ . . . ⊥A where A appears r2 times;
- calculating (CALC_k), by a calculation circuit of the electronic device (SC), a positive integer k′ from the positive integer k, from the first positive integer r1, and from the second positive integer r2;
- implementing (M_ML), by a calculation circuit of the electronic device (SC), the Montgomery ladder modified to use positive integer k′ in place of positive integer k, first parameter R1=A⊥A⊥ . . . ⊥A where A appears r1 times in place of a parameter R1=1, and second parameter R2=A⊥A⊥ . . . ⊥A where A appears r2 times in place of a parameter R2=A.
An electronic device (SC) arranged to protect against side-channel attacks when making use of a Montgomery ladder to calculate element A⊥A⊥ . . . ⊥A where A appears k times, A being an element of an Abelian group with a law ⊥ and k being a positive integer, the electronic device (SC) comprising:
- a circuit (MCONT) for determining a first positive integer r1;
- a circuit (MCONT) for calculating a first parameter R1=A⊥A⊥ . . . ⊥A where A appears r1 times;
- a circuit (MCONT) for determining a second positive integer r2;
- a circuit (MCONT) for calculating a second parameter R2=A⊥A⊥ . . . ⊥A where A appears r2 times;
- a circuit (MCONT) for calculating a positive integer k′ from the positive integer k, from the first positive integer r1, and from the second positive integer r2;
- and
- a circuit (MCONT) for calculating the Montgomery ladder, modified to use positive integer k in place of positive integer k, first parameter R1=A⊥A⊥ . . . ⊥A where A appears r1 times in place of a parameter R1=1, and second parameter R2=A⊥A⊥ . . . ⊥A where A appears r2 times in place of a parameter R2=A.
Dependencies are inferred from the claim text.