Method for selecting a value between two values ​​stored in two different registers

Description

[0001] Embodiments and implementations relate to computer systems, including a method of selecting a value from two values stored in two different registers of the computer system from a selection bit.

[0002] Some applications of a computer system require selecting a value from two values stored in two different registers of that computer system. This value selection can be done from a selection bit that the user wishes to keep secret.

[0003] In particular, the selection of a value from two values stored in two different registers can be carried out within the framework of cryptographic methods. For example, algorithms calculating a modular exponentiation in a finite field or a scalar multiplication on an elliptic curve can implement such a selection. These algorithms are used in the "RSA" and "ElGamal" cryptosystems, the "DSA" (acronym for "Digital Signature Algorithm") and "ECDSA" (acronym for "Elliptic curve digital signature algorithm") algorithms and the "ECDH" (acronym for "Elliptic-curve Diffie-Hellman") protocol. The selection bit is for example a bit of a cryptographic key that the user wishes to keep secret.

[0004] Furthermore, data manipulation in a computer system may result in a change in the power consumption of the processing unit performing that data manipulation.

[0005] Data manipulation can also result in a change in execution time depending on the data being manipulated. In particular, a computer system may use a cache memory. This cache memory can temporarily store data. Accessing data stored in a cache is faster than accessing data stored in a memory for which the cache memory serves as an intermediary.

[0006] Data manipulation can also cause a change in the electromagnetic field of the processing unit manipulating the data.

[0007] These changes are examples of physical observations that can be used by an attacker wishing to retrieve information from the computer system. These observations are referred to as a "side-channel attack."

[0008] In particular, an attacker may seek to know the value of the selection bit used to select a value from two values stored in different registers. However, the selection of a value from two values stored in two different registers is carried out by executing computer instructions which may, for example, result in changes in energy consumption and / or execution time or electromagnetic fields. These changes may be observed by an attacker. Observing these changes may allow the attacker to determine the value of the selection bit.

[0009] For example, in the cryptography methods mentioned above, the attacker can observe the changes to determine each bit of the cryptographic key. This allows the attacker to recover the cryptographic key, which they can then use maliciously.

[0010] There are several known solutions for making a selection between two values recorded in different registers.

[0011] A first known solution is to implement an if-then-else function in which the condition evaluated is the value of the selection bit.

[0012] The implementation of the if-then-else function uses instruction sequences that differ depending on the value of the select bit. These instruction sequences can result in different execution times, different power consumption, or different magnetic fields. Therefore, an attacker can determine the value of the select bit based on their observations.

[0013] A second solution is to put the two values in an array, then access the selected value in the array based on the value of the selection bit. This solution may involve using a cache memory during memory accesses based on the value of the selection bit. Using the cache memory can modify the access times of memory accesses based on the value of the selection bit. On an architecture supporting a cache, it is therefore possible for an attacker to find the value of the selection bit based on the observed memory access times.

[0014] A third solution is to use a mask on the values to be selected, the mask used depending on the selection bit. For example, on a 32-bit architecture, the mask can have the value 0xFFFFFFFFF or 0x00000000 depending on the value of the selection bit. However, these masks have very different Hamming weights (number of bits at 1). Thus, the energy consumption for using these masks can vary greatly depending on the mask selected. If the difference in energy consumption due to the use of masks is sufficient to be observed, an attacker can find the value of the selection bit.

[0015] A fourth solution is described in US patent application published under number 2021 / 306134. This solution uses masks having the same Hamming weight on a 32-bit architecture. In particular, the masks correspond to an alternation of 1 bits and 0 bits. In particular, the masks have the value 0xAAAAAAAA or 0x55555555 depending on the value of the selection bit. The value of the mask is obtained by performing or not performing a right shift of one bit by the value 0xAAAAAAAA depending on the value of the selection bit. If the shift occurs, the 32 bits of the register change value simultaneously. Otherwise, no bit changes value. Such a difference can also cause a significant variation in energy consumption depending on the hardware considered.If the difference in power consumption due to the use of masks is sufficient to be observed, an attacker can recover the value of the selection bit.

[0016] There is therefore a need to propose a solution allowing the selection of a value from two values stored in two different registers in a simple and discreet manner, in particular to be robust against side channel attacks.

[0017] According to one aspect, there is provided a method implemented by computer - in particular by a computer system as described below, for example a system on chip - for selecting a value from two values recorded in two different registers from a selection bit, the method comprising: a concatenation of the two values recorded in the two registers so as to obtain a concatenated word presenting said two values in two distinct portions of the concatenated word, then a rotation of said concatenated word according to the value of the selection bit so as to position the selected value in a given portion of the concatenated word among said two portions, then a deletion of the non-selected value in the concatenated word so as to keep only the selected value in the concatenated word by eliminating the non-selected value from the concatenated word.

[0018] Such a selection method has the advantage of being implemented by a sequence of instructions independent of the value of the selection bit and does not contain memory accesses dependent on the selection bit.

[0019] In particular, such a selection method has the advantage of being robust against side-channel attacks.

[0020] Preferably, said removing the unselected value in the concatenated word comprises shifting the concatenated word so as to retain only the selected value in the concatenated word by removing the unselected value from the concatenated word.

[0021] Advantageously, concatenation makes it possible to concatenate two 16-bit values so as to obtain a 32-bit concatenated word in which the two values are included in two 16-bit portions of the concatenated word.

[0022] In an advantageous embodiment, said rotation of said concatenated word comprises: a first rotation of the concatenated word according to a predetermined number M of bits, M being different from 0 and a multiple of 16, then a second rotation of the concatenated word according to a number of bits depending on the selection bits so as to obtain the selected value on said given portion.

[0023] Performing a two-step rotation avoids performing a 0-bit rotation when the selection bit is 0. Such a rotation, not modifying the value contained in the register, could in fact be observable by an attacker.

[0024] Advantageously, the number of shift bits for the second rotation is determined by performing: a logical OR function between the value of the selection bit and a value equal to 0xN0000000 where N is between 1 and F in hexadecimal system and is defined relative to the predetermined number M of bits for the first rotation, then a 28-bit rotation on the value obtained by the logical OR function so as to obtain a value of the number of shift bits for the second rotation.

[0025] According to another aspect, there is provided a computer program product comprising instructions which, when the program is executed by a computer, cause the latter to implement a selection method as described above.

[0026] According to another aspect, there is provided a computer system comprising: a memory in which is stored a computer program product as described above, and a processing unit configured to execute said computer program product.

[0027] In particular, the processing unit has an architecture supporting rotation of register contents.

[0028] Other advantages and characteristics of the invention will appear on examining the detailed description of embodiments, which are in no way limiting, and the appended drawings in which: [ Fig 1 ] [ Fig 2 ] illustrate embodiments and implementations of the invention.

[0029] There figure 1 illustrates a mode of implementation of a method, implemented by computer (in particular by a computer system as described below), of selecting a value from two values recorded in two different registers of the computer from a selection bit.

[0030] The selection bit is stored in a register in the computer. This selection bit is a secret selection bit.

[0031] Each of these values can be represented in 16 bits. Alternatively, each of these values can be represented in 32 bits.

[0032] When each value is represented on 32 bits, the steps of the selection process described below are carried out a first time on the 16 most significant bits of each value then a second time on the 16 least significant bits of each value, or vice versa.

[0033] In other words, the steps of the method are performed a first time to select the 16 most significant bits of a value from among the two values according to the selection bit, then a second time to select the 16 least significant bits of this same value, or vice versa. The most significant bits and the least significant bits selected are then concatenated to obtain the selected value.

[0034] The method comprises a concatenation step 20 in which the two values recorded in the two different registers are concatenated. The concatenation of the two values makes it possible to obtain a concatenated word. This concatenated word then has a first portion comprising a first value and a second portion comprising the second value. The two portions comprise the same number of bits. For example, each portion comprises 16 bits so that the concatenated word comprises 32 bits.

[0035] The method then comprises a rotation step 21 in which a rotation operation is performed on the bits of the concatenated word. The rotation operation is performed according to the value of the selection bit. For example, the rotation of the concatenated word is performed so as to place the bits of the value selected by the selection bit on the most significant bits of the concatenated word. In particular, when the concatenated word comprises two 16-bit portions, the rotation performed is a 16-bit or 32-bit rotation depending on the value of the selection bit.

[0036] The operation 21 of rotating the concatenated word can be carried out in two stages. In particular, the method can comprise a first rotation 21a of the concatenated word according to a predetermined number M of bits. The number M can be between 1 and 15 for example.

[0037] Then, the method can comprise a second rotation 21b of the concatenated word according to a number of bits depending on the selection bits so as to obtain the selected value on the portion with high-order bits of the concatenated word.

[0038] For example, the number of shift bits for the second rotation is determined by first performing a logical OR function between the value of the selection bit and a value equal to 0xN0000000 where N is between 1 and F in hexadecimal and is defined relative to the number M of bits predetermined for the first rotation. The logical OR function then makes it possible to obtain a value equal to 0xN0000000 when the selection bit is equal to 0, and 0xN0000001 when the selection bit is equal to 1. A 28-bit rotation to the right is then performed so as to obtain a value equal to 0x0000000N when the selection bit is equal to 0 and 0x0000001N.

[0039] This calculated value sets the number of shift bits for the second rotation.

[0040] The first rotation and the second rotation allow to perform a rotation of the concatenated word by a number of bits equal to M+N 16 if the selection bit is 0 or to M+(1N) 16 . The values of M and N are chosen so that the sum M+N 16 is equal to 16 (in decimal system) and so that the sum M+(1N) 16 is equal to 32 (in decimal system).

[0041] Performing a rotation 21 in two stages (a first rotation 21a then a second rotation of 21b) makes it possible to avoid the rotation being directly 0 bits (when the rotation is 32 bits) or 16 bits. The first rotation therefore makes it possible to have a modification of the concatenated word regardless of the value of the selection bit. In this way, determining the selection bit from an observation of the rotation is made more complex.

[0042] Once the rotation operation 21 has been performed on the concatenated word, the value selected by the selection bit is located on a given portion of the concatenated word, for example the 16 most significant bits of the concatenated word, i.e. on the first portion of the concatenated word. The value not selected by the selection bit is then located on the 16 least significant bits of the concatenated word, i.e. on the second portion of the concatenated word.

[0043] The method then comprises a deletion step 22 in which the unselected value is deleted from the concatenated word. In particular, the deletion step 22 may for example comprise a shift operation on the concatenated word so as to keep only the value selected by the selection bit. For example, a 16-bit shift to the right is carried out so as to place the selected value on the 16 least significant bits of the concatenated word, i.e. on the second portion of the concatenated word. Thus, the unselected value is eliminated from the concatenated word to keep only the selected value in the concatenated word.

[0044] Alternatively, a mask can be applied to the concatenated word to remove the unselected value and keep only the selected value.

[0045] Such a selection method has the advantage, at least for certain architectures, of being able to be executed during an execution time which is the same regardless of the value of the selection bit. Indeed, the selection method comprises the same sequence of instructions to be executed regardless of the value of the selection bit.

[0046] Such a selection method has the advantage of being robust against side-channel attacks.

[0047] Tables [Table 1] to [Table 4] illustrate different examples of implementation of the method described above. These tables show the instructions executed by the computer. The instructions are represented here in assembly language for an ARM Cortex ®< -M3 processor. Tables [Table 1] and [Table 2] illustrate examples of implementation of the same method when the selection is made between two 16-bit values according to the value of the selection bit. Tables [Table 3] and [Table 4] illustrate examples of implementation of another method in which the selection is made between two 32-bit values according to the value of the selection bit.

[0048] Table [Table 1] illustrates an example of implementation of the method when the two values v0 and v1 initially stored in registers r0 and r1 are on 16 bits, and when the value of the selection bit Sel_bit initially stored in register r2 is equal to 0 so as to select the value v0 stored in register r0. [Table 1] Sel_bit=0 N° Instruction Instruction Registre r0 Registre r1 Registre r2 #0 État initial v0 v1 Sel_bit = 0 #1 EOR r0,r0,r1,LSL #16 v1 ∥ v0 #2 ROR r0,r0, #1 (v1 ∥ v0) >>> 1 #3 ORR r2,r2,=0xF0000000 0xF0000000 #4 ROR r2,r2,#28 0x0000000F = 15 #5 ROR r0,r0,r2 v0 ∥ v1 #6 LSR r0,r0,#16 v0

[0049] Instruction #1 is an "EOR r0, r0, r1, LSL#16" instruction. This instruction concatenates the values v0 and v1 stored in the registers r0 and r1 to obtain a concatenated word v1∥v0 and stores this concatenated word v1∥v0 in the register r0. In particular, this instruction shifts the value v1 represented on 16 bits to the left by 16 bits before performing an EXCLUSIVE OR logical operation between this shifted value v1 and the value v0 to obtain the concatenated word v1∥v0. The concatenated word then has a first portion of 16 high-order bits containing the value v1 and a second portion of 16 low-order bits containing the value v0.

[0050] Instruction #2 is a "ROR r0, r0, #1" instruction. This instruction performs a 1-bit right rotation operation on the concatenated word v1∥v0 so as to obtain a concatenated word shifted by 1 bit by right rotation (v1∥v0)>>>1. This shifted concatenated word is stored in the r0 register.

[0051] Instruction #3 is an "ORR r2, r2, =0xF0000000" instruction. This instruction performs a logical OR operation between the value of the selection bit Sel_bit stored in the r2 register and the value 0xF0000000 (represented here in hexadecimal), and records the result of this operation in the r2 register. Since the value of the selection bit is equal to 0, the result of the logical OR operation is equal to 0xF0000000.

[0052] Instruction #4 is a "ROR r2, r2, #28" instruction. This instruction performs a 28-bit right rotation operation on the result of the logical OR operation stored in register r2, and saves the result of this rotation operation in register r2. Here, the result of the rotation operation is equal to 0x0000000F in hexadecimal system, which is 15 in decimal system.

[0053] Instruction #5 is a "ROR r0, r0, r2" instruction. This instruction performs a right rotation operation by a number of bits corresponding to the value stored in register r2 (here 0x0000000F, i.e. a 15-bit right rotation) on the shifted concatenated word (v1∥v0)>>>1 stored in register r0, and records the result of this rotation operation in register r0. Here, the result of this 15-bit rotation operation corresponds to the concatenated word v0∥v1 which has a first portion of 16 high-order bits including the value v0 and a second portion of 16 low-order bits including the value v1. Thus, this result corresponds to a 16-bit rotation of the concatenated word v1∥v0.

[0054] Instruction #6 corresponds to an instruction "LSR r0, r0, #16". This instruction performs a 16-bit right shift operation on the concatenated word v0∥v1 resulting from the rotation operation, and stores the result of this shift operation in the register r0. This shift operation eliminates the unselected value v1 and keeps only the selected value v0.

[0055] Table [Table 2] illustrates an example of implementation of the method when the two values v0 and v1 initially stored in registers r0 and r1 are on 16 bits, and when the value of the selection bit Sel_bit initially stored in register r2 is equal to 1 so as to select the value v1. [Table 2] Sel_bit=1 N° Instruction Instruction Registre r0 Registre r1 Registre r2 #0 État initial v0 v1 Sel_bit = 1 #1 EOR r0,r0,r1,LSL #16 v1 ∥ v0 #2 ROR r0,r0, #1 (v1 ∥ v0) >>> 1 #3 ORR r2,r2,=0xF0000000 0xF0000001 #4 ROR r2,r2,#28 0x0000001F = 31 #5 ROR r0,r0,r2 v1 ∥ v0 #6 LSR r0,r0,#16 v1

[0056] The instructions are identical to those described in relation to table [Table 1]. However, the results of the operations performed by executing these instructions differ from those in table [Table 1] because the value of the selection bit is equal to 1 and no longer 0.

[0057] In particular, the result of the logical OR operation of instruction #3 is equal to 0xF0000001, and no longer 0xF0000000. Thus, the result of the rotation operation of instruction #4 is equal to 0x0000001F, that is, 31 in decimal.

[0058] The rotation operation performed by instruction #5 is therefore a 31-bit rotation, and no longer a 15-bit rotation. Thus, the result of this rotation operation corresponds to the concatenated word v1∥v0. This concatenated word v1∥v0 has a first portion of 16 high-order bits including the value v1 and a second portion of 16 low-order bits including the value v0. This result corresponds to a 32-bit rotation of the concatenated word v1∥v0 obtained after the execution of instruction #2.

[0059] Therefore, the result of the shift operation in instruction #6 is equal to the selected value v1.

[0060] The executed instructions are the same regardless of the value of the selection bit. Thus, the execution time of the process is the same regardless of the value of the selection bit on an architecture where the execution time of the instructions used is constant. This makes it more difficult for an attacker to identify the value of the selection bit.

[0061] Furthermore, the value of register r2 differs by only one bit depending on the values of the selection bit. It is therefore complex for an attacker to identify a change in register r2 based on the selection bit. It is therefore complex to identify the value of the selection bit by observing register r2.

[0062] Furthermore, as previously stated, rotating the concatenated word in two stages (a first rotation of 1 bit then a second rotation of 15 or 31 bits) prevents the rotation from being directly 0 or 16. In particular, a rotation of 0 could be detected by an attacker. Rotating the concatenated word in two stages makes it more difficult to identify the value of the selection bit.

[0063] Furthermore, the method allows a constant Hamming weight to be maintained in the r0 register until instruction #6. In other words, the method allows the same number of bits at 1 to be maintained in the register values. This makes it more difficult for an attacker to identify the value of the selection bit.

[0064] Tables [Table 3] and [Table 4] illustrate examples of implementing a method for selecting between two 32-bit values depending on the value of the selection bit.

[0065] Table [Table 3] illustrates an example of implementation of the method when the two values v0 and v1 initially stored in registers r0 and r1 are represented on 32 bits, and when the value of the selection bit Sel_bit initially stored in register r2 is equal to 0 so as to select the value v0 stored in register r0. The value v0 comprises 16 most significant bits v0 H< and 16 least significant bits v0 L<. The value v1 comprises 16 most significant bits v1 H< and 16 least significant bits v1 L<. [Table 3] Sel_bit=0 N° Instruction Instruction Registre r0 Registre r1 Registre r2 Registre r3 #0 État initial v0 = v0 H< ∥ v0 L< v1 = v1 H< ∥ v1 L< Sel_bit = 0 #1 UXTH r3,r0 v0 L< #2 EOR r3,r3,r1,LSL #16 v1 L< ∥ v0 L< #3 ROR r3,r3,#1 (v1 L< ∥ v0 L< ) >>> 1 #4 UXTH r0,r0,ROR #16 v0 H< #5 LSL r0,r0,#16, v0 H< ∥ 0 #6 EOR r1,r0,r1,LSR #16 v0 H< ∥ v1 H< #7 ROR r1,r1,#1 (v0 H< ∥ v1 H< ) >>> 1 #8 ORR r2,r2,#0xF0000000 0xF0000000 #9 ROR r2,r2,#28 0x0000000F = 15 #10 ROR r1,r1,r2 v1 H< ∥ v0 H< #11 ROR r3,r3,r2 v0 L< ∥ v1 L< #12 LSL r1,r1,#16 v0 H< #13 EOR r0,r1,r3,LSR #16 v0 = v0 H< ∥ v0 L<

[0066] Instruction #1 is a "UXTH r3, r0" instruction. This instruction sets the high 16 bits of the value v0 to zero and stores the result of this operation in the r3 register. The result of this operation retrieves only the low 16 bits v0 L< of the value v0.

[0067] Instruction #2 is an "EOR r3, r3, r1, LSL#16" instruction. This instruction concatenates the low-order bits v1 L< and v0 L< of the values v1 and v0 stored in registers r1 and r0 to obtain a first concatenated word v1 L< ∥v0 L< and stores this concatenated word v1 L< ∥v0 L< in register r3. In particular, this instruction shifts the value v1 L< 16 bits to the left before performing an EXCLUSIVE OR operation between this shifted value v1 L< and the value v0 L< to obtain the concatenated word v1 L< ∥v0 L< . The concatenated word v1 L< ∥v0 L< then has a first portion of 16 high-order bits comprising the 16 low-order bits v1 L< of the value v1 and a second portion of 16 low-order bits comprising the 16 low-order bits v0 L< of the value v0.

[0068] Instruction #3 is a "ROR r3, r3, #1" instruction. This instruction performs a 1-bit right rotation operation on the concatenated word v1 L< ∥v0 L< so as to obtain a concatenated word shifted by 1 bit by right rotation (v1 L< ∥v0 L< )>>>1. This shifted concatenated word is stored in the r3 register.

[0069] Instruction #4 is a "UXTH r0, r0, ROR#16" instruction. This instruction performs a 16-bit right rotation of the value v0 so as to invert the values v0 H< of the most significant bits with the values v0 L< of the least significant bits of the value v0, before setting the most significant 16 bits of the rotation result to zero and storing the result of this operation in the r0 register. The result of this operation allows only the most significant 16 bits v0 H< of the value v0 to be retrieved.

[0070] Instruction #5 is an LSL instruction r0,r0,#16. This instruction shifts the value v0 H< 16 bits to the left. The result of this operation is then the concatenated word v0 H< ||0.

[0071] Instruction #6 is an "EOR r1, r0, r1, LSR#16" instruction. This instruction concatenates the high-order bits v0 H< and v1 H< of the values v0 and v1 to obtain a second concatenated word v0 H< ∥v1 H< , and stores this concatenated word v0 H< ∥v1 H< in register r1. In particular, this instruction isolates the 16 high-order bits of v1 by shifting v1 16 bits to the right before performing an EXCLUSIVE OR operation between the value v0 H< ∥0 and the value v1 H< to obtain the concatenated word v0 H< ∥v1 H< . The concatenated word v0 H< ∥v1 H< then has a first portion of 16 high-order bits comprising the 16 high-order bits v0 H< of the value v0 and a second portion of 16 low-order bits comprising the 16 high-order bits v1 H< of the value v1.

[0072] Instruction #7 is a "ROR r1, r1, #1" instruction. This instruction performs a 1-bit right rotation operation on the concatenated word v0 H< ∥v1 H< so as to obtain a concatenated word shifted by 1 bit by right rotation (v0 H< ∥v1 H< ). This shifted concatenated word is stored in the r1 register.

[0073] Instruction #8 is an "ORR r2, r2, =0xF0000000" instruction. This instruction performs a logical OR operation between the value of the selection bit Sel_bit stored in the r2 register and the value 0xF0000000 (represented here in hexadecimal), and records the result of this operation in the r2 register. Since the value of the selection bit is equal to 0, the result of the logical OR operation is equal to 0xF0000000.

[0074] Instruction #9 is a "ROR r2, r2, #28" instruction. This instruction performs a 28-bit right rotation operation on the result of the logical OR operation stored in register r2, and saves the result of this rotation operation in register r2. Here, the result of the rotation operation is equal to 0x0000000F in hexadecimal system, which is 15 in decimal system.

[0075] Instruction #10 is a "ROR r1, r1, r2" instruction. This instruction performs a right rotation operation by a number of bits corresponding to the value stored in register r2 (here 0x0000000F, i.e. a 15-bit right rotation) on the shifted concatenated word (v0 H< ∥v1 H< )>>>1 stored in register r1, and records the result of this rotation operation in register r1. Here, the result of this 15-bit rotation operation corresponds to the concatenated word v1 H< ∥v0 H< which has a first portion of 16 high-order bits comprising the 16 high-order bits v1 H< of the value v1 and a second portion of 16 low-order bits comprising the 16 high-order bits v0 H< of the value v0. Thus, this result corresponds to a 16-bit rotation of the concatenated word v0 H< ∥v1 H< .

[0076] Instruction #11 is a "ROR r3, r3, r2" instruction. This instruction performs a right rotation operation by a number of bits corresponding to the value stored in register r2 (here 0x0000000F, i.e. a 15-bit right rotation) on the shifted concatenated word (v1 L< ∥v0 L< )>>>1 stored in register r3, and records the result of this rotation operation in register r3. Here, the result of this 15-bit rotation operation corresponds to the concatenated word v0 L< ∥v1 L< which has a first portion of 16 high-order bits comprising the 16 low-order bits v0 L< of the value v0 and a second portion of 16 low-order bits comprising the 16 low-order bits v1 L< of the value v1. Thus, this result corresponds to a 16-bit rotation of the concatenated word v1 L< ∥v0 L< .

[0077] Instruction #12 corresponds to an instruction "LSL r1, r1, #16". This instruction performs a 16-bit left shift operation on the concatenated word v1 H< ∥v0 H< resulting from the rotation operation, and stores the result of this shift operation in the register r1. This shift operation eliminates the unselected value v1 H< and keeps only the selected value v0 H<.

[0078] Instruction #13 corresponds to an instruction "EOR r0, r1, r3, LSR #16". This instruction allows to concatenate the 16 most significant bits v0 H< and the 16 least significant bits v0 L< of the value v0 to retrieve this selected value v0, and allows to save this retrieved value v0 in the register r0. In particular, this instruction allows first of all to shift by 16 bits to the right the concatenated word v0 L< ∥v1 L< of the register r3 to obtain v0 L< before performing an EXCLUSIVE OR logical operation with the value v0 H< to obtain the concatenated word v0 H< ∥v0 L< corresponding to the selected value v0.

[0079] Table [Table 4] illustrates an example of implementation of the method when the two values v0 and v1 initially stored in registers r0 and r1 are represented on 32 bits, and when the value of the selection bit Sel_bit initially stored in register r2 is equal to 1 so as to select the value v1 stored in register r1. [Table 4] Sel_bit=1 N° Instruction Instruction Registre r0 Registre r1 Registre r2 Registre r3 #0 État initial v0 = v0 H< ∥ v0 L< v1 = v1 H< ∥ v1 L< Sel_bit = 1 #1 UXTH r3,r0 v0 L< #2 EOR r3,r3,r1,LSL #16 v1 L< ∥ v0 L< #3 ROR r3,r3,#1 (v1 L< ∥ v0 L< ) >>> 1 #4 UXTH r0,r0,ROR #16 v0 H< #5 LSL r0,r0,#16 v0 H< ∥ 0 #6 EOR r1,r0,r1,LSR #16 v0 H< ∥ v1 H< #7 ROR r1,r1,#1 (v0 H< ∥ v1 H< ) >>> 1 #8 ORR r2,r2,#0xF0000000 0xF0000001 #9 ROR r2,r2,#28 0x0000001F = 31 #10 ROR r1,r1,r2 v0 H< ∥ v 1 H< #11 ROR r3,r3,r2 v1 L< ∥ v0 L< #12 LSL r1,r1,#16 v1 H< #13 EOR r0,r1,r3,LSR #16 v1 = v1 H< ∥ v1 L<

[0080] The instructions are identical to those described in relation to table [Table 3]. However, the results of the operations performed by executing these instructions differ from those in table [Table 3] because the value of the selection bit is equal to 1 and no longer 0.

[0081] In particular, the result of the logical OR operation of instruction #8 is equal to 0xF0000001, and no longer 0xF0000000. Thus, the result of the rotation operation of instruction #9 is equal to 0x0000001F, that is, 31 in decimal.

[0082] The rotation operations performed by instructions #10 and #11 are therefore rotations on 31 bits, and no longer on 15 bits.

[0083] More specifically, the result of the rotation operation of instruction #10 therefore corresponds to the concatenated word v0 H< ∥v1 H< . This concatenated word v0 H< ∥v1 H< has a first portion of 16 high-order bits comprising the 16 high-order bits v0 H< of the value v0 and a second portion of 16 low-order bits comprising the 16 high-order bits v1 H< of the value v1. This result corresponds to a 32-bit rotation of the concatenated word v0 H< ∥v1 H< obtained after the execution of instruction #6.

[0084] The result of the rotation operation of instruction #11 therefore corresponds to the concatenated word v1 L< ∥v0 L< . This concatenated word v1 L< ∥v0 L< has a first portion of 16 high-order bits comprising the 16 low-order bits v1 L< of the value v1 and a second portion of 16 low-order bits comprising the 16 low-order bits v0 L< of the value v0. This result corresponds to a 32-bit rotation of the concatenated word v1 L< ∥v0 L< obtained after the execution of instruction #2.

[0085] Therefore, the result of the shift operation of instruction #12 is equal to the high-order 16 bits v1 H< of the selected value v1, and the result of the EXCLUSIVE OR operation of instruction #13 results in the concatenated word v1 H< ∥ v1 L< corresponding to the selected value v1.

[0086] The described selection methods can be implemented within the framework of a cryptographic method. In particular, the described selection methods can be implemented in the "RSA" and "ElGamal" cryptosystems, the "DSA" (acronym for "Digital Signature Algorithm") and "ECDSA" (acronym for "Elliptic curve digital signature algorithm") algorithms, and the "ECDH" (acronym for "Elliptic-curve Diffie-Hellman") protocol. For example, the described selection methods can be implemented in a Montgomery ladder algorithm.

[0087] More particularly, the selection bit may be a bit of a cryptographic key that the user wishes to keep secret. For example, such a selection may be implemented to calculate a modular exponentiation or a scalar multiplication based on a bit of the cryptographic key.

[0088] There figure 2illustrates an embodiment of a computer system SYS, such as a system on a chip for example. The computer system SYS comprises a processing unit UT and a memory MEM in which a computer program PRG is stored. The processing unit UT has an architecture supporting rotation of the register contents.

[0089] The computer program PRG comprises instructions which, when the program is executed by the processing unit UT, cause the latter to implement a selection method such as those described previously.

Claims

1. A computer-implemented method for selecting one of two values stored in two different registers from a selection bit, the method comprising: - concatenating (20) the two values stored in the two registers so as to obtain a concatenated word presenting said two values in two distinct portions of the concatenated word, then - rotating (21, 21a, 21b) said concatenated word according to the value of the selection bit so as to position the selected value in a given portion of the concatenated word from said two portions, then - deleting (22) of the unselected value in the concatenated word so as to keep only the selected value in the concatenated word by eliminating the unselected value from the concatenated word.

2. The method according to claim 1, wherein said deletion of the unselected value in the concatenated word comprises shifting (22) the concatenated word so as to keep only the selected value in the concatenated word by eliminating the unselected value of the concatenated word.

3. The method according to any one of claims 1 or 2, wherein the concatenation allows concatenating two values over 16 bits so as to obtain a 32-bit concatenated word in which the two values are comprised in two 16-bit portions of the concatenated word.

4. The method according to claim 3, wherein said rotation of said concatenated word comprises: - a first rotation (21a) of the concatenated word according to a predetermined number M of bits, M being different from 0 and a multiple of 16, then - a second rotation (21b) of the concatenated word according to a number of bits depending on the selection bit so as to obtain the value selected on said given portion.

5. The method according to claim 4, wherein the number of shift bits for the second rotation is determined by carrying out: - a logical OR function between the value of the selection bit and a value equal to 0xN0000000 where N is comprised between 1 and F in hexadecimal system and is defined relative to the predetermined number M of bits for the first rotation, then - a rotation of 28 bits on the value obtained by the logical function OR so as to obtain a value of the number of shift bits for the second rotation.

6. A computer programme product comprising instructions which, when these instructions are executed by a computer, lead said computer to implement a method according to one of claims 1 to 5.

7. A computer system comprising: - a memory in which a computer program product according to claim 6 is stored, and - a processing unit configured to execute said computer program product.