METHOD FOR DETERMINING A MODULAR INVERSE, ELECTRONIC DEVICE AND COMPUTER PROGRAMS FOR THIS PURPOSE

Description

[0001] The present invention relates generally to the field of cryptographic processing using modular arithmetic.

[0002] It relates more specifically to a modular inverse determination method, an RSA CRT key generation method, and an associated computer program and cryptographic processing device. WO 2019 / 079048 A1 discloses an example of a hidden modular inverse calculation.

[0003] Some cryptographic algorithms, particularly asymmetric cryptography such as the RSA (Rivest-Shamir-Adleman) algorithm, use the principles of modular arithmetic. The generation of cryptographic keys, containing both public and private elements, is necessary before encrypting or signing messages. The confidentiality of the private elements must be preserved.

[0004] The RSA CRT algorithm (for "Chinese Remainder Theorem" in Anglo-Saxon terminology) is a variant of the RSA algorithm that uses the Chinese Remainder Theorem to speed up calculations.

[0005] In RSA CRT, private elements include: a prime number P, another prime number Q, a first decryption exponent equal to a secret exponent modulo the other prime number minus one, a second decryption exponent equal to the secret exponent modulo the prime number minus one, a modular inverse C of the other prime number modulo the prime number: C = Q -1 < mod P. Observing a processor implementing a key generation process can allow us to detect information about the data successively manipulated and, after observing one or more implementations of the process, to deduce information about the value processed.

[0006] The generation of the modular inverse C must therefore be protected against such attacks, generally called side-channel attacks.

[0007] Unfortunately, existing solutions do not provide satisfactory protection against the generation of the modular inverse.

[0008] To remedy these drawbacks, the present invention proposes, according to a first aspect, a method for determining a modular inverse of a number Q in the ring of integers modulo a given modulus P, the number and the given modulus being prime numbers, the given modulus being masked in the form of first parts of an initial masking, the method being implemented by an electronic device and the method comprising the following steps: Determination, preferably by random sampling, of a first multiplicative mask and a second multiplicative mask that are non-zero and coprime; Determination of another masked modulus by applying the first multiplicative mask to the given modulus P; Determination of a masked number equal to the product of the second multiplicative mask and the number Q; Determination of a multiplicative inverse of the other masked modulus and then determination of an intermediate inverse D resulting from a multiplication of the multiplicative inverse of the other masked modulus by the first multiplicative mask modulo the masked number; Determination of second parts of a modular additive masking of a dividend, the dividend having value (-D · P + 1) mod N with N a public modulus of value equal to P · Q, and the determination of each second part comprising the determination of a product of the intermediate inverse and a distinct third part of the same preliminary masking of the given modulus.Calculation of the exact division of the dividend by the number, the modular inverse being the result of the exact division, the dividend, the modular inverse and the number being manipulated in masked form.

[0009] Other advantageous and non-limiting features of the process according to the invention, taken individually or in all technically possible combinations, are as follows: The initial masking is a masking by means of an additive masking, a modular additive masking, a multiplicative masking, and a modular multiplicative masking; the preliminary masking is an additive masking; the third parts are the first parts; the method further includes a mask-change step during which the third parts of the preliminary masking of the given module are determined from the first parts of the initial masking of said given module or from the other masked module and the first multiplicative mask; the determination of one and only one second part of the masked dividend further includes an increase of 1 in the product determined modulo the public module; the exact division includes replacing the modular additive masking of the dividend with an additive masking; the calculation of the exact division manipulates the masked number and the second multiplicative mask, the second multiplicative mask being odd;The method further includes calculating the public module from the given module and the number. According to a second aspect, the invention proposes a method for generating an RSA CRT key comprising a method as defined above.

[0010] According to a third aspect, the invention proposes a computer program comprising instructions executable by a processor and adapted to implement a process as defined above, when these instructions are executed by the processor.

[0011] This program can use any programming language, and be in the form of source code, object code, or code somewhere between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0012] At least part of the methods according to the invention can be implemented by computer. Consequently, the present invention can take the form of a fully hardware embodiment or an embodiment combining software aspects (including firmware, resident software, microcode, etc.) and hardware, all of which can be collectively referred to herein as a "block".

[0013] According to a fourth aspect, the invention proposes an electronic device for determining a modular inverse of a number Q in the ring of integers modulo a given modulus P, the number and the given modulus being prime numbers, the given modulus being masked in the form of first parts of an initial masking, and the electronic device comprising: a multiplicative mask determination block configured to determine, preferably by random sampling, a first multiplicative mask and a second multiplicative mask that are non-zero and coprime; a block for determining another masked module configured to determine another masked module by applying the first multiplicative mask to the given module P; a block for determining a masked number configured to determine a masked number equal to the product of the second multiplicative mask and the number Q; an inversion block configured to determine a multiplicative inverse of the other masked module and then determine an intermediate inverse D resulting from multiplying the multiplicative inverse of the other masked module by the first multiplicative mask modulo the masked number; a dividend determination block configured to determine second parts of a modular additive masking of a dividend.the dividend having a value of (-D · P + 1) mod N with N a public modulus of value equal to P · Q, and the determination of each second part comprising the determination of a product of the intermediate inverse and a third part distinct from the same preliminary masking of the given modulus, an exact division block configured to compute the exact division of the dividend by the number, the modular inverse being the result of the exact division, the dividend, the modular inverse and the number being manipulated in masked form.

[0014] This electronic device can be configured to implement each of the embodiment possibilities envisaged for the processes as defined above.

[0015] Of course, the different features, variants and embodiments of the invention can be combined with each other in various ways as long as they are not incompatible or mutually exclusive.

[0016] Other features and advantages of the present invention will become apparent from the description given below, with reference to the attached figures which illustrate examples of embodiment without any limiting character.

[0017] In the figures: There figure 1 schematically represents a preferred embodiment of an electronic device according to the invention; The figure 2 illustrates in flowchart form the main steps of a secure comparison according to an implementation method, for the implementation of the invention; The figure 3 illustrates in flowchart form the main steps of a method for determining a modular inverse according to a first embodiment of the invention; The figure 4 illustrates in flowchart form the main substeps of an exact division calculation step in hidden form according to a first embodiment for implementing a method for determining a modular inverse according to the invention; The figure 5 illustrates, in the form of a flowchart, the main substeps of an exact division calculation step in hidden form according to a second embodiment for implementing a method for determining a modular inverse according to the invention; The figure 6 illustrates in flowchart form the main steps of a method for determining a modular inverse according to a second embodiment of the invention; The figure 7 illustrates in flowchart form the main steps of a method for determining a modular inverse according to a third embodiment of the invention; The figure 8 illustrates in the form of a flowchart the main steps of a method for determining a modular inverse according to a fourth embodiment of the invention.

[0018] Unless otherwise indicated, elements common or similar to several figures bear the same reference signs and have identical or similar characteristics, so that these common elements are generally not described again for the sake of simplicity.

[0019] In the context of this description, the terms "first", "second", "third", "fourth", "fifth", "sixth" are only indicative to distinguish the elements they qualify, but do not imply any order between them.

[0020] There figure 1 schematically represents an electronic device 2 comprising a processor 4 (for example a microprocessor), a storage unit 6, a random access memory 8 and a communication unit 10.

[0021] RAM 8 and memory entity 6 are each linked to processor 4 so that processor 4 can read or write data into memory entity 6 and / or RAM 8.

[0022] The memory entity 6 stores computer program instructions, some of which are designed to implement a process as described with reference to one of the figures 2 à 8 , when these instructions are executed by processor 4.

[0023] The storage entity 6 is for example a hard drive or a non-volatile memory, possibly rewritable, for example of type EEPROM (for "Electrically Erasable and Programmable Read-Only Memory" according to the commonly used Anglo-Saxon term).

[0024] RAM 8 can store at least some of the following elements (including a first multiplicative mask, a second multiplicative mask, the first parts of an initial mask, another masked module, a masked number, a multiplicative inverse, an intermediate inverse, the third parts of a preliminary mask, the second parts of a modular additive mask of a dividend, and a modular inverse as described with reference to at least one figure among the figures 2 à 8 ) handled during the various treatments carried out during one of the processes described below.

[0025] In the following description, memory refers to any one of the storage entity 6 and the random access memory 8.

[0026] The electronic device 2 also includes several blocks (not shown).

[0027] Typically, electronic device 2 includes a multiplicative mask determination block, a masked module determination block, a masked number determination block, an inversion block, a dividend determination block, and an exact division block. Electronic device 2 may also include a public module determination block and / or a mask change block and / or a key generation block.

[0028] In practice, these blocks can be achieved through a combination of hardware and software elements.

[0029] Each block has a functionality described in one of the methods according to the invention and described below with reference to figures 2 à 8 . Thus, for each block, the electronic device 2 stores, for example, software instructions executable by the processor 4 of the electronic device 2 in order to use a hardware element (for example, a communication entity or a memory) and thus implement the functionality offered by the block.

[0030] According to one possible embodiment, the computer program instructions stored in the storage entity 6 were, for example, received (typically from a remote computer) during an operating phase of the electronic device 2 prior to the processes described with reference to figures 2 à 8 .

[0031] The communication entity 10 is connected to the processor 4 in such a way as to allow the processor 4 to receive data from another electronic device (not shown) and / or to transmit data to another electronic device (not shown). In some embodiments, the processor 4 can thus receive data L from the other electronic device, for example, computer program instructions and / or input data, and / or transmit output data. Input data is, for example, a message that the electronic device 2 must sign using an RSA CRT key comprising a modular inverse generated by a process as described with reference to figures 2 à 8 An output data point is, for example, the result of said signature.

[0032] The electronic device 2 can take many forms (not shown).

[0033] According to a first example, the electronic device is a smart card, such as an identity card, a bank card or a universal integrated circuit card (also known as a UICC card for "Universal Integrated Circuit Card" in Anglo-Saxon terminology).

[0034] In this case, the communication entity 10 includes, for example, contacts flush with one side of the smart card. Alternatively, the communication entity 10 could be implemented as a contactless communication block. Generally, the communication entity 10 can be a wired or wireless communication block with another electronic entity.

[0035] According to a second example, the electronic device is a secure component, such as a secure microcontroller, which is integrated into another electronic device, typically a communication terminal or a car.

[0036] According to other examples, the electronic device is a USB key, a mobile phone, a personal computer, a server, or an identity document, such as an electronic passport.

[0037] As will be seen later, the electronic device 2 is configured to determine a modular inverse of a number Q in the ring of integers modulo a given modulo P, the number and the given modulus being prime numbers, and the given modulus being masked as the first parts of an initial mask. The electronic device 2 can further be configured to generate an RSA CRT key comprising the modular inverse thus determined.

[0038] According to a first example, a quantity A is additively masked over the integers with n parts if it is given in the form of n quantities A 1 , ... ,A n such that the following equation is satisfied on the integers: A 1 + ··· + A n = A . In this example, the quantity A is said to be masked in the form of n parts A 1 , ... ,A n of an additive masking.

[0039] According to a second example, a quantity A is additively masked modulo a quantity B with n parts if it is given in the form of n quantities A₁, ..., Aₙ such that the following equation is satisfied: A₁ + ... + Aₙ = A mod B. In this example, the quantity A is said to be masked in the form of n parts A₁, ..., Aₙ of a modular additive masking of modulo B.

[0040] According to a third example, a quantity A is multiplicatively masked over 2-part integers if it is given in the form of 2 quantities A1, A2 such that the following equation is satisfied: A · A2 = A1. In this example, the quantity A is said to be masked in the form of 2 parts A1, A2 of a multiplicative masking.

[0041] According to a fourth example, a quantity A is multiplicatively masked modulo a quantity B with 2 parts if it is given in the form of two quantities A₁, A₂ such that the following equation is satisfied: A · A₂ = A₁ mod B. In this case, the inverse of the quantity A₂ modulo the quantity B is well-defined. In this example, the quantity A is said to be masked in the form of two parts A₁, A₂ of a modular multiplicative masking of modulo B.

[0042] Multiplicative masking with n shares and modular multiplicative masking with n shares, n being greater than or equal to 3, are other possible examples but are not preferred in the context of an RSA CRT algorithm.

[0043] The initial masking can be a masking by additive masking, modular additive masking, multiplicative masking and modular multiplicative masking.

[0044] In the embodiments of the invention described below with reference to figures 3 à 8 , the sum of n parts A 1 , ... ,A n of a modular additive masking of a quantity A can be safely compared with another quantity B.

[0045] There figure 2 illustrates in flowchart form the main steps of a secure comparison according to an implementation method for implementing the invention. More specifically, the figure 2 illustrates the main steps of a secure comparison of a sum of n parts A 1 , ... ,A n of a modular additive masking of a quantity A and another quantity B.

[0046] The size of quantity A is a bits.

[0047] The secure comparison is implemented here by the electronic device 2 due to the execution of the computer program instructions stored in the storage entity 6 as indicated above.

[0048] According to a random number generation step (step E2), processor 4 determines a random number F by random sampling, that is, by truly random sampling or by pseudo-random sampling, within a closed interval having a lower bound of 0 and an upper bound of 2a + 0 < -1, where 0 is a safety integer. The safety integer preferably has a non-zero value, for example 80.

[0049] The secure comparison then includes a step of calculating a first intermediate data (step E4), during which the processor 4 calculates a first intermediate data G 1 as follows: G 1 = A 1 + F.

[0050] The secure comparison then includes an index initialization step (step E6), during which processor 4 initializes an integer i to the value 2.

[0051] The secure comparison then includes a step of updating the first intermediate data (step E8), during which the processor 4 updates the first intermediate G 1 as follows: G 1 = G 1 + A i .

[0052] Processor 4 then determines, in a test step (step E10), whether the integer ia reaches the value n. If not, the integer i is incremented by 1 in an increment step (step E12) and processor 4 loops back to the first intermediate data update step (step E8).

[0053] Thus the implementation of the secure comparison implements n - 1 iterations of the step of updating the first intermediate data (step E8).

[0054] If yes at the test step (step E10), processor 4 calculates, at a second intermediate data calculation step (step E14), a second intermediate data G 2 as follows: G 2 = B + F.

[0055] The secure comparison then includes another test step (step E16), during which processor 4 determines whether the first intermediate data point is strictly less than the second intermediate data point. During this additional test step, processor 4 can directly compare the first intermediate data point to the second intermediate data point.

[0056] If the first intermediate data is strictly less than the second intermediate data, this indicates that the result of the sum of the n parts A 1 , ... ,A n of the modular additive masking of quantity A is strictly less than the other quantity B.

[0057] After the last iteration of the first intermediate data update step (step E8), the first intermediate data has the value F + ∑ i = 1 n A i = F + A .

[0058] During the other test step, determining whether the first intermediate data point is strictly less than the second intermediate data point is equivalent to determining whether F + A is strictly less than F + B, that is, determining whether A is strictly less than B. However, the quantity A is not manipulated as such during this step and the other steps of the secure comparison, thus preserving the confidentiality of the quantity A. The random variable F ensures the confidentiality of the quantity A.

[0059] A person in the trade will understand that the steps of the secure comparison can be executed in other orders as long as each step has the elements necessary for its execution.

[0060] For example, the step of calculating a second intermediate data point (step E14) can be executed before the step of calculating a first intermediate data point (step E4) or before the step of initializing an index (step E6) or before the step of updating the first intermediate data point (step E8), but after the step of determining a random number (step E2).

[0061] The secure comparison described with reference to the figure 2 The loop executes its iterations with an index that increments with each iteration. Those skilled in the art will understand that the loop's index can be managed differently as long as all the index's values ​​are traversed by executing the loop's iterations.

[0062] Typically, the process can be adapted to perform the n - 1 iterations of the first intermediate data update step (step E8) in a different order, each iteration using a different value of the integer, between 2 and n. For example, the person skilled in the art can initialize the integer with the value n in the index initialization step (step E6), replace the increment step (step E12) with a decrement step that decrements the integer i by 1, and determine in the test step (step E10) whether the integer ia reaches the value 2.

[0063] The person skilled in the art will also understand that the implementation of the first intermediate data calculation step (step E4), and the implementations of the first intermediate data update step (step E8), can be managed differently to obtain the final value of the first intermediate data, by summing each part of the modular additive masking of quantity A and randomness F, randomness F being added to the current value of the first intermediate data before all parts of the modular additive masking are.

[0064] There figure 3 illustrates in the form of a flowchart the main steps of a method for determining a modular inverse according to a first embodiment of the invention.

[0065] The process of figure 3 aims to determine a modular inverse of a number Q in the ring of integers modulo a given modulus P, the number and the given modulus being prime numbers, and the given modulus being masked in the form of the first n parts of an initial masking with n an integer strictly greater than one. The initial masking here is an additive masking.

[0066] The process of figure 3 is implemented here by the electronic device 2 due to the execution of the computer program instructions stored in the storage entity 6 as indicated above.

[0067] The size of the given modulus P is p bits and the size of the number Q is q bits. For example, pa has a value of 1024 and qa also has a value of 1024. Note, however, that p can have a value different from that of q.

[0068] According to a step of determining multiplicative masks (step S2), the processor 4 determines a first multiplicative mask R and a second multiplicative mask S that are non-zero and coprime.

[0069] The first multiplicative mask R has a size r, respectively the second multiplicative mask S has a size s, which is preferably at least the size of a word.

[0070] The word is also called a machine word. The word is a basic unit manipulated by the processor. The size of a word is, for example, 8 bits, 16 bits, 32 bits, 64 bits or 128 bits.

[0071] The size r of the first multiplicative mask R, and the size s of the second multiplicative mask S, is for example 80 bits.

[0072] The size r of the first multiplicative mask R may be different from the size s of the second multiplicative mask S.

[0073] Preferably, the size r of the first multiplicative mask R and the size s of the second multiplicative mask S are identical.

[0074] The determination of the first multiplicative mask R and the second multiplicative mask S is preferably by random draw, that is to say by truly random draw or by pseudo-random draw.

[0075] Typically, processor 4 draws a first random number uniformly within a closed interval with a lower bound of 1 and an upper bound of 2s < -1, the second multiplicative mask being the first random number. Then, processor 4 draws a second random number uniformly within a closed interval with a lower bound of 1 and an upper bound of 2r < -1, and repeats this process until the greatest common divisor of the first and second random numbers is equal to 1. The first multiplicative mask is the second random number when the greatest common divisor of the first and second random numbers is equal to 1.

[0076] According to one implementation variant, the second multiplicative mask may have been stored in a memory of the electronic device 2 during an operating phase of the electronic device 2 prior to the process described here. The determination of the second multiplicative mask S is then by reading from a memory of the electronic device 2. To determine the first multiplicative mask, the processor 4 can draw a random number uniformly within the closed interval having a lower bound of 1 and an upper bound of 2r < -1, and repeat this operation until the greatest common divisor of the second multiplicative mask and the second random number is equal to 1. The first multiplicative mask is the second random number when the greatest common divisor of the second multiplicative mask and the second random number is equal to 1.

[0077] The process then includes a step of determining another masked module (step S4), during which the processor 4 determines another masked module P (R) by applying the first multiplicative mask R to the given module P.

[0078] Typically, processor 4 calculates the other hidden module P(R) as follows: P R = ∑ j = 1 n P j ⋅ R with P j the first parts.

[0079] According to a step of determining a masked number (step S6), the processor 4 determines a masked number Q (S) equal to the product of the second multiplicative mask S and the number Q.

[0080] The masked number can be determined by reading a memory of the electronic device 2, for example if the masked number has been previously determined and then stored in the storage entity 6. This implementation can be advantageous if the second multiplicative mask has also been recorded in a memory of the electronic device 2 during an operating phase of said electronic device 2, prior to the process described here.

[0081] The masked number can be determined by calculation, for example if the number Q is masked in the form of fourth parts of another initial masking, the fourth parts having previously been determined and then stored in the storage entity 6. The other initial masking can be a masking by an additive masking, a modular additive masking, a multiplicative masking and a modular multiplicative masking.

[0082] Typically, when the other initial masking is an additive masking with m shares, processor 4 calculates the masked number Q(s) as follows: Q S = ∑ j = 1 m Q j ⋅ S with Q j the fourth parts.

[0083] Preferably, the other initial masking is an additive masking with n shares, i.e., m equals n.

[0084] The process then includes a step of determining a multiplicative inverse (step S8) during which the processor 4 determines a multiplicative inverse P(R) -1< of the other masked module, typically by calculation from the other masked module P(R).

[0085] The process continues with a step of determining an intermediate inverse (step S10) during which processor 4 determines an intermediate inverse D resulting from a multiplication of the multiplicative inverse of the other masked modulo by the first multiplicative mask modulo the masked number. Typically, processor 4 calculates the intermediate inverse as follows: D = P R − 1 ⋅ R mod Q S .

[0086] The process then includes a step of determining second parts of a modular additive masking of a dividend (step S12), during which the processor 4 determines second parts of a modular additive masking of a dividend, the dividend having value (-D · P + 1) mod N with N a public modulus of value equal to P · Q, and the determination of each second part comprising the determination of a product of the intermediate inverse and a separate third part of the same preliminary masking of the given modulus.

[0087] Typically, for any i from 1 to n, processor 4 computes a second part Ti of a modular additive masking of a dividend T as follows: Ti = -D · Pi + Hi mod N such that ∑ i = 1 n H i mod N = 1 In this example, the third parts are the first parts. In other words, the preliminary masking is the initial masking. The determination of each second part Ti therefore includes the determination of a product D · Pi of the intermediate inverse D and a distinct third part Pi of the same preliminary masking of the given modulus P, that is, the preliminary masking of the given modulus P. The modular additive masking of the dividend is here a modular additive masking of modulus N.

[0088] Preferably, for one and only one value of i, Hi equals 1, and for other values ​​of i, Hi is zero. In this case, the determination of one and only one second part of the hidden dividend further includes an increase of 1 in the product determined modulo the public modulo.

[0089] The process is therefore more efficient because it limits the operations necessary to determine the dividend.

[0090] The public module N may have been recorded in a memory of the electronic device 2 during an operating phase of the electronic device 2 prior to the process described here.

[0091] If the public module N is not available, the process can calculate the public module from the given module and the number.

[0092] According to a first example, processor 4 calculates the public modulus N as follows: Z = ∑ i = 1 n P i ⋅ Q s then N = Z / S with Z an intermediate result. Summing products P i · Q (s) , i ranging from 1 to n, allows preserving the confidentiality of the given modulus P.

[0093] According to a second example, if the number Q is masked in the form of m fourth parts of an additive masking, the fourth parts having been previously determined and then stored in the memory entity 6, the processor 4 calculates the public modulus N as follows: N = ∑ i = 1 n ∑ j = 1 m P i ⋅ Q j . Sommer n · m products P i · Q j , i going from l to n and j going from l to m, allows to preserve the confidentiality of the given modulus P and the number Q.

[0094] The process then includes a step of calculating the exact division of the dividend by the number (step S14) during which the processor 4 calculates the exact division of the dividend by the number, the modular inverse being the result of the exact division, the dividend, the modular inverse and the number being manipulated in masked form.

[0095] A person skilled in the art will understand that the steps in the process of determining a modular inverse described with reference to the figure 3 , can be executed in other orders as long as each step has the elements necessary for its execution.

[0096] According to an example, the step of determining a masked number (step S6) can be executed before the step of determining another masked module (step S4) and after the step of determining multiplicative masks (step S2).

[0097] According to another example, the step of determining a multiplicative inverse (step S8) can be executed before the step of determining a masked number (step S6) and after the step of determining another masked modulus (step S4).

[0098] There figure 4 illustrates in flowchart form the main substeps of the step for calculating the exact division of the dividend by the number (step S14) according to a first embodiment. In this first embodiment of the exact division calculation step, the masked number Q(S) is the masked form of the number manipulated to perform the exact division; and the modular inverse is manipulated in the form of n fifth parts C1, ..., Cn of an additive masking.

[0099] According to a substep of mask change (substep SS2), processor 4 replaces the modular additive N-module masking of the dividend with an additive masking.

[0100] During this substep, processor 4 replaces the n second parts of the T 1 , ... ,T n modular additive masking of modulo N of the dividend with n sixth parts E 1 , ... ,E n of an additive masking on the integers, of said dividend.

[0101] Typically, processor 4 draws n-1 third random variables E2, ..., En uniformly within a closed interval with a lower bound of 0 and an upper bound of 2p+q< -1, then processor 4 initializes a data item E1 as follows: E1 = T1. Next, for each i from 2 to n, processor 4 updates the data item E1 as follows: E1 = E1 - Ei. Then, for each i from 2 to n, processor 4 updates the data item E1 as follows: E1 = E1 + Ti. Finally, for each i from 2 to n, if T1 + ... + Tn is a value strictly less than (i - 1) · N, processor 4 updates the data item E1 as follows: E1 = E1 - N.

[0102] The processor thus obtains n sixth parts E1, ..., En from the n third parts T1, ..., Tn. Subtracting at least one third random Ei from the data El before adding the n - 1 third parts T2, ..., Tn to the data E1 allows the confidentiality of the dividend to be preserved.

[0103] The comparisons of T 1 + ··· + T n and (i - 1) · N are made in a safe manner, for example according to the embodiment described above with reference to the figure 2 .

[0104] The exact division calculation step then includes a dividend randomization substep (substep SS4), during which processor 4 randomizes each sixth part of the masked dividend by applying the second multiplicative mask to the relevant sixth part. Typically, for any i from 1 to n, processor 4 performs a calculation as follows: Ei = Ei · S. Each sixth part Ei can be decomposed into one or more words Ei[j] of rank j, where j represents the weight of the relevant word and Ei[0] is the lowest-weight word of the sixth part Ei. Similarly, the hidden number Q (S) can be decomposed into one or more word(s) Q(s)[j] of rank j, j representing the weight of the word concerned and Q(s)[0] being the word with the lowest weight of the hidden number Q (S); and for any i from 1 to n, the fifth part C i of the modular inverse can be decomposed into one or more word(s) C i [j] of rank j, j representing the weight of the word concerned and C i [0] being the word with the lowest weight of the fifth part C i.

[0105] Each fifth part Ci of the modular inverse is decomposed into w words, where w has the value defined as follows: w = (p + k - 1) ≤ b, with k = 2b, where k is the word size manipulated by the processor. As already described, the size k of a word is, for example, 8 bits, 16 bits, 32 bits, 64 bits, or 128 bits. For example, if k is 8, then b is 3.

[0106] In this disclosure, the notation A » a denotes the largest integer less than or equal to A / 2 a< .

[0107] The exact division calculation step then includes a substep for calculating the inverse of the least significant word of the masked number Q(S) (substep SS6), during which processor 4 calculates an inverse U modulo M, a power of 2, of the inverse of the least significant word of the masked number Q(S). Processor 4 thus obtains the inverse U, whose value is defined as follows: U = (-Q(S)[0]) - 1 mod M. Typically, M has a value of 2k, where k is the word size manipulated by processor 4.

[0108] Calculating an inverse modulo a power of 2 can be done using techniques known to those skilled in the art, for example, the technique described at the end of section 4 of the document "Tudor Jebelean: An Algorithm for Exact Division. J. Symb. Comput. 15(2): 169-180 (1993)". The exact division calculation step then includes a substep for initializing a first index (substep SS8) during which processor 4 initializes an integer j to the value 0.

[0109] The exact division calculation step then includes a sub-step of initializing a second index (sub-step SS10) during which processor 4 initializes an integer i to the value 1.

[0110] The exact division calculation step then includes a substep for calculating a fifth-part word (substep SS12), during which processor 4 calculates the j-th word of the fifth part Ci of the modular inverse as follows: Ci[j] = Ei[0] · U mod 2 ki. As already described, k is the word size manipulated by processor 4.

[0111] The exact division calculation step then includes a substep of updating a sixth part (substep SS14) during which processor 4 updates the sixth part E i as follows: E i = (E i - Q (S) · C i [j]) » k.

[0112] Processor 4 then determines, in a first test substep (step SS16), whether the integer ia reaches the value n.

[0113] If not, the integer i is incremented by 1 in a first increment substep (substep SS20) and the process loops back to the substep of calculating a fifth part word (substep SS12).

[0114] If the first test substep (SS16) confirms the value, the processor then determines, in a second test substep (SS18), whether the integer ja reaches the value w - 1. If the second test substep does not confirm the value, the integer j is incremented by 1 in a second increment substep (SS22) and the process loops back to the initialization substep of a second index (SS10) to perform a next iteration.

[0115] Thus, the process implements n · w substeps for calculating a fifth-part word (substep SS12) and n · w substeps for updating a sixth part (substep SS14).

[0116] If the second test substep (substep SS18) is successful, the step of calculating the exact division of the dividend by the number (step S14) ends.

[0117] In this first embodiment of the exact division calculation step, the masked number Q(S) is the masked form of the number that is manipulated to perform the exact division. The exact division calculation thus manipulates the masked number Q(S) and the second multiplicative mask S. This method is therefore more efficient because it reduces the number of operations required to calculate the exact division.

[0118] For this first implementation of the exact division calculation step, the second multiplicative mask must be odd. This second odd multiplicative mask helps to secure the process against side-channel attacks.

[0119] A person skilled in the art will understand that the sub-steps of the exact division calculation step can be executed in other orders, provided that each sub-step has the necessary elements for its execution.

[0120] According to an example, the substep of calculating the inverse of the opposite of the lowest weight word of the masked number Q(S) (substep SS6) can be executed before the dividend randomization substep (substep SS4) and / or the mask change substep (substep SS2).

[0121] According to another example, the initialization substep of a first index (substep SS8) can be executed before the calculation substep of the inverse of the opposite of the lowest weight word of the masked number Q(S) (substep SS6) and / or the randomization substep of the dividend (substep SS4) and / or the mask change substep (substep SS2).

[0122] The method for carrying out the exact division calculation step, described with reference to the figure 4 The loop executes the iterations of each loop with an index that increments with each iteration. Those skilled in the art will understand that the index i can be handled differently as long as all values ​​of index i are traversed by executing the iterations of the loop in question. Typically, the exact division calculation step can be adapted to perform the n · w substeps of updating a sixth part (substep SS14) in a different order, each iteration using a different value of the integer pair i,j.For example, a person skilled in the art can initialize the integer i with the value n in the substep initializing a second index (substep SS10), initialize the integer j with the value 0 in the substep initializing a first index (substep SS8), replace the first substep incrementing (substep SS20) with a first substep decrementing that decrements the integer i by 1, determine in the first substep testing (substep SS16) whether the integer ia reaches 1, and determine in the second substep testing (substep SS18) whether the integer ja reaches w - 1.

[0123] There figure 5 illustrates in flowchart form the main substeps of the step for calculating the exact division of the dividend by the number (step S14) according to a second embodiment. In this second embodiment of the exact division calculation step, the number is manipulated as a plurality of parts of an additive masking; the modular inverse is manipulated as n fifth parts C 1 , ... ,C n of an additive masking.

[0124] More precisely, the second embodiment is described here as manipulating the m fourth parts. It should be noted, however, that the second embodiment could manipulate a plurality of parts of an additive masking of the number obtained from another masking, for example from the masked number Q(S) and the second multiplicative mask S. Such a mask change is described below for the mask change step (step S111) with reference to the figure 7 .

[0125] The second embodiment of the exact division calculation step includes a mask change substep identical to the mask change substep (substep SS2) described above with reference to the figure 4 .

[0126] The exact division calculation step then includes a sub-step of randomizing the dividend and the number (sub-step SS104), during which the processor 4 determines a fourth random number X by random draw, i.e. by truly random draw or by pseudo-random draw, then randomizes each sixth part of the masked dividend by applying the fourth random number to the sixth part concerned and each fourth part by applying the fourth random number to the fourth part concerned.

[0127] Typically, processor 4 draws the fourth random number X uniformly within a closed interval having a lower bound of 1 and an upper bound of 2s < -1, and for all i from 1 to n, processor 4 performs a calculation as follows: Ei = Ei · X. Furthermore, for all i from 1 to m, the processor performs a calculation as follows: Qi = Qi · X.

[0128] Processor 4 must roll a fourth odd random number X.

[0129] The fourth odd random number helps to secure this second method of implementing the exact division calculation step against side-channel attacks.

[0130] Each sixth part Ei can be decomposed into one or more words Ei[j] of rank j, where j represents the weight of the word in question and Ei[0] is the lowest-weight word in the fifth part Ei. Similarly, the fourth part Q i can be decomposed into one or more word(s) Q i [j] of rank j, j representing the weight of the word concerned and Q i [0] being the word with the lowest weight of the fourth part Q i ; and for any i from 1 to n, the fifth part C i of the modular inverse can be decomposed into one or more word(s) C i [j] of rank j, j representing the weight of the word concerned and C i [0] being the word with the lowest weight of the fifth part C i .

[0131] Each fifth part Ci of the modular inverse is decomposed into w words, where w has the value defined as follows: w = (p + k - 1) ≤ b, with k = 2b, where k is the word size manipulated by the processor. As already described, the size k of a word is, for example, 8 bits, 16 bits, 32 bits, 64 bits, or 128 bits. For example, if k is 8, then b is 3.

[0132] The exact division calculation step then includes a substep for calculating the inverse of the opposite of a least significant word (substep SS106), during which processor 4 calculates an inverse U modulo M, a power of 2, of the opposite of the sum of the least significant words from the randomized fourth parts. Processor 4 thus obtains the inverse U, whose value is defined as follows: U = − ∑ i = 1 m Q i 0 − 1 mod M Typically, M has a value of 2k< , k being the word size manipulated by the processor 4.

[0133] As already described, the calculation of an inverse modulo a power of 2 can be done according to the techniques known to a person skilled in the art, for example according to the technique described at the end of section 4 of the document "Tudor Jebelean: An Algorithm for Exact Division. J. Symb. Comput. 15(2): 169-180 (1993)".

[0134] The exact division calculation step then comprises substeps for initializing a first index, initializing a second index, and calculating a fifth word, respectively identical to the substeps for initializing a first index (substep SS8), initializing a second index (substep SS10), and calculating a fifth word (substep SS12) described above with reference to the figure 4 .

[0135] The exact division calculation step then includes a substep of initializing a third index (substep SS113) during which processor 4 initializes an integer v to the value 1.

[0136] The exact division calculation step then includes a substep of updating a sixth part (substep SS114) during which processor 4 updates the sixth part E i as follows: E i = E i - Q v · C i [j].

[0137] Processor 4 then determines, in a third test substep (step SS115), whether the integer will reach the value m.

[0138] If not, the integer v is incremented by 1 in a third increment substep (substep SS116) and the process loops back to the update substep of a sixth part (substep SS114).

[0139] If yes at the third test substep (substep SS115), the processor modifies a sixth part, at a sixth part modification substep (substep SS117), as follows: E i = E i » k.

[0140] The exact division calculation step then includes a first test substep identical to the first test substep (substep SS16) described above with reference to the figure 4 .

[0141] If the first test substep (SS16) fails, the integer i is incremented by 1 in a first increment substep identical to the first increment substep (SS20) described with reference to the figure 4 and the process loops back to the substep of calculating a fifth-part word (substep SS12).

[0142] If the first test substep (SS16) is successful, the processor then determines, in a second test substep identical to the second test substep (SS18) described with reference to the figure 4 , if the integer ja reaches the value w - 1.

[0143] If the second test substep fails, the integer j is incremented by 1 in a second increment substep identical to the second increment substep (SS22 substep) described with reference to the figure 4 and the process loops back to the initialization substep of a second index (substep SS10) to perform a next iteration.

[0144] Thus, the process implements n · w substeps of calculating a fifth part word (substep SS12), n · w substeps of modifying a sixth part (substep SS117), and n · w · m substeps of updating a sixth part (substep SS114).

[0145] If the second test substep (substep SS18) is successful, the step of calculating the exact division of the dividend by the number (step S14) ends.

[0146] A person skilled in the art will understand that the sub-steps of the exact division calculation step can be executed in other orders, provided that each sub-step has the necessary elements for its execution.

[0147] According to an example, the initialization substep of a first index (substep SS8) can be executed before the calculation substep of the inverse of the opposite of a lowest weight word (substep SS106) and / or the randomization substep of the dividend and the number (substep SS104) and / or the mask change substep (substep SS2).

[0148] The method for carrying out the exact division calculation step, described with reference to the figure 5 The loop executes the iterations of each loop with an index that increments with each iteration. Those skilled in the art will understand that the index i and / or index v can be handled differently as long as all the values ​​of the index in question are traversed by executing the iterations of the loop.

[0149] Typically, the exact division calculation step can be adapted to perform the n · w substeps of calculating a fifth-part word in a different order, each iteration using a different value of the integer pair i,j. For example, the person skilled in the art can initialize the integer i with the value n in the substep initializing a second index (substep SS10), initialize the integer j with the value 0 in the substep initializing a first index (substep SS8), replace the first increment substep (substep SS20) with a first decrement substep that decrements the integer i by 1, determine in the first test substep (substep SS16) whether the integer ia reaches 1, and determine in the second test substep (substep SS18) whether the integer ja reaches w - 1.

[0150] Furthermore, the exact division calculation step can be adapted to perform the n · w · m substeps of updating a sixth part (substep SS114) in a different order, each iteration using a different value of the integer v for a given pair of integers i,j. For example, the person skilled in the art can initialize the integer v with the value m in the substep initializing a third index (substep SS113), replace the third increment substep (substep SS116) with a third decrement substep that decrements the integer v by 1, and determine in the third test substep (substep SS115) whether the integer v reaches 1.

[0151] A masked implementation of an operation, or of an algorithm, producing a result equal to the application of said operation or of said algorithm to operands, is an implementation that manipulates said operands in masked form to produce the result also in masked form, without ever manipulating the operands or the result in unmasked form.

[0152] The invention allows the modular inverse of the number Q in the ring of integers modulo the given modulus P to be calculated in masked form, that is to say without manipulation of the number, the given modulus and the modular inverse, in unmasked form.

[0153] The invention makes it possible to replace a modular reduction operation of the number modulo the given modulo, said modular reduction operation being in a form masked by: a modular reduction of a first datum modulo the public modulo, the first datum and the public modulo being manipulated in unmasked form, and a modular inversion of the other masked modulo modulo the masked number, the other masked modulo and the masked number being manipulated as such, i.e. the other masked modulo and the masked number not being themselves masked to be manipulated, and an exact division in masked form, i.e. manipulating the dividend, the divisor and its result in masked form.

[0154] Thus, the process described with reference to figures 3 à 5 does not require the hidden implementation of modular reduction and modular inversion operations. Instead, the method allows the use of the hidden implementation of exact division.

[0155] The invention performs the following calculation in a secure manner: [-[(P (R) ) -1< · R mod (Q(s))] · P + 1 mod N] / Q.

[0156] This calculation can also be noted as: [-[(P · R) -1< · R mod (Q · S)] · P + 1 mod N] / Q.

[0157] By definition of the modular inverse, there exists α such that: Q · [Q -1< mod P] = 1 + α · P.

[0158] When the number Q is multiplied by the second multiplicative mask S, according to the definition of the modular inverse, there exists β such that: [(Q · S) -1< mod P] · S = [Q -1< mod P] + β · P.

[0159] If we multiply this last equation by the number Q over the integers, there exists β such that: Q · [(Q · S) -1< mod P] · S = Q · [Q -1< mod P] + β · P · Q.

[0160] We saw that: Q · [Q -1< mod P] = 1 + α · P. We therefore have: Q · [(Q · S) -1< mod P] · S = 1 + α · P + β · P · Q.

[0161] Now we have Q · [Q -1< mod P] = 1 + α · P. Therefore, 1 + α · P is strictly greater than 0 and strictly less than P. Q, that is to say, strictly less than N.

[0162] So when we reduce Q. [(Q · S) -1< mod P] · S = 1 + α · P + β · P · Q by N, we obtain: (Q. [(Q · S) -1< mod P] · S) mod N = 1 + α · P = Q · [Q -1< mod P].

[0163] When we express the inverse of Q · S modulo P by the inverse of P modulo Q · S, we have: Q. [(Q · S) -1< mod P] · S = P · Q · S - [P -1< mod (Q · S)] · P + 1.

[0164] We therefore have: (P · Q · S - [P -1< mod (Q · S)] · P + 1) mod N = Q · [Q -1< mod P].

[0165] Since P · Q is the public modulus N, we have the following equality: (-[P - 1 < mod (Q · S)] · P + 1) mod N = Q · [Q -1< mod P].

[0166] Finally, when we multiply the given modulus P by the first application mask R, we obtain: (-[P -1< mod (Q · S)] · P + 1) mod N = (-[((P · R) -1< · R) mod (Q · S)] · P + 1) mod N. The following equality is therefore verified: (-[((P · R) -1< · R) mod (Q · S)] · P + 1) mod N = Q · [Q -1< mod P].

[0167] The invention thus obtains the calculation of the modular inverse of a number Q in the ring of integers modulo a given modulo P by performing the following calculation: [-[(P (R) -1< · R mod (Q(s))] · P + 1 mod N] / Q.

[0168] There figure 6 illustrates in the form of a flowchart the main steps of a method for determining a modular inverse according to a second embodiment of the invention.

[0169] The process of figure 6 aims to determine the modular inverse of a number Q in the ring of integers modulo a given modulo P, the number and the given modulo being prime numbers, and the given modulo being masked in the form of n first parts P 1 , ... ,P n of an initial masking with n an integer strictly greater than one.

[0170] The size of the given modulus P is p bits and the size of the number Q is q bits. For example, pa has a value of 1024 and qa also has a value of 1024. Note, however, that p can have a value different from that of q.

[0171] The initial masking here is a modular additive masking of modulo 2 p'< with p' an integer greater than or equal to p.

[0172] The process of figure 6 is implemented here by the electronic device 2 due to the execution of the computer program instructions stored in the storage entity 6 as indicated above.

[0173] According to a mask change step (step S0), processor 4 replaces the modular additive masking of modulo 2 p'< of the given modulo with an additive masking on the integers.

[0174] Typically, processor 4 draws n-1 third random variables E'2, ..., E'n uniformly in a closed interval having a lower bound of 0 and an upper bound of 2p < -1, then processor 4 initializes another variable E'1 as follows: E'1 = P1. Then, for each i from 2 to n, processor 4 updates the other variable E'1 as follows: E'1 = E'1 - E'i. Then, for each i from 2 to n, processor 4 updates the variable E'1 as follows: E'1 = E'1 + Pi. Finally, for each i from 2 to n, if P1 + ··· + Pn is a value strictly less than (i - 1) · 2p'< , processor 4 updates the other data as follows: E'1 = E'1 - 2p< '. Then, for all i from 1 to n, processor 4 updates a first part Pi as follows: Pi = E'i .

[0175] Subtracting at least one other third random E' i from the other data E' l before adding to the other data E' l the first n - 1 parts P 2 , ... ,P n , allows the confidentiality of the given module to be preserved.

[0176] The comparison of P 1 + ··· + P n and (i - 1) · 2 p< ' is done securely, for example according to the embodiment described above with reference to the figure 2 .

[0177] At the end of the mask change step (step S0), the first parts are the masked form of the given module according to an additive masking on the integers.

[0178] The process then comprises a step of determining multiplicative masks, a step of determining another masked modulus, a step of determining a masked number, a step of determining a multiplicative inverse, a step of determining an intermediate inverse, a step of determining second parts of a modular additive masking of a dividend, and a step of calculating the exact division of the dividend by the number, respectively identical to the step of determining multiplicative masks (step S2), the step of determining another masked modulus (step S4), the step of determining a masked number (step S6), the step of determining a multiplicative inverse (step S8), and the step of determining an intermediate inverse (step S10).to the step of determining second parts of a modular additive masking of a dividend (step S12) and to the step of calculating the exact division of the dividend by the number (step S14) described above with reference to the , figure 3 .

[0179] If the number Q is masked in the form of fourth parts of another initial masking, the process of the figure 6 may further include another mask change step (not shown), during which processor 4 replaces the other initial masking with an additive masking on the integers.

[0180] For example, if the other initial masking is a modular additive masking of modulo 2 q< ' with q' an integer greater than or equal to q, the process of the figure 6 may further include another mask-changing step (not shown), during which processor 4 replaces the modular additive masking of modulo 2q<' of the number with additive masking on the integers. Typically, processor 4 draws m-1 fifth random numbers E"2, ... E"m uniformly in a closed interval having a lower bound of 0 and an upper bound of 2q<-1, then processor 4 initializes a second other data point E"l as follows: E"1 = Q1. Then, for each i from 2 to m, processor 4 updates the second other data point E"l as follows: E"1 = E"1 - E"i. Then, for each i from 2 to m, processor 4 updates the data E"l as follows: E"1 = E"1 + Qi. Finally, for each i from 2 to m, if Q1 + ... + Qn is a value strictly less than (i - 1) · 2q < ', processor 4 updates the second other data as follows: E"1 = E"1 - 2q < '.Then, for any i from 1 to m, the processor 4 updates a fourth part Q i as follows: Q i = E" i .

[0181] Subtracting at least one fifth random E" i from the second other data E" l before adding to the second other data E" l the m - 1 fourth parts Q 2 , ... ,Q m , allows the confidentiality of the number to be preserved.

[0182] The comparison of Q1 + ... + Qm and (i - 1)2qm is carried out safely, for example according to the embodiment described above with reference to the figure 2 .

[0183] At the end of the other mask change step, the fourth parts are the masked form of the number according to an additive masking on the integers.

[0184] The other mask change step is performed within the process before another step of said process needs the fourth parts of the number.

[0185] For example, the other mask change step is executed before the step of determining a masked number (step S6), and / or before the step of determining second parts of a modular additive masking of a dividend (step S12), and / or before the step of calculating the exact division of the dividend by the number (step S14).

[0186] Thus, the process described with reference to the figure 6 does not require the hidden implementation of modular reduction and modular inversion operations. Instead, the method allows the use of the hidden implementation of exact division.

[0187] A person skilled in the art will understand that the steps in the process of determining a modular inverse described with reference to the figure 6 , can be executed in other orders as long as each step has the elements necessary for its execution.

[0188] According to a first example, the step of determining a masked number (step S6) can be executed before the step of determining another masked module (step S4) and after the step of determining multiplicative masks (step S2).

[0189] According to a second example, the step of determining a multiplicative inverse (step S8) can be executed before the step of determining a masked number (step S6) and after the step of determining another masked modulus (step S4).

[0190] According to a third example, the mask change step (step S0) can be executed before the step of determining another masked module (step S4) and after the step of determining multiplicative masks (step S2).

[0191] There figure 7 illustrates in the form of a flowchart the main steps of a method for determining a modular inverse according to a third embodiment of the invention.

[0192] The process of figure 7 also aims to determine the modular inverse of a number Q in the ring of integers modulo a given module P, the number and the given module being prime numbers, and the given module being masked in the form of n first parts P l , ... ,P n of an initial masking with n an integer strictly greater than one.

[0193] The size of the given modulus P is p bits and the size of the number Q is q bits. For example, pa has a value of 1024 and qa also has a value of 1024. Note, however, that p can have a value different from that of q.

[0194] The initial masking here is a multiplicative masking on two-part integers. Therefore, the integer n has a value of 2 here.

[0195] The process of figure 7 is implemented by the electronic device 2 due to the execution of computer program instructions stored in the storage entity 6.

[0196] The process of figure 7 includes a step for determining multiplicative masks identical to the step for determining multiplicative masks (step S2) described with reference to the figure 3 The process then includes a step of determining another masked module (step S104), during which the processor 4 determines another masked module P (R) by applying the first multiplicative mask R to the given module P.

[0197] Typically, processor 4 calculates the other hidden module P(R) as follows: P(R) = (P1 · R) / P2 with P1 and P2 being the first parts.

[0198] According to a step of determining a masked number (step S106), the processor 4 determines a masked number Q(S) equal to the product of the second multiplicative mask S and the number Q.

[0199] The masked number can be determined by reading a memory of the electronic device 2, for example if the masked number has been previously determined and then stored in the storage entity 6. This implementation can be advantageous if the second multiplicative mask has also been recorded in a memory of the electronic device 2 during an operating phase of said electronic device 2 prior to the process described here.

[0200] The masked number can be determined by calculation, for example if the number Q is masked in the form of fourth parts of another initial masking, the fourth parts having previously determined and then stored in the storage entity 6. The other initial masking can be a masking pami an additive masking, a modular additive masking, a multiplication masking and a modular multiplicative masking.

[0201] Typically, when the other initial masking is a multiplicative masking with m shares, m having a value of 2, processor 4 calculates the masked number Q(S) as follows: Q(S) = (Q1 · S) / Q2 with Q1 and Q2 the fourth parts.

[0202] The process then comprises a step for determining a multiplicative inverse and a step for determining an intermediate inverse, respectively identical to the step for determining a multiplicative inverse (step S8) and the step for determining an intermediate inverse (step S10) described with reference to the figure 3 .

[0203] The process then includes a mask change step (step S111), during which processor 4 replaces a multiplicative masking of the given modulus with an additive masking on the integers.

[0204] During this mask change step (step S111), processor 4 determines third parts E'1, E'2 of a preliminary mask of the given module from the first parts of the initial mask of said given module, or from the other masked module and the first multiplicative mask. The preliminary mask here is an additive mask on the integers.

[0205] For example, processor 4 draws a third other random as third part E' 2 , uniformly in a closed interval having a lower bound of value 0 and an upper bound of value 2 p< - 1, then processor 4 calculates the third part E' 1 as follows: E' 1 = (P (R) - E' 2 · R) / R.

[0206] According to another example, processor 4 draws a third random number as a third part E' 2, uniformly in a closed interval having a lower bound of value 0 and an upper bound of value 2 p< - 1, then processor 4 calculates the third part E' 1 as follows: E' 1 = (P 1 - E' 2 · P 2 ) / P 2 .

[0207] The process then includes a step of determining second parts of a modular additive masking of a dividend (step S112), during which the processor 4 determines second parts of a modular additive masking of a dividend, the dividend having value (-D · P + 1) mod N with N a public modulus of value equal to P · Q, and the determination of each second part comprising the determination of a product of the intermediate inverse and a separate third part of the same preliminary masking of the given modulus, i.e. the preliminary masking of the given modulus.

[0208] Typically, for any i from 1 to n, processor 4 computes a second part Ti of a modular additive masking of a dividend T as follows: Ti = -D · E'i + Hi mod N such that ∑ i = 1 n H i mod N = 1 . The determination of each second part T i therefore includes the determination of a product D · E' i of the intermediate inverse D and a third distinct part E' i of the same preliminary masking of the given modulus P, that is to say of the preliminary masking of the given modulus P.

[0209] Preferably, for one and only one value of i, Hi equals 1, and for other values ​​of i, Hi is zero. In this case, the determination of one and only one second part of the hidden dividend further includes an increase of 1 in the product determined modulo the public modulo.

[0210] The process is therefore more efficient because it limits the operations necessary to determine the dividend.

[0211] The public module N may have been recorded in a memory of the electronic device 2 during an operating phase of the electronic device 2 prior to the process described here.

[0212] If the public module N is not available, the process can calculate the public module from the given module and the number.

[0213] In a first example, processor 4 calculates the public modulus N as follows: N = (P1 · Q(S)) / (P2 · S). Calculating P1 · Q(S) and P2 · S before performing the division preserves the confidentiality of the given modulus P and the number Q.

[0214] According to a second example, processor 4 calculates the public modulus N as follows: Z = ∑ i = 1 2 E ′ i ⋅ Q S then N = Z / S with Z an intermediate result. Summing products E' i · Q (S) , i ranging from 1 to 2, preserves the confidentiality of the given modulus P. Furthermore, division by the second multiplicative mask S affects the result of this sum, thus preserving the confidentiality of the number Q.

[0215] According to a third example, processor 4 calculates the public modulus N as follows: N = (P(R) · Q(S)) / (R · S). Calculating P(R) · Q(s) and R · S before performing the division preserves the confidentiality of the given modulus P and the number Q.

[0216] According to a fourth example, if the number Q is masked as two fourth parts of a multiplicative mask, the fourth parts having been previously determined and then stored in the memory entity 6, the processor 4 calculates the public modulus N as follows: N = (P1 · Q1) / (P2 · Q2). Calculating P1 · Q1 and P2 · Q2 before performing the division preserves the confidentiality of the given modulus P and the number Q.

[0217] According to a fifth example, if the number Q is masked in the form of 2 fourth parts of a multiplicative masking, processor 4 can calculate the public modulus N as follows: Z = ∑ i = 1 2 E ′ i ⋅ Q 1 then N = Z / Q2 with Z an intermediate result. Summing products E'i · Q1, i ranging from 1 to 2, preserves the confidentiality of the given modulus P. Furthermore, division by the fourth part Q2 affects the result of this sum, thus preserving the confidentiality of the number Q.

[0218] According to a sixth example, if the number Q is masked as two fourths of a multiplicative mask, processor 4 can calculate the public modulus N as follows: N = (P(R) · Q1) / (R · Q2). Calculating P(R) · Q1 and R · Q2 before performing the division preserves the confidentiality of the given modulus P and the number Q.

[0219] The process then includes a step for calculating the exact division of the dividend by the number, identical to the step for calculating the exact division of the dividend by the number (step S14) described with reference to the figure 3 .

[0220] It should be noted that if the step of calculating the exact division of the dividend by the number is according to the second embodiment described with reference to the figure 5 , the process of figure 7 may include an additional step (not shown) during which processor 4 replaces a multiplicative masking of the number with an additive masking. This step can be performed similarly to what was described for the mask change step (step S111).

[0221] Thus, the process described with reference to the figure 7 does not require the hidden implementation of modular reduction and modular inversion operations. Instead, the method allows the use of the hidden implementation of exact division.

[0222] A person skilled in the art will understand that the steps in the process of determining a modular inverse described with reference to the figure 7 , can be executed in other orders as long as each step has the elements necessary for its execution.

[0223] According to a first example, the step of determining a masked number (step S106) can be executed before the step of determining another masked module (step S104) and after the step of determining multiplicative masks (step S2).

[0224] According to a second example, the step of determining a multiplicative inverse (step S8) can be executed before the step of determining a masked number (step S106) and after the step of determining another masked modulus (step S104).

[0225] According to a third example, the mask change step (step S111) can be executed before the step of determining a masked number (step S106) and after the step of determining another masked module (step S104), or before a step among the step of determining multiplicative masks (step S2) and the step of determining another masked module (step S104).

[0226] The method for determining a modular inverse described with reference to the figure 7 can be adapted to multiplicative masking with n shares, n being greater than or equal to 3.

[0227] There figure 8 illustrates in the form of a flowchart the main steps of a method for determining a modular inverse according to a fourth embodiment of the invention.

[0228] The process of figure 8 also aims to determine the modular inverse of a number Q in the ring of integers modulo a given module P, the number and the given module being prime numbers, and the given module being masked in the form of n first parts P 1 , ... ,P n of an initial masking with n an integer strictly greater than one.

[0229] The size of the given modulus P is p bits and the size of the number Q is q bits. For example, pa has a value of 1024 and qa also has a value of 1024. Note, however, that p can have a value different from that of q.

[0230] The initial masking here is a modular multiplicative masking of modulo 2 p< ' with two shares, with p' an integer greater than or equal to p. The integer therefore has a value of 2 here.

[0231] According to a mask change step (step S100), processor 4 replaces the modular multiplicative masking of modulo 2 p< ' of the given modulo with an additive masking on the integers.

[0232] Typically, processor 4 starts by replacing the modular multiplicative masking of modulo 2 p< ' of the given modulo with a modular additive masking of modulo 2 p< '.

[0233] To do this, processor 4 draws an intermediate random number R' uniformly within a closed interval having a lower bound of 0 and an upper bound of 2p< ' - 1, then processor 4 calculates a third intermediate value Z' as follows: Z' = P 2 -1< mod 2p< '. Next, processor 4 calculates two intermediate parts P' 1 ,P' 2 as follows: P' 1 = (P 1 - R') · Z' mod 2p< ' and P' 2 = R' · Z' mod 2p< '.

[0234] The two intermediate parts P' 1 ,P' 2 are the given module masked in the form of the modular additive masking of module 2 p< '.

[0235] Processor 4 then proceeds by replacing the modular additive masking of modulo 2 p< ' of the given modulo with additive masking on integers.

[0236] To do this, processor 4 draws a third random number E'2 uniformly within a closed interval with a lower bound of 0 and an upper bound of 2p < -1. Then, processor 4 calculates a first random number E'1 as follows: E'1 = P'1 - E'2. Next, processor 4 updates the first random number E'1 as follows: E'1 = E'1 + P'2. Finally, if P'1 + P'2 is a value strictly less than 2p < ', processor 4 updates the first random number as follows: E'1 = E'1 - 2p < '. Then, for all i from 1 to 2, processor 4 updates a first subset as follows: Pi = E'i.

[0237] Subtracting at least the third other random E' 2 from the intermediate part P' 1 before adding the intermediate part P' 2 to the first other data E' 1 allows the confidentiality of the given module to be preserved.

[0238] The comparison of P' 1 + P' 2 and 2 p< ' is done in a safe manner, for example according to the embodiment described above with reference to the figure 2 .

[0239] At the end of the mask change step (step S100), the first parts are the masked form of the given module according to an additive masking on the integers.

[0240] The process then comprises a step of determining multiplicative masks, a step of determining another masked modulus, a step of determining a masked number, a step of determining a multiplicative inverse, a step of determining an intermediate inverse, a step of determining second parts of a modular additive masking of a dividend, and a step of calculating the exact division of the dividend by the number, respectively identical to the step of determining multiplicative masks (step S2), the step of determining another masked modulus (step S4), the step of determining a masked number (step S6), the step of determining a multiplicative inverse (step S8), and the step of determining an intermediate inverse (step S10).to the step of determining second parts of a modular additive masking of a dividend (step S12) and to the step of calculating the exact division of the dividend by the number (step S14) described above with reference to the , figure 3 .

[0241] If the number Q is masked in the form of fourth parts of another initial masking, the process of the figure 8 may further include another mask change step (not shown), during which processor 4 replaces the other initial masking with an additive masking on the integers.

[0242] For example, if the other initial masking is a modular multiplicative masking of modulo 2 q< ' with q' an integer greater than or equal to q, the process of the figure 8 may further include another mask change step (not shown), during which processor 4 replaces the modular multiplicative masking of modulo 2 q< ' of the number with an additive masking on the integers.

[0243] Typically, processor 4 starts by replacing the modular multiplicative masking of modulo 2 q< ' of the number with a modular additive masking of modulo 2 q< ',

[0244] To do this, processor 4 draws another intermediate random number R" uniformly within a closed interval having a lower bound of 0 and an upper bound of 2q< ' - 1, then processor 4 calculates a fourth intermediate data point Z" as follows: Z" = Q 2 -1< mod 2q< '. Then processor 4 calculates two other intermediate parts Q' 1 , Q' 2 as follows: Q' 1 = (Q 1 - R") · Z" mod 2q< ' and Q' 2 = R" · Z" mod 2q< '.

[0245] The two other intermediate parts Q' 1 ,Q' 2 are the number masked in the form of the modular additive masking of modulo 2 q< '.

[0246] Processor 4 then proceeds by replacing the modular additive masking of modulo 2 q< ' of the number with additive masking on integers.

[0247] Typically, processor 4 draws a fifth random number E"2 uniformly within a closed interval having a lower bound of 0 and an upper bound of 2q < -1. Then, processor 4 calculates a second random number E"1 as follows: E"1 = Q'1 - E"2. Next, processor 4 updates the second random number E"1 as follows: E"1 = E"1 + Q'2. Finally, if Q'1 + Q'2 is strictly less than 2q < ', processor 4 updates the second random number as follows: E"1 = E"1 - 2q < '. Then, for any i from 1 to 2, processor 4 updates a fourth random number as follows: Q i = E" i .

[0248] Subtracting at least the fifth random E" 2 from the other intermediate part Q' 1 before adding the other intermediate part Q' 2 to the second other data E" 1, allows the confidentiality of the number to be preserved.

[0249] The comparison of Q'1 + Q'2 and 2q<' is carried out in a secure manner, for example according to the embodiment described above with reference to the figure 2 .

[0250] At the end of the other mask change step, the fourth parts are the masked form of the number according to an additive masking on the integers.

[0251] The other mask change step is performed within the process before another step of said process needs the fourth parts of the number.

[0252] For example, the other mask change step is executed before the step of determining a masked number (step S6), and / or before the step of determining second parts of a modular additive masking of a dividend (step S12), and / or before the step of calculating the exact division of the dividend by the number (step S14).

[0253] Thus, the process described with reference to the figure 8 does not require the hidden implementation of modular reduction and modular inversion operations. Instead, the method allows the use of the hidden implementation of exact division.

[0254] A person skilled in the art will understand that the steps in the process of determining a modular inverse described with reference to the figure 8 , can be executed in other orders as long as each step has the elements necessary for its execution.

[0255] According to a first example, the step of determining a masked number (step S6) can be executed before the step of determining another masked module (step S4) and after the step of determining multiplicative masks (step S2).

[0256] According to a second example, the step of determining a multiplicative inverse (step S8) can be executed before the step of determining a masked number (step S6) and after the step of determining another masked modulus (step S4).

[0257] According to a third example, the mask change step (step S100) can be executed before the step of determining another masked module (step S4) and after the step of determining multiplicative masks (step S2).

[0258] The method for determining a modular inverse described with reference to the figure 8 can be adapted to modular multiplicative masking with n shares, n being greater than or equal to 3.

[0259] The electronic device 2 can implement a method for generating an RSA CRT key comprising a method as described above. Typically, the electronic device 2 can implement a method for generating an RSA CRT key comprising a modular inverse determined by a method as described above, in particular with reference to a figure among the figures 3 , 6, 7 et 8 .

Claims

1. Method for determining a modular inverse of a number Q in the ring of integers modulo a given modulus P, the number and the given modulus being prime numbers, the given modulus being masked in the form of first parts of an initial masking, the method being implemented by an electronic device (2) and the method comprising the following steps: - determining (S2), preferably by random selection, a first multiplicative mask and a second multiplicative mask which are non-zero and coprime, - determining (S4, S104) another masked modulus by applying the first multiplicative mask to the given modulus P, - determining (S6, S106) a masked number equal to the product of the second multiplicative mask and of the number Q, - determining (S8) a multiplicative inverse of the other masked modulus then determining (S10) an intermediate inverse D resulting from a multiplication of the multiplicative inverse of the other masked modulus by the first multiplicative mask modulo the masked number, - determining (S12, S112) second parts of a modular additive masking of a dividend, the dividend having the value (-D · P + 1) mod N where N is a public modulus of value equal to P · Q, and the determination of each second part comprising determining a product of the intermediate inverse and of a distinct third part of a same preliminary masking of the given modulus, - calculating (S14) the exact division of the dividend by the number, the modular inverse being the result of the exact division, with the dividend, the modular inverse and the number being manipulated in masked form.

2. Method according to the preceding claim, wherein the initial masking is a masking from among an additive masking, a modular additive masking, a multiplicative masking and a modular multiplicative masking.

3. Method according to either one of the preceding claims, wherein the preliminary masking is an additive masking.

4. Method according to any one of the preceding claims, wherein the third parts are the first parts.

5. Method according to any one of the preceding claims, wherein the determination of one and only one second part of the masked dividend further comprises increasing the determined product modulo the public modulus by 1.

6. Method according to any one of the preceding claims, wherein the exact division comprises replacing (SS2) the modular additive masking of the dividend with an additive masking.

7. Method according to any one of the preceding claims, wherein the calculation of the exact division manipulates the masked number and the second multiplicative mask, the second multiplicative mask being odd.

8. Method according to any one of the preceding claims, further comprising calculating the public modulus from the given modulus and the number.

9. Method for generating an RSA CRT key, comprising a method according to one of the preceding claims.

10. Computer program comprising instructions which are able to be executed by a processor and are designed to implement a method according to any one of the preceding claims when these instructions are executed by the processor.

11. Electronic device for determining a modular inverse of a number Q in the ring of integers modulo a given modulus P, the number and the given modulus being prime numbers, the given modulus being masked in the form of first parts of an initial masking, and the electronic device comprising: - a block for determining multiplicative masks, configured to determine, preferably by random selection, a first multiplicative mask and a second multiplicative mask which are non-zero and coprime, - a block for determining another masked modulus, configured to determine another masked modulus by applying the first multiplicative mask to the given modulus P, - a block for determining a masked number, configured to determine a masked number equal to the product of the second multiplicative mask and of the number Q, - an inversion block configured to determine a multiplicative inverse of the other masked modulus then determine an intermediate inverse D resulting from a multiplication of the multiplicative inverse of the other masked modulus by the first multiplicative mask modulo the masked number, - a block for determining a dividend, configured to determine second parts of a modular additive masking of a dividend, the dividend having the value (-D · P + 1) mod N where N is a public modulus of value equal to P · Q, and the determination of each second part comprising determining a product of the intermediate inverse and of a distinct third part of a same preliminary masking of the given modulus, - an exact division block configured to calculate the exact division of the dividend by the number, the modular inverse being the result of the exact division, with the dividend, the modular inverse and the number being manipulated in masked form.