Method for determining a modular inverse, electronic device and associated computer programs.

Abstract

Method for determining a modular inverse of a number Q modulo a module P, Q and P being prime numbers, P being masked into first parts, the method comprising the determinations of: - (S2) a first and a second non-zero and coprime multiplicative masks, - (S4) another module masked by applying the first multiplicative mask to the module, - (S6) a masked number equal to the product of the second multiplicative mask and the number, - (S10) an intermediate inverse D resulting from a multiplication of a multiplicative inverse of the other masked module by the first multiplicative mask modulo the masked number, - (S12) each second part of a masking of a dividend having a value with N equal to , with the multiplication of D and a third distinct part of the same masking of the module, - (S14) the exact division of the dividend by Q, in masked form. Figure for the abstract: fig. 3.

Description

Title of the invention: Method for determining a modular inverse, electronic device and associated computer programs.

[0001] The present invention relates generally to the field of cryptographic processing using modular arithmetic.

[0002] It relates more particularly to a modular inverse determination method, an RSA CRT key generation method, as well as an associated computer program and cryptographic processing device.

[0003] Some cryptographic algorithms, particularly asymmetric cryptography such as the RSA (Rivest-Shamir-Adleman) algorithm, use the principles of modular arithmetic. The generation of cryptographic keys, containing public and private elements, is necessary prior to the encryption or signing of messages. The confidentiality of the private elements must be preserved.

[0004] The RSA CRT algorithm (for "Chinese Remainder Theorem" in Anglo-Saxon terminology) is a variant of RSA algorithms that uses the Chinese Remainder Theorem to speed up calculations.

[0005] In RSA CRT, private elements include: - a prime number P, - another prime number Q, - a first decryption exponent equal to a secret exponent modulo the other prime number minus one, - a second decryption exponent equal to the secret exponent modulo the prime number minus one, - a modular inverse C of the other prime number modulo the prime number: C - Q1 mod P-

[0006] Observing a processor implementing a key generation process can allow the detection of information on the data successively manipulated and, after observing one or more implementations of the process, the deduction of information on the value processed.

[0007] The generation of the modular inverse C must therefore be protected against such attacks, generally called side-channel attacks.

[0008] Unfortunately, existing solutions do not allow satisfactory protection of the generation of the modular inverse.

[0009] To remedy these drawbacks, the present invention proposes, according to a first aspect, a method for determining a modular inverse of a number Q in the ring of integers modulo a given modulus P, the number and the given modulus being prime numbers, the given modulus being masked in the form of first parts of an initial masking, the process being implemented by an electronic device and the process comprising the following steps: - Determination, preferably by random selection, of a first multiplicative mask and a second multiplicative mask that are not numed and are relatively prime, - Determination of another masked module by applying the first multiplicative mask to the given module P, - Determining a masked number equal to the product of the second multiplicative mask and the number Q, - Determination of a multiplicative inverse of the other masked modulus, then determination of an intermediate inverse D resulting from a multiplication of the multiplicative inverse of the other masked modulus by the first multiplicative mask modulo the masked number, - Determination of second parts of a modular additive masking of a dividend, the dividend having value (-D - P + 1) mod N with N a public modulus of value equal to P • Q, and the determination of each second part comprising the determination of a product of the intermediate inverse and a separate third part of the same preliminary masking of the given modulus, - Calculation of the exact division of the dividend by the number, the modular inverse being the result of the exact division, the dividend, the modular inverse and the number being manipulated in masked form.

[0010] Other advantageous and non-limiting features of the process according to the invention, taken individually or in all technically possible combinations, are as follows: - the initial masking is a masking by an additive masking, a modular additive masking, a multiplicative masking and a modular multiplicative masking; - preliminary masking is additive masking; - the third parts are the first parts; - the process further includes a mask change step during which the third parts of the preliminary masking of the given module are determined from the first parts of the initial masking of said given module or from the other masked module and the first multiplicative mask; - the determination of one and only one second part of the hidden dividend also includes an increase of 1 in the product determined modulo the public module; - the exact division includes replacing the modular additive masking of the dividend with additive masking; - The exact division calculation manipulates the masked number and the second mask multiplicative, the second multiplicative mask being odd; - the process further includes calculating the public module from the given module and the number.

[0011] According to a second aspect, the invention proposes a method for generating an RSA CRT key comprising a method as defined above.

[0012] According to a third aspect, the invention proposes a computer program comprising instructions executable by a processor and adapted to implement a process as defined above, when these instructions are executed by the processor.

[0013] This program may use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0014] At least part of the methods according to the invention can be implemented by computer. Consequently, the present invention can take the form of an entirely hardware embodiment or an embodiment combining software aspects (including firmware, resident software, microcode, etc.) and hardware, which can all be collectively referred to herein as a "block".

[0015] According to a fourth aspect, the invention proposes an electronic device for determining a modular inverse of a number Q in the ring of integers modulo a given modulus P, the number and the given modulus being prime numbers, the given modulus being masked in the form of first parts of an initial masking, and the electronic device comprising: - a multiplicative mask determination block configured to determine, preferably by random sampling, a first multiplicative mask and a second multiplicative mask that are not numb and are relatively prime, - a block for determining another masked module configured to determine another masked module by applying the first multiplicative mask to the given module P, - a block for determining a hidden number configured to determine a hidden number equal to the product of the second multiplicative mask and the number Q, - an inversion block configured to determine a multiplicative inverse of the other masked module and then determine an intermediate inverse D resulting from a multiplication of the multiplicative inverse of the other masked module by the first multiplicative mask modulo the masked number, - a dividend determination block configured to determine second parts of a modular additive masking of a dividend, the dividend having a value of (-D • P + 1) mod N with N a public modulus of value equal to P • Q, and the determination of each second part comprising the determination of a product of the intermediate inverse and a third part distinct from the same preliminary masking of the given modulus, - an exact division block configured to calculate the exact division of the dividend by the number, the modular inverse being the result of the exact division, the dividend, the modular inverse and the number being manipulated in masked form.

[0016] This electronic device can be configured to implement each of the embodiment possibilities envisaged for the processes as defined above.

[0017] Of course, the different features, variants and embodiments of the invention can be combined with each other in various ways insofar as they are not incompatible or mutually exclusive.

[0018] Other features and advantages of the present invention will become apparent from the description given below, with reference to the attached figures which illustrate examples of embodiment without any limiting character.

[0019] In the figures:

[0020] [Fig. 1] schematically represents a preferred embodiment of a device electronic according to the invention;

[0021] [Fig.2] illustrates in the form of a flowchart the main steps of a comparison secured according to an implementation method, for the implementation of the invention;

[0022] [Fig.3] illustrates in the form of a flowchart the main steps of a de termination of a modular inverse according to a first embodiment of the invention;

[0023] [Fig.4] illustrates in flowchart form the main sub-steps of a step of calculation of exact division in masked form according to a first embodiment for the implementation of a method for determining a modular inverse according to the invention;

[0024] [Fig.5] illustrates in flowchart form the main substeps of a step of calculation of exact division in masked form according to a second embodiment for the implementation of a method for determining a modular inverse according to the invention;

[0025] [Fig.6] illustrates in the form of a flowchart the main steps of a de- termination of a modular inverse according to a second embodiment of the invention;

[0026] [Fig.7] illustrates in the form of a flowchart the main steps of a de termination of a modular inverse according to a third embodiment of the invention;

[0027] [Fig.8] illustrates in the form of a flowchart the main steps of a de- termination of a modular inverse according to a fourth embodiment of the invention.

[0028] Unless otherwise indicated, common or similar elements in several figures bear the same reference signs and have identical or similar characteristics, so that these common elements are generally not described again for the sake of simplicity.

[0029] In the context of this description, the qualifiers "first", "second", "third", "fourth", "fifth", "sixth" are only indicative to distinguish the elements they qualify, but do not imply any order between them.

[0030] Fig. 1 schematically represents an electronic device 2 comprising a processor 4 (for example a microprocessor), a storage unit 6, a random access memory 8 and a communication unit 10.

[0031] The RAM 8 and the storage entity 6 are each linked to the processor 4 so that the processor 4 can read or write data in the storage entity 6 and / or the RAM 8.

[0032] The memory entity 6 stores computer program instructions, some of which are designed to implement a process as described with reference to one of Figures 2 to 8, when these instructions are executed by the processor 4.

[0033] The storage entity 6 is for example a hard disk or a non-volatile memory, possibly rewritable, for example of type EEPROM (for "Electrically Erasable and Programmable Read-Only Memory" according to the commonly used Anglo-Saxon term).

[0034] The RAM 8 can store at least some of the elements (in particular a first multiplicative mask, a second multiplicative mask, first parts of an initial masking, another masked module, a masked number, a multiplicative inverse, an intermediate inverse, third parts of a preliminary masking, second parts of a modular additive masking of a dividend, and a modular inverse as described with reference to at least one figure among Figures 2 to 8) manipulated during the various processing carried out during one of the processes described below.

[0035] In the following description, memory refers to any one of the storage entity 6 and the random access memory 8.

[0036] The electronic device 2 also comprises several blocks (not shown).

[0037] Typically, the electronic device 2 includes a block for determining multiplicative masks, a block for determining another masked module, a block for determining a masked number, an inversion block, a block for determining a dividend and an exact division block.

[0038] The electronic device 2 may further include a block for determining a public module and / or a masking change block and / or a key generation block.

[0039] These blocks can in practice be made by a combination of hardware and software elements.

[0040] Each block has a functionality described in one of the methods according to the invention and described below with reference to figures 2 to 8. Thus, for each block, the electronic device 2 stores, for example, software instructions executable by the processor 4 of the electronic device 2 in order to use a hardware element (for example, a communication entity or a memory) and thus implement the functionality offered by the block.

[0041] According to one possible embodiment, the computer program instructions stored in the storage entity 6 were, for example, received (typically from a remote computer) during an operating phase of the electronic device 2 prior to the processes described with reference to Figures 2 to 8.

[0042] The communication entity 10 is connected to the processor 4 in such a way as to allow the processor 4 to receive data from another electronic device (not shown) and / or to transmit data to another electronic device (not shown). In some embodiments, the processor 4 can thus receive data L from the other electronic device, for example, computer program instructions and / or input data, and / or transmit output data. Input data is, for example, a message that the electronic device 2 must sign using an RSA CRT key comprising a modular inverse generated by a process as described with reference to Figures 2 to 8. Output data is, for example, the result of said signature.

[0043] The electronic device 2 can take many forms (not shown).

[0044] According to a first example, the electronic device is a smart card, such as an identity card, a bank card or a universal integrated circuit card (also known as a UICC card for "Universal Integrated Circuit Card" in Anglo-Saxon terminology).

[0045] In this case, the communication entity 10 comprises, for example, contacts flush with one side of the smart card. Alternatively, the communication entity 10 could be implemented as a contactless communication block. Generally, the communication entity 10 can be a wired or wireless communication block with another electronic entity.

[0046] According to a second example, the electronic device is a secure element, such as a secure microcontroller, which is integrated into another electronic device, typically a communication terminal or a car.

[0047] According to other examples, the electronic device is a USB key, a phone mobile, a personal computer, a server or an identity document, such as an electronic passport.

[0048] As will be seen later, the electronic device 2 is configured to determine a modular inverse of a number Q in the ring of integers modulo a given modulo P, the number and the given modulus being prime numbers, and the given modulus being masked in the form of first parts of an initial masking. The electronic device 2 can further be configured to generate an RSA CRT key comprising the modular inverse thus determined.

[0049] According to a first example, a quantity A is additively masked over the integers with n parts if it is given in the form of n quantities Ai, ..., An such that the following equation is satisfied on the integers: A{ + ■ ■ ■ + An = A . In this example, the quantity A is said to be masked in the form of n parts Ai, ..., An of an additive masking.

[0050] According to a second example, a quantity A is additively masked modulo a quantity B with n parts if it is given in the form of n quantities Ai, ..., An such that the following equation is satisfied: Ax + ■ ■ ■ + An = A mod B. In this example, the quantity A is said to be masked in the form of n parts Ai, ..., An of a modular additive masking of modulo B.

[0051] According to a third example, a quantity A is multiplicatively masked over 2-part integers if it is given in the form of 2 quantities AbA2 such that the following equation is satisfied: A ■ A2 = A]. In this example, the quantity A is said to be masked in the form of 2 parts AbA2 of a multiplicative masking.

[0052] According to a fourth example, a quantity A is multiplicatively masked modulo a quantity B with 2 parts if it is given in the form of 2 quantities AbA2 such that the following equation is satisfied: A • A2 = Aj mod B. In this case, the inverse of the quantity A2 modulo the quantity B is well-defined. In this example, the quantity A is said to be masked in the form of 2 parts AbA2 of a modular multiplicative masking of modulo B.

[0053] Multiplicative masking with n shares and modular multiplicative masking with n shares, n being greater than or equal to 3, are other possible examples but are not preferred in the context of an RSA CRT algorithm.

[0054] The initial masking can be a masking by an additive masking, a modular additive masking, a multiplicative masking and a modular multiplicative masking.

[0055] In the embodiments of the invention described below with reference to Figures 3 to 8, the sum of n parts Ab ... ,An of a modular additive masking of a quantity A can be safely compared with another quantity B.

[0056] Figure 2 illustrates in flowchart form the main steps of a secure comparison according to an implementation method for the implementation of the invention. More specifically, [Fig.2] illustrates the main steps of a secure comparison of a sum of n parts Ab ... ,An of a modular additive masking of a quantity A and another quantity B.

[0057] The size of the quantity A is a bits.

[0058] The secure comparison is implemented here by the electronic device 2 due to the execution of the computer program instructions stored in the storage entity 6 as indicated above.

[0059] According to a random number generation step (step E2), the processor 4 determines a random number F by random sampling, that is, by truly random sampling or by pseudo-random sampling, within a closed interval having a lower bound of 0 and an upper bound of 2a+0 - 1, where o is a safety integer. The safety integer preferably has a non-zero value, for example 80.

[0060] The secure comparison then includes a step of calculating a first intermediate data (step E4), during which the processor 4 calculates a first intermediate data Gi as follows: Gf = Ai + F.

[0061] The secure comparison then includes an index initialization step (step E6), during which the processor 4 initializes an integer i to the value 2.

[0062] The secure comparison then includes a step of updating the first intermediate data (step E8), during which the processor 4 updates the first intermediate Gi as follows: Gj = Gj + Ab

[0063] The processor 4 then determines, at a test step (step E10), whether the integer ia reaches the value n.

[0064] In the negative, the integer i is incremented by 1 in an increment step (step E12) and the processor 4 loops to the first intermediate data update step (step E8).

[0065] Thus the implementation of the secure comparison implements n -1 iterations of the step of updating the first intermediate data (step E8).

[0066] In the affirmative at the test step (step E10), the processor 4 calculates, at a calculation step of a second intermediate data (step E14), a second intermediate data G2 as follows: G2 = B + F.

[0067] The secure comparison then includes another test step (step El6), during which the processor 4 determines whether the first intermediate data point is strictly less than the second intermediate data point. During this other test step, the processor 4 can directly compare the first intermediate data point to the second intermediate data point.

[0068] If the first intermediate data point is strictly less than the second intermediate data point, this indicates that the result of the sum of the n parts Ai, ..., An of the modular additive masking of the quantity A is strictly less than the other quantity B.

[0069] After the last iteration of the first intermediate data update step (step E8), the first intermediate data has the value F + / . A, = F + A' "1=1 1

[0070] During the other test step, determining whether the first intermediate data point is strictly less than the second intermediate data point is therefore equivalent to determining whether F + A is strictly less than F + B, that is, determining whether A is strictly less than B. However, the quantity A is not manipulated as such during this step and the other steps of the secure comparison, which preserves the confidentiality of the quantity A. The random number F ensures the confidentiality of the quantity A.

[0071] A person skilled in the art will understand that the steps of the secure comparison can be executed in other orders insofar as each step has the elements necessary for its execution.

[0072] For example, the step of calculating a second intermediate data (step E14) can be executed before the step of calculating a first intermediate data (step E4) or before the step of initializing an index (step E6) or before the step of updating the first intermediate data (step E8), but after the step of determining a random number (step E2).

[0073] The safe comparison described with reference to [Fig. 2] executes the loop iterations with an index that increments at each iteration. Those skilled in the art will understand that the loop index can be managed differently as long as all the values ​​of the index are traversed by executing the loop iterations.

[0074] Typically, the method can be adapted to perform the n - 1 iterations of the first intermediate data update step (step E8) in a different order, each iteration using a different value of the integer, between 2 and n. For example, the person skilled in the art can initialize the integer with the value n in the index initialization step (step E6), replace the increment step (step E12) with a decrement step that decrements the integer i by 1, and determine in the test step (step E10) whether the integer ia reaches the value 2.

[0075] The person skilled in the art will also understand that the implementation of the step of calculating a first intermediate data (step E4), and the implementations of the step of updating the first intermediate data (step E8), can be managed differently to obtain the final value of the first intermediate data, by summing each part of the modular additive masking of the quantity A and the random F, the random F being added to the current value of the first intermediate data before all parts of the modular additive masking are.

[0076] Figure 3 illustrates in the form of a flowchart the main steps of a method for determining a modular inverse according to a first embodiment of the invention.

[0077] The method of [Fig. 3] aims to determine a modular inverse of a number Q in the ring of integers modulo a given modulus P, the number and the given modulus being prime numbers, and the given modulus being masked in the form of the first n parts of an initial masking with n an integer strictly greater than one. The initial masking is here an additive masking.

[0078] The process of [Fig.3] is implemented here by the electronic device 2 due to the execution of the computer program instructions stored in the storage entity 6 as indicated above.

[0079] The size of the given modulus P is p bits and the size of the number Q is q bits. For example, pa has a value of 1024 and qa also has a value of 1024. Note, however, that p can have a value different from that of q.

[0080] According to a step of determining multiplicative masks (step S2), the processor 4 determines a first multiplicative mask R and a second multiplicative mask S that are not harmed and are coprime.

[0081] The first multiplicative mask R has a size r, respectively the second multiplicative mask S has a size s, which is preferably at least the size of a word.

[0082] The word is also called a machine word. The word is a basic unit manipulated by the processor 4. The size of a word is, for example, 8 bits, 16 bits, 32 bits, 64 bits or 128 bits.

[0083] The size r of the first multiplicative mask R, respectively the size s of the second multiplicative mask S, is for example 80 bits.

[0084] The size r of the first multiplicative mask R may be different from the size s of the second multiplicative mask S.

[0085] Preferably, the size r of the first multiplicative mask R and the size s of the second multiplicative mask S are identical.

[0086] The determination of the first multiplicative mask R and the second multiplicative mask S is preferably by random draw, that is to say by truly random draw or by pseudo-random draw.

[0087] Typically, processor 4 draws a first random number uniformly within a closed interval having a lower bound of 1 and an upper bound of 2S-1, the second multiplicative mask being the first random number. Then processor 4 draws a second random number uniformly within a closed interval having a lower bound of 1 and an upper bound of 2r-1 and repeats this operation until the greatest common divisor of the first and second random numbers is equal to 1. The first multiplicative mask is the second random number when the greatest common divisor The common factor of the first and second hazards is equal to 1.

[0088] According to one implementation variant, the second multiplicative mask may have been stored in a memory of the electronic device 2 during an operating phase of the electronic device 2 prior to the process described herein. The determination of the second multiplicative mask S is then by reading from a memory of the electronic device 2. To determine the first multiplicative mask, the processor 4 can draw a random number uniformly within the closed interval having a lower bound of 1 and an upper bound of 2r-1, and repeat this operation until the greatest common divisor of the second multiplicative mask and the second random number is equal to 1. The first multiplicative mask is the second random number when the greatest common divisor of the second multiplicative mask and the second random number is equal to 1.

[0089] The process then includes a step of determining another masked module (step S4), during which the processor 4 determines another masked module P(R) by applying the first multiplicative mask R to the given module P.

[0090] Typically, processor 4 calculates the other hidden modulus P(R) as follows: P <R) — ( P • R ) avec 'CS Premières parties.

[0091] According to a step of determining a masked number (step S6), the processor 4 determines a masked number Q(S) equal to the product of the second multiplicative mask S and the number Q.

[0092] The masked number can be determined by reading a memory of the electronic device tronic 2, for example if the masked number has been previously determined and then stored in the storage entity 6. This implementation can be advantageous if the second multiplicative mask has also been recorded in a memory of the electronic device 2 during an operating phase of said electronic device 2, prior to the process described here.

[0093] The hidden number can be determined by calculation, for example if the number Q is masked in the form of fourth parts of another initial masking, the fourths parts having been previously determined and then stored in the memo entity risation 6. The other initial masking can be a masking by means of an additive masking, modular additive masking, multiplicative masking, and multi-masking modular folding.

[0094] Typically, when the other initial masking is an additive masking with m shares, the Processor 4 calculates the hidden number Q(S) as follows: Qts^Ç / QjS) with Qj the fourth parts.

[0095] Preferably, the other initial masking is an additive masking with n shares, that is, m is equal to n.

[0096]

[0097]

[0098]

[0099]

[0100]

[0101] The process then includes a step of determining a multiplicative inverse (step S8) during which the processor 4 determines a multiplicative inverse P(R) 1 of the other masked module, typically by calculation from the other masked module P(R). The process continues with a step of determining an intermediate inverse (step S10) during which processor 4 determines an intermediate inverse D resulting from a multiplication of the multiplicative inverse of the other masked modulo by the first multiplicative mask modulo the masked number. Typically, processor 4 calculates the intermediate inverse as follows: p = (P(R)) ' R mod Q^- The process then includes a step of determining second parts of a modular additive masking of a dividend (step S12), during which the processor 4 determines second parts of a modular additive masking of a dividend, the dividend having value (-D • P + 1) mod N with N a public modulus of value equal to P • Q, and the determination of each second part comprising the determination of a product of the intermediate inverse and a separate third part of the same preliminary masking of the given modulus. Typically, for any i from 1 to n, processor 4 computes a second part T; of a modular additive masking of a dividend T as follows: T; = - D • Pj + Hj mod N such that y11 pj mod N — 1 ' ^ans this example, the ^=1 i Third parts are the first parts. In other words, the preliminary masking is the initial masking. The determination of each second part T; therefore includes the determination of a product D • Pj of the intermediate inverse D and a distinct third part P; of the same preliminary masking of the given modulus P, that is, the preliminary masking of the given modulus P. The modular additive masking of the dividend is here a modular additive masking of modulus N. Preferably, for one and only one value of i, H; is 1 and for other values ​​of i, H; is zero. In this case, the determination of one and only one second part of the hidden dividend further includes an increase of 1 in the product determined modulo the public modulo. The process is therefore more efficient because it limits the operations necessary to determine the dividend.

[0102] The public module N may have been recorded in a memory of the electronic device 2 during an operating phase of the electronic device 2 prior to the process described here.

[0103] If the public module N is not available, the method can calculate the public module from the given module and the number.

[0104] According to a first example, processor 4 calculates the public modulus N as follows: 2 — Y111 ( p.. Q ) then N = Z / S with Z an intermediate result. Summing of products Pj • Q(s), i ranging from 1 to n, allows preserving the confidentiality of the given module P.

[0105] According to a second example, if the number Q is masked in the form of m fourth parts of an additive masking, the fourth parts having been previously determined and then stored in the storage entity 6, the processor 4 calculates the public modulus N as follows: p. Q jj • Sommer n ' m products Pi • Qj, i ranging from 1 to n and j ranging from 1 to m, allows the confidentiality of the given module P and the number Q to be preserved.

[0106] The method then includes a step of calculating the exact division of the dividend by the number (step S14) during which the processor 4 calculates the exact division of the dividend by the number, the modular inverse being the result of the exact division, the dividend, the modular inverse and the number being manipulated in masked form.

[0107] A person skilled in the art will understand that the steps of the process for determining a modular inverse described with reference to [Fig.3] can be carried out in other orders insofar as each step has the elements necessary for its execution.

[0108] According to an example, the step of determining a masked number (step S6) can be executed before the step of determining another masked module (step S4) and after the step of determining multiplicative masks (step S2).

[0109] According to another example, the step of determining a multiplicative inverse (step S8) can be executed before the step of determining a masked number (step S6) and after the step of determining another masked modulus (step S4).

[0110] Fig. 4 illustrates in the form of a logic diagram the main sub-steps of the step of calculating the exact division of the dividend by the number (step S14) according to a first embodiment.

[0111] In this first embodiment of the exact division calculation step, - the hidden number Q(S) is the hidden form of the number manipulated to perform the exact division; and - the modular inverse is manipulated in the form of n fifth parts Ci, ... ,Cn of an additive masking.

[0112] According to a substep of mask change (substep SS2), the processor 4 replaces the modular additive masking of modulo N of the dividend with an additive masking.

[0113] During this substep, the processor 4 replaces the n second parts of the Tb ... ,Tn modular additive masking of modulo N of the dividend by n sixth parts Eb ... ,En of an additive masking on the integers, of said dividend.

[0114] Typically, processor 4 draws n-1 third randoms E2, ... , In uniformly in a closed interval having a lower bound of 0 and an upper bound of 2^1 - 1, then processor 4 initializes a data Ei as follows: Ej = T(. Then, for each i from 2 to n, processor 4 updates the data Ei as follows: Ej = E j - Ej. Then, for each i from 2 to n, processor 4 updates the data Ei as follows: Ej = Es + Tj. Finally, for each i from 2 to n, if T j + ■ ■ ■ + Tn is a value strictly less than ( i - 1 ) • N, processor 4 updates the data Ei as follows: Ej = E1 - N.

[0115] The processor therefore obtains n sixth parts EH ... ,En from the n third parts TH ... ,Tn.

[0116] Subtracting at least one third random Ej from the data Ei before adding to the data El the n -1 third parts T2, ... ,Tn, allows the confidentiality of the dividend to be preserved.

[0117] The comparisons of Tj + ■ ■ ■ + Tn and ( i - 1 ) • N are made in a safe manner, for example according to the embodiment described above with reference to [Fig.2].

[0118] The exact division calculation step then includes a dividend randomization substep (substep SS4), during which processor 4 randomizes each sixth part of the masked dividend by applying the second multiplicative mask to the sixth part concerned. Typically, for any i from 1 to n, processor 4 performs a calculation as follows: Ej = E, • S.

[0119] Each sixth part E; can be decomposed into one or more word(s) E;[j] of rank j, j representing the weight of the word concerned and E;[0] being the word with the lowest weight of the sixth part E;.

[0120] Similarly, - the hidden number Q(S) can be decomposed into one or more word(s) Q(S)[j] of rank j, j representing the weight of the word in question and Q(S)[0] being the word with the lowest weight of the hidden number Q(S); and - for any i from 1 to n, the fifth part C; of the modular inverse can be decomposed into one or more word(s) C;[j] of rank j, j representing the weight of the word concerned and C;[0] being the word with the lowest weight of the fifth part C;.

[0121] Each fifth part Q of the modular inverse is decomposed into w words, w having the value defined as follows: w = (p + k - l) > b with k = 2b, k being the word size manipulated by the processor 4. As already described, the size k of a word is, for example, 8 bits, 16 bits, 32 bits, 64 bits, or 128 bits. For example, if k is 8, b is 3.

[0122] In this disclosure, the notation A > a denotes the largest integer less than or equal to A / 2a-

[0123] The exact division calculation step then includes a substep of calculating the inverse of the opposite of the least significant word of the masked number Q(S) (substep SS6) during which processor 4 calculates an inverse U modulo M, a power of 2, of the opposite of the least significant word of the masked number Q(S). Processor 4 thus obtains the inverse U whose value is defined as follows: U - ( - mod M' Typically, M has a value of 2k, where k is the word size.

[0124]

[0125]

[0126] manipulated by processor 4. Calculating an inverse modulo a power of 2 can be done using techniques known to a person skilled in the art, for example using the technique described at the end of section 4 of the document "Tudor Jebelean: An Algorithm for Exact Division. J. Symb. Comput. 15(2): 169-180 (1993)". The exact division calculation step then includes a sub-step of initializing a first index (sub-step SS8) during which the processor 4 initializes an integer j to the value 0. The exact division calculation step then includes a substep of initializing a second index (substep SS 10) during which processor 4 initializes an integer i to the value 1.

[0127] The exact division calculation step then includes a substep for calculating a fifth-part word (substep SS 12), during which the processor 4 calculates the j-th word of the fifth part C; of the modular inverse as follows: çj j] = EjO] - U mod 2k- As already described, k is the word size manipulated by processor 4.

[0128] The exact division calculation step then includes a substep for updating a sixth part (substep SS 14) during which processor 4 updates the sixth part E; as follows: g, _ (e- _ Q . • C [ j] ) > k-

[0129] Processor 4 then determines, in a first test substep (step SS 16), whether the integer ia reaches the value n.

[0130] In the negative, the integer i is incremented by 1 in a first increment substep (substep SS20) and the process loops to the substep of calculating a fifth part word (substep SS12).

[0131] If the affirmative at the first test substep (substep SS16), the processor then determines, at a second test substep (substep SS 18) whether the integer ja reaches the value w - 1.

[0132] If negative in the second test substep, the integer j is incremented by 1 in a second increment substep (substep SS22) and the process loops back to the initialization substep of a second index (substep SS10) to perform a next iteration.

[0133] Thus, the process implements n'w substeps of calculating a fifth-part word (substep SS 12) and n'w substeps of updating a sixth part (substep SS 14).

[0134] If the second test substep (substep SS18) is successful, the step of calculating the exact division of the dividend by the number (step S14) ends.

[0135] In this first embodiment of the exact division calculation step, the masked number Q(S) is the masked form of the number that is manipulated to perform the exact division. The calculation of the exact division thus manipulates the masked number Q(S) and the second multiplicative mask S. The process is therefore more efficient because it limits the operations necessary to calculate the exact division.

[0136] For this first embodiment of the exact division calculation step, the second multiplicative mask must be odd. The second odd multiplicative mask helps to secure the process against side-channel attacks.

[0137] A person skilled in the art will understand that the sub-steps of the exact division calculation step can be executed in other orders insofar as each sub-step has the elements necessary for its execution.

[0138] According to an example, the substep of calculating the inverse of the opposite of the lowest weight word of the masked number Q(S) (substep SS6) can be executed before the substep of randomizing the dividend (substep SS4) and / or the substep of changing the mask (substep SS2).

[0139] According to another example, the initialization substep of a first index (substep SS8) can be executed before the calculation substep of the inverse of the opposite of the lowest weight word of the masked number Q(S) (substep SS6) and / or the randomization substep of the dividend (substep SS4) and / or the mask change substep (substep SS2).

[0140] The embodiment of the exact division calculation step, described with reference to [Fig. 4], executes the iterations of each loop with an index that increments at each iteration. Those skilled in the art will understand that the index i can be handled differently as long as all the values ​​of index i are traversed by executing the iterations of the loop in question.

[0141] Typically, the exact division calculation step can be adapted to perform the n' w substeps of updating a sixth part (substep SS14) in a different order, each iteration using a different value of the integer pair i,j. For example, a person skilled in the art can initialize the integer i with the value n in the substep of initializing a second index (substep SS10), initialize the integer j with the value 0 in the substep of initializing a first index (substep SS8), replace the first increment substep (substep SS20) with a first decrement substep that decrements the integer i by 1, determine in the first test substep (substep SS16) if the integer ia reaches 1, and determine in the second test substep (substep SS18) if the integer ja reaches w- 1.

[0142] [Fig.5] illustrates in the form of a logic diagram the main sub-steps of the step of calculating the exact division of the dividend by the number (step S14) according to a second embodiment.

[0143] In this second embodiment of the exact division calculation step, - the number is manipulated in the form of a plurality of parts of an additive masking; - the modular inverse is manipulated in the form of n fifth parts Cb ... ,Cn of an additive masking.

[0144] More precisely, the second embodiment is described here as manipulating the m fourth parts. It should be noted, however, that the second embodiment could manipulate a plurality of parts of an additive masking of the number obtained from another masking, for example from the masked number Q(S) and the second multiplicative mask S. Such a mask change is described below for the mask change step (step SI 11) with reference to [Fig. 7].

[0145] The second embodiment of the exact division calculation step includes a sub-step of mask change identical to the sub-step of mask change (sub-step SS2), described above with reference to [Fig.4].

[0146] The exact division calculation step then includes a substep of randomizing the dividend and the number (substep SS 104), during which the processor 4 determines a fourth random number X by random draw, i.e. by truly random draw or by pseudo-random draw, then randomizes each sixth part of the masked dividend by applying the fourth random number to the sixth part concerned and each fourth part by applying the fourth random number to the fourth part concerned.

[0147] Typically, the processor 4 draws the fourth random number X uniformly within a closed interval having a lower bound of value 1 and an upper bound of value 2S-1, and for all i from 1 to n, the processor 4 performs a calculation as follows: Ej = E; • X. Furthermore, for all i from 1 to m, the processor performs a calculation as follows: Qj = Q; • X.

[0148] Processor 4 must draw a fourth odd random number X.

[0149] The fourth odd randomness makes it possible to secure this second mode of the second embodiment of the exact division calculation step against side-channel attacks.

[0150] Each sixth part E; can be decomposed into one or more word(s) E;[j] of rank j, j representing the weight of the word concerned and E;[0] being the word with the lowest weight of the fifth part E;.

[0151] Similarly, - the fourth part Q; can be decomposed into one or more word(s) Q;[j] of rank j, j representing the weight of the word concerned and Qi[0] being the word with the lowest weight of the fourth part Q;; and - for any i from 1 to n, the fifth part C; of the modular inverse can be decomposed into one or more word(s) C;[j] of rank j, j representing the weight of the word concerned and C;[0] being the word with the lowest weight of the fifth part C;.

[0152] Each fifth part C; of the modular inverse is decomposed into w words, w having the value defined as follows: w − (p + k − 1) > b with k = 2b, k being the word size manipulated by the processor 4. As already described, the size k of a word is, for example, 8 bits, 16 bits, 32 bits, 64 bits, or 128 bits. For example, if k is 8, b is 3.

[0153] The exact division calculation step then includes a substep for calculating the inverse of the opposite of a lowest-weight word (substep SS 106) during which processor 4 calculates an inverse U modulo M, a power of 2, of the opposite of the sum of the lowest-weight words of the randomized fourth parts. Processor 4 thus obtains the inverse U whose value is defined as follows: For value 2k, k is the size of word manipulated by processor 4.

[0154] As already described, the calculation of an inverse modulo a power of 2 can be done according to the techniques known to a person skilled in the art, for example according to the technique described at the end of section 4 of the document “Tudor Jebelean: An Algorithm for Exact Division. J. Symb. Comput. 15(2): 169-180 (1993)”.

[0155] The exact division calculation step then includes substeps of initializing a first index, initializing a second index, and calculating a fifth part word, respectively identical to the substeps of initializing a first index (substep SS8), initializing a second index (substep SS10) and calculating a fifth part word (substep SS12) described above with reference to [Fig.4].

[0156] The exact division calculation step then includes a substep of initializing a third index (substep SS113) during which the processor 4 initializes an integer v to the value 1.

[0157] The exact division calculation step then includes a substep of updating a sixth part (substep SS 114) during which the processor 4 updates the sixth part E; as follows: E; = Ej - Q • Cs [ j ].

[0158] Processor 4 then determines, in a third test substep (step SS115), whether the integer will reach the value m.

[0159] In the negative, the integer v is incremented by 1 in a third increment substep (substep SS116) and the process loops back to the update substep of a sixth part (substep SS114).

[0160] In the affirmative at the third test substep (substep SS115), the processor modifies a sixth part, at a sixth part modification substep (substep SS117), as follows: Ej = E; > k.

[0161] The exact division calculation step then includes a first test substep identical to the first test substep (substep SS 16) described above with reference to [Fig.4].

[0162] In the negative at the first test substep (substep SS 16), the integer i is incremented by 1 in a first increment substep identical to the first increment substep (substep SS20) described with reference to [Fig.4] and the process loops to the calculation substep of a fifth-part word (substep SS12).

[0163] If the affirmative at the first test substep (substep SS16), the processor then determines, at a second test substep identical to the second test substep (substep SS18) described with reference to Figure 4, whether the integer ja reaches the value w - 1.

[0164] If the second test substep fails, the integer j is incremented by 1 in a second increment substep identical to the second increment substep (substep SS22) described with reference to [Fig.4] and the process loops back to the initialization substep of a second index (substep SS10) to perform a next iteration.

[0165] Thus, the process implements n'w substeps of calculating a fifth part word (substep SS 12), n'w substeps of modifying a sixth part (substep SS 117), and n'w'm substeps of updating a sixth part (substep SS 114).

[0166] If the second test substep (substep SS18) is successful, the step of calculating the exact division of the dividend by the number (step S14) ends.

[0167] A person skilled in the art will understand that the sub-steps of the exact division calculation step can be executed in other orders insofar as each sub-step has the elements necessary for its execution.

[0168] According to one example, the initialization substep of a first index (substep SS8) can be executed before the calculation substep of the inverse of the opposite of a lowest weight word (substep SS106) and / or the randomization substep of the dividend and the number (substep SS104) and / or the mask change substep (substep SS2).

[0169] The embodiment of the exact division calculation step, described with reference to Figure 5 executes the iterations of each loop with an index that increments with each iteration. Those skilled in the art will understand that the index i and / or the index v can be handled differently as long as all the values ​​of the index in question are traversed by executing the iterations of the loop.

[0170] Typically, the exact division calculation step can be adapted to perform the n'w substeps of calculating a fifth-part word in a different order, each iteration using a different value of the integer pair i,j. For example, a person skilled in the art can initialize the integer i with the value n in the substep initializing a second index (substep SS10), initialize the integer j with the value 0 in the substep initializing a first index (substep SS8), replace the first increment substep (substep SS20) with a first decrement substep that decrements the integer i by 1, determine in the first test substep (substep SS16) whether the integer ia reaches 1, and determine in the second test substep (substep SS18) whether the integer ja reaches w - 1.

[0171] Furthermore, the exact division calculation step can be adapted to perform the n • w • m substeps of updating a sixth part (substep SS 114) in a different order, each iteration using a different value of the integer v for a given pair of integers i,j. For example, the person skilled in the art can initialize the integer v with the value m in the substep of initializing a third index (substep SS 113), replace the third substep of incrementing (substep SS 116) with a third substep of decrementing that decrements the integer v by 1, and determine in the third substep of testing (substep SS 115) whether the integer v reaches 1.

[0172] A masked implementation of an operation, or of an algorithm, producing a result equal to the application of said operation or of said algorithm to operands, is an implementation which manipulates said operands in masked form to produce the result also in masked form, without ever manipulating the operands or the result in unmasked form.

[0173] The invention makes it possible to calculate in masked form the modular inverse of the number Q in the ring of integers modulo the given modulus P, that is to say without manipulation of the number, the given modulus and the modular inverse, in unmasked form.

[0174] The invention makes it possible to replace a modular reduction operation of the number modulo the given modulo, said modular reduction operation being in a form masked by: - a modular reduction of a first datum modulo the public modulo, the first datum and the public modulo being manipulated in their unmasked form, and - a modular inversion of the other masked modulo modulo the masked number, the other masked modulo and the masked number being manipulated as such, that is, the other masked modulo and the masked number not being themselves masked to be manipulated, and - an exact division in masked form, that is to say manipulating the dividend, the divisor and its result in masked form.

[0175] Thus, the method described with reference to Figures 3 to 5 does not require the implementation in hidden form of modular reduction and modular inversion operations. Instead, the method allows the use of the implementation in hidden form of an exact division.

[0176] The invention performs the following calculation securely: [-[(P(R))'' ■ R mod (QJ • P + 1 mod n] / Q-

[0177] This calculation can also be noted as: [-[(P- R)4 • R mod (Q ■ S)] • P+ 1 mod N] / Q;

[0178] By definition of the modular inverse, there exists a such that: Q - [Q'1 mod P] = 1 + aP-

[0179] When the number Q is multiplied by the second multiplicative mask S, according to the definition of the modular inverse, there exists [3 such that: [ ( Q • S)4 mod P] • S= [Q*1 mod P] + [3 ■ P-

[0180] If we multiply this last equation by the number Q over the integers, there exists [3] such that: Q. [(QS) 4modP] SQ- [Q4modP]+(3-PQ-

[0181] We have seen that: Q. [Q'hnodP] = 1 + a ■ P- Therefore, we have: Q - [(QS)4modP] -S = 1+aP + pP Q-

[0182] Or we have Q . [ Q-! mod P ] = 1 + a • P. Therefore 1 + a ■ P is strictly greater than 0 and strictly less than PQ, that is to say strictly less than N.

[0183] Thus, when we reduce q q. $y> mo(j pj . g- 1 + a • P+ p • P - Q By N' we obtain: q (q . gy1 mo{] p] • s) mod N = 1 + a • P = Q • [ Q4 mod P],

[0184] When we express the inverse of Q • S modulo P by the inverse of P modulo Q • S, we have: Q.[ (Q ■ S)4 mod P] • S = P- Q • S- [P4 mod (Q- S) ] • P +1-

[0185] We therefore have: (PQS-[P1 mod (QS)] P+l) modN= Q - [Q4modP].

[0186] Or P ■ Q is the public module N, so we have the following equality: ( - [P1 mod (QS) ] P+ 1) mod N - Q- [Q4 mod P].

[0187] Finally, when we multiply the given modulus P by the first application mask R, we obtain: ( - [P"1 mod (Q- S) ] P +1) mod N= ( - [ ( (PR)4- R) mod (Q- S) ] • P+1) mod N

[0188] The following equality is therefore verified: (-[((PR)'-R) mod (Q • S) ] • P+1) modN = Q- [Q'modP].

[0189] The invention thus obtains the calculation of the modular inverse of a number Q in the ring of integers modulo a given modulo P by performing the following calculation: [-[(W' ■ R mod (Qj • P + 1 mod n] / Q-

[0190] Figure 6 illustrates in the form of a flowchart the main steps of a method for determining a modular inverse according to a second embodiment of the invention.

[0191] The method of [Fig.6] aims to determine the modular inverse of a number Q in the ring of integers modulo a given modulo P, the number and the given modulo being prime numbers, and the given modulo being masked in the form of n first parts Pb ... ,Pn of an initial masking with n an integer strictly greater than one.

[0192] The size of the given modulus P is p bits and the size of the number Q is q bits. For example, pa has a value of 1024 and qa also has a value of 1024. Note, however, that p can have a value different from that of q.

[0193] The initial masking is here a modular additive masking of modulo 2? with p' an integer greater than or equal to p.

[0194] The process of [Fig.6] is here implemented by the electronic device 2 due to the execution of the computer program instructions stored in the storage entity 6 as indicated above.

[0195] According to a mask change step (step S0), the processor 4 replaces the modular additive masking of module 2P of the given module with an additive masking on the integers.

[0196] Typically, processor 4 draws n-1 third random variables E'2, ..., E'n uniformly in a closed interval having a lower bound of 0 and an upper bound of 2P - 1, then processor 4 initializes another data item E'i as follows: E'j = Pb. Next, for each i from 2 to n, processor 4 updates the other data item E'i as follows: = E^ - E'j. Then, for each i from 2 to n, the Processor 4 updates the data E' i as follows: E\ = E\ + Pj. Finally, for each i from 2 to n, if Pj + Pn is a value strictly less than (i - 1) • 2P' The processor 4 updates the other data as follows: g1 _ g- _ 7P'. Then, for all i from 1 to n, the processor 4 updates a first part P; as follows: Pj = Ej.

[0197] Subtracting at least one other third random variable E'j from the other data E' before adding to the other data E' the first n-1 parts P2, ..., Pn, allows the confidence to be preserved. confidentiality of the given module.

[0198] The comparison of Pi + ■ ■ ■ + P« and Q _ । j . pP is done in a secure manner, for example according to the embodiment described above with reference to [Fig.2].

[0199] At the end of the mask change step (step S0), the first parts are the masked form of the given module according to an additive masking on the integers.

[0200] The method then comprises a step of determining multiplicative masks, a step of determining another masked module, a step of determining a masked number, a step of determining a multiplicative inverse, a step of determining an intermediate inverse, a step of determining second parts of a modular additive masking of a dividend and a step of calculating the exact division of the dividend by the number, respectively identical to the step of determining multiplicative masks (step S2), the step of determining another masked module (step S4), the step of determining a masked number (step S6), the step of determining a multiplicative inverse (step S8), the step of determining an intermediate inverse (step S10),to the step of determining second parts of a modular additive masking of a dividend (step S12) and to the step of calculating the exact division of the dividend by the number (step S14) described above with reference to [Fig.3]. ,

[0201] If the number Q is masked in the form of fourth parts of another initial masking, the process of [Fig.6] may further include another mask-changing step (not shown), during which the processor 4 replaces the other initial masking with an additive masking on the integers.

[0202] For example, if the other initial masking is a modular additive modulo masking with q' an integer greater than or equal to q, the process in Figure 6 may further include another mask-changing step (not shown), during which the processor 4 replaces the modular additive modulo masking 2q of the number with an additive masking on integers.

[0203] Typically, processor 4 draws m-1 fifth random numbers E”2, ..., E”m uniformly in a closed interval having a lower bound of 0 and an upper bound of 2q - 1, then processor 4 initializes a second other data point E”i as follows: E”i = Q. Next, for each i from 2 to m, processor 4 updates the second other data point E’i as follows: E’i = E’i - E”j. Then, for each i from 2 to m, processor 4 updates the data point E’i as follows: E’i = E’i + Q. Finally, for each i from 2 to m, if Q(i + Qm) is a value strictly less than (i - 1), processor 4 updates the second other data point as follows: E’i = E”j + Q. Then, for each i from 1 to m, if Q(i + Qm) is a value strictly less than (i - 1), processor 4 updates the second other data point as follows: E’i = E”j + Q. Then, for each i from 1 to m, the processor 4 updates a fourth part Q; as follows: Q.= E'^.

[0204] Subtracting at least one fifth random E”; from the second other data E”i before adding to the second other data E’ ’ i the ni - 1 fourth parts Q2, ... ,Qm, allows the confidentiality of the number to be preserved.

[0205] The comparison of Qj + • • • + Qm and 1) ■ 2q is in a secure manner, for example according to the embodiment described above with reference to [Fig.2].

[0206] At the end of the other mask change step, the fourth parts are the masked form of the number according to an additive masking on the integers.

[0207] The other mask change step is performed within the process before another step of said process needs the fourth parts of the number.

[0208] For example, the other mask change step is executed before the step of determining a masked number (step S6), and / or before the step of determining second parts of a modular additive masking of a dividend (step S12), and / or before the step of calculating the exact division of the dividend by the number (step S14).

[0209] Thus, the method described with reference to [Fig. 6] does not require the implementation of modular reduction and modular inversion operations in hidden form. Instead, the method allows the use of the implementation of exact division in hidden form.

[0210] A person skilled in the art will understand that the steps of the process for determining a modular inverse described with reference to [Fig.6] can be carried out in other orders insofar as each step has the elements necessary for its execution.

[0211] According to a first example, the step of determining a masked number (step S6) can be executed before the step of determining another masked module (step S4) and after the step of determining multiplicative masks (step S2).

[0212] According to a second example, the step of determining a multiplicative inverse (step S8) can be executed before the step of determining a masked number (step S6) and after the step of determining another masked modulus (step S4).

[0213] According to a third example, the mask change step (step S0) can be executed before the step of determining another masked module (step S4) and after the step of determining multiplicative masks (step S2).

[0214] Figure 7 illustrates in the form of a flowchart the main steps of a method for determining a modular inverse according to a third embodiment of the invention.

[0215] The method in [Fig. 7] also aims to determine the modular inverse of a number Q in the ring of integers modulo a given modulus P, the number and the given modulus being prime numbers, and the given modulus being masked in the form of n first parts Pb ... ,Pn of an initial masking with n an integer strictly greater than one.

[0216] The size of the given modulus P is p bits and the size of the number Q is q bits. For example, pa has a value of 1024 and qa also has a value of 1024. Note, however, that p can have a value different from that of q.

[0217] The initial masking here is a multiplicative masking on two-part integers. The integer therefore has a value of 2 here.

[0218] The process of [Fig.7] is implemented by the electronic device 2 due to the execution of the computer program instructions stored in the storage entity 6.

[0219] The process of [Fig.7] includes a step of determining multiplicative masks identical to the step of determining multiplicative masks (step S2) described with reference to [Fig.3].

[0220] The process then includes a step of determining another masked module (step S104), during which the processor 4 determines another masked module P(R) by applying the first multiplicative mask R to the given module P.

[0221] Typically, processor 4 calculates the other hidden modulus P(R) as follows: P <R,= (P,R) / P2avecPi et P2les premières parties.

[0222] According to a step of determining a masked number (step S106), the processor 4 determines a masked number Q(S) equal to the product of the second multiplicative mask S and the number Q.

[0223] The masked number can be determined by reading a memory of the electronic device 2, for example if the masked number has been previously determined and then stored in the storage entity 6. This implementation can be advantageous if the second multiplicative mask has also been recorded in a memory of the electronic device 2 during an operating phase of said electronic device 2 prior to the process described here.

[0224] The masked number can be determined by calculation, for example if the number Q is masked in the form of fourth parts of another initial masking, the fourth parts having previously determined and then stored in the storage entity 6. The other initial masking can be a masking pami an additive masking, a modular additive masking, a multiplication masking and a modular multiplicative masking.

[0225] Typically, when the other initial masking is a multiplicative masking with m shares, m having the value 2, the processor 4 calculates the masked number Q(S) as with Qi and Q2 the fourth parts.

[0226] The process then includes a step of determining a multiplicative inverse and a step of determining an intermediate inverse, respectively identical to the step of determining a multiplicative inverse (step S8) and to the step of determining an intermediate inverse (step S10) described with reference to [Fig.3].

[0227] The process then includes a mask change step (SI step 11), during which the processor 4 replaces a multiplicative masking of the given modulus with an additive masking on the integers.

[0228] During this mask change step (step S111), processor 4 determines third parts E'i, E'2 of a preliminary masking of the given module from the first parts of the initial masking of said given module or from the other masked module and the first multiplicative mask. The preliminary masking here is an additive masking on the integers.

[0229] For example, processor 4 draws a third random number as a third part E'2, uniformly within a closed interval having a lower bound of 0 and an upper bound of 2P - 1, and then processor 4 calculates the third part E'i as follows: - E'2 • R) / R-

[0230] According to another example, processor 4 draws a third random number as a third part E'2, uniformly within a closed interval having a lower bound of value 0 and an upper bound of value 2P-L, and then processor 4 calculates the third part E'i as follows: E'j = (Pj-E^ • P->) / P2-

[0231] The process then includes a step of determining second parts of a modular additive masking of a dividend (step SI 12), during which the processor 4 determines second parts of a modular additive masking of a dividend, the dividend having value (-D - P + 1) mod N with N a public modulus of value equal to P • Q, and the determination of each second part comprising the determination of a product of the intermediate inverse and a separate third part of the same preliminary masking of the given modulus, i.e. the preliminary masking of the given modulus.

[0232] Typically, for every i from 1 to n, processor 4 computes a second part T; of a modular additive masking of a dividend T as follows: Tj = - D • E j + Hj mod N such that ynh mod N = 1 ' The determination of each ^=1 < second part T; therefore includes the determination of a product D • And of the intermediate inverse D and of a third distinct part E'j of the same preliminary masking of the given modulus P, that is to say of the preliminary masking of the given modulus P.

[0233] Preferably, for one and only one value of i, H; is 1 and for other values ​​of i, H; is zero. In this case, the determination of one and only one second part of the hidden dividend further includes an increase of 1 in the product determined modulo the public modulo.

[0234]

[0235]

[0236]

[0237]

[0238]

[0239]

[0240]

[0241]

[0242] The process is therefore more efficient because it limits the operations necessary to determine the dividend. The public module N may have been recorded in a memory of the electronic device 2 during an operating phase of the electronic device 2 prior to the process described here. If the public module N is not available, the process can calculate the public module from the given module and the number. According to a first example, processor 4 calculates the public modulus N as follows: N = (PI'Q(S)) / (P2. . The calculation of Pj • Qf gj and P2 • S before performing the division, allows to preserve the confidentiality of the given module P and the number Q. According to a second example, processor 4 calculates the public modulus N as follows: z_ y2 / p, then N = Z / S with Z an intermediate result. Summing products E'j • Q(Sy i going from 1 to 2, allows the confidentiality of the given modulus P to be preserved. In addition, the division by the second multiplicative mask S is on the result of this sum, which allows the confidentiality of the number Q to be preserved. According to a third example, processor 4 calculates the public modulus N as follows: N= (P(r)'Q(^) / (R ■ S) • calculation of Pçr) ■ and RS before performing the division, allows to preserve the confidentiality of the given modulus P and the number Q. According to a fourth example, if the number Q is masked in the form of 2 fourth parts of a multiplicative masking, the fourth parts having previously been determined and then stored in the storage entity 6, the processor 4 calculates the public modulus N as follows: N = ( Pi • Qj ) / ( P2 * Q2 ) ' calculation of P, • Q{ and P2 • Q? before performing the division, allows to preserve the confidentiality of the given modulus P and the number Q. According to a fifth example, if the number Q is masked as two fourth parts of a multiplicative mask, processor 4 can compute the public modulus N as follows: _ J^2 ^E'- Q ) PUL Z / Q7 with Z an intermediate result. Summing products Ej ■ Qp i from 1 to 2 preserves the confidentiality of the given modulus P. Furthermore, division by the fourth part Q2 affects the result of this summation, thus preserving the confidentiality of the number Q. According to a sixth example, if the number Q is masked in the form of 2 fourth parts of a multiplicative masking, processor 4 can calculate the public modulus N as follows: N = ( P(R) • Qx ) / ( R • Q2 ) • The calculation of P(r) ■ Q} and R • Q9 before performing the division, allows the confidentiality of the given modulus P and the number Q to be preserved.

[0243] The process then includes a step of calculating the exact division of the dividend by the number identical to the step of calculating the exact division of the dividend by the number (step S14) described with reference to [Fig.3].

[0244] It should be noted that if the step of calculating the exact division of the dividend by the number is according to the second embodiment described with reference to [Fig. 5], the process of [Fig. 7] may include an additional step (not shown) during which the processor 4 replaces a multiplicative masking of the number with an additive masking. This step may be carried out similarly to what has been described for the mask-changing step (step SI 11).

[0245] Thus, the process described with reference to [Fig. 7] does not require the implementation in masked form of the modular reduction and modular inversion operations. Instead, the process allows the use of the masked implementation of an exact division.

[0246] A person skilled in the art will understand that the steps of the process for determining a modular inverse described with reference to [Fig.7] can be carried out in other orders insofar as each step has the elements necessary for its execution.

[0247] According to a first example, the step of determining a masked number (step S106) can be executed before the step of determining another masked modulus (step S104) and after the step of determining multiplicative masks (step S2).

[0248] According to a second example, the step of determining a multiplicative inverse (step S8) can be executed before the step of determining a masked number (step S106) and after the step of determining another masked modulus (step S104).

[0249] According to a third example, the mask change step (step S11) can be executed before the step of determining a masked number (step S106) and after the step of determining another masked modulus (step S104), or before one of the steps of determining multiplicative masks (step S2) and the step of determining another masked modulus (step S104).

[0250] The method for determining a modular inverse described with reference to [Fig.7] can be adapted to multiplicative maskings with n shares, n being greater than or equal to 3.

[0251] Figure 8 illustrates in the form of a flowchart the main steps of a method for determining a modular inverse according to a fourth embodiment of the invention.

[0252] The method of [Fig. 8] also aims to determine the modular inverse of a number Q in the ring of integers modulo a given modulus P, the number and the given modulus being prime numbers, and the given modulus being masked in the form of n first parts Pb ... ,Pn of an initial masking with n a strictly greater integer to one.

[0253] The size of the given modulus P is p bits and the size of the number Q is q bits. For example, pa has a value of 1024 and qa also has a value of 1024. Note, however, that p can have a value different from that of q.

[0254] The initial masking is here a modular multiplicative masking of modulo 2? with two shares, with p' an integer greater than or equal to p. The integer na therefore has the value 2 here.

[0255] According to a mask change step (step S100), processor 4 replaces the modular multiplicative masking of modulo 2P of the given modulo with an additive masking on the integers.

[0256] Typically, processor 4 starts by replacing the modular multiplicative masking of modulo pP of the given module with a modular additive masking of modulo pP.

[0257] To do this, processor 4 draws an intermediate random number R' uniformly within a closed interval having a lower bound of value 0 and an upper bound of value pP' ], then processor 4 calculates a third intermediate data point Z' as follows: 2 — niod 2P'- Next, processor 4 calculates two intermediate parts P'i,P'2 as follows: p ( = ( prR-) . Z mod 2P' and P2 = R' • Z mod 2P'

[0258] The two intermediate parts P' i,P'2 are the given module masked in the form of the Modular additive masking of module pP'.

[0259] Processor 4 then proceeds by replacing the modular additive masking of modulo pP of the given modulo with additive masking on integers.

[0260] For this purpose, processor 4 draws a third other random E'2 uniformly in a closed interval having a lower bound of value 0 and an upper bound of value 2P-1, then processor 4 calculates a first other data point E'i as follows: E'i = P'j - E'2. Then, processor 4 updates the first other data point E'1 as follows: E'i = E'j + P'2. Finally, if P'i + P'2 is a value strictly less than 2P, Processor 4 updates the first other data as follows: jr _ _ 2P- Then, for any i from 1 to 2, the processor 4 updates a first part as follows: P;= Ej.

[0261] Subtracting at least the third other random E'2 from the intermediate part P' before adding the intermediate part P'2 to the first other data E'i allows the confidentiality of the given module to be preserved.

[0262] The comparison of P\ + P2 and 9P is done in a secure manner, for example according to the embodiment described above with reference to [Fig.2].

[0263] At the end of the mask change step (step S100), the first parts are the masked form of the given module according to an additive masking on the integers.

[0264] The method then comprises a step of determining multiplicative masks, a step of determining another masked module, a step of determining a masked number, a step of determining a multiplicative inverse, a step of determining an intermediate inverse, a step of determining second parts of a modular additive masking of a dividend and a step of calculating the exact division of the dividend by the number, respectively identical to the step of determining multiplicative masks (step S2), the step of determining another masked module (step S4), the step of determining a masked number (step S6), the step of determining a multiplicative inverse (step S8), the step of determining an intermediate inverse (step S10),to the step of determining second parts of a modular additive masking of a dividend (step S12) and to the step of calculating the exact division of the dividend by the number (step S14) described above with reference to [Fig.3]. ,

[0265] If the number Q is masked in the form of fourth parts of another initial masking, the process of [Fig.8] may further include another mask-changing step (not shown), during which the processor 4 replaces the other initial masking with an additive masking on the integers.

[0266] For example, if the other initial masking is a modular multiplicative masking of modulo with q' an integer greater than or equal to q, the process in Figure 8 may further include another mask-changing step (not shown), during which the processor 4 replaces the modular multiplicative masking of modulo 2q of the number with an additive masking on integers.

[0267] Typically, processor 4 starts by replacing the modular multiplicative masking of modulo 2q of the number with a modular additive masking of modulo

[0268] To do this, processor 4 draws another intermediate random number R' uniformly within a closed interval having a lower bound of value 0 and an upper bound of value pM'_j, then processor 4 calculates a fourth intermediate data point Z” as follows: — Q mod 7q- Then processor 4 calculates two other parts in termedials Q' i,Q'2 as follows: q' = q R" j . z mcK] 2q' and Q2 = R” • Z" mod 2q-

[0269] The two other intermediate parts Q' i,Q'2 are the number masked in the form of the modular additive masking of module '•

[0270] Processor 4 then proceeds by replacing the modular additive masking of pcl module of the number with additive masking on integers.

[0271] Typically, the processor 4 draws a fifth random number E”2 uniformly within a closed interval having a lower bound of value 0 and an upper bound of value 2q-1, then processor 4 calculates a second other data point E”i as follows: E”j — Q' - E”2. Then processor 4 updates the second other data point E' ' i as follows: E”i = E”i 4- Q' Finally, if Q\ 4- Q' is a value strictly less than , processor 4 updates the second other data point as follows: g” _ g” _ 2q . Then, for any i from 1 to 2, processor 4 updates a fourth part as follows: Q(= E”.

[0272] Subtracting at least the fifth random E”2 from the other intermediate part Q\ before adding the other intermediate part Q'2 to the second other data E”i, allows the confidentiality of the number to be preserved.

[0273] The comparison of + Q'? and qA is done in a secure manner, for example according to the embodiment described above with reference to [Fig.2].

[0274] At the end of the other mask change step, the fourth parts are the masked form of the number according to an additive masking on the integers.

[0275] The other mask change step is performed within the process before another step of said process needs the fourth parts of the number.

[0276] For example, the other mask change step is executed before the step of determining a masked number (step S6), and / or before the step of determining second parts of a modular additive masking of a dividend (step S12), and / or before the step of calculating the exact division of the dividend by the number (step S14).

[0277] Thus, the process described with reference to [Fig. 8] does not require the implementation of modular reduction and modular inversion operations in hidden form. Instead, the process allows the use of the implementation of exact division in hidden form.

[0278] A person skilled in the art will understand that the steps of the process for determining a modular inverse described with reference to [Fig.8] can be carried out in other orders insofar as each step has the elements necessary for its execution.

[0279] According to a first example, the step of determining a masked number (step S6) can be executed before the step of determining another masked module (step S4) and after the step of determining multiplicative masks (step S2).

[0280] According to a second example, the step of determining a multiplicative inverse (step S8) can be executed before the step of determining a masked number (step S6) and after the step of determining another masked modulus (step S4).

[0281] According to a third example, the mask change step (step S100) can be executed before the step of determining another masked module (step S4) and after the step of determining multiplicative masks (step S2).

[0282] The method for determining a modular inverse described with reference to [Fig.8] can be adapted to modular multiplicative masking with n shares, n being greater than or equal to 3.

[0283] The electronic device 2 can implement a method for generating an RSA CRT key comprising a method as described above. Typically, the electronic device 2 can implement a method for generating an RSA CRT key comprising a modular inverse determined by a method as described above, in particular with reference to one of Figures 3, 6, 7 and 8.

Claims

Demands

1. A method for determining a modular inverse of a number Q in the ring of integers modulo a given modulus P, the number and the given modulus being prime numbers, the given modulus being masked in the form of prime parts of an initial masking, the method being implemented by an electronic device (2) and the method comprising the following steps: - Determination (S2), preferably by random sampling, of a first multiplicative mask and a second multiplicative mask that are not numb and are coprime, - Determination (S4, S104) of another masked modulus by applying the first multiplicative mask to the given modulus P, - Determination (S6, S106) of a masked number equal to the product of the second multiplicative mask and the number Q,- Determination (S8) of a multiplicative inverse of the other masked modulus, then determination (S10) of an intermediate inverse D resulting from a multiplication of the multiplicative inverse of the other masked modulus by the first multiplicative mask modulo the masked number; - Determination (S12, S112) of second parts of a modular additive masking of a dividend, the dividend having the value (-D • P + 1) mod N with N a public modulus of value equal to P • Q, and the determination of each second part comprising the determination of a product of the intermediate inverse and a distinct third part of the same preliminary masking of the given modulus; - Calculation (S14) of the exact division of the dividend by the number, the modular inverse being the result of the exact division, the dividend, the modular inverse, and the number being manipulated in masked form.

2. A method according to the preceding claim wherein the initial masking is masking by additive masking, modular additive masking, multiplicative masking and modular multiplicative masking.

3. A method according to any one of the preceding claims wherein the preliminary masking is an additive masking.

4. A method according to any one of the preceding claims wherein the third parties are the first parties.

5. A method according to any one of the preceding claims wherein the determination of one and only one second part of the dividend masked also includes an increase of 1 in the product determined modulo the public module.

6. A method according to any one of the preceding claims wherein the exact split comprises the replacement (SS2) of the modular additive masking of the dividend by an additive masking.

7. A method according to any one of the preceding claims wherein the calculation of the exact division manipulates the masked number and the second multiplicative mask, the second multiplicative mask being odd.

8. A method according to any one of the preceding claims further comprising calculating the public modulus from the given modulus and the number.

9. Method for generating an RSA CRT key comprising a method according to one of the preceding claims.

10. A computer program comprising instructions executable by a processor and adapted to implement a method according to any one of the preceding claims, when these instructions are executed by the processor.

11. An electronic device for determining a modular inverse of a number Q in the ring of integers modulo a given modulus P, the number and the given modulus being prime numbers, the given modulus being masked in the form of prime parts of an initial masking, and the electronic device comprising: - a block for determining multiplicative masks configured to determine, preferably by random sampling, a first multiplicative mask and a second multiplicative mask that are not numed and are coprime, - a block for determining another masked modulus configured to determine another masked modulus by applying the first multiplicative mask to the given modulus P, - a block for determining a masked number configured to determine a masked number equal to the product of the second multiplicative mask and the number Q,- an inversion block configured to determine a multiplicative inverse of the other masked module and then determine an intermediate inverse D resulting from a multiplication of the multiplicative inverse of the other masked module by the first multiplicative mask modulo the masked number, - a dividend determination block configured to determine, of the second parts of a modular additive masking of a dividend, the dividend having value (-D • P + 1) mod N with N a public modulus of value equal to P • Q, and the determination of each second part comprising the determination of a product of the intermediate inverse and a separate third part of the same preliminary masking of the given modulus, - an exact division block configured to calculate the exact division of the dividend by the number, the modular inverse being the result of the exact division, the dividend, the modular inverse and the number being manipulated in masked form.

Images