Method and apparatus for minimizing differential power attacks on processors
View Patent ↗A method of masking a cryptographic operation using a secret value, comprising the steps of dividing the secret value into a plurality of parts; combining with each part a random value to derive a new part such that the new parts when combined are equivalent to the original secret value; and utilizing each of the individual parts in the operation.
1. A method of an executable program of a cryptographic processor masking a conditional jump operation in said cryptographic processor, said cryptographic processor being programmed such that said executable program executes a sequence of instructions, wherein the conditional jump is determined by said executable program evaluating a distinguishing value V against a reference value and wherein the reference value is bounded by an upper limit Vmax and a lower limit Vmin, the method comprising the steps of:
(a) determining a location of said conditional jump in said executable program; and
(b) inserting processor instructions at said location to direct execution of said program to one of two branches, said processor instructions computing a target address in said processor instructions, the target address being derived from said distinguishing value and a base address constituted by a random number, wherein for each evaluation of said distinguishing value against said reference value one of said branches is selected and a random number of processor instructions are executed within said branch for directing program flow to said one of two branches.
2. A method as defined in claim 1 , wherein said distinguishing value is combined with said random number, thereby adding a random number of instructions on every conditional evaluation.
3. A method as defined in claim 1 , wherein said inserted instructions include calls to respective subroutines, said subroutines including instructions for changing the return address of the subroutines to said one of two branches.
4. A method as defined in claim 1 , wherein said target address is computed using an extended addressing mode of said processor.
5. A method of performing an executable program of a cryptographic processor to mask a conditional jump operation in said cryptographic processor, said cryptographic processor being programmed such that said executable program executes a sequence of instructions that includes a set processor instructions to direct execution of said program to one of two branches, wherein the conditional jump is determined by said executable program evaluating a distinguishing value V against a reference value and wherein the reference value is bounded by an upper limit Vmax and a lower limit Vmin, the method comprising the steps of computing at a location of said conditional jump in said executable program, a target address, the target address being derived from said distinguishing value and a base address constituted by a random number, wherein for each evaluation of said distinguishing value against said reference value one of said branches is selected and a random number of processor instructions are executed within said branch when directing program flow to said one of two branches.
6. A method as defined in claim 5 , wherein said distinguishing value is combined with said random number, thereby adding a random number of instructions on every conditional evaluation.
7. A method as defined in claim 5 , wherein said inserted instructions include calls to respective subroutines, said subroutines including instructions for changing the return address of the subroutines to said one of two branches.
8. A method as defined in claim 5 , wherein said target address is computed using an extended addressing mode of said processor.
9. A cryptographic token having a cryptographic processor to perform a conditional jump operation in an executable program, said cryptographic processor being programmed such that said executable program executes a sequence of instructions that include a set of processor instructions, wherein the conditional jump is determined by said executable program evaluating a distinguishing value V against a reference value and wherein the reference value is bounded by an upper limit Vmax and a lower limit Vmin, said executable program computing at a location of said conditional jump in said executable program, a target address in said processor instructions, the target address being derived from said distinguishing value and a base address constituted by a random number, wherein for each evaluation of said distinguishing value against said reference value one of said branches is selected and a random number of processor instructions are executed within said branch for directing program flow to said one of two branches.
10. A token as defined in claim 9 , wherein said distinguishing value is combined with said random number, thereby adding a random number of instructions on every conditional evaluation.
11. A token as defined in claim 9 , wherein said inserted instructions include calls to respective subroutines, said subroutines including instructions for changing the return address of the subroutines to said one of two branches.
12. A token as defined in claim 9 , wherein said target address is computed using an extended addressing mode of said processor.