Integer division method secure against covert channel attacks
View Patent ↗The invention relates to a cryptographic method involving an integer division of type q=a div b and r=a mod b, wherein a is a number of m bits, b is a number of n bits, with n being less than or equal to m, and b n−1 being non-null and the most significant bit of b. In addition, each iteration of a loop subscripted by i, which varies between 1 and m−n+1, involves a partial division of a word A of n bits of number a by number b in order to obtain one bit of quotient q. According to the invention, the same operations are performed with each iteration, regardless of the value of the quotient bit obtained. In different embodiments of the invention, one of the following is also performed with each iteration: the addition and subtraction of number b to/from word A; the addition of number b or a complementary number /b of b to word A; or a complement operation at 2 n of an updated datum (b or /b) or a dummy datum (c or /c) followed by the addition of the datum updated with word A.
1. A cryptographic method during which an integer division of the type q=a div b and r=a mod b is performed in a processor of an electronic device, where q is a quotient, a is a number containing m bits, b is a number containing n bits, with n less than or equal to m and b n−1 is non-zero, b n−1 being the most significant bit of b, comprising the following steps:
(i) performing a partial division of a word A, comprising n bits of the number a, by the number b to obtain a bit of the quotient q, wherein at least one of the numbers a and b comprises secret data;
(ii) repeating step (i) for m−n+1 iterations with the same number and type of operations being performed at each iteration, regardless of the value of the quotient bit obtained, to obtain the quotient q; and
(iii) generating encrypted or decrypted data in accordance with said quotient.
2. A method according to claim 1 , wherein, at each iteration, an addition of the number b to the word A and a subtraction of the number b from the word A are performed.
3. A method according to claim 1 wherein, at each iteration, either the number b or a number b complementary to the number b is added to the word A.
4. A method according to claim 3 , further including the step, at each iteration, of updating a first variable (σ′) indicating whether, during the following iteration, the number b or the number b is to be added with the word A according to the quotient bit produced.
5. A method according to claim 1 , further including the steps, at each iteration, of performing an operation of complement to 2 n of an updated data item (b or b ) or of a notional data item (c or c ), and adding the updated data item with the word A.
6. A method according to claim 5 , further including the step, at each iteration, of updating a second variable (δ), indicating whether, during the following iteration, the operation of complement to 2 n is to be performed on the updated data item or on the notional data item.
7. A method according to claim 5 , further including the step, at each iteration, of updating a third variable (β) indicating whether the updated data item is equal to the data item b or to its complement to 2 n .
8. An electronic component comprising calculation means programmed to implement a method according to claim 1 , said calculation means comprising a central unit associated with a memory comprising several registers for storing the data a and b.
9. A chip card comprising an electronic component according to claim 8 .