Scrambling of a calculation performed according to an RSA-CRT algorithm
A method and a circuit for scrambling an RSA-CRT algorithm calculation by an electronic circuit, in which a result is obtained from two modular exponentiation calculations, each providing a partial result, and from a recombination step, and in which a first step adds a digital quantity to at least one first partial result before said recombination step; and a second step cancels the effects of this quantity after the recombination step.
1. A method for scrambling an RSA-CRT algorithm calculation by an electronic circuit, wherein a result is obtained from two modular exponentiation calculations, each providing a partial result, and from a recombination step, the method comprising acts of:
adding a digital quantity to at least one first partial result used in the RSA-CRT algorithm before said recombination step; and
cancelling the effects of the digital quantity after the recombination step, wherein
each partial result is modulo one of two relatively prime numbers, the product of which represents the modulo of the modular exponentiation, said digital quantity being such that the modular addition, modulo the number from which the second partial result is obtained, of this quantity to the first partial result, is not zero;
said digital quantity is less than the difference between the second of the two relatively prime numbers and the first partial result; and
the recombination step comprises calculating a value X m according to the following relation:
X m =[( X ″−( X′+R ))*( q −1 mod p )]* q +( X′+R ),
where X′ and X″ designate the first and second partial results, q and p designate respectively the first and second of the two relatively prime numbers, and R designates said digital quantity.
2. The method of claim 1 , wherein the act of cancelling comprises calculating a result X according to the following relation:
X=X m −R *(1−( q −1 mod p )* q ).
3. The method of claim 1 , wherein:
the first partial result X′ corresponds to a modular exponentiation of formula Y z′ mod q, with z′=d mod(q−1), where d represents a private key of the RSA algorithm;
second partial result X″ corresponds to a modular exponentiation of formula Y z″ mod p, with z″=d mod(p−1); and
numbers p and q respect the following equation:
e*d= 1 mod(( p− 1)*( q− 1)), where e represents a public key of the RSA algorithm.
4. The method of claim 1 , further comprising changing said digital quantity on each execution of the algorithm.
5. An electronic circuit for scrambling an RSA-CRT algorithm calculation, wherein a result is obtained from two modular exponentiation calculations, each providing a partial result, and from a recombination step, the electronic circuit comprising:
a processor configured to add a digital quantity to at least one first partial result used in the RSA-CRT algorithm before said recombination step, and cancel the effects of the digital quantity after the recombination step, wherein
each partial result is modulo one of two relatively prime numbers, the product of which represents the modulo of the modular exponentiation, said digital quantity being such that the modular addition, modulo the number from which the second partial result is obtained, of this quantity to the first partial result, is not zero;
said digital quantity is less than the difference between the second of the two relatively prime numbers and the first partial result; and
the recombination step comprises calculating a value X m according to the following relation:
X m =[( X ″−( X′+R ))*( q −1 mod p )]* q +( X′+R ),
where X′ and X″ designate the first and second partial results, q and p designate respectively the first and second of the two relatively prime numbers, and R designates said digital quantity.