Arrangement for and method of protecting a data processing device against an attack or analysis
In order to further develop an arrangement for as well as a method of protecting at least one data processing device, in particular at least one embedded system, for example at least one chip card or smart card, against at least one attack, in particular against at least one side-channel attack, for example against at least one current trace analysis, the data processing device, in particular at least one integrated circuit of the data processing device, carrying out calculations, in particular cryptographic operations wherein an attack, for example an E[lectro]M[agnetic] radiation attack, or an analysis, for example a D[ifferential]P[ower]A[nalysis], such attack or such analysis in particular targeted on finding out a private key, is to be securely averted, it is proposed to blind all intermediate results of the calculations by at least one random variable, without inverting any operand of the calculations.
1. A system for data processing, the system being arranged to use operands to carry out a cryptographic operation on an input message (M), the system comprising:
a memory for storing instructions,
the system being configured to perform, by the instructions:
blinding the input message (M) using a first random variable (V) to generate a blinded input message; and
blinding all intermediate results (R) of the cryptographic operation using the first random variable (V) to generate corresponding blinded intermediate results;
wherein none of the operands is inverted during the cryptographic operation;
wherein the blinded input message is calculated as M−V mod(N) and each blinded intermediate result is calculated as R−V mod(N), and the first random variable (V) is calculated as (B m−1 +B −2 + . . . +B+1)v, wherein N is a modulus comprising m words, each of the m words comprises n bits, v is a second random variable that is one word comprising n bits, and B is equal to 2 n .
2. The system according to claim 1 , wherein the first random variable (V) is kept constant during a complete cryptographic operation, and is changed when a new cryptographic operation is started.
3. The system according to claim 1 , wherein the cryptographic operation is based on at least one of Rivest-Shamir-Adleman (RSA) algorithm and Elliptic Curve Cryptography (ECC) algorithm.
4. The system according to claim 1 , further comprising using a Montgomery reduction (Mr).
5. The system according to claim 1 , comprising:
at least one memory unit for storing the operands and the results of the calculations,
at least one multiplier unit connected to the memory unit,
at least one state machine for controlling the multiplier unit for performing the calculations, for reading the input operands from the memory unit, and/or
for writing the results of the calculations to the memory unit.
6. The system according to claim 5 , wherein the multiplier unit comprises at least one c-register module, at least one r-register module, at least one first full adder module connected to the c-register module, at least one second full adder module connected to the r-register module, and at least one ranger module for determining the range of the result.
7. A computer-implemented method of protecting at least one data processing device against at least one attack, the data processing device being arranged to use operands to carry out a cryptographic operation on an input message (M), the method comprising:
blinding the input message (M) using a first random variable (V) to generate a blinded input message; and
blinding all intermediate results (R) of the cryptographic operation using the first random variable (V) to generate corresponding blinded intermediate results;
wherein none of the operands is inverted during the cryptographic operation;
wherein the blinded input message is calculated as M−V mod(N) and each blinded intermediate result is calculated as R−V mod(N), and the first random variable (V) is calculated as (B m−1 +B m−2 + . . . +B+1)v, wherein N is a modulus comprising m words, each of the m words comprises n bits, v is a second random variable that is one word comprising n bits, and B is equal to 2 n .
8. The method according to claim 7 , wherein the first random variable (V) is kept constant during a complete cryptographic operation, and is changed when a new cryptographic operation is started.
9. The method according to claim 7 , wherein the cryptographic operation is based on at least one of Rivest-Shamir-Adleman (RSA) algorithm and Elliptic Curve Cryptography (FCC) algorithm.
10. The method according to claim 7 , further comprising using a Montgomery reduction (Mr).
11. A non-transitory computer readable storage medium storing one or more instructions, when executed by a processor cause the processor to perfume a method of protecting at least one data processing device against at least one attack, the data processing device being arranged to use operands to carry out a cryptographic operation on an input message (M), the method comprising:
blinding the input message (M) using a first random variable (V) to generate a blinded input message; and
blinding all intermediate results (R) of the cryptographic operation using the first random variable (V) to generate corresponding blinded intermediate results;
wherein none of the operands is inverted during the cryptographic operation;
wherein the blinded input message is calculated as M−V mod(N) and each blinded intermediate result is calculated as R−V mod(N), and the first random variable (V) is calculated as (B m−1 +B m−2 + . . . +B+1)v, wherein N is a modulus comprising m words, each of the m words comprises n bits, v is a second random variable that is one word comprising n bits, and B is equal to 2 n .
12. The computer readable storage medium according to claim 11 , wherein the first random variable (V) is kept constant during a complete cryptographic operation, and is changed when a new cryptographic operation is started.
13. The computer readable storage medium according to claim 11 , wherein the cryptographic operation is based on at least one of Rivest-Shamir-Adleman (RSA) algorithm and Elliptic Curve Cryptography (FCC) algorithm.
14. The computer readable storage medium according to claim 11 , wherein the method further comprises using a Montgomery reduction (Mr).