Exponentiation method resistant against side-channel and safe-error attacks
View Patent ↗An exponentiation method resistant against side-channel attacks and safe-error attacks. Input to the method is g in a multiplicatively written group G and a /-digit exponent d with a radix m>1 and output is z=g d-1 ·(d−1) is expressed as a series of (/−1) non-zero digits, d* 0 . . . d* I-2 , in the set {m−1, . . . , 2m−2} and an extra digit d* I-1 that is equal to d I-1 −1, where d I-1 represents the most significant radix-m digit of d, and g d-1 is evaluated through a m-ary exponentiation algorithm on input g and (d−1) represented by d* 0 . . . d* I-1 . Also provided are an apparatus and a computer program product.
1. A processor-implemented attack-resistant cryptographic exponentiation method taking as input g in a multiplicatively written group G and a I-digit exponent f with a radix m>1 and most significant digit f I-1 >0 and outputs z=g f , the method being performed in a processor and through
a m-ary exponentiation algorithm being performed by the processor on input g and f wherein
one step of the m-ary exponentiation algorithm uses a new most significant digit f* I-1 =f I-1 −1 and at least one other step uses a non-zero digit f* i in the set {m−1, . . . , 2m−2}, wherein i is the index of the non-zero digit.
2. The exponentiation method of claim 1 wherein f* I is computed as f* i =m−1+f i where f i is in set {0, . . . m−1} and f I-1 . . . f 1 f 0 the unique representation of f in base m.
3. The exponentiation method of claim 1 , where f is computed as d−1, d being a I-digit exponent with a radix m>1.
4. The exponentiation method of claim 3 , further comprising the step of evaluating y=g d as z·g.
5. The exponentiation method of claim 3 , wherein the m-ary exponentiation algorithm processes the exponent from left to right.
6. The exponentiation method of claim 3 , wherein the m-ary exponentiation algorithm processes the exponent from right to left.
7. The exponentiation method of claim 5 , wherein m=2 and d I-1 *=0.
8. The exponentiation method of claim 7 , wherein the extra-step involving f* I-1 is skipped.
9. An apparatus for performing an attack-resistant cryptographic exponentiation method taking as input g in a multiplicatively written group G and a I-digit exponent f with a radix m>1 and most significant digit f I-1 >0 and outputs z=g f , the apparatus comprising a processor for performing a m-ary exponentiation algorithm on input g and f, wherein one step of the m-ary exponentiation algorithm uses a new most significant digit f* I-1 =f I-1 −1 and at least one other step uses a non-zero digit f* i in the set {m−1, . . . , 2m−2}, wherein i is the index of the non-zero digit.
10. A non-transitory computer-readable storage medium having stored thereon instructions that, when executed by a processor, performs the method of claim 1 .