Modular exponentiation method and device resistant against side-channel attacks

1. A method of performing in an electronic device a modular exponentiation in a cryptographic operation comprising iterative modular multiplications steps and taking as input a first modulus N, a secret exponent d and a base x, the method being performed in a processor of the electronic device and comprising the steps, during at least one modular multiplication step aiming at computing a result c from two values a, b and the first modulus N so that c=a·b mod N, of:

taking, by the processor, as input the two values a, b and the first modulus N;

obtaining, by the processor, from the two values a, b and the first modulus N, two operands a′, b′ and a second modulus N′ such that at least one of the two operands a′, b′ is different from the two values a, b, and that the two operands a′, b′ are different when a is equal to b, so that the modular multiplication c=a·b mod N from a side-channel viewpoint behaves like a modular squaring except for when a′ equals b′; wherein the operand a′ is obtained from the value a, the operand b′ is obtained from the value b, and the second modulus N′ is obtained from the first modulus N using operations with at most linear complexity;

computing, by the processor, an intermediate result c′=a′·b′ mod N′;

deriving, by the processor, the result c from the intermediate result c′, wherein c is obtained from c′ using an operation with at most linear complexity; and

using, by the processor, the result c in the modular exponentiation of the cryptographic operation.

2. The method of claim 1 , wherein a′= 2 a, b′=b+N and N′= 2 N, and wherein c′=c/2.

3. The method of claim 1 , wherein a′=N−a, b′=b and N′=N, and wherein c′=N−c.

4. The method of claim 3 , wherein the first modulus N is odd.

5. A non-transitory computer readable medium having stored thereon instructions that, when executed by a processor, perform the method of any one of claims 1 to 4 .

6. A processor in an electronic device for performing a modular exponentiation in a cryptographic operation comprising iterative modular multiplications steps and taking as input a first modulus N, a secret exponent d and a base x, the processor being configured to, during at least one modular multiplication aiming at computing a result c from two values a, b and the first modulus N so that c=a·b mod N:

take as input the two values a, b and the first modulus N;

obtain, from the two values a, b and the first modulus N, two operands a′, b′ and a second modulus N′ such that at least one of the two operands a′, b′ is different from the two values a, b, and that the two operands a′, b′ are different when a is equal to b, so that the modular multiplication c=a·b mod N from a side-channel viewpoint behaves like a modular squaring except for when a′ equals b′; wherein the operand a′ is obtained from the value a, the operand b′ is obtained from the value b, and the second modulus N′ is obtained from the first modulus N using operations with at most linear complexity;

compute an intermediate result c′=a′·b′ mod N′; and

derive the result c from the intermediate result c′, wherein c is obtained from c′ using an operation with at most linear complexity;

wherein the processor further is configured to use the result c in the modular exponentiation of the cryptographic operation.

7. The processor of claim 6 , wherein a′= 2 a, b′=b+N and N′= 2 N, and wherein c′=c/2.

8. The processor of claim 6 , wherein a′=N+a, b′=b and N′=N, and wherein c′=N−c.

9. The processor of claim 8 , wherein the first modulus N is odd.