WHITE-BOX IMPLEMENTATION

1 - 16 . (canceled)

17 . A method for computation of an outcome of an exponentiation C x having a base C and an exponent x by means of a white-box implementation of the exponentiation, the method comprising:

receiving information indicative of at least a part of a plurality of values ω i and at least a part of information indicative of a plurality of values φ i , the plurality of values ω i satisfying ω i =C λ i , the plurality of values φ i , satisfying

x

=

∑

i

=

1

r



λ

i



ϕ

i

,

i=1, 2, . . . , r ; and

encrypting a message to obtain a ciphertext and/or decrypting the ciphertext to obtain the message, by using

P

=

∏

i

=

1

r



ω

i

ϕ

i

wherein P=C x , thereby hiding at least one of the precise value of the base C and exponent x from a white-box attack.

18 . The method according to claim 17 , wherein the base C is a ElGamal public key.

19 . The method according to claim 17 , wherein encrypting a message m comprises:

generating a ciphertext including calculating α k2 by using P,

k2 corresponding to x, α being associated with the key.

20 . The method according to claim 19 , wherein generating a ciphertext comprises:

generating the ciphertext given by (γ, δ) by using P,

γ=α k1 , δ=m·(α a ) k1 ·α k2

α being associated with a public key

g being a function,

α being associated with a private key,

1≦k1≦n−1,

k2=g(γ).

21 . The method according to claim 17 , wherein decrypting a ciphertext comprises:

decrypting a ciphertext including calculating α k2 by using P, k2 corresponding to x, α being associated with the key.

22 . The method according to claim 21 , wherein decrypting a ciphertext comprises:

decrypting the ciphertext given by (γ, δ) by using P to obtain the message m given by γ −a ·α −k2 ·δ, γ=α k1 , δ=m·(α a ) k1 ·α k2 ,

a being associated with a public key,

g being a function,

α being associated with a private key,

1≦k1≦n−1,

k2=g(δ).

23 . A non-transitory computer readable storage storing a program comprising instructions, which when executed by a processor, causes the processor to perform computation of an outcome of an exponentiation C x having a base C and an exponent x by means of a white-box implementation of the exponentiation, comprising:

receiving a device with information indicative of at least a part of a plurality of values ω i and at least a part of information indicative of a plurality of values φ i ,

the plurality of values ω i satisfying ω i =C λ i , the plurality of values φ i satisfying

x

=

∑

i

=

1

r



λ

i



ϕ

i

,

i=1, 2, . . . , r; and

encrypting a message m to obtain a ciphertext and/or decrypting the ciphertext to obtain the message m, by using

P

=

∏

i

=

1

r



ω

i

ϕ

i

wherein P=C x , thereby hiding at least one of the precise value of the base C and exponent x from a white-box attack.

24 . A method for computation of an outcome of an exponentiation C x having a base C and an exponent x by means of a white-box implementation of the exponentiation, the method comprising:

establishing a plurality of values λ i , for i=1, 2, . . . , r,

establishing a plurality of values ω i for i=1, 2, . . . , r, satisfying ω i =C λ i , C being associated with a key of a cipher,

establishing a plurality of values φ i , for i=1, 2, . . . , r, satisfying

x

=

∑

i

=

1

r



λ

i



ϕ

i

;

and

providing a device with information indicative of at least a part of the plurality of values ω i and at least a part of information indicative of the plurality of values φ i to calculate

P

=

∏

i

=

1

r



ω

i

ϕ

i

wherein P=C x , thereby hiding at least one of the precise values of the base C and exponent x from a white-box attack.

25 . The method according to claim 24 , wherein the base C is a ElGamal public key.

26 . The method according to claim 24 , wherein encrypting a message m comprises:

generating a ciphertext including calculating α k2 by using P, k2 corresponding to x, α being associated with the key.

27 . The method according to claim 26 , wherein generating a ciphertext comprises:

generating the ciphertext given by (γ, δ) by using P,

γ=α k1 , δ=m·(α a ) k1 ·α k2 ,

α being associated with a public key

g being a function,

α being associated with a private key,

1≦k1≦n−1,

k2=g(γ).

28 . The method according to claim 24 , wherein decrypting a ciphertext comprises:

decrypting a ciphertext including calculating α −k2 by using P,

k2 corresponding to x, α being associated with the key.

29 . The method according to claim 28 , wherein decrypting a ciphertext comprises:

decrypting the ciphertext given by (γ, δ) by using P to obtain the message m given by γ −a ·α −k2 ·δ, γ=α k1 , δ=m·(α a ) k1 ·α k2 ,

α being associated with a public key,

g being a function,

α being associated with a private key,

1≦k1≦n−1,

k2=g(γ).

30 . The method according to claim 17 , wherein the exponent x is variable, and wherein establishing a plurality of values λ i comprises:

establishing a set V of values to be used as the exponent x, and a plurality of sets of values W 1 , W 2 . . . , W r such that

V

⊆

{

∑

i

=

1

r



λ

i

·

w

i



(

w

1

,

w

2

,

…



,

w

r

)

∈

W

1

×

W

2

×

…

×

W

r

}

.

31 . The method according to claim 30 , wherein establishing the plurality of values φ i comprises:

selecting the values φ i such that φ i ∈W i , for i 1, 2, . . . , r.

32 . The method according to claim 24 , wherein W i ={0,1}, for i=1, 2, . . . , r.

33 . The method according to claim 24 , wherein C is of order q, q being a positive integer such that C x =1.

34 . The method according to claim 17 , comprising at least one of:

selecting different pluralities of values λ i with respect to the base C and the exponent x, to be used in respect of different devices; and

selecting different values r with respect to the base C and the exponent x, in respect of different devices.

35 . The method according to claim 17 , comprising at least one of:

selecting wherein r is an integer and r≧2;

generating the key;

encrypting and/or decrypting information indicative of the plurality of values ω i and information indicative of the plurality of values φ i .

36 . A non-transitory computer readable storage storing a program comprising instructions, which when executed by a processor, causes the processor to perform computation of an outcome of an exponentiation C x having a base C and an exponent x by means of a white-box implementation of the exponentiation, comprising:

establishing a plurality of values λ i , for i=1, 2, . . . , r,

establishing a plurality of values ω i for i=1, 2, . . . , r, satisfying ω i =C λ i , C being associated with a key of a cipher,

establishing a plurality of values ω i , for i1, 2, . . . , r, satisfying

x

=

∑

i

=

1

r



λ

i



ϕ

i

;

and

providing a device with information indicative of at least a part of the plurality of values ω i and at least a part of information indicative of the plurality of values φ i to calculate

P

=

∏

i

=

1

r



ω

i

ϕ

i

wherein P=C x , thereby hiding at least one of the precise values of the base C and exponent x from a white-box attack.