Protection of a calculation against side-channel attacks
A method for protecting a ciphering algorithm executing looped operations on bits of a first quantity and on a first variable initialized by a second quantity, wherein, for each bit of the first quantity, a random number is added to the state of this bit to update a second variable maintained between two thresholds.
1. A method, comprising:
executing, using a cryptographic circuit, a ciphering algorithm including executing looped operations on bits of a first quantity and on a first variable initialized by a second quantity; and
protecting, using the cryptographic circuit, the ciphering algorithm during execution of the looped operations, the protecting including, for each bit of the first quantity, updating a second variable maintained between two thresholds, wherein the updated second variable has a value which is a function of a random number and a state of the bit of the first quantity and the second variable represents a random-number drift introduced during executions of the looped operations.
2. The method of claim 1 wherein said second variable is used in one of plural operations performed for each bit of the first quantity.
3. The method of claim 1 wherein the random number is drawn for each bit of the first quantity.
4. The method of claim 1 , comprising, after updating the second variable for each bit of the first quantity, updating the first variable by a calculation taking into account said second variable and the second quantity.
5. The method of claim 1 wherein the second variable includes no more than 8 bits.
6. The method of claim 2 wherein said plural operations comprise an addition and a doubling, said second variable being taken into account during the addition.
7. The method of claim 6 wherein the executing includes multiplying a point of an elliptic curve by a scalar number, said scalar number representing the first quantity and said point representing the second quantity.
8. The method of claim 2 wherein said plural operations comprise a squaring and a multiplication, said second variable being taken into account in the multiplication.
9. The method of claim 8 wherein the executing includes performing a modular exponentiation of the second quantity, the first quantity representing an exponent of the modular exponentiation of the second quantity.
10. A device, comprising:
one or more memories; and
cryptographic circuitry, which, in operation:
executes a ciphering algorithm including executing looped operations on bits of a first quantity and on a first variable initialized by a second quantity; and
protects execution of the ciphering algorithm during execution of the looped operations, the protecting including, for each bit of the first quantity, maintaining a second variable between two thresholds during an execution of a looped operation, the maintained second variable having a value which is a function of a random number and a state of the bit of the first quantity, wherein the second variable represents a random-number drift introduced during executions of the looped operations.
11. The device of claim 10 wherein said second variable is used in one of plural operations performed for each bit of the first quantity.
12. The device of claim 11 wherein said plural operations comprise an addition and a doubling, said second variable being taken into account during the addition.
13. The device of claim 12 wherein the executing includes multiplying a point of an elliptic curve by a scalar number, said scalar number representing the first quantity and said point representing the second quantity.
14. The device of claim 11 wherein said plural operations comprise a squaring and a multiplication, said second variable being taken into account in the multiplication.
15. The device of claim 14 wherein the executing includes performing a modular exponentiation of the second quantity, the first quantity representing an exponent of the modular exponentiation of the second quantity.
16. A system, comprising:
one or more memories;
one or more processing circuits; and
cryptographic circuitry, which, in operation:
executes a ciphering algorithm including executing looped operations on bits of a first quantity and on a first variable initialized by a second quantity; and
protects execution of the ciphering algorithm during execution of the looped operations, the protecting including, for each bit of the first quantity, maintaining a second variable between two thresholds during an execution of a looped operation, the maintained second variable having a value which is a function of a random number and a state of the bit of the first quantity, wherein the second variable represents a random-number drift introduced during executions of the looped operations.
17. The system of claim 16 wherein one of the one or more processing circuits includes the cryptographic circuitry.
18. The system of claim 16 wherein the combining the random number and the state of the bit of the first quantity comprises subtracting the state of the bit of the first quantity from the random number.
19. The method of claim 1 wherein the combining the random number and the state of the bit of the first quantity comprises subtracting the state of the bit of the first quantity from the random number.
20. The device of claim 10 wherein the combining the random number and the state of the bit of the first quantity comprises subtracting the state of the bit of the first quantity from the random number.
21. The method of claim 1 wherein the ciphering algorithm is an encryption algorithm.
22. The device of claim 10 wherein the ciphering algorithm is an encryption algorithm.
23. The system of claim 16 wherein the ciphering algorithm is an encryption algorithm.