Method of coding a secret formed by a numerical value

1. A method of coding a secret formed by a numerical value d, in a secret-key or public-key cryptography scheme, in which the secret is subdivided into a plurality of a determined number N of elements d i of rank i, i being a rank varying between 1 and N, to which a composition law is successively applied to obtain the numerical value d of said secret, said composition law being formed by a distributive arithmetic or logic operation, endowed with a neutral element, said method being carried out by a security component of a cryptographic device, the security component comprising a bus with a read-write protected access, said method furthermore comprising:

calculating a first image T N of said secret by iterative application of the composition law term by term between a first image T i-1 of rank i−1, T o being a predefined arbitrary value, T i being a first current image of rank i, and a composition product according to said composition law of the element d i of rank i and a random value R i of rank i, chosen from among a first set of a plurality of N random values

[ T i =T i-1 ( d i R i )] i=1 i=N →T N ;

calculating a first numerical value S 1 by successively applying said composition law to said random values R i of said first set of N random values for i varying between 1 and N:

S

1

=

π

i

=

1

⊗

N

⁢

R

i

;

calculating a second numerical value S 2 , the composition product according to said composition law applied successively to random values A j of a second set of N−1 random values

S

2

=

π

j

=

1

⊗

N

-

1

⁢

A

j

;

calculating a second image T′ of said secret by applying an inverse composition law to said first image T N of said secret and to said second numerical value S 2 , so as to produce an intermediate image T x of said secret, and then by applying said inverse composition law to said intermediate image T x and to said first numerical value S 1 , so as to produce said second image T′ of said secret

T x =T N S 2

T′=T x S 1

allocating to each of the first N−1 successive elements d i of said plurality of elements [d i ] the random value A j of corresponding rank of said second set of at least one random value and to the element d N of rank N the numerical value of said second image T′;

delivering on the bus with read-write protected access solely the elements d i successively, under the supervision of said cryptographic device.

2. The method as claimed in claim 1 , wherein said logic operation is the bitwise exclusive OR operation.

3. The method as claimed in claim 1 , wherein said distributive arithmetic operation is addition, the inverse composition law being formed by subtraction.

4. The method as claimed in claim 1 , wherein for a secret formed by a numerical value d of determined length L, each random value R i of the first respectively A j of the second set of random values is chosen of length less than 2 L−N+1 .

5. The method as claimed in claim 3 , wherein for an arithmetic operation formed by addition, said method furthermore comprises, prior to said step consisting in allocating, a comparison step for comparing superiority of the numerical value of said second image T′ with the zero value, a positive response to said comparison step being followed by said step consisting in allocating, said comparison step being followed by a step of returning to said step consisting in calculating said first image T N of said secret for iteration of the method, otherwise.

6. The method as claimed in claim 1 , wherein said secret formed by a numerical value d is either a secret key in a secret-key cryptography scheme, or a private key in a public-key cryptography scheme or else any value of access code, for identification with secret intent of an authentication, non-repudiation or signature process.

7. A security component of a cryptographic device comprising a secure processor, a nonvolatile memory, a work memory, a program memory and a bus with read-write protected access, wherein said program memory comprises a computer program including a series of instructions stored in said program memory, said secure processor being for coding a secret formed by a numerical value d, in a secret-key or public-key cryptography scheme, in which the secret is subdivided into a plurality of a determined number N of elements d i of rank i, i being a rank varying between 1 and N, to which a composition law is successively applied to obtain the numerical value d of said secret, said composition law being formed by a distributive arithmetic or logic operation, endowed with a neutral element, and wherein, during the execution of said instructions, said secure processor executes the steps of,

calculating a first image T N of said secret by iterative application of the composition law term by term between a first image T i-1 of rank i−1, T o being a predefined arbitrary value, T i being a first current image of rank i, and a composition product according to said composition law of the element d i of rank i and a random value R i of rank i, chosen from among a first set of a plurality of N random values

[ T i =T i-1 ( d i R i )] i=1 i=N →T N ;

calculating a first numerical value S 1 by successively applying said composition law to said random values R i of said first set of N random values for i varying between 1 and N:

S

1

=

π

i

=

1

⊗

N

⁢

R

i

;

calculating a second numerical value S 2 , the composition product according to said composition law applied successively to a random values A j of a second set of N−1 random values

S

2

=

π

j

=

1

⊗

N

-

1

⁢

A

j

;

calculating a second image T′ of said secret by applying an inverse composition law to said first image T N of said secret and to said second numerical value S 2 , so as to produce an intermediate image T x of said secret, and then by applying said inverse composition law to said intermediate image T x and to said first numerical value S 1 , so as to produce said second image T′ of said secret

T x =T N S 2

T′=T x S 1

allocating to each of the first N−1 successive elements d i of said plurality of elements [d i ] the random value A j of corresponding rank of said second set of at least one random value and to the element d N of rank N the numerical value of said second image T′,

said security processor delivering on bus with read-write protected access solely the elements d i , successively, under the supervision of said cryptographic device.

8. The security component as claimed in claim 7 , wherein said logic operation is the bitwise exclusive OR operation.

9. The security component as claimed in claim 7 , wherein said arithmetic operation is addition, the inverse composition law being formed by subtraction.

10. The security component as claimed in claim 7 , wherein for a secret formed by a numerical value d of determined length L, each random value R i of the first respectively A j of the second set of random values is chosen of length less than 2 L−N+1 .

11. The security component as claimed in claim 9 , wherein for an arithmetic operation formed by addition, said method furthermore comprises, prior to said step consisting in allocating, a comparison step for comparing superiority of the numerical value of said second image T′ with the zero value, a positive response to said comparison step being followed by said step consisting in allocating, said comparison step being followed by a step of returning to said step consisting in calculating said first image T N of said secret for iteration of the method, otherwise.

12. The security component as claimed in claim 7 , wherein said secret formed by a numerical value d is either a secret key in a secret-key cryptography scheme, or a private key in a public-key cryptography scheme or else any value of access code, for identification with secret intent of an authentication, non-repudiation or signature process.