Method for performing cryptographic operations in a processing device, corresponding processing device and computer program product
A method performs cryptographic operations on data in a processing device. An iterative operation between a first operand formed by a given number of words and a second operand using a secret key is performed. The iterative operation includes, for each bit of the secret key, applying one of a first set operations and a second set of operations to the first operand and to the second operand depending on of the bit, and conditionally swapping words of the first and the second operand based on a control bit value obtained by applying a logic XOR function to a random bit.
1. A method, comprising:
performing cryptographic operations on data in a processing device, the performing including applying an asymmetric cryptographic procedure including an iterative operation between a first operand formed by a given number of words and a second operand using a secret key,
the iterative operation including, for each bit of the secret key:
applying one of a first set operations and a second set of operations to the first operand and to the second operand depending on the bit of the secret key; and
conditionally swapping words of the first and the second operand on the basis of a control bit value, the control bit value being obtained applying a logic XOR function to a random bit,
wherein the conditional swap includes:
storing in a first register the word of the first operand;
storing in a second register a corresponding word of the second operand;
storing in the word of the first operand the value of the first or second register depending on the control bit value; and
storing in the corresponding word of the second operand the value of the second or first register depending on the control bit value,
wherein the iterative operation includes:
storing the random bit in a first mask register;
generating a randomized key value by performing a logic XOR operation on the current bit of the secret key and the random bit and storing the randomized key value in a second mask register;
storing a bit-wise complement of a value stored in the first mask register in a third mask register; and
storing a bit-wise complement of a value stored in the second mask register in a fourth mask register.
2. A method, comprising:
performing cryptographic operations on data in a processing device, the performing including applying an asymmetric cryptographic procedure including an iterative operation between a first operand formed by a given number of words and a second operand using a secret key,
the iterative operation including, for each bit of the secret key:
applying one of a first set operations and a second set of operations to the first operand and to the second operand depending on the bit of the secret key; and
conditionally swapping words of the first and the second operand on the basis of a control bit value, the control bit value being obtained applying a logic XOR function to a random bit,
wherein the conditional swap includes:
storing in a first register the word of the first operand;
storing in a second register a corresponding word of the second operand;
storing in the word of the first operand the value of the first or second register depending on the control bit value;
storing in the corresponding word of the second operand the value of the second or first register depending on the control bit value; and
after storing in the first register the word of the first operand and storing in the second register a corresponding word of the second operand:
rewriting the first operand and second operand by storing in them respective dummy values;
then storing in the word of the first operand the value of the first or second register depending on the control bit value, overwriting the dummy value of the first operand; and
storing in the corresponding word of the second operand the value of the second or first register depending on the control word value, overwriting the dummy value of the second operand.
3. The method according to claim 2 wherein the respective dummy values are zero or constant values.
4. The method according to claim 2 wherein the respective dummy values are random generated values.
5. The method according to claim 2 wherein the respective dummy values are different from one another.
6. The method according to claim 2 , wherein the asymmetric cryptographic procedure is a multiplication operation including, prior to the iterative operation, initializing a mask variable, and the iterative operation includes:
for each bit of the secret key:
setting the random bit;
obtaining a randomized key value by performing a logic XOR operation on the current bit of the secret key and the random bit;
performing the conditional swap using as control bit the result of a logic XOR operation on the mask variable and the random bit;
setting the mask variable to the random bit value; and
performing a loop of the asymmetric cryptographic multiplication selecting the set of operations to apply to the current word of the first operand and to a corresponding word of the second operand depending on the value of the randomized key value.
7. The method according to claim 6 , comprising:
storing the random bit in a first mask register;
storing the randomized key value in a second mask register;
storing a bit-wise complement of a value stored in the first mask register in a third mask register; and
storing a bit-wise complement of a value stored in the second mask register in a fourth mask register.
8. The method according to claim 1 , wherein the iterative operation includes an Elliptic Curve Cryptography (ECC) scalar multiplication loop or a Rivest-Shamir-Adleman (RSA) modular exponentiation loop.
9. An apparatus, comprising:
a plurality of registers; and
logic circuitry coupled to the plurality of registers, wherein the logic circuitry, in operation, performs, using a secret key, an iterative operation between a first operand formed by a number of words and a second operand, the iterative operation including, for each bit of the secret key:
applying one of a first set operations and a second set of operations to the first operand and to the second operand depending on the bit of the secret key; and
conditionally swapping words of the first and the second operand on the basis of a control bit value, the control bit value being obtained applying a logic XOR function to a random bit,
wherein the conditional swap includes:
storing in a first register of the plurality of registers the word of the first operand;
storing in a second register of the plurality of registers a corresponding word of the second operand;
storing in the word of the first operand the value of the first or second register depending on the control bit value; and
storing in the corresponding word of the second operand the value of the second or first register depending on the control bit value,
wherein the iterative operation includes:
storing the random bit in a first mask register;
generating a randomized key value by performing a logic XOR operation on the current bit of the secret key and the random bit and storing the randomized key value in a second mask register;
storing a bit-wise complement of a value stored in the first mask register in a third mask register; and
storing a bit-wise complement of a value stored in the second mask register in a fourth mask register.
10. An apparatus, comprising:
a plurality of registers; and
logic circuitry coupled to the plurality of registers, wherein the logic circuitry, in operation, performs, using a secret key, an iterative operation between a first operand formed by a number of words and a second operand, the iterative operation including, for each bit of the secret key:
applying one of a first set operations and a second set of operations to the first operand and to the second operand depending on the bit of the secret key; and
conditionally swapping words of the first and the second operand on the basis of a control bit value, the control bit value being obtained applying a logic XOR function to a random bit,
wherein the conditional swap includes:
storing in a first register of the plurality of registers the word of the first operand;
storing in a second register of the plurality of registers a corresponding word of the second operand;
storing in the word of the first operand the value of the first or second register depending on the control bit value;
storing in the corresponding word of the second operand the value of the second or first register depending on the control bit value; and
after storing in the first register the word of the first operand and storing in the second register the corresponding word of the second operand:
rewriting the first operand and second operand by storing in them respective dummy values;
storing in the word of the first operand the value of the first or second register depending on the control bit value, overwriting the dummy value of the first operand; and
storing in the corresponding word of the second operand the value of the second or first register depending on the control word value, overwriting the dummy value of the second operand.
11. The apparatus according to claim 10 wherein the respective dummy values are zero or constant values.
12. The apparatus according to claim 10 wherein the respective dummy values are random generated values.
13. The apparatus according to claim 10 wherein the respective dummy values are different from one another.
14. The apparatus according to claim 10 wherein the iterative operation is part of an asymmetric cryptographic procedure including a multiplication operation, and the logic circuitry, in operation, initializes a mask variable prior to the iterative operation, the iterative operation including:
for each bit of the secret key:
setting the random bit;
obtaining a randomized key value by performing a logic XOR operation on the current bit of the secret key and the random bit;
performing the conditional swap using as control bit the result of a logic XOR operation on the mask variable and the random bit; and
setting the mask variable to the random bit value, wherein performing a loop of the asymmetric cryptographic multiplication includes selecting the set of operations to apply to the current word of the first operand and to a corresponding word of the second operand depending on the value of the randomized key value.
15. The apparatus according to claim 14 , wherein the logic circuitry, in operation:
stores the random bit in a first mask register of the plurality of registers;
stores the randomized key value in a second mask register of the plurality of registers;
stores a bit-wise complement of a value stored in the first mask register in a third mask register of the plurality of registers; and
stores a bit-wise complement of a value stored in the second mask register in a fourth mask register of the plurality of registers.
16. The apparatus of claim 9 , wherein the iterative operation includes an Elliptic Curve Cryptography (ECC) scalar multiplication loop or a Rivest-Shamir-Adleman (RSA) modular exponentiation loop.
17. A system, comprising:
a multiplier;
a random access memory; and
a controller, including:
a plurality of registers; and
logic circuitry coupled to the plurality of registers, wherein the logic circuitry, in operation, performs, using a secret key, an iterative operation between a first operand formed by a number of words and a second operand, the iterative operation including, for each bit of the secret key:
applying one of a first set operations and a second set of operations to the first operand and to the second operand depending on the bit of the secret key; and
conditionally swapping words of the first and the second operand on the basis of a control bit value, the control bit value being obtained applying a logic XOR function to a random bit,
wherein the conditional swap includes:
storing in a first register of the plurality of registers the word of the first operand;
storing in a second register of the plurality of registers a corresponding word of the second operand;
storing in the word of the first operand the value of the first or second register depending on the control bit value; and
storing in the corresponding word of the second operand the value of the second or first register depending on the control bit value,
wherein the iterative operation includes:
storing the random bit in a first mask register;
generating a randomized key value by performing a logic XOR operation on the current bit of the secret key and the random bit and storing the randomized key value in a second mask register;
storing a bit-wise complement of a value stored in the first mask register in a third mask register; and
storing a bit-wise complement of a value stored in the second mask register in a fourth mask register.
18. A system, comprising:
a multiplier;
a random access memory; and
a controller, including:
a plurality of registers; and
logic circuitry coupled to the plurality of registers, wherein the logic circuitry, in operation, performs, using a secret key, an iterative operation between a first operand formed by a number of words and a second operand, the iterative operation including, for each bit of the secret key:
applying one of a first set operations and a second set of operations to the first operand and to the second operand depending on the bit of the secret key; and
conditionally swapping words of the first and the second operand on the basis of a control bit value, the control bit value being obtained applying a logic XOR function to a random bit,
wherein the conditional swap includes:
storing in a first register of the plurality of registers the word of the first operand;
storing in a second register of the plurality of registers a corresponding word of the second operand;
storing in the word of the first operand the value of the first or second register depending on the control bit value;
storing in the corresponding word of the second operand the value of the second or first register depending on the control bit value; and
after storing in the first register the word of the first operand and storing in the second register the corresponding word of the second operand:
rewriting the first operand and second operand by storing in them respective dummy values;
storing in the word of the first operand the value of the first or second register depending on the control bit value, overwriting the dummy value of the first operand; and
storing in the corresponding word of the second operand the value of the second or first register depending on the control word value, overwriting the dummy value of the second operand.
19. The system according to claim 18 wherein the iterative operation is part of an asymmetric cryptographic procedure including a multiplication operation, which, in operation is performed by the multiplier, and the logic circuitry, in operation, initializes a mask variable prior to the iterative operation, the iterative operation including:
for each bit of the secret key:
setting the random bit;
obtaining a randomized key value by performing a logic XOR operation on the current bit of the secret key and the random bit;
performing the conditional swap using as control bit the result of a logic XOR operation on the mask variable and the random bit; and
setting the mask variable to the random bit value, wherein performing a loop of the asymmetric cryptographic multiplication includes selecting the set of operations to apply to the current word of the first operand and to a corresponding word of the second operand depending on the value of the randomized key value.
20. The system according to claim 19 wherein the logic circuitry, in operation:
stores the random bit in a first mask register of the plurality of registers;
stores the randomized key value in a second mask register of the plurality of registers;
stores a bit-wise complement of a value stored in the first mask register in a third mask register of the plurality of registers; and
stores a bit-wise complement of a value stored in the second mask register in a fourth mask register of the plurality of registers.
21. A non-transitory computer-readable medium having contents which cause a computing device to perform an asymmetric cryptographic procedure including an iterative operation, the iterative operation on a first operand formed by a given number of words and a second operand using a secret key, the iterative operation including, for each bit of the secret key:
applying one of a first set operations and a second set of operations to the first operand and to the second operand depending on the bit of the secret key; and
conditionally swapping words of the first and the second operand on the basis of a control bit value, the control bit value being obtained applying a logic XOR function to a random bit,
wherein the conditional swap includes:
storing in a first register the word of the first operand;
storing in a second register a corresponding word of the second operand;
storing in the word of the first operand the value of the first or second register depending on the control bit value; and
storing in the corresponding word of the second operand the value of the second or first register depending on the control bit value,
wherein the iterative operation includes:
storing the random bit in a first mask register;
generating a randomized key value by performing a logic XOR operation on the current bit of the secret key and the random bit and storing the randomized key value in a second mask register;
storing a bit-wise complement of a value stored in the first mask register in a third mask register; and
storing a bit-wise complement of a value stored in the second mask register in a fourth mask register.
22. The non-transitory computer-readable medium according to claim 21 wherein the contents comprise instructions executed by the computing device.
23. A non-transitory computer-readable medium having contents which cause a computing device to perform an asymmetric cryptographic procedure including an iterative operation, the iterative operation on a first operand formed by a given number of words and a second operand using a secret key, the iterative operation including, for each bit of the secret key:
applying one of a first set operations and a second set of operations to the first operand and to the second operand depending on the bit of the secret key; and
conditionally swapping words of the first and the second operand on the basis of a control bit value, the control bit value being obtained applying a logic XOR function to a random bit,
wherein the conditional swap includes:
storing in a first register the word of the first operand;
storing in a second register a corresponding word of the second operand;
storing in the word of the first operand the value of the first or second register depending on the control bit value;
storing in the corresponding word of the second operand the value of the second or first register depending on the control bit value; and
after storing in the first register the word of the first operand and storing in the second register the corresponding word of the second operand:
rewriting the first operand and second operand by storing in them respective dummy values;
storing in the word of the first operand the value of the first or second register depending on the control bit value, overwriting the dummy value of the first operand; and
storing in the corresponding word of the second operand the value of the second or first register depending on the control word value, overwriting the dummy value of the second operand.