Granted Patent B2

US 12,388,615 · App. 18/260,793 · Granted Aug 12, 2025

Inventors: David Vigilant (Malakoff, FR); Steven Madec (Montigny le Bretonneux, FR); Mylène Roussellet (Saint Savournin, FR)

Assignee: THALES DIS FRANCE SAS

H04L9/003H04L9/3066H04L2209/046

Abstract

Claims (59)

1. A method for securing against side channel attacks via execution of an elliptic curve cryptographic process comprising a multiple points multiplication operation computing a multiple points multiplication operation result R=Σ i=1 n d i ·P i with n an integer, n>=1, d i being predetermined scalar values, P i being points of an elliptic curve over a finite field defined by parameters (F, E, G, N) together with the point addition law where F is a field over which is defined the curve, E is an equation of the curve, G is a base point in E over F and N is the order of the base point G,

said method being performed by a cryptographic device and comprising:

generating (S 1 ) a masking value iRand;

multiplicatively masking (S 2 ) each predetermined scalar value d 1 with said generated masking value iRand to obtain masked scalars d i ′ with i in {1, . . . ,n};

computing (S 3 ) a masked multiple points multiplication operation result R′=Σ i=1 n d i ′·P i with i in {1, . . . ,n}; and

obtaining (S 4 ) said multiple points multiplication operation result R by unmasking said masked multiple points multiplication operation result R′.

2. The method of claim 1 ,

wherein generating a masking value iRand comprises generating a random value Rand and computing the masking value iRand by inverting the random value Rand (iRand=1/Rand mod N); and

wherein unmasking said masked multiple points multiplication operation result R′ comprises multiplying said masked multiple points multiplication operation result R′ with said generated random value Rand.

3. The method of claim 1 , wherein computing the masked multiple points multiplication operation result R′ comprises:

precomputing (S 31 ) all possible sums R k =Σ i=1 n a i ·P i , for a i in [0, 2 w −1], with w a predetermined integer w>=1;

initializing (S 32 ) an intermediate value A at the infinity point; and

for an integer j from 0 to |B|-w by steps w (S 33 ), with B a number of bits of the predetermined scalar values:

a. multiplying said intermediate value A by 2 w

b. selecting a sum R m among said precomputed possible sums R k such that:

Rm

=

∑

i

=

1

n

(

d

ij

′

⁢

❘

"\[LeftBracketingBar]"

…

❘

"\[RightBracketingBar]"

⁢

d

ij

+

w

-

1

′

)

·

P

i

with d ij ′ the j th bit of d i ′,

c. adding said selected sum Rm to said intermediate value A.

4. The method of claim 3 , wherein said random value size is 32 or 64 bits.

5. The method of claim 2 is enabled by a computer program product directly loadable into a memory of at least one computer, comprising software code instructions for performing steps of the method when said product is run on a computer.

6. The method of claim 5 , wherein a non-transitory computer readable medium storing the software code that when executed by a cryptographic device comprising at least one hardware processor performs the method.

7. A cryptographic device comprising:

a processing system having at least one hardware processor; and

at least one Non Volatile Memory and/or a read-only memory;

wherein the cryptographic device

secures against side channel attacks via execution of an elliptic curve cryptographic process comprising a multiple points multiplication operation computing a multiple points multiplication operation result R=Σ i=1 n d i ·P i with n an integer, n>=1, d i being predetermined scalar values, P i being points of an elliptic curve over a finite field defined by parameters (F, E, G, N) together with the point addition law where F is a field over which is defined the curve, E is an equation of the curve, G is a base point in E over F and N is the order of the base point G,

wherein the cryptographic device:

generates (S 1 ) a masking value iRand;

multiplicatively masks (S 2 ) each predetermined scalar value d 1 with said generated masking value iRand to obtain masked scalars d i ′ with i in {1 . . . ,n};

computes (S 3 ) a masked multiple points multiplication operation result R′=Σ i=1 n d i ′·P i with i in {1 . . . n}; and

obtains (S 4 ) said multiple points multiplication operation result R by unmasking said masked multiple points multiplication operation result R′.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (10)