Scrambling of a calculation performed according to an RSA-CRT algorithm
A method and a circuit for scrambling an RSA-CRT algorithm calculation by an electronic circuit, in which a result is obtained from two modular exponentiation calculations, each providing a partial result, and from a recombination step, and in which a first step adds a digital quantity to at least one first partial result before said recombination step; and a second step cancels the effects of this quantity after the recombination step.
1. A method for scrambling an RSA-CRT algorithm calculation by an electronic circuit, the method comprising acts of:
calculating a first partial modular exponentiation;
calculating a second partial modular exponentiation;
adding a digital quantity to one of the first or second partial modular exponentiations used in the RSA-CRT algorithm before a recombination step; and
cancelling the effects of the digital quantity in or after the recombination step.
2. The method of claim 1 , wherein each of the partial modular exponentiations comprises a value obtained from modular exponentiation of data to be ciphered or deciphered.
3. The method of claim 2 , wherein the first partial modular exponentiation is modulo a first of two relatively prime numbers and the second partial modular exponentiation is modulo a second of the two relatively prime numbers, and the product of the first and second of the two relatively prime numbers is equal to a modulo of a modular exponentiation that provides an equivalent result to a result obtained from the cancelling.
4. The method of claim 3 , wherein said digital quantity is less than the difference between the second of the two relatively prime numbers and the first partial modular exponentiation.
5. The method of claim 4 , wherein the recombination step comprises calculating a value X m according to the following relation:
X m =[( X ″−( X′+R ))*( q −1 mod p )]* q +( X′+R ),
where X′ and X″ designate the first and second partial modular exponentiations, q and p designate respectively the first and second of the two relatively prime numbers, and R designates said digital quantity.
6. The method of claim 5 , wherein the act of cancelling comprises calculating a result X according to the following relation:
X=X m −R *(1−( q −1 mod p )* q ).
7. The method of claim 5 , wherein:
the first partial modular exponentiation X′ corresponds to a modular exponentiation of formula Y z′ mod q, with z′=d mod(q−1), where d represents a private key of the RSA algorithm;
second partial modular exponentiation result X″ corresponds to a modular exponentiation of formula Y z″ mod p, with z″=d mod(p−1); and
numbers p and q respect the following equation:
e*d =1 mod(( p −1)*( q −1)),
where e represents a public key of the RSA algorithm.
8. The method of claim 1 , further comprising changing said digital quantity on each execution of the algorithm.
9. The method of claim 1 , wherein the electronic circuit is incorporated in a smart card.
10. The method of claim 1 , wherein the act of cancelling results in a ciphered or deciphered value, and wherein the digital quantity is selected such that a modular sum of the digital quantity and the one of the first or second partial modular exponentiations is not zero, wherein the modulo of the modular sum is a modulo used in the other of the first or second partial modular exponentiations.
11. The method of claim 1 , wherein the digital quantity is a random number.
12. The method of claim 1 , further comprising authenticating or identifying the electronic circuit.
13. An electronic circuit comprising:
a processor configured to add a digital quantity to a first partial modular exponentiation used in an RSA-CRT algorithm before a recombination step, to calculate a second partial modular exponentiation and to cancel the effects of the digital quantity in or after the recombination step to obtain a ciphered or deciphered value; and
input/output circuitry, wherein
the processor is configured to select the digital quantity such that a modular sum of the digital quantity and the first partial modular exponentiation is not zero.
14. The electronic circuit of claim 13 , wherein the electronic circuit is incorporated in a smart card.
15. The electronic circuit of claim 13 , wherein the digital quantity is a random number.
16. The electronic circuit of claim 13 , wherein the recombination step combines the first and second partial modular exponentiations.
17. The electronic circuit of claim 16 , wherein the first partial modular exponentiation is modulo a first of two relatively prime numbers and the second partial modular exponentiation is modulo a second of the two relatively prime numbers, and the product of the first and second of the two relatively prime numbers is equal to a modulo of a modular exponentiation that provides an equivalent result to the recombination step.
18. The electronic circuit of claim 17 , wherein a modulo of the modular sum is the second of the two relatively prime numbers.
19. The electronic circuit of claim 17 , wherein the digital quantity is less than the difference between the second of the two relatively prime numbers and the first partial modular exponentiation.
20. The electronic circuit of claim 19 , wherein the processor is configured to calculate a value X m according to the following relation:
X m =[( X ″−( X′+R ))*( q −1 mod p )]* q +( X′+R ),
where X′ and X″ designate the first and second partial modular exponentiations, q and p designate respectively the first and second of the two relatively prime numbers, and R designates said digital quantity.
21. The electronic circuit of claim 20 , wherein the processor is further configured to calculate a value X according to the following relation:
X=X m −R *(1−( q −1 mod p )* q ).