Abstract: A microprocessor device comprising an implementation of a cryptographic operation constructed to process parameters and generate an output, wherein at least some of the parameters are obfuscated such that the cryptographic operation processes the obfuscated parameters, wherein the parameters which are obfuscated are obfuscated in that they are encrypted according to an additive homomorphic cryptographic system.

Abstract: A method for key generation is arranged in a client processor device, by means of which a second public client key Pc? of the client is generated. The public key Pc? is formed by a calculation, or sequence of calculations, which does not contain any operation whose result depends exclusively on the nonce s and at least one public value, or the public key Pc? being formed by a calculation, or sequence of calculations, where into each operation in which the nonce s enters, at least one non-public value enters the first private client key kc or the second private client key kc?, for example as a result of the calculation Pc?=(kc?·s)·G+(kc?·kc)·Pt.

Abstract: A microprocessor device comprising an implementation of a cryptographic operation constructed to process parameters and generate an output, wherein at least some of the parameters are obfuscated such that the cryptographic operation processes the obfuscated parameters, wherein the parameters which are obfuscated are obfuscated in that they are encrypted according to an additive homomorphic cryptographic system.

Abstract: A method in a portable data carrier for executing a cryptographic operation on security-relevant data comprises a step of determining a remainder (r) of a dividend (a) modulo a divisor (b). In so doing, the remainder (r) is determined iteratively by means of a division device of the data carrier. In each iteration there is carried out a Montgomery multiplication with the divisor (b) as the modulus and an additive linkage of an output value of the Montgomery multiplication with a coefficient (ai) derived from the dividend (a) and associated with the respective iteration. The Montgomery multiplication is carried out here by means of a multiplication device of the data carrier, preferably a corresponding coprocessor. The Montgomery multiplication of a subsequent iteration receives a result of a preceding iteration as an input value.

Abstract: A method in a portable data carrier for executing a cryptographic operation on security-relevant data comprises a step of determining a remainder (r) of a dividend (a) modulo a divisor (b). In so doing, the remainder (r) is determined iteratively by means of a division device of the data carrier. In each iteration there is carried out a Montgomery multiplication with the divisor (b) as the modulus and an additive linkage of an output value of the Montgomery multiplication with a coefficient (ai) derived from the dividend (a) and associated with the respective iteration. The Montgomery multiplication is carried out here by means of a multiplication device of the data carrier, preferably a corresponding coprocessor. The Montgomery multiplication of a subsequent iteration receives a result of a preceding iteration as an input value.

Abstract: In a method for protected execution of a cryptographic calculation in which a key with at least two key parameters is drawn on, an integrity check of the key is performed, in order to prevent a cryptographic attack in which conclusions are drawn as to at least one second key parameter by corrupting at least one first key parameter. A further method serves to determine a key for a cryptographic calculation with at least two key parameters provided for use in the first-mentioned method. A computer program product and a portable data carrier have corresponding features. The methods enable particularly good protection of cryptographic calculations against attacks.

Abstract: In a method for protected execution of a cryptographic calculation in which a key (12) with at least two key parameters (p, q, pinv, sp, dp, sq, dq) is drawn on, an integrity check (30, 34, 40, 54) of the key (12) is performed, in order to prevent a cryptographic attack in which conclusions are drawn as to at least one second key parameter (p, q, pinv, sp, dp, sq, dq) by corrupting at least one first key parameter (p, q, pinv, sp, dp, sq, dq). A further method serves to determine a key for a cryptographic calculation with at least two key parameters (p, q, pinv, sp, dp, sq, dq), provided for use in the first mentioned method. A computer program product and a portable data carrier have corresponding features. The invention enables particularly good protection of cryptographic calculations against attacks.