Abstract: A device for converting a term comprising a product of a first operand and a second operand into a representation having an integer quotient regarding a modulus and a remainder, the integer quotient being defined by T/N, T being the term and N being the modulus, and the remainder being defined by T mod N, N being the modulus. The device modularly reduces the term using the modulus on the one hand and modularly reduces the term using an auxiliary modulus, which is greater than the modulus, on the other hand to obtain the remainder on the one hand and the auxiliary remainder on the other hand. Both the remainder and the auxiliary remainder are combined to obtain the integer quotient. The inventive device makes it possible to calculate even the integer quotient, that is the result of the divide (DIV) operation, by performing a command for a modular multiplication existing on conventional cryptoprocessors two times.

Abstract: A processor includes a calculator, a plurality of electronic fuses for storing secret data and reader for reading out the plurality of electronic fuses to determine the secret data. By storing the secret data, like for example a secret key for the identification of the processor or a chip card, respectively, in which the processor is arranged, in electronic fuses, a secure and efficient and simultaneously flexible way for introducing sensitive information into an integrated circuit is achieved.

Abstract: In a method for protecting a calculation in a cryptographic algorithm, the calculation obtaining input data so as to create output data, input data for the calculation are initially provided. Subsequently, the calculation is performed so as to obtain the output data of the calculation. After the calculation has been performed, a verification is carried out as to whether the input data was changed during the calculation, to be precise using a verification algorithm which differs from the calculation itself. If the verification proves that the input data was changed during the calculation, forwarding of the output data is suppressed. By doing so, outputting of incorrect results of the calculation of the cryptographic algorithm is prevented with a high degree of certainty, since the input data is particularly susceptible to hardware attacks. In addition, the input data may be examined with a view to their integrity with little expenditure compare to calculating the cryptographic algorithm itself.

Abstract: For a secure encryption of original data the original data are first of all encrypted using an encryption key or an encryption algorithm. The thus obtained data are then again decrypted using a decryption algorithm and a decryption key in order to obtain decrypted data. These data are again used together with the original data in order to calculate an auxiliary key. The decrypted data are then encrypted using the calculated auxiliary key in order to obtain output data. In case of a DFA attack no output of the device is suppressed, but the output result is encrypted using the auxiliary key which deviates from the original encryption key in case of the DFA attack so that an attacker cannot use the output data anymore and the DFA attack is useless.

Abstract: A processor includes a source register having a source register content, a destination register, a calculating unit for performing a calculation using the source register content, wherein the calculation is performed in several calculation cycles, and wherein in each cycle only one portion of the source register content is useable, a data bus connected to the source register, the destination register and the calculating unit, and a processor controller. The processor controller is operable to supply the source register content in portions to the calculating unit on the one hand and to the destination register on the other hand during the calculation via the data bus, so that after an execution of the calculation the source register content is written into the destination register. Therefore it is possible to obtain a register copy of a source register the destination register via a limited data bus without additional machine cycles for long operands to be processed in portions.

Abstract: Device for treating a memory state resulting from incomplete writing or erasing of data. The memory includes memory cells organized in a plurality of pages each having generation information indicating a programming time of the page. A unit determines generation information from the generation information of the plurality of pages to obtain determined generation information indicating a programming time which is not the oldest programming time. A page determination unit determines a page including an inconsistency from the plurality of pages to obtain a determined page. A selection unit selects a further page, a marking unit marks the further page to obtain a marked page, and a providing unit provides new generation information based on the determined generation information. A reading unit reads data from the marked page and a writing unit writes the data read from the marked page and the new generation information to the determined page.

Abstract: A method and apparatus for writing to a target memory page of a memory has an initial memory page having allocated thereto a marking memory containing information whether a content of the initial memory page is written correctly to the target memory page. The apparatus includes a memory controller for determining whether the target memory page has an error, if the target memory page has an error, for erasing it, if the marking memory indicates that the target memory page is not written correctly, for writing the target memory page based on the initial memory page, if the target memory page is written correctly, for changing the marking memory such that the marking memory indicates that the target memory page is written correctly, and if the marking memory of the initial memory page indicates that the target memory page is written correctly, for erasing the initial memory page.

Abstract: A calculating unit for reducing an input number with respect to a modulus, wherein the input number has input number portions of different significances, wherein the input number portions represent the input number with respect to a division number, wherein the modulus has modulus portions of different significances, and wherein the modulus portions represent the modulus with respect to the division number, includes a unit for estimating a result of an integer division of the input number by the modulus using a stored most significant portion of the number, a stored most significant portion of the modulus and the number, and for storing the estimated result in a memory of the calculating unit, and a unit for calculating a reduction result based on a subtraction of a product of the modulus and a value derived from the estimated result from the number.

Abstract: For calculating a result of a modular multiplication with long operands, at least the multiplicand is divided into at least three shorter portions. Using the three shorter portions of the multiplicand, the multiplier and the modulus, a modular multiplication is performed within a cryptographic calculation, wherein the portions of the multiplicand, the multiplier and the modulus are parameters of the cryptographic calculation. The calculation is performed sequentially using the portions of the multiplicand and using an intermediate result obtained in a previous calculation, until all portions of the multiplicand are processed, to obtain the final result of the modular multiplication. The calculation of an intermediate result is performed using a multiplication addition operation, in which MMD operations and updating operations are performed sequentially, and short auxiliary registers and short result registers are used.

Abstract: For calculating the result of a sum of a first operand and a second operand, a modified second operand is calculated, which is negative and less than the modulus. Based on this modified second operand, a sum is calculated which is less than a maximally processable number of a calculating unit executing the calculation. Finally, the sum calculated using the modified second operand is reduced, namely with respect to the modulus, to obtain the result of the sum of the first and second operands.

Abstract: For the determination of a result of a modular exponentiation, a randomization auxiliary number is employed for the randomization of the exponent on the basis of the product of the public key and the private key less “1”. This randomization auxiliary number may be derived from the private RSA dataset without special functionalities. Thus, low-overhead exponent randomization may be performed for each security protocol universally, to perform a digital signature secure against side-channel attacks.

Abstract: A processor circuit includes a logic chip with a logic circuit and a non-volatile memory as well as a memory chip with a non-volatile memory. A key is stored in the non-volatile memory of the logic chip by using electronic fuses. Further, personalization information is stored, which signalizes that the logic chip is allocated to a memory chip. A chip identification encrypted with the key is stored in the memory chip at an ID memory area. During starting up the processor, it is first verified whether the encrypted logic chip identification stored in the memory chip is authentic or not. Thereby, a simple and inexpensive personalization of a memory chip to a logic chip can be obtain in order to ward off attacks with regard to the removal or manipulation, respectively, of the memory chip.

Abstract: A processor means includes calculating means, a plurality of electronic fuses for storing secret data and means for reading out the plurality of electronic fuses to determine the secret data. By storing the secret data, like for example a secret key for the identification of the processor means or a chip card, respectively, in which the processor means is arranged, in electronic fuses, a secure and efficient and simultaneously flexible way for introducing sensitive information into an integrated circuit is achieved.

Abstract: Device for treating a memory state resulting from incomplete writing or erasing of data. The memory includes memory cells organized in a plurality of pages each having generation information indicating a programming time of the page. A unit determines generation information from the generation information of the plurality of pages to obtain determined generation information indicating a programming time which is not the oldest programming time. A page determination unit determines a page including an inconsistency from the plurality of pages to obtain a determined page. A selection unit selects a further page, a marking unit marks the further page to obtain a marked page, and a providing unit provides new generation information based on the determined generation information. A reading unit reads data from the marked page and a writing unit writes the data read from the marked page and the new generation information to the determined page.

Abstract: An apparatus for calculating a representation of a result operand of the non-linear logical operation between a first operand and a second operand includes a first logic gate and a second logic gate. Each operand is represented by two auxiliary operands, which, when linearly combined together result in the respective operand. The first and second logic gates are designed such that an average energy consumption of the first or second logic gate is substantially equal to a plurality of combinations of auxiliary operands at the beginning of a first operation cycle and auxiliary operands at the beginning of a second operating cycle, the average energy being derivable from a plurality of different orders of occurrences of the first to fourth auxiliary operands.

Abstract: An apparatus for detecting a potential attack on a crypto-graphic calculation performing a calculation with at least one parameter includes first means for providing a parameter masked according to a first masking algorithm, first means for performing the calculation with the masked parameter in order to obtain a masked result of the calculation, means for remasking the masked result formed to process the masked result so that a remasked result masked according to a second masking algorithm is obtained, second means for providing a parameter masked according to the first masking algorithm, second means for performing the calculation with the provided masked parameter in order to obtain a second masked result, and means for examining the first remasked result and the second masked result in order to detect the potential attack.

Abstract: A device for calculating a multiplication of a multiplier and a multiplicand includes a first performer that performs an exact three operand addition and a second performer that performs an approximated operand addition and a calculator that calculates current look-ahead parameters using the approximated intermediate results. The first performer is further implemented to perform an exact three operand addition in the current iteration step using the exact intermediate result for the current iteration step and using the look-ahead parameters calculated for the current iteration step.

Abstract: For calculating the result of an exponentiation Bd, B being a base and d being an exponent which can be described by a binary number from a plurality of bits, a first auxiliary quantity X is at first initialized to a value of 1. Then a second auxiliary quantity Y is initialized to the base B. Then, the bits of the exponent are sequentially processed by updating the first auxiliary quantity X by X2 or by a value derived from X2 and by updating the second auxiliary quantity Y by X*Y or by a value derived from X*Y, if a bit of the exponent equals 0. If a bit of the exponent equals 1, the first auxiliary quantity X is updated by X*Y or by a value derived from X*Y and the second auxiliary quantity Y is updated by Y2 or by a value derived from Y2. After sequentially processing all the bits of the exponent, the value of the first auxiliary quantity X is used as the result of the exponentiation. Thus a higher degree of security is obtained by homogenizing the time and current profiles.

Abstract: A register cell includes a first input for a data unit to be written into the register cell. The register cell includes further a second input for a negated data unit to be written into the register cell. A first pair of oppositely coupled inverters as a first storage circuit is adapted to be coupled to the first input. A second pair of oppositely coupled inverters as a second storage circuit is adapted to be coupled to a second input. Using two oppositely coupled pairs of inverters makes it possible to initialize both the first input and the second input of the register either to a high voltage state (precharge) or to a low voltage state (discharge), such that the power consumption of the register cell is homogenized from one working clock to the next.

Abstract: An apparatus for calculating a modular multiplication includes an examiner for examining digits of the multiplier with a lookahead algorithm to obtain a multiplication shift value. In addition, a determinator and intermediate-result shift value are provided which determine a positive intermediate-result shift value. A calculator for calculating a multiplicand shift value as the difference between the intermediate-result shift value and the multiplication shift value. The intermediate result from the preceding iteration step as well as the multiplicand are then shifted by the corresponding shifting magnitudes to then perform a three-operands addition with the shifted values, if need be while considering lookahead parameters.