Abstract: In a general aspect, a test method can include: acquiring a plurality of value sets, each comprising values of a physical quantity or of logic signals, linked to the activity of a circuit to be tested when executing distinct cryptographic operations applied to a same secret data, for each value set, counting occurrence numbers of the values of the set, for each operation and each of the possible values of a part of the secret data, computing a partial result of operation, computing sums of occurrence numbers, each sum being obtained by adding the occurrence numbers corresponding to the operations which when applied to a same possible value of the part of the secret data, provide a partial operation result having a same value, and analyzing the sums of occurrence numbers to determine the part of the secret data.

Abstract: In a general aspect, a test method can include: acquiring a plurality of value sets, each comprising values of a physical quantity or of logic signals, linked to the activity of a circuit to be tested when executing distinct cryptographic operations applied to a same secret data, for each value set, counting occurrence numbers of the values of the set, for each operation and each of the possible values of a part of the secret data, computing a partial result of operation, computing sums of occurrence numbers, each sum being obtained by adding the occurrence numbers corresponding to the operations which when applied to a same possible value of the part of the secret data, provide a partial operation result having a same value, and analyzing the sums of occurrence numbers to determine the part of the secret data.

Abstract: A cryptographic data processing method, implemented in an electronic device including a processor, the method including steps of providing a point of an elliptic curve in a Galois field, and a whole number, and of calculating a scalar product of the point by the number, the coordinates of the point and the number having a size greater than the size of words that may be processed directly by the processor, the scalar multiplication of the point by the number including steps of: storing scalar multiples of the point multiplied-by the number 2 raised to a power belonging to a series of whole numbers, setting a resulting point for each non-zero bit of the first number, adding the resulting point and one of the stored multiple points, and providing at the output of the processor the resulting point as result of the scalar product.

Abstract: This disclosure relates to methods for generating a prime number, which can be implemented in an electronic device. An example method can include calculating a candidate prime number using a formula Pr=2P·R+1, where P is a prime number and R is an integer. The method can also include applying the Pocklington primality test to the candidate prime number and rejecting the candidate prime number if it fails the Pocklington test. The integer can be generated from an invertible number belonging to a set of invertible elements modulo the product of numbers belonging to a group of small prime numbers greater than 2, where the candidate prime number is not divisible by any number of the group. The prime number P having a number of bits equal to within one bit, to half or a third of the number of bits of the candidate prime number.

Abstract: The invention relates to a method for generating a prime number, implemented in an electronic device, the method including steps of generating a prime number from another prime number using the formula Pr=2P·R+1, where P is a prime number having a number of bits lower than that of the candidate prime number, and R is an integer, and applying the Pocklington primality test to the candidate prime number, the candidate prime number being proven if it passes the Pocklington test. According to the invention, the size in number of bits of the candidate prime number is equal to three times the size of the prime number, to within one unit, the generated candidate prime number being retained as candidate prime number only if the quotient of the integer division of the integer by the prime number is odd.

Abstract: A cryptographic data processing method, implemented in an electronic device including a processor, the method including steps of providing a point of an elliptic curve in a Galois field, and a whole number, and of calculating a scalar product of the point by the number, the coordinates of the point and the number having a size greater than the size of words that may be processed directly by the processor, the scalar multiplication of the point by the number including steps of: storing scalar multiples of the point multiplied-by the number 2 raised to a power belonging to a series of whole numbers, setting a resulting point for each non-zero bit of the first number, adding the resulting point and one of the stored multiple points, and providing at the output of the processor the resulting point as result of the scalar product.

Abstract: The invention relates to a method for generating a prime number, implemented in an electronic device, the method including steps of generating a prime number from another prime number using the formula Pr=2P·R+1, where P is a prime number having a number of bits lower than that of the candidate prime number, and R is an integer, and applying the Pocklington primality test to the candidate prime number, the candidate prime number being proven if it passes the Pocklington test. According to the invention, the size in number of bits of the candidate prime number is equal to three times the size of the prime number, to within one unit, the generated candidate prime number being retained as candidate prime number only if the quotient of the integer division of the integer by the prime number is odd.

Abstract: The invention relates to a method for generating a prime number, implemented in an electronic device, the method including steps of calculating a candidate prime number having a number of bits, using the formula: Pr=2P·R+1, where P is a prime number and R is an integer, applying the Pocklington primality test to the candidate prime number, rejecting the candidate prime number if it fails the Pocklington test, generating the integer from an invertible number belonging to a set of invertible elements modulo the product of numbers belonging to a group of small prime numbers greater than 2, so that the candidate prime number is not divisible by any number of the group, the prime number P having a number of bits equal, to within one bit, to half or a third of the number of bits of the candidate prime number.

Abstract: The invention relates to a symmetric encryption process executed by a microcircuit to transform a message into an encrypted message from a secret key, the process including a first round, intermediary rounds, and a last round. According to the invention, the process includes several executions of the first round and of the last round, and a number of executions of at least one intermediary round, the number of executions being less than the number of executions of the first and last rounds. The invention is particularly applicable to DES, Triple DES, and AES processes.

Abstract: The invention relates to a method for personalizing a secure processor in a NFC system to execute a secure application, comprising steps of obtaining by a server identification data of a user memorized in a secure storage medium, personalization data corresponding to the user identification data, and identification data of a NFC system of the user, comprising an encryption key of the secure processor, encrypting by the server personalization data using the encryption key, transmitting to the NFC system encrypted personalization data, receiving by the secure processor encrypted personalization data, deciphering personalization data, and memorizing in a secured way personalization data by the secure processor.

Abstract: An integrated circuit including a multiplication function configured to execute a multiplication operation of two binary words x and y including a plurality of basic multiplication steps of components xi of word x by components yj of word y is described. The multiplication function of the integrated circuit is configured to execute two successive multiplications by modifying, in a random or pseudo-random manner, an order in which the basic multiplication steps of components xi by components yj are executed.

Abstract: A process for testing an integrated circuit includes collecting a set of points of a physical property while the integrated circuit is executing a multiplication, dividing the set of points into a plurality subsets of lateral points, calculating an estimation of the value of the physical property for each subset, and applying to the subset of lateral points a step of horizontal transversal statistical processing by using the estimations of the value of the physical property, to verify a hypothesis about the variables manipulated by the integrated circuit.

Abstract: A microprocessor including a memory and a central processing unit configured to sign a binary word written in the memory, and during the reading of a binary word in the memory, verify the signature of the binary word and, if the signature is invalid, launching a protective action of the memory. According to the invention, the central processing unit is configured to execute a write instruction of a binary word accompanied by an invalid signature in a memory zone, so that a later read of the memory zone by the central processing unit launches the protective action.

Abstract: A cryptographic method carries out a modular exponentiation of the type C=A<B1> mod N, where A is an operand, B1 is a first exponent, N is a modulus and C is a result. The method includes the steps of masking the operand A by a number s, carrying out a modular exponentiation of the masked operand by the exponent B1, and demasking the result of the exponentiation, by removing a contribution from the random number s from the result of the exponentiation. During the step of masking the operand A, the operand A is multiplied by a parameter of the form K<s.B2>, where K is a constant and B2 is a second exponent such that B1.B2=1 mod N. The method is implemented preferably by using a Montgomery multiplier. The preferred choice for the constant K is K=2p, p being an integer lying between 0 and n, n being an upper bound of the size of the modulus N and conventionally depending on the choice of implementation of the Montgomery multiplication.

Abstract: A method and a device protected against hidden channel attacks includes a calculation of the result of the exponentiation of a data m by an exponent d. The method and the device are configured to execute only multiplications of identical large variables, by breaking down any multiplication of different large variables x, y into a combination of multiplications of identical large variables.

Abstract: A countermeasure method in an electronic component implementing an asymmetric private key encryption algorithm includes generating a protection parameter, calculating, using a primitive, an intermediate data from the protection parameter, dividing the binary representation of the private key into several binary blocks, transforming each binary block using the protection parameter and, for each transformed binary block, performing an intermediate calculation using the primitive, and calculating an output data by combining the intermediate data with the intermediate calculations.

Abstract: An integrated circuit including a multiplication function configured to execute a multiplication operation of two binary words x and y including a plurality of basic multiplication steps of components xi of word x by components yj of word y is described. The multiplication function of the integrated circuit is configured to execute two successive multiplications by modifying, in a random or pseudo-random manner, an order in which the basic multiplication steps of components xi by components yj are executed.

Abstract: A process for testing an integrated circuit includes collecting a set of points of a physical property while the integrated circuit is executing a multiplication, dividing the set of points into a plurality subsets of lateral points, calculating an estimation of the value of the physical property for each subset, and applying to the subset of lateral points a step of horizontal transversal statistical processing by using the estimations of the value of the physical property, to verify a hypothesis about the variables manipulated by the integrated circuit.

Abstract: A countermeasure method in an electronic component implementing an asymmetric private key encryption algorithm includes generating a first output data, using a primitive, and a protection parameter, transforming, using the protection parameter, at least one element of a set consisting of the private key and an intermediate parameter obtained from the first output data, to respectively supply first and second operands, and generating, from an operation involving the first and second operands, a second output data.

Abstract: An integrated circuit includes a communication interface circuit, a cryptographic algorithm, a countermeasure configured to protect the cryptographic algorithm against side-channel attacks, and a mask generator configured to provide the countermeasure with mask values. The integrated circuit is configured to execute a specific command requiring the disclosure of mask values used by the countermeasures to protect the cryptographic algorithm during a cryptographic session, and, in response to such a command, to send the mask values through the communication interface circuit.