Abstract: A device for determining an inverse of an initial value related to a modulus, comprising a unit configured to process an iterative algorithm in a plurality of iterations, wherein an iteration includes two modular reductions and has, as an iteration loop result, values obtained by an iteration loop of an extended Euclidean algorithm.

Abstract: Embodiments relate to systems and methods for authenticating devices and securing data. In embodiments, a session key for securing data between two devices can be derived as a byproduct of a challenge-response protocol for authenticating one or both of the devices.

Abstract: A calculating unit for reducing an input number with respect to a modulus, wherein the input number has input number portions of different significances, wherein the input number portions represent the input number with respect to a division number, wherein the modulus has modulus portions of different significances, and wherein the modulus portions represent the modulus with respect to the division number, includes a unit for estimating a result of an integer division of the input number by the modulus using a stored most significant portion of the number, a stored most significant portion of the modulus and the number, and for storing the estimated result in a memory of the calculating unit, and a unit for calculating a reduction result based on a subtraction of a product of the modulus and a value derived from the estimated result from the number.

Abstract: A calculating unit for reducing an input number with respect to a modulus, wherein the input number has input number portions of different significances, wherein the input number portions represent the input number with respect to a division number, wherein the modulus has modulus portions of different significances, and wherein the modulus portions represent the modulus with respect to the division number, includes a unit for estimating a result of an integer division of the input number by the modulus using a stored most significant portion of the number, a stored most significant portion of the modulus and the number, and for storing the estimated result in a memory of the calculating unit, and a unit for calculating a reduction result based on a subtraction of a product of the modulus and a value derived from the estimated result from the number.

Abstract: For the determination of a result of a modular exponentiation, a randomization auxiliary number is employed for the randomization of the exponent on the basis of the product of the public key and the private key less “1”. This randomization auxiliary number may be derived from the private RSA dataset without special functionalities. Thus, low-overhead exponent randomization may be performed for each security protocol universally, to perform a digital signature secure against side-channel attacks.

Abstract: An apparatus for protecting an RSA calculation of an output based on input values by means of the Chinese remainder theorem, the apparatus comprising for a first determining device adapted to determine a first security parameter based on the input values, a computing device adapted to compute a control value based on the first security parameter and the input values, a calculating device adapted to calculate a modified input parameters based on the input values and the first security parameter, for a performing device adapted to perform the RSA calculation based on the modified input values to obtain a single modified output, and for a second determining device adapted to determine whether the single modified output is in a predetermined relation to the control value and applying a countermeasure in case the predetermined relation is not fulfilled.

Abstract: A device for generating a session key which is known to a first communication partner and a second communication partner, for the first communication partner, from secret information which may be determined by the first and second communication partners, includes a first module operable to calculate the session key using a concatenation of at least a part of a random number and a part of the secret information. The device also includes a second module operable to use the session key for communication with the second communication partner.

Abstract: An apparatus for detecting a potential attack on a crypto-graphic calculation performing a calculation with at least one parameter includes first means for providing a parameter masked according to a first masking algorithm, first means for performing the calculation with the masked parameter in order to obtain a masked result of the calculation, means for remasking the masked result formed to process the masked result so that a remasked result masked according to a second masking algorithm is obtained, second means for providing a parameter masked according to the first masking algorithm, second means for performing the calculation with the provided masked parameter in order to obtain a second masked result, and means for examining the first remasked result and the second masked result in order to detect the potential attack.

Abstract: An apparatus for calculating a result of a scalar multiplication of a reference number with a reference point on an elliptic curve comprises a point selector and a processor. The point selector is configured to select randomly or pseudo-randomly an auxiliary point on the elliptic curve. The processor is configured to calculate the result of the scalar multiplication with a double-and-always-add process using the auxiliary point.

Abstract: A device for calculating a multiplication of a multiplier and a multiplicand includes a first performer that performs an exact three operand addition and a second performer that performs an approximated operand addition and a calculator that calculates current look-ahead parameters using the approximated intermediate results. The first performer is further implemented to perform an exact three operand addition in the current iteration step using the exact intermediate result for the current iteration step and using the look-ahead parameters calculated for the current iteration step.

Abstract: A method and apparatus for writing to a target memory page of a memory has an initial memory page having allocated thereto a marking memory containing information whether a content of the initial memory page is written correctly to the target memory page. The apparatus includes a memory controller for determining whether the target memory page has an error, if the target memory page has an error, for erasing it, if the marking memory indicates that the target memory page is not written correctly, for writing the target memory page based on the initial memory page, if the target memory page is written correctly, for changing the marking memory such that the marking memory indicates that the target memory page is written correctly, and if the marking memory of the initial memory page indicates that the target memory page is written correctly, for erasing the initial memory page.

Abstract: An apparatus for calculating a modular multiplication includes an examiner for examining digits of the multiplier with a lookahead algorithm to obtain a multiplication shift value. In addition, a determinator and intermediate-result shift value are provided which determine a positive intermediate-result shift value. A calculator for calculating a multiplicand shift value as the difference between the intermediate-result shift value and the multiplication shift value. The intermediate result from the preceding iteration step as well as the multiplicand are then shifted by the corresponding shifting magnitudes to then perform a three-operands addition with the shifted values, if need be while considering lookahead parameters.

Abstract: An apparatus for calculating a representation of a result operand of the non-linear logical operation between a first operand and a second operand includes a first logic gate and a second logic gate. Each operand is represented by two auxiliary operands, which, when linearly combined together result in the respective operand. The first and second logic gates are designed such that an average energy consumption of the first or second logic gate is substantially equal to a plurality of combinations of auxiliary operands at the beginning of a first operation cycle and auxiliary operands at the beginning of a second operating cycle, the average energy being derivable from a plurality of different orders of occurrences of the first to fourth auxiliary operands.

Abstract: A device for calculating a result or an integer multiple of the result of a division of a numerator by a denominator includes a unit for providing a factor which is selected such that a product of the factor and the denominator is greater than the result. The device further includes a unit for modularly reducing a first product of the numerator and the factor using a modulus equaling a sum of a second product of the denominator and the factor and of an integer to obtain an auxiliary quantity having the result. A unit is used to extract the result or the integer multiple of the result from the auxiliary quantity. A division is thus reduced to a modular reduction and an extraction which is uncomplicated as far as calculation is concerned so that, in particular in long-number division tasks, the speed on the one hand and the safety on the other hand are increased.

Abstract: Apparatus for calculating a result of a modular multiplication of a first operand and a second operand with regard to a modulus, each having a length of 2 n bits, the operands and the modulus are split into sub-operands of half the length and are fed to controller controlling MMD unit for performing a MultModDiv operation in accordance with a predetermined step sequence with corresponding input operands and MMD moduli to obtain integer quotient values and residual values with regard to the MMD modulus at an output. The combiner is operable to combine integer quotient values and residual values from predetermined steps of the step sequence to obtain the result.

Abstract: A data processing system comprising a computer chip having a processing circuit and a chip-internal first memory and a chip-external second memory being coupled to the computer chip, wherein the processing circuit is configured to allow execution of computer programs stored in the first memory and to prevent execution of computer programs stored in the second memory when the data processing system is in a first state, and to allow execution of computer programs stored in the second memory when the data processing system is in a second state.

Abstract: An apparatus for protecting an RSA calculation of an output based on input values by means of the Chinese remainder theorem, the apparatus comprising for a first determining device adapted to determine a first security parameter based on the input values, a computing device adapted to compute a control value based on the first security parameter and the input values, a calculating device adapted to calculate a modified input parameters based on the input values and the first security parameter, for a performing device adapted to perform the RSA calculation based on the modified input values to obtain a single modified output, and for a second determining device adapted to determine whether the single modified output is in a predetermined relation to the control value and applying a countermeasure in case the predetermined relation is not fulfilled.

Abstract: A device for determining an inverse of an initial value related to a modulus, comprising a unit configured to process an iterative algorithm in a plurality of iterations, wherein an iteration includes two modular reductions and has, as an iteration loop result, values obtained by an iteration loop of an extended Euclidean algorithm.

Abstract: In a method for protecting an exponentiation calculation by means of the Chinese remainder theorem, in particular the combining step (16), wherein the Garner combination algorithm is preferably used, is verified for its correctness prior to outputting (24) the results of the combining step (18). In doing so, the combination algorithm is verified directly prior to outputting the result of the exponentiation calculation, so as to eliminate the outputs of an incorrect result, for example due to a hardware error attack, so as to ward off the error attack.

Abstract: A device for converting a term comprising a product of a first operand and a second operand into a representation having an integer quotient regarding a modulus and a remainder, the integer quotient being defined by T/N, T being the term and N being the modulus, and the remainder being defined by T mod N, N being the modulus. The device modularly reduces the term using the modulus on the one hand and modularly reduces the term using an auxiliary modulus, which is greater than the modulus, on the other hand to obtain the remainder on the one hand and the auxiliary remainder on the other hand. Both the remainder and the auxiliary remainder are combined to obtain the integer quotient. The inventive device makes it possible to calculate even the integer quotient, that is the result of the divide (DIV) operation, by performing a command for a modular multiplication existing on conventional cryptoprocessors two times.