Abstract: A device for converting a term comprising a product of a first operand and a second operand into a representation having an integer quotient regarding a modulus and a remainder, the integer quotient being defined by T/N, T being the term and N being the modulus, and the remainder being defined by T mod N, N being the modulus, includes means for modularly reducing the term using the modulus on the one hand and for modularly reducing the term using an auxiliary modulus, which is greater than the modulus, on the other hand to obtain the remainder on the one hand and the auxiliary remainder on the other hand. Both the remainder and the auxiliary remainder are fed into means for combining to obtain the integer quotient. The inventive device makes it possible to calculate even the integer quotient, that is the result of the DIV operation, by performing a command for a modular multiplication existing on conventional cryptoprocessors two times.

Abstract: Apparatus for calculating a result of a modular multiplication of a first operand and a second operand with regard to a modulus, each having a length of 2 n bits, the operands and the modulus are split into sub-operands of half the length and are fed to controller controlling MMD unit for performing a MultModDiv operation in accordance with a predetermined step sequence with corresponding input operands and MMD moduli to obtain integer quotient values and residual values with regard to the MMD modulus at an output. The combiner is operable to combine integer quotient values and residual values from predetermined steps of the step sequence to obtain the result.

Abstract: A processor includes a source register having a source register content, a destination register, a calculating unit for performing a calculation using the source register content, wherein the calculation is performed in several calculation cycles, and wherein in each cycle only one portion of the source register content is useable, a data bus connected to the source register, the destination register and the calculating unit, and a processor controller. The processor controller is operable to supply the source register content in portions to the calculating unit on the one hand and to the destination register on the other hand during the calculation via the data bus, so that after an execution of the calculation the source register content is written into the destination register. Therefore it is possible to obtain a register copy of a source register the destination register via a limited data bus without additional machine cycles for long operands to be processed in portions.

Abstract: A calculating unit includes a first calculating unit block, a second calculating unit block, controller, and connector having connecting lines, wherein for each elementary cell having a same significance in the first calculating unit block and the second calculating unit block an individual connecting line is provided to achieve a quick register exchange by means of the controller of the calculating unit blocks operating in parallel.

Abstract: A register cell includes a first input for a data unit to be written into the register cell. The register cell includes further a second input for a negated data unit to be written into the register cell. A first pair of oppositely coupled inverters as a first storage circuit is adapted to be coupled to the first input. A second pair of oppositely coupled inverters as a second storage circuit is adapted to be coupled to a second input. Using two oppositely coupled pairs of inverters makes it possible to initialize both the first input and the second input of the register either to a high voltage state (precharge) or to a low voltage state (discharge), such that the power consumption of the register cell is homogenized from one working clock to the next.

Abstract: A device for generating an operation code having a plurality of operation code words includes a means for providing an operation group with operations from a set of operations, wherein the operations from the operation group are performable alternatively to one another depending on a decision within a program. The device further includes a means for associating operation code words with the operations of the operation group, wherein the associated code words are different from one another and implemented such that a characteristic of a circuit depending on a processing of the operation code words is located within a predetermined range for the operation code words of the operation group. Decisions within the program which depend on secret data may therefore not be tapped any more by detecting the characteristic, like for example a current reception of a circuit, by side-channel attacks, so that a cryptoprocessor works more efficient and safe without an additional circuit complexity.

Abstract: For a secure encryption of original data the original data are first of all encrypted using an encryption key or an encryption algorithm. The thus obtained data are then again decrypted using a decryption algorithm and a decryption key in order to obtain decrypted data. These data are again used together with the original data in order to calculate an auxiliary key. The decrypted data are then encrypted using the calculated auxiliary key in order to obtain output data. In case of a DFA attack no output of the device is suppressed, but the output result is encrypted using the auxiliary key which deviates from the original encryption key in case of the DFA attack so that an attacker cannot use the output data anymore and the DFA attack is useless.

Abstract: A device for calculating a result or an integer multiple of the result of a division of a numerator by a denominator includes a unit for providing a factor which is selected such that a product of the factor and the denominator is greater than the result. The device further includes a unit for modularly reducing a first product of the numerator and the factor using a modulus equaling a sum of a second product of the denominator and the factor and of an integer to obtain an auxiliary quantity having the result. A unit is used to extract the result or the integer multiple of the result from the auxiliary quantity. A division is thus reduced to a modular reduction and an extraction which is uncomplicated as far as calculation is concerned so that, in particular in long-number division tasks, the speed on the one hand and the safety on the other hand are increased.

Abstract: In a method for protecting a calculation in a cryptographic algorithm, the calculation obtaining input data so as to create output data, input data for the calculation are initially provided. Subsequently, the calculation is performed so as to obtain the output data of the calculation. After the calculation has been performed, a verification is carried out as to whether the input data was changed during the calculation, to be precise using a verification algorithm which differs from the calculation itself. If the verification proves that the input data was changed during the calculation, forwarding of the output data is suppressed. By doing so, outputting of incorrect results of the calculation of the cryptographic algorithm is prevented with a high degree of certainty, since the input data is particularly susceptible to hardware attacks. In addition, the input data may be examined with a view to their integrity with little expenditure compare to calculating the cryptographic algorithm itself.

Abstract: For calculating the result of an exponentiation Bd, B being a base and d being an exponent which can be described by a binary number from a plurality of bits, a first auxiliary quantity X is at first initialized to a value of 1. Then a second auxiliary quantity Y is initialized to the base B. Then, the bits of the exponent are sequentially processed by updating the first auxiliary quantity X by X2 or by a value derived from X2 and by updating the second auxiliary quantity Y by X*Y or by a value derived from X*Y, if a bit of the exponent equals 0. If a bit of the exponent equals 1, the first auxiliary quantity X is updated by X*Y or by a value derived from X*Y and the second auxiliary quantity Y is updated by Y2 or by a value derived from Y2. After sequentially processing all the bits of the exponent, the value of the first auxiliary quantity X is used as the result of the exponentiation. Thus a higher degree of security is obtained by homogenizing the time and current profiles.

Abstract: In a method for protecting an exponentiation calculation by means of the Chinese remainder theorem, in particular the combining step (16), wherein the Garner combination algorithm is preferably used, is verified for its correctness prior to outputting (24) the results of the combining step (18). In doing so, the combination algorithm is verified directly prior to outputting the result of the exponentiation calculation, so as to eliminate the outputs of an incorrect result, for example due to a hardware error attack, so as to ward off the error attack.