METHOD SECURED AGAINST SIDE-CHANNEL ATTACKS PERFORMING AN ARITHMETIC OPERATION OF A CRYPTOGRAPHIC ALGORITHM MIXING BOOLEAN AND ARITHMETIC OPERATIONS

摘要

The present invention relates to a method secured against side channel attacks performing an arithmetic operation of a cryptographic algorithm mixing Boolean and arithmetic operations, wherein said method is performed by a cryptographic device comprising a processing system having at least one hardware processor, and said operation has a first value (x) and a second value (y) as operands, comprising:—obtaining (S1) a first masked value (x′), a second masked value (y′), a first Boolean mask (r_x), a second Boolean mask (r_y), said first masked value (x′) resulting from masking said first value (x) by said first Boolean mask (r_x) by performing a Boolean exclusive OR (XOR) operation between said first value (x) and said first Boolean mask (r_x), and said second masked value (y′) resulting from masking said second value (y) by said second Boolean mask (r_y) by performing a Boolean exclusive OR (XOR) operation between said second value (y) and said second Boolean mask (r_y),—performing (S2) in any order a plurality of computing steps combining values among said first masked value (x′), said second masked value (y′), said first Boolean mask (r_x) and said second Boolean mask (r_y) to obtain a boolean masked result equal to the result of the arithmetic operation having said first value (x) and said second value (y) as operands, masked by a third boolean mask (r_x xor r_y) resulting from performing said Boolean exclusive OR (XOR) operation between said first Boolean mask (r_x) and said second Boolean mask (r_y) ((x+y) xor (r_x xor r_y)), wherein said computing steps perform Boolean exclusive OR (XOR) operations or arithmetic operations between said values without disclosing any information relative to the first and second values and, wherein said computing steps are executed by the hardware processor by performing a constant number of elementary operations whatever the bit-size of said first and second values,—outputting (S3) said boolean masked result of the arithmetic operation between said first value (x) and said second value (y).