Gemplus

Gemalto Sa

Zama Sas

Marc Joye

Pascal Paillier

Karine Villegas

Benoit Chevallier-Mames

Jean-Sébastien Coron

Nathalie Feyt

Pascal Gilbert Yves Paillier

Florence Ques-Rochat

Benoit Chevallier Mames

Sung-Ming Yen

The invention relates to a cryptographic method and variants thereof based on homomorphic encryption enabling the evaluation of real-valued functions on encrypted data, in order to allow carrying out homomorphic processing on encrypted data more broadly and efficiently.

Cryptographic method, systems and services for evaluating univariate or multivariate real-valued functions on encrypted data

Some embodiments are directed to a computer-implemented method () of determining a set of coefficients for homomorphically multiplying an encrypted value by a scalar. The encrypted value is represented by multiple respective value ciphertexts encrypting the value multiplied by respective powers of an even radix. The scalar multiplication is performed as a linear combination of the multiple respective value ciphertexts according to the set of coefficients. The set of coefficients are determined as digits of a radix decomposition of the scalar with respect to the radix. The determined digits lie between minus half the radix, inclusive, and plus half the radix, inclusive. It is ensured that no two subsequent digits are both equal in absolute value to half the radix.

Encrypted scalar multiplication

Some embodiments are directed to a fully homomorphic encryption (FHE) cryptography, wherein some encrypted data items are clipped, thereby reducing a bit-size of the encrypted data item and increasing an associated noise level of the encrypted data item. An FHE operation or a decrypt operation that operates on the clipped encrypted data item as input, has noise tolerance above a noise level associated with the clipped encrypted data item.

Fully homomorphic cryptography with improved data item representation

The invention relates to a cryptographic method involving an integer division of type q=a div b and r=a mod b, wherein a is a number of m bits, b is a number of n bits, with n being less than or equal to m, and bbeing non-null and the most significant bit of b. In addition, each iteration of a loop subscripted by i, which varies between 1 and m&#x2212;n+1, involves a partial division of a word A of n bits of number a by number b in order to obtain one bit of quotient q. According to the invention, the same operations are performed with each iteration, regardless of the value of the quotient bit obtained. In different embodiments of the invention, one of the following is also performed with each iteration: the addition and subtraction of number b to/from word A; the addition of number b or a complementary number /b of b to word A; or a complement operation at 2of an updated datum (b or /b) or a dummy datum (c or /c) followed by the addition of the datum updated with word A.

Integer division method secure against covert channel attacks

A cryptographic operation includes calculating a multiplication of an element of an additively denoted group by a scalar. After two registers R+R, are initialized, iterations are carried out over the components Kof the scalar K. If Kof the scalar equals 0, then the value in register Ris replaced by 2(R+R) If Kequals 1, the value in register Ris replaced by 2(R+R). At the end of the algorithm, the value of the register Ris returned as the calculated result. This method poses the advantage of carrying out a calculation of multiplying by a scalar by carrying out only doubling and adding operations of the type 2(A+B).

Method of securing a calculation of an exponentiation or a multiplication by a scalar in an electronic device

A method for the secure application of a cryptographic algorithm of the RSA type in an electronic component obtains the value of a public exponent e from a given set of probable values, without a priori knowledge of that value. Having determined the value for the public exponent e, the application of countermeasures using the value of e, to block error attacks and side channel attacks, particularly of the DPA and SPA type, are carried out on the application of a private operation of the cryptographic algorithm.

Method of securely implementing a cryptography algorithm of the RSA type, and a corresponding component

The invention relates to a cryptographic method secured against a covert channel attack. According to the invention, in order to carry out a selected block of instructions as a function of an input variable amongst N predefined instruction blocks, a common block is carried out on the predefined N instruction blocks, a predefined number of times, the predefined number being associated with the selected instruction block.

Cryptographic method protected against covert channel type attacks

The invention concerns a cryptographic method which includes integer division of the type q=a div b and/or a modular reduction of the type r=a mod b, with q being a quotient, a being a number of m bits, b being a number of n bits, n being not more than m and bbeing the most significant bit of the number b. The number a is masked by a random number p before performing the integer division and/or the modular reduction. The invention also concerns an electronic component for implementing the method. The invention is applicable for making smart cards secure against hidden channel attacks, and in particular differential attacks.

Method for secure integer division or modular reduction against hidden channel attacks

A table establishes correspondence between first sets of at least one number, expressed in accordance with a signed code where each number may have the value of 0, 1 or &#x2212;1, and second sets of at least one number, expressed according to a simple form where each number may have the value 0 or 1. An input sequence of numbers is decomposed into sets of numbers present in the correspondence table. For each set of numbers derived from the decomposition, a corresponding set of numbers is given by the correspondence table. A sequence of numbers is compiled from the sets retrieved from the table. The invention is in particular useful in various algorithms, such as in cryptography, for example to store values in signed binary mode, in compact non-adjacent form with only the numbers 0, 1 and/or for rapidly producing random numbers in the non-adjacent form.

Device and method for processing digital values in particular in non-adjacent form

There exist numerous public key probabilistic encryption algorithms. Most of these algorithms do not have a maximum security level against someone capable of chosen ciphertext attacks. The disclosed method provides a construct to enhance the security of any public key probabilistic or deterministic encryption algorithm to achieve an optimal security level.

Method for enhancing security of public key encryption schemas

The invention concerns a method for implementing in an electronic component a cryptographic algorithm using calculating means. The invention is characterized in that it consists in carrying out the following steps: a) selecting a value e among a specific number of values e, ebeing integers, b) checking if everifies a predetermined relationship: if so, then e=e, and storing e for use in calculating said cryptographic algorithm.

Method of implementing in an electronic component a cryptographic algorithm for finding the public exponent

A random prime number is generated within a predetermined interval by precalculating and storing a single value that functions as a universal parameter for generating prime numbers of any desired size. The value, &#x3c0;, is chosen as a product of k prime numbers. A number a is also chosen such that is co-prime with &#x3c0;. Once the values for &#x3c0; and a have been determined they can be stored and used for all subsequent iterations of the prime number generating algorithm. To generate a prime number, a random number x is chosen with uniform distribution, and a candidate prime number within the predetermined interval is calculated on the basis of the random number. This candidate is tested for primality, and returned as the result if it is prime. If the candidate is not prime, the random number x is multiplied by a, and used to generate a new candidate. This procedure is repeated, until the candidate is prime. Since a single value, namely &#x3c0;, needs to be precalculated, economies of storage are achieved. In addition, the interval of interest is approximated with a higher degree of resolution. Moreover, it is possible to utilize the same value of &#x3c0; for a number of different intervals.

Method for generating a random prime number within a predetermined interval

A random number that is co-prime with a set of prime numbers is generated, without having to calculate the greatest common denominator of the numbers. The value of 1&#x2212;x(mod &#x3c0;), where x is a randomly generated value and &#x3bb; is the Carmichael function, is tested to determine whether it is non-zero. If it equals zero, x is chosen as the random number of interest. Otherwise the value for x is updated, and the procedure is repeated. Due to the minimal amount of computation resources required to select x, the process is particularly well suited for generating cryptographic keys in portable electronic devices, such as smart cards.

Generation of a random number that is non-divisible by a set of prime numbers

A method for converting in a binary representation of a number based on a left-to-right processing of bits of the binary representation, to obtain a signed representation equivalent to the so-called Reitwiesner representation. The use of such a conversion method with left-to-right arithmetic processing improves hardware implementation of the method.

Growing community of inventors

Saint Zacharie, France

Marc Joye