Giesecke & Devrient Gmbh

Giesecke+devrient Mobile Security Gmbh

Giesecke+devrient Epayments Gmbh

Markus Bockes

Michael Baldischweiler

Hermann Drexler

Jürgen Pulkus

Harald Vater

Martin Seysen

Michael Lamla

Helmut Kahl

Lars Hoffmann

Ludger Hemme

Torsten Karch

Nikola Mamuzic

Sabine Weicker

A method for key generation is arranged in a client processor device, by means of which a second public client key P' of the client is generated. The public key P′ is formed by a calculation, or sequence of calculations, which does not contain any operation whose result depends exclusively on the nonce s and at least one public value, or the public key P′ being formed by a calculation, or sequence of calculations, where into each operation in which the nonce s enters, at least one non-public value enters the first private client key kor the second private client key k′, for example as a result of the calculation P′=(k′·s)•G+(k′·k)•P.

Key generation and PACE protocol with protection against side channel attacks spying out a nonce

A microprocessor device comprising an implementation of a cryptographic operation constructed to process parameters and generate an output, wherein at least some of the parameters are obfuscated such that the cryptographic operation processes the obfuscated parameters, wherein the parameters which are obfuscated are obfuscated in that they are encrypted according to an additive homomorphic cryptographic system.

White-box ECC implementation

A method in a portable data carrier for executing a cryptographic operation on security-relevant data comprises a step of determining a remainder (r) of a dividend (a) modulo a divisor (b). In so doing, the remainder (r) is determined iteratively by means of a division device of the data carrier. In each iteration there is carried out a Montgomery multiplication with the divisor (b) as the modulus and an additive linkage of an output value of the Montgomery multiplication with a coefficient (a) derived from the dividend (a) and associated with the respective iteration. The Montgomery multiplication is carried out here by means of a multiplication device of the data carrier, preferably a corresponding coprocessor. The Montgomery multiplication of a subsequent iteration receives a result of a preceding iteration as an input value.

Method for arbitrary-precision division or modular reduction

In a method for protected execution of a cryptographic calculation in which a key with at least two key parameters is drawn on, an integrity check of the key is performed, in order to prevent a cryptographic attack in which conclusions are drawn as to at least one second key parameter by corrupting at least one first key parameter. A further method serves to determine a key for a cryptographic calculation with at least two key parameters provided for use in the first-mentioned method. A computer program product and a portable data carrier have corresponding features. The methods enable particularly good protection of cryptographic calculations against attacks.

Protected cryptographic calculation

Growing community of inventors

Munich, Germany

Markus Bockes