Patent Publication Number: US-11029922-B2

Title: Method for determining a modular inverse and associated cryptographic processing device

Description:
The present application claims priority from French patent application No. 18 55 043 filed on Jun. 8, 2018, which is incorporated herein by reference. 
     FIELD OF THE INVENTION 
     The present invention generally relates to the field of cryptographic processing using modular arithmetic. 
     It relates more specifically to a method for determining a modular inverse and an associated cryptographic processing device. 
     BACKGROUND OF THE INVENTION 
     It has already been proposed, for example in the article, “ Algorithm for Classical Modular Inverse ”, by Robert Lórencz in Cryptographic Hardware and Embedded Systems—CHES 2002, 4th International Workshop, pp. 57-70, volume 2523 of LNCS, Springer, a method for determining the modular inverse of a number, wherein successive iterations are applied to two pairs, each comprising a first variable and a second variable such that at the end of each iteration and for each pair, the product of the second variable and of said number is equal to the first variable modulo a given module (the two pairs comprising a first pair and a second pair). 
     In such a process, it is provided that each iteration includes either a division by two of the first variable of the first pair or of the second pair, or a combination of the first variable of the first pair and of the first variable of the second pair by addition or subtraction. 
     The respective values of the first variables thus decrease until one of them is equal to 1, in which case, due to the relationship stated above between the first variable and the second variable of each pair, the associated second value is equal to the modular inverse sought. 
     An implementation of such a method (for example, in the scope of a cryptographic algorithm) without specific precaution is not however protected against side-channel attacks. Indeed, the observation of a processor implementing the method can make it possible to detect information on data successively handled and, after repeated observation of a great number of implementations of the method, to deduct the processed number from it. 
     SUMMARY OF THE INVENTION 
     In this context, the present invention provides a method for determining a modular inverse of a number, wherein successive iterations are applied to two pairs, each comprising a first variable and a second variable, such that at the end of each iteration and for each pair, the product of the second variable and of said number is equal to the first variable modulo a given module, the two pairs comprising a first pair and a second pair, each iteration including at least one division of the first variable of the first pair or of the second pair by two, or a combination of the first variable of the first pair and of the first variable of the second pair by addition or subtraction, wherein at least some of the iterations including a combination by addition or subtraction comprise a step of storing a result of said combination in the first variable of a pair determined randomly from among the first pair and the second pair. 
     The variable storing the result of the abovementioned combination can thus differ from one implementation of the method to another (i.e. from one implementation of the cryptographic algorithm using this method to another), such that the later processing will differ according to the implementation in question. 
     This variability of the functioning is furthermore introduced for several of the iterations including such a combination, such that the processing carried out will be clearly modified from one implementation to another and cannot therefore be used by an attacker to deduce information about the data handled. 
     Other non-limiting and advantageous characteristics of the method according to the invention, taken individually or according to any technically possible combinations, are as follows: 
     when the number of iterations performed is greater than a threshold, each iteration including a combination by addition or subtraction comprises a step of storing the result of said combination in a variable withgreater absolute value from among the first variable of the first pair and the first variable of the second pair; 
     the method comprises a prior step of determining the threshold by random draw; 
     for at least one iteration comprising a combination by addition or subtraction, the combination is made by addition if the first variable of the first pair and the first variable of the second pair have opposite signs, and by subtraction if the first variable of the first pair and the first variable of the second pair have the same sign; 
     each iteration comprising a division of the first variable of a given pair by two comprises, if the second variable of said given pair is even, a step of dividing the second variable of said given pair by two, and, if the second variable of said given pair is odd, a step of determining a sum of the second variable of said given pair and of the module, and a step of dividing said sum by two; 
     the method comprises a step of storing a random value in an additional variable, and, in at least one iteration, a division of the additional variable by two is performed if the additional variable is even, and, if the additional variable is odd, a sum of the additional variable and of the module is determined and a division of this sum by two is performed; 
     each iteration including a combination by addition or subtraction comprises a corresponding (in practice similar) combination of the second variable of the first pair and of the second variable of the second pair. 
     The invention also proposes a cryptographic processing device, comprising a unit for determining the modular inverse of a number designed to apply successive iterations to two pairs each comprising a first variable and a second variable such that at the end of each iteration and for each pair, the product of the second variable and of said number is equal to the first variable modulo a given module, the two pairs comprising a first pair and a second pair, wherein said unit is designed to activate, at each iteration, at least one division block for dividing by two the first variable of the first pair or of the second pair, or a combination block for combining the first variable of the first pair and the first variable of the second pair by addition or subtraction, wherein said unit is designed, for at least some of the iterations, to store a result produced by the combination block in the first variable of a pair determined randomly from among the first pair and the second pair. 
     The unit for determining the modular inverse can furthermore be designed, when the number of iterations performed is greater than a threshold, to store the result produced by the combination block, in a variable with greater absolute value from among the first variable of the first pair and the first variable of the second pair. 
     The combination block can in practice be designed to perform the combination by addition if the first variable of the first pair and the first variable of the second pair have opposite signs (i.e. if a product of the first variable of the first pair and of the first variable of the second pair is negative), and by subtraction if the first variable of the first pair and the first variable of the second pair have the same sign (i.e. if said product of the first variable of the first pair and of the first variable of the second pair is positive). 
     The unit for determining the modular inverse is, for example, implemented in practice by means of a processor and computer program instructions stored in a memory (associated with the processor) and which can be executed by the processor to implement, for example, a method such as described below in reference to  FIG. 2 . 
     The division block can, in this case, itself also be implemented by means of the processor and computer program instructions stored in the memory and which can be executed by the processor to implement, for example, steps such as those in  FIGS. 3 and 4  described below. 
     Likewise, the combination block can thus be implemented by means of the processor and computer program instructions stored in the memory and which can be executed by the processor to implement, for example steps such as those of  FIG. 6  described below. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The following description in light of the appended drawings, given as non-limiting examples, will provide understanding of what the invention involves, and how it can be achieved. 
       In the appended drawings: 
         FIG. 1  schematically represents the main elements of an electronic entity within which the invention is implemented; 
         FIG. 2  represents an example of a method for determining an inverse according to the invention; 
         FIG. 3  represents a portion of the method of  FIG. 2  including a step of dividing by two; 
         FIG. 4  represents a portion of the method of  FIG. 2  including another step of dividing by two; 
         FIG. 5  represents an optional portion of the method of  FIG. 2 ; and 
         FIG. 6  represents a portion of the method of  FIG. 2  including a step of combining variables. 
     
    
    
     DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION 
       FIG. 1  schematically represents the main elements of an electronic entity  1  within which the invention is implemented. This electronic entity is, for example, a microcircuit card, such as a universal integrated circuit card (or UICC). In a variant, it could be a secure element (or SE)—for example a secure microcontroller; such a secure element is, for example, integrated to a handheld electronic device, such as a communication terminal or an electronic passport. According to another variant also, the electronic entity  1  could be a computer or a hardware security module (or HSM). 
     The electronic entity  1  comprises a processor  2  (here, a microprocessor), a random access memory  4  and a rewritable non-volatile memory  6  (for example, of the EEPROM (Electrically Erasable and Programmable Read-Only Memory) type). The electronic entity  1  could possibly further comprise a read-only memory. The random access memory  4  and the rewritable non-volatile memory  6  (as well as, if necessary, the read-only memory) are each linked to the processor  2  such that the processor  2  can read or write data in each of these memories. 
     One of these memories, for example, the rewritable non-volatile memory  6 , stores computer program instructions, some of which make it possible to implement the method described below in reference to  FIG. 2 , when these instructions are executed by the processor  2 . 
     The memories  4 ,  6  also store data representative of values used during the implementation of this method. 
     The electronic entity  1  is designed (here, using some of the instructions stored in a memory  4 ,  6  of the electronic entity  1  and which can be executed by the processor  2  of the electronic entity) to implement a cryptographic algorithm comprising a modular inversion. The electronic entity  1  is therefore a cryptographic processing device. 
     The electronic entity  1  further comprises a communication interface  8  for communicating with external electronic devices. In the case described here, where the electronic entity  1  is a microcircuit card, the communication interface  8  comprises, for example, contacts flush with a face of the microcircuit card. In a variant, the communication interface  8  could be produced by a contactless communication module. Generally, the communication interface  8  can be a (wired or wireless) communication module for communicating (by wired or wireless communication) with another electronic entity. 
     In some embodiments, the processor  2  can thus receive data d from the other electronic entity via the communication interface  8  and/or transmit other data, for example, a result of applying the abovementioned cryptographic algorithm, to the other electronic entity via the communication interface  8 . 
     In other embodiments, the result of applying the abovementioned cryptographic algorithm is stored in a memory, for example the rewritable non-volatile memory  6 , of the electronic entity  1 . 
     According to a first embodiment example which can be considered, the cryptographic algorithm is an algorithm for generating keys, for example in the scope of an asymmetric encryption scheme (such as RSA). In this context, the modular inversion operation is applied to the public exponent which forms part of the public key (public exponent which can then be used as an exponent to encrypt a message or verify the signature of a message) in order to obtain the associated private key (which can then be used as an exponent to decrypt a message or sign a message), or a component of the associated private key. 
     According to a second embodiment example which can be considered, the cryptographic algorithm is a cryptographic algorithm (for example, signature or signature verification) on an elliptic curve, such as the ECDSA (Elliptic Curve Digital Signature Algorithm). In such cryptographic algorithms, the modular inversion operation is applied to a scalar number; the modular inverse thus determined can thus be applied at a point of the elliptic curve by scalar product. 
     According to a third embodiment example which can be considered, the cryptographic algorithm uses a multiplicative masking mechanism (i.e. a multiplication of a value to be processed by a random mask) in order to protect the algorithm against side-channel attacks. The modular inverse determined by the modular inversion operation can thus be multiplied by a masked value in the scope of an operation of demasking this value. 
       FIG. 2  represents, in the form of a flowchart, a modular inverse determination method example according to the invention. 
     As explained below, this method makes it possible to determine the modular inverse of a number a in modular arithmetic of module p, i.e. to determine the value of: a −1  mod p. (Generally, it is provided that the module p is strictly greater than 2 and that the module p and the number a are prime to each other. In practice, in some embodiments, the module p is a prime number and/or the number a is strictly less than the module p.) 
     As already indicated, the number a can be the public exponent of a public key of an asymmetric encryption scheme (for example, of RSA type) and the method for determining the modular inverse is thus implemented in the scope of determining the private key associated with the public key (cryptographic algorithm for generating keys). 
     In this same context (cryptographic algorithm for generating keys in an asymmetric encrypting scheme such as RSA), the method for determining the modular inverse can be implemented for calculating a key parameter i a =a −1  mod p, where a is a secret factor of the RSA module (these secret factors being generally referenced p and q). 
     In a variant, the number a can be a scalar in the scope of a cryptographic algorithm on an elliptic curve, the modular inverse obtained thus possibly being applied to a point of the elliptic curve by means of a scalar product (directly or after multiplication by at least one other scalar). 
     According to another variant, also in the scope of a cryptographic algorithm on an elliptic curve, the method for determining the modular inverse is applied to the third coordinate (generally referenced z) of a point of the curve in projective coordinates during a conversion into affine coordinates. 
     According also to another variant, the number a can be a multiplicative mask; the modular inverse obtained can thus be applied by multiplication to a masked item of data handled in the scope of the cryptographic algorithm in question. 
     In another use case, the method for determining the modular inverse is implemented in the scope of a method for protecting the RSA-CRT algorithm against fault attacks, such as described in the article, “ Fault Attacks and Countermeasures on Vigilant&#39;s RSA - CRT Algorithm ”, by Jean-Sébastien Coron, Christophe Giraud, Nicolas Morin, Gilles Piret, David Vigilant, in FDTC 2010 (2010 Workshop on Fault Diagnosis and Tolerance in Cryptography, FDTC 2010, Santa Barbara, Calif., USA, 21 Aug. 2010), IEEE Computer Society 2010, pp. 89-96. The number a is, in this case, a secret factor of the module N of the RSA algorithm and the module p is the mask r 2  which is applied to said secret factor. 
     The method of  FIG. 2  starts in step E 0  by initialisation (here, the setting to zero) of a counter CNT. The counter CNT is, for example, stored in the RAM  4  and initialised in step E 0  by the processor  2 . 
     Optionally, during this step E 0 , it can also be provided, to determine, by random draw, a variable A (used in the optional steps represented in  FIG. 5 , as described below). 
     The processor  2  thus initialises, in step E 2 , a first pair (U 0 , V 0 ) of variables with the values (p, 0). In other words, the first variable U 0  of the first pair is initialised with the value of the module p and the second variable V 0  of the first pair is initialised with the value 0 (value of the neutral element for the addition). 
     The processor  2  then initialises in step E 4 , a second pair (U 1 , V 1 ) of variables with the values (a, 1). In other words, the first variable U 1  of the second pair is initialised with the value of the number a (of which it is sought to determine the modular inverse) and the second variable V 1  of the second pair is initialised with the value 1 (value of the neutral element for the multiplication). 
     It is noted, that for each pair (i.e. for the first pair, as for the second pair), the product of the second variable V 0 ; V 1  and of the number a is equal to the first variable U 0 ; U 1  modulo the module p. Indeed: 
     V 0 .a=0.a=0=p mod p=U 0  mod p, 
     V 1 .a=1.a=a=U 1  mod p. 
     As explained below, this relationship will be true (for each of the two pairs) all throughout the method, at the end of each of the iterations described below. 
     The method thus enters into a loop (in step E 6 ) in order to implement a plurality of iterations, as long as none of the first variables U 0 , U 1  is zero. 
     Each of these iterations thus starts in step E 6 , in which the processor  2  determines if the first variable U 0  of the first pair has an even value (i.e. if U 0 =0 mod 2). 
     In the negative (arrow N), the method continues in step E 16  described below. 
     In the positive case (arrow P), the processor  2  proceeds to step E 8  (represented in  FIG. 3 ), to divide by 2 the content of the first variable U 0  of the first pair (for example, by shifting a bit towards the right, the binary representation of the first variable U 0 ), then implements step E 10 . 
     During this step E 10 , the processor  2  determines if the second variable V 0  of the first pair has an even value (i.e. if V 0 =0 mod 2). 
     In the positive case (arrow P), the processor  2  proceeds to step E 12  to divide by 2 the content of the second variable V 0  of the first pair (for example, by shifting a bit towards the right, the binary representation of this second variable V 0 ). 
     In the negative case (arrow N), the processor  2  first adds the module p to the content of the second variable V 0  of the first pair, then proceeds to divide by 2 the content (thus modified) of the second variable V 0  of the first pair, for example by shifting a bit towards the right, the binary representation of this second variable V 0  (step E 14 ). 
     Indeed, it is reminded that the module p is odd (it is a prime number strictly greater than 2) and that, if the second variable V 0  is odd according to the test of step E 10 , the sum V 0 +p is thus even and therefore divisible by 2. 
     Moreover, it is noted, that the processing carried out in steps E 8  to E 14  make it possible to keep the relationship: V 0 .a=U 0  mod p. 
     Whatever the result of the test of step E 10 , the method is followed by step E 56  described below. 
     Now, step E 16  is described (to which the method leads when the content of the first variable U 0  of the first pair is odd, see above step E 6 ). 
     The processor  2  determines in step E 16  if the first variable U 1  of the second pair has an even value (i.e. if U 1 =0 mod 2). 
     In the negative (arrow N), the method is followed by step E 26  described below in reference to  FIG. 5 . 
     In the positive case (arrow P), the processor  2  proceeds to step E 18  (represented in  FIG. 4 ) to divide by 2 the content of the first variable U 1  of the second pair (for example, by shifting a bit towards the right, the binary representation of the first variable U 1 ), then implements step E 20 . 
     During this step E 20 , the processor  2  determines if the second variable V 1  of the second pair has an even value (i.e. if V 1 =0 mod 2). 
     In the positive case (arrow P), the processor  2  proceeds to step E 22  to divide by 2 the content of the second variable V 1  of the second pair (for example, by shifting a bit towards the right, the binary representation of this second variable V 1 ). 
     In the negative case (arrow N), the processor  2  first adds the module p to the content of the second variable V 1  of the second pair, then proceeds to dividing by 2 the content (thus modified) of the second variable V 1  of the second pair, for example by shifting a bit towards the right, the binary representation of this second variable V 1  (step E 24 ). 
     It is noted that steps E 18  to E 24  implement within the second pair (U 1 , V 1 ), a processing identical to that implemented within the first pair (U 0 , V 0 ) by means of steps E 8  to E 14 . 
     As indicated for the first pair (U 0 , V 0 ) above, this processing makes it possible to keep the relationship: V 1 .a=U 1  mod p. 
     Whatever the result of the test of step E 20 , the method is followed by step E 56  described below. 
     Now, step E 26  is described (represented in  FIG. 5 ) to which the method leads when the content of the first variable U 1  of the second pair is odd (after the test of step E 16 ). 
     The implementation of steps E 26  to E 32  (represented in  FIG. 5 ) is optional and the method could therefore, in a variant, be followed directly by step E 34  represented in  FIG. 6  (in case of negative determination in step E 16 ). 
     The processor  2  proceeds to step E 26  to dividing by 2 the content of the variable A (for example, by shifting a bit towards the right, the binary representation of the variable A), then implements step E 28 . 
     During this step E 28 , the processor  2  determines if the variable A has an even value (i.e. if A=0 mod 2). 
     In the positive case (arrow P), the processor  2  proceeds to step E 30  to dividing by 2 the content of the variable A (for example, by shifting a bit towards the right, the binary representation of this variable A). 
     In the negative case (arrow N), the processor  2  first adds the module p to the content of the variable A, then proceeds to dividing by 2 the content (thus modified) of the variable A, for example, by shifting a bit towards the right, the binary representation of this variable A (step E 32 ). 
     Steps E 26  to E 32  are dummy steps intended to simulate, when the two first variables U 0 , U 1  are odd (negative results in the tests of steps E 6  and E 16 ), the functioning implemented, either in steps E 8  to E 14 , or in steps E 18  to E 24 . During steps E 26  to E 32 , indeed, operations to variable A (dummy variable) of the same type as those used, either in steps E 8  to E 14 , or in steps E 18  to E 24  are applied. 
     The content of the variable A is not, however, used at all to determine the modular inverse and can therefore be modified at will, without consequence on the modular inverse determined. A division by 2 of the variable A can moreover thus be made (in practice, a shifting of a bit towards the right of the variable A) in step E 26  (to simulate step E 8  or step E 18 ) without verifying beforehand, if the content of the variable A is even. 
     Whatever the result of the test of step E 28  (or in case of negative determination in the test of step E 16  in the variant where the steps of  FIG. 5  are not used), the method is followed by step E 34  (see  FIG. 6 ). 
     The processor  2  determines, in step E 34 , if the current value of the counter CNT is greater than at a limit B. In practice, the limit B can be predetermined (and in this case, for example, stored in the non-volatile memory  6 ). 
     According to a first variant which can be considered, the limit B could be determined (at the start of the method of  FIG. 2 , for example in step E 0 ) according to the number of bits of the module p. 
     According to a second variant which can be considered, the limit B could be determined (at the start of the method of  FIG. 2 , for example in step E 0 ) by random draw, for example within a predetermined range of values. 
     As explained below, the limit B makes it possible to determine from which iteration, the convergence of the process is accelerated (thanks to steps E 38  to E 42 ). 
     As long as the current value of the counter CNT is less than the limit B (negative determination in step E 34 ), the method continues to step E 36  to which the processor  2  determines a binary index r by random draw (from among the value 0 and the value 1). 
     The method is then followed by step E 44  described below. 
     When the current value of the counter CNT is greater than the limit B (positive determination in step E 34 ), the method is followed by step E 38  in which the processor  2  compares the absolute values of the first variables U 0 , U 1 . (Indeed, a first variable U 0 ; U 1  at least could be negative in some situations following a preceding passage to step E 50 .) 
     If the absolute value of the first variable U 0  of the first pair is greater than the absolute value of the first variable U 1  of the second pair (i.e. |U 0 |&gt;|U 1 |, positive test in step E 38 ), the processor  2  sets the binary index r to 0 (step E 40 ). 
     If the absolute value of the first variable U 0  of the first pair is less than or equal to the absolute value of the first variable U 1  of the second pair (i.e. |U 0 |≤|U 1 |, negative test in step E 38 ), the processor  2  sets the binary index r to 1 (step E 42 ). 
     Due to steps E 46  and E 50  described below, it is thus the first variable U 0 ; U 1  having the greater absolute value which will be modified in step E 46  or E 50 , specifically with a view to decrease the absolute value thereof, which helps with the convergence of the process. 
     Whatever the result of the test of step E 38 , the method is followed by step E 44  now described. 
     The processor  2  determines in step E 44  if the first variables U 0 , U 1  have opposite signs, i.e. if (U 0 &gt;0 &amp; U 1 &lt;0)∥(U 0 &gt;0), where “&amp;” designates the logical operator AND, and “∥” designates the logical operator OR. In practice for instance, the processor  2  determines in step E 44  if the product of both first variables U 0 , U 1  is negative. 
     If so, in step E 44  (arrow P), the processor  2  proceeds in step E 46  to the combination by addition of the first variable U 0  of the first pair and of the first variable U 1  of the second pair, and to the storing the result of this combination in the first variable U r  of the pair designated by the binary index r, a binary index of value 0 designating the first pair and a binary index of value 1 designating the second pair. 
     The first variables U 0 , U 1  here having opposite signs, this combination by addition makes it possible to reduce the absolute value of the modified first variable U r . 
     The processor  2  also proceed, in this case, to the combination by addition of the second variable V 0  of the first pair and of the second variable V 1  of the second pair, and to the storing of the result of this combination in the second variable V r  of the pair designated by the binary index r (step E 48 ). 
     Thanks to the similarity of the processing carried out respectively on the first variables U 0 , U 1  and on the second variables V 0 , V 1  during steps E 46  and E 48 , the relationship V r .a=U r  mod p remains true for the pair (designated by the binary index r) which has just been modified (the relationship V 1-r .a=U 1-r  mod p remaining true, also for the other pair, due to it not being modified). 
     (Here, it is noted that the abovementioned additions are referenced “U r +U 1-r ” and “V r +V 1-r ” in  FIG. 6  by symmetry with the subtractions of steps E 50  and E 52  described below, but could, in a variant, be referenced respectively “U 0 +U 1 ” and “V 0 +V 1 ”.) 
     In the negative in step E 44  (arrow N), the processor  2  proceeds in step E 50  to the combination by subtraction of the first variable U 0  of the first pair and of the first variable U 1  of the second pair, and to the storing of the result of this combination in the first variable U r  of the pair designated by the binary index r. 
     The first variables U 0 , U 1  here being of the same sign (i.e. their product is positive), this combination by subtraction makes it possible to reduce the absolute value of the modified first variable U r . 
     Specifically, in step E 50 , the processor  2  subtracts, from the first variable U r  of the pair designated by the binary index r, the first variable U 1-r  of the other pair: as indicated in  FIG. 6 , the operation carried out is: U r −U 1-r . 
     The processor  2  also proceeds, in this case, to the combination by subtraction of the second variable V 0  of the first pair and of the second variable V 1  of the second pair, and to the storing of the result of this combination in the second variable V r  of the pair designated by the binary index r (step E 52 ). 
     Specifically, in step E 52 , the processor  2  subtracts, from the second variable V r  of the pair designated by the binary index r, the second variable V 1-r  of the other pair: V r −V 1-r . 
     Thanks to the similarity of the processing carried out respectively on the first variables U 0 , U 1  and on the second variables V 0 , V 1  during steps E 50  and E 52 , the relationship V r .a=U r  mod p remains true for the pair (designated by the binary index r) which has just been modified (the relationship V i-r .a=U 1-r  mod p remaining true, also for the other pair due to the fact that it is not modified). 
     It is reminded that, as long as the current value of the counter CNT has not reached the limit B, the binary index r (which designates the pair modified during steps E 46  and  48 , or E 50  and E 52 ) is determined randomly (in step E 36  described above). 
     Thus, the sequence of the variables successively modified during different iterations is different from one implementation to another of the method of  FIG. 2 , such that an attacker cannot deduce the values handled from the repeated observation of the implementation of the method. 
     Whatever the result of the test in step E 44 , the method continues in step E 56  (represented in  FIG. 2 ), in which the processor increments the counter CNT. 
     As long as neither the first variable U 0  of the first pair, nor the first variable U 1  of the second pair equals 0 (test of step E 58 ), the method loops in step E 6  to implement a new iteration. 
     Thus, the method of  FIG. 2  comprises a plurality of iterations each including a division by two of the first variable U 0  of the first pair (step E 8 ,  FIG. 3 ), or a division by two of the first variable U 1  of the second pair (step E 18 ,  FIG. 4 ), or even a combination of the first variable U 0  of the first pair and of the first variable U 1  of the second pair ( FIG. 6 ) by addition (step E 46 ) or by subtraction (step E 50 ). 
     In a variant, each iteration could comprise several operations from among: a division by two of the first variable U 0  of the first pair, a division by two of the first variable U 1  of the second pair, a combination of the first variable U 0  of the first pair and of the first variable U 1  of the second pair by addition or by subtraction. 
     In particular, it can be provided, that each iteration comprises: 
     as long as the first variable U 0  of the first pair has an even value, a repetition of the steps of  FIG. 3 , each time including a division by two of the first variable U 0  of the first pair; 
     as long as the first variable U 1  of the second pair has an even value, a repetition of the steps of  FIG. 4 , each time including a division by two of the first variable U 1  of the second pair; 
     the steps of  FIG. 6 , including a combination of the first variable U 0  of the first pair and of the first variable U 1  of the second pair by addition or by subtraction. 
     As explained above (whatever the embodiment), at the end of each iteration, the following relationships are maintained: 
     V 0 .a=U 0  mod p and V i .a=U 1  mod p. 
     When the first variable U 0  of the first pair or the first variable U 1  of the second pair is zero (negative determination in the test of step E 58 ), the method continues in step E 60 , in which the processor  2  determines if the first variable U 0  of the first pair is zero. 
     If so, (arrow P), the processor  2  sets an index i to the value 1 (step E 62 ). In the negative (arrow N), the processor  2  sets an index i to the value 0 (step E 64 ). The index i thus designates the pair of which the first variable U i  is non-zero (and in this case equals 1 as an absolute value). 
     The processor  2  thus determines in step E 66  if the first variable U i  of the pair designated by the index i equals −1, in which case the processor  2  determines the value p-V i  (i.e. the result obtained by subtracting the second variable V i  designated by the index i from the module p) and stores the value thus determined in the second variable V i  designated by the index i (overwriting the preceding value). 
     Thus, in any case, the following is achieved: V i .a=1 mod p. 
     The processor  2  can thus determine in step E 70  the value of the modular inverse sought (a −1 ) by applying to the second variable of the pair designated by the index i, the operation of the remainder of module p: a −1 =V i  mod p.