Patent ID: 8588407

Claim:
A method for protecting a digital quantity over a first number of bits, in an algorithm executing at least one modular exponentiation of data by said quantity, successive iterations of different calculation steps, according to a state of a current bit of said quantity, comprising at least two multiplications, the method comprising performing, for each iteration, a same number of multiplications whatever the state of said current bit, said steps of each iteration comprising a test on the state of only said current bit to condition the operands of at least one of the multiplications, branching to a first multiplication or to a second multiplication according to the state of said current bit, and using intermediate results of all the multiplication steps of each iteration in calculating a final result, wherein for a number n of bits of said quantity, a first register for storing the final result is initialized with the unity value and said steps of each iteration of n iterations are: R i =( S i+1 ) 2 mod P ; then S i =R i *M mod P if the current bit is equal to 0, or S i =R i *( kP+ 1)mod P otherwise, where S i designates the value contained in the first register during iteration i, R i designates the value contained in a second register during iteration i, M designates the data, P designates the modulo over n bits, and k designates a non-zero relative integer, wherein S i represents the modular exponentiation of data M after all iterations and wherein the digital quantity is protected against fault injection by performing the same number of multiplications whatever the state of the current bit and by using the intermediate results of all the multiplication steps of each iteration in calculating the final result.