S = M
for i from 1 to n-1 do
{
S = S * S(mod N)
if di == 1 then
{ S = S * M(mod N) }
}
replaced by:
S = M
for i from 1 to n-1 do
{
A = S * S(mod N)
B = A * M(mod N)
maskA = !di
maskB = di
S = (A & maskA) | (B & maskB)
}
Basically, it calculates the 2 possible values in to store in S, then selects automatically the right one to put in S, based on the value of di.
The choice is performed by adding properly masked results. Of course when I write "maskB = di" I mean extending the the bit to all the bits of the integer (or whatever it is). This IS possible, even in C, for example "maskB = 0 - di" if di is 0 or 1.
In assembly language you even dont need masks (that was my first idea).
On processors supporting MOVcc, you just have to move the two results conditionally to the returned register.
[^] # Re: assez de blabla. voila ce que j'en dis.
Posté par helloworld256 . En réponse à la dépêche Une faille majeure de la cryptographie courante. Évalué à 2.
how to remove conditional jumps:
my method:
S = M
for i from 1 to n-1 do
{
S = S * S(mod N)
if di == 1 then
{ S = S * M(mod N) }
}
replaced by:
S = M
for i from 1 to n-1 do
{
A = S * S(mod N)
B = A * M(mod N)
maskA = !di
maskB = di
S = (A & maskA) | (B & maskB)
}
Basically, it calculates the 2 possible values in to store in S, then selects automatically the right one to put in S, based on the value of di.
The choice is performed by adding properly masked results. Of course when I write "maskB = di" I mean extending the the bit to all the bits of the integer (or whatever it is). This IS possible, even in C, for example "maskB = 0 - di" if di is 0 or 1.
In assembly language you even dont need masks (that was my first idea).
On processors supporting MOVcc, you just have to move the two results conditionally to the returned register.