KR101094339B1 - Apparatus and Method for Fiat-Shamir identification immune to Fault attacks, and Recoreding medium thereof - Google Patents

Abstract

과 비밀값 T_A를 저장하는 메모리부; 랜덤값 r을 이용하여 x = r² mod N 을 연산하고 상기 서명 요청자에 전송하는 약정값 전송부; 상기 서명 요청자에서 정수 l 이하의 자연수로 이루어진 집합 중 랜덤하게 선택된 부분 집합 S를 수신하는 대응값 수신부; 및 상기 비밀값 T_A 및 상기 부분 집합 S의 원소를 이용하여 반응값을 연산하고 상기 서명 요청자에 전송하는 반응값 전송부를 포함한다.Disclosed are a Fiat Shamir personal identification device, a method, and a recording medium thereof secured against an error injection attack. Fiat Shamir personal identification device that is safe against error injection attack according to an embodiment of the present invention

And a memory unit for storing the secret value T _A ; X = r ² using random value r a contract value transmitter for calculating mod N and transmitting the mod N to the signature requester; A corresponding value receiver for receiving a randomly selected subset S from a set consisting of a natural number of l or less in the signature requester; And a response value transmitter for calculating a response value using the secret value T _A and the elements of the subset S and transmitting the response value to the signature requester.

Description

Apparatus and Method for Fiat-Shamir identification immune to Fault attacks, and Recoreding medium

The present invention relates to the Fiat-Shamir scheme, which is a personal identification protocol recommended as a standard, and more particularly, to a Fiat Shamir personal identification device, a method, and a recording medium thereof which are safe from an error injection attack.

With the advent of the information society, the protection of information using cryptographic algorithms and cryptographic protocols is increasing in importance. Among these cryptographic algorithms, public key cryptography solves the disadvantages of secret key cryptographic algorithms including Advanced Encryption Standard (AES), key distribution problem, digital signature problem, etc. It is quickly becoming an application.

There are symmetric key encryption method and public key encryption method for encrypting the transmitted contents. Among the public key encryption methods, RSA (Rivest Shamir Adleman) public key is widely used. There is an encryption method. RSA public key cryptography is proposed by Rivest, Shamir, and Adleman. Its security is based on the fact that it is more difficult to factor down as the size of the ciphertext becomes larger.

On the other hand, after the subchannel attack was introduced by Kocher in 1996, various attack methods for the encryption algorithm of the embedded device were introduced. Sub-channel attacks, which are classified as passive attack methods, use attack time by the attacker using the algorithm execution time, the amount of power used during the operation of the algorithm, and electromagnetic waves, and each time attack (TA) attack, Simple Power Analysis SPA), Differential Power Analysis (DPA), and Electro-Magnetic Analysis (EMA).

Active attacks inject a modified external clock, change the temperature, or attack the device using a laser such as X-ray, and this type of active attack is called a fault attack (FA).

Bellcore introduced the error injection attack method in the RSA cryptosystem (CRT-RSA) using the Chinese Remainder Theorem (CRT) in 1996. This was injected by error injection attack method.

On the other hand, as the use of smart cards increases for the error injection attack method in CRT-RSA, a safe countermeasure for efficient side channel attack and error injection attack is required, and the computing power and memory are limited in embedded devices such as smart cards. As a result, an efficient countermeasure using less memory and amount of computation is required. Recently, Giraud has proposed a safe method for simple power attack analysis and fault injection attack, one of the first power analysis attack methods.

The exponential algorithm in the Giraud method is computed using the Montgomery Ladder method, which is safe against simple power analysis and error injection attacks, and confirms error injection using only the private key. Therefore, it can be safely used even in the public key environment of Java card which can use only private key.

이다. 여기서 n은 공개 모듈라값이고, 비밀값인 큰 소수 p와 q의 곱으로 연산된다. 한편, 암호화 표준에서는 RSA 서명 생성과정의 속도를 향상하기 위하여 중국인의 나머지 정리(CRT)를 이용한 RSA 암호 시스템(CRT-RSA)을 사용하기를 권고하고 있다.As described above, in the RSA public key encryption method, there is a public key that can be known to the public as well as a public key that can be known only to the public. For example, the RSA signature value s for private key d and message m is

to be. Where n is a public modular value and is computed as the product of a large prime number p, which is a secret value, and q. Meanwhile, the encryption standard recommends the use of the RSA cryptosystem (CRT-RSA), which uses the remainder of the Chinese (CRT) to speed up the RSA signature generation process.

Recently, the error injection attack method has been introduced not only in the encryption algorithm but also in the Fiat Shamir technique, which is a personal identification protocol. But there is no way to respond.

The first technical problem to be achieved by the present invention is to provide a Fiat Shamir personal identification device that is safe against an error injection attack, which reflects a secret value that makes it difficult to analyze a malicious attacker.

The second technical problem to be achieved by the present invention is to provide a Fiat Shamir personal identification method that is safe against an error injection attack applied to the above Fiat Shamir personal identification device.

A third technical problem to be achieved by the present invention is to provide a computer-readable recording medium for executing a program on a computer for the Fiat Shamir personal identification method that is safe against the error injection attack.

과 비밀값 T_A를 저장하는 메모리부; 랜덤값 r을 이용하여 x = r² mod N 을 연산하고 상기 서명 요청자에 전송하는 약정값 전송부; 상기 서명 요청자에서 정수 l 이하의 자연수로 이루어진 집합 중 랜덤하게 선택된 부분 집합 S를 수신하는 대응값 수신부; 및 상기 비밀값 T_A 및 상기 부분 집합 S의 원소를 이용하여 반응값을 연산하고 상기 서명 요청자에 전송하는 반응값 전송부를 포함한다.Fiat Shamir personal identification device that is safe against error injection attack according to an embodiment of the present invention

And a memory unit for storing the secret value T _A ; X = r ² using random value r a contract value transmitter for calculating mod N and transmitting the mod N to the signature requester; A corresponding value receiver for receiving a randomly selected subset S from a set consisting of a natural number of l or less in the signature requester; And a response value transmitter for calculating a response value using the secret value T _A and the elements of the subset S and transmitting the response value to the signature requester.

과 비밀값 T_A를 저장하는 메모리부; 랜덤값 r 및

를 이용하여 x = sr² mod N 을 연산하고 상기 서명 요청자에 전송하는 약정값 전송부; 상기 서명 요청자에서 선택된 집합

를 수신하는 대응값 수신부; 및 상기 비밀값 T_A 및 상기 집합 S의 원소를 이용하여 반응값을 연산하고 상기 서명 요청자에 전송하는 반응값 전송부를 포함한다.In addition, a Fiat Shamir personal identification device secured against an error injection attack according to another embodiment of the present invention is a secret key

And a memory unit for storing the secret value T _A ; Random values r and

Using x = sr ² a contract value transmitter for calculating mod N and transmitting the mod N to the signature requester; A set selected from the signature requester

Corresponding value receiving unit for receiving; And a response value transmitter for calculating a response value using the secret value T _A and the elements of the set S and transmitting the response value to the signature requester.

과 비밀값 T_A를 저장하는 서명자에서 랜덤값 r을 이용하여 x = r² mod N 을 연산하고 서명 요청자에 전송하는 단계; 상기 서명 요청자에서 정수 l 이하의 자연수로 이루어진 집합 중 랜덤하게 선택된 부분 집합 S를 상기 서명자가 수신하는 단계; 상기 서명자에서 상기 비밀값 T_A 및 상기 부분 집합 S의 원소를 이용하여 반응값을 연산하고 상기 서명 요청자에 전송하여, 상기 서명 요청자가 y²과

을 비교하여 상기 서명자를 검증하게 하는 단계를 포함한다.In addition, Fiat Shamir personal identification method that is safe against error injection attack according to an embodiment of the present invention secret key

And a secret value using the random value r from the signer to store T _A x = r ² computing mod N and sending it to the signature requester; The signer receiving a randomly selected subset S from a set of natural numbers of l or less in the signature requester; In the signer, a response value is calculated using the elements of the secret value T _A and the subset S and sent to the signature requester, so that the signature requester has y ² and

Comparing the data to verify the signer.

과 비밀값

을 저장하는 서명자에서 랜덤값 r 및

를 이용하여 x = sr² mod N 을 연산하여 서명 요청자에 전송하는 단계; 상기 서명 요청자에서 선택된 집합

를 상기 서명자가 수신하는 단계; 상기 서명자에서 상기 비밀값 T_A 및 상기 집합 S의 원소를 이용하여 반응값을 연산하고 상기 서명 요청자에 전송하여, 상기 서명 요청자에서 y²과

을 비교하여 상기 서명자를 검증하게 하는 단계를 포함한다.In addition, Fiat Shamir personal identification method that is safe against an error injection attack according to another embodiment of the present invention is a secret key

And secret

In the signer that stores the random value r and

Using x = sr ² computing mod N and sending it to the signature requester; A set selected from the signature requester

Receiving by the signer; The signer computes a response using the secret value T _A and the elements of the set S and sends it to the signature requester, whereby y ² and

Comparing the data to verify the signer.

According to embodiments of the present invention, in case of personal identification using Fiat Shamir technique, it is difficult to analyze an attacker by reflecting a value unknown to the attacker so as not to find the value of the secret information without increasing the amount of computation. It is safe against error injection attacks.

1 is a block diagram of a Fiat Shamir personal identification device secured against an error injection attack of the present invention.
2 is a flow chart of a Fiat Shamir personal identification method secured against an error injection attack of the present invention.
3A illustrates Fiat Shamir personal identification protocol.
3B illustrates a Fiat Shamir personal identification method secured against an error injection attack according to an embodiment of the present invention.
FIG. 4A illustrates the Feige Fiat Shamir personal identification protocol.
4B illustrates a Fiat Shamir personal identification method secured against an error injection attack according to another embodiment of the present invention.

Hereinafter, with reference to the drawings will be described a preferred embodiment of the present invention. However, embodiments of the present invention illustrated below may be modified in various other forms, and the scope of the present invention is not limited to the embodiments described below.

Hereinafter, the signer means a device that stores smart card or other authentication information or personal information. The signature requester refers to a device or server that verifies the signer using information received from the signer.

1 is a block diagram of a Fiat Shamir personal identification device 100 that is secure against an error injection attack of the present invention. In the following, N is the product of the secret key p and q, and p and q represent different prime numbers. In the embodiments of the present invention, the signature requester includes a secret value T _A unknown to the response operation, making it difficult to analyze a malicious attacker.

, 서명자의 약정값 x = r² mod N, 서명자의 반응값

를 이용한다.Fiat Shamir personal identification device that is safe against error injection attack according to an embodiment of the present invention is the secret value of the signer

, Signer's pact x = r ² mod N, signer response

Use

, 비밀키

, 비밀값 T_A 등을 저장한다. 이때, 상기 비밀키란, s₁modN, s₂modN,…, s_tmodN 에 각각 해당하는 t개의 값을 포함하는 복수 개인 것을 말한다.The memory unit 110 has a public key for a public value N, a known integer l , t (l≤t).

, Secret key

, Secret value T _A , and so on. In this case, the secret key is s ₁ modN, s ₂ modN,... , s _t modN plural number containing t values respectively.

The agreement value transmitter 120 calculates a random value r and transmits the agreement value to the signature requester.

Corresponding value receiving section 130 receives a set of randomly selected subset S consisting of a natural number of the integer l or less in the signature requester. The subset S is the corresponding value of the signature requester used to compute the response.

The response value transmitting unit 140 calculates a response value using the elements of the secret value T _A and the subset S stored in the memory unit 110 and transmits the response value to the signature requester.

, 서명자의 약정값 x = sr² mod N,

, 서명자의 반응값

를 이용한다.On the other hand, Fiat Shamir personal identification device that is safe against error injection attack according to another embodiment of the present invention is the secret value of the signer

, Signer's pact x = sr ² mod N,

The response of the signer

Use

(1≤i≤t), 비밀키

, 비밀값 T_A 등을 저장한다.The memory unit 110 has a public key for a public value N, a known integer l , t (l≤t).

(1≤i≤t), secret key

, Secret value T _A , and so on.

을 약정값을 연산하고 서명 요청자에 전송한다.The agreement value transmission unit 120 is a random value r and

Computes a promise and sends it to the signing requester.

The corresponding value receiver 130 receives a subset S selected at random from the signature requester. The subset S is the corresponding value of the signature requester used to compute the response.

The response value transmitting unit 140 calculates a response value using the elements of the secret value T _A and the subset S stored in the memory unit 110 and transmits the response value to the signature requester.

2 is a flow chart of a Fiat Shamir personal identification method secured against an error injection attack of the present invention.

The personal identification protocol of the present invention is largely composed of four steps. The first step is a contract process 11 in which the signer 100 calculates a contract value using a random value and the like and transmits the contract value to the signing requester. The second step is a corresponding process 12 in which the signature requester 200 randomly selects the set S and sends it to the signer 100. The set S randomly selected by the signing requester 200 is used by the signer to calculate the response. The third step is a reaction process 13 in which the signer 100 calculates a response value using the new secret value T _A and the corresponding value of the signature requester 200 and transmits the response value to the signature requester 200. Finally, the fourth step is a verification process 14 for verifying the signer 100 by comparing the value calculated using the contract value received by the signing requester 200 with the response value.

In FIGS. 3A-4B, Alice means the signer side, and Bob means the signature requester side.

의 집합을 저장한다. 또한, 서명자는 공개키에 대한 집합

를 저장한다. 서명자와 서명 요청자는 보안 파라미터인 l, t(l≤t)의 값을 공유한다.3A illustrates Fiat Shamir personal identification protocol. In FIG. 3A, the signer stores n bits of modulus N (= p · q), the reversible element

Save the set of. Also, the signer is a set of public keys.

Save it. The signer and the signing requester share the security parameters l and t (l≤t).

에 오류가 발생한다고 가정하면,

은 다음과 같이 유도될 수 있다.In the error injection attack of the signature requester, the signature requester may detect that an error has occurred during the verification process, which is the fourth step of the protocol.

Suppose an error occurs in

Can be derived as follows.

로 바뀌게 된다. 여기서,

이다. 여러 번의 시행 착오를 통해 서명 요청자는 다음의 정보를 수집할 수 있다. 즉, 프로토콜의 첫 번째 단계인 약정 과정에서

, 프로토콜의 세 번째 단계인 반응 과정에서

의 값을 얻을 수 있다.That is, when a single bit flip occurs, s _j is the third step of the protocol.

Will change to here,

to be. After several trials and errors, the requestor can collect the following information: In other words, in the contract process, the first step of the protocol,

In the reaction process, the third step of the protocol,

You can get the value of.

The signature request can be obtained the value of s _j through the following operation of Equation (1) on the assumption that an error occurs in the s _j.

의 모든 위치에서 에러가 발생하는 상황을 만들면, 서명자의 비밀 값이나 비밀키들을 모두 찾아낼 수 있게 된다.Here, the signature requestor can find the secret value stored by the signer by determining the exact value of s _j by determining the exact error location i. However, the signature requester went through l trials and errors

If you create a situation where an error occurs at any location, you can find all the signer's secrets or private keys.

3B illustrates a Fiat Shamir personal identification method secured against an error injection attack according to an embodiment of the present invention.

의 집합 및 비밀값

를 저장한다. 또한, 서명자는 공개키에 대한 집합

를 저장한다. 서명자와 서명 요청자는 보안 파라미터인 l, t(l≤t)의 값을 공유한다. 바람직하게는, s_i와 N의 최대 공약수 (greatest common divisor)가 1이 되도록 s_i와 N의 값을 정할 수도 있다.In FIG. 3B the signer stores the n-bit law N (= p · q), and the reversible element

Set and secret

Save it. Also, the signer is a set of public keys.

Save it. The signer and the signing requester share the security parameters l and t (l≤t). Preferably, it may determine the value of s _i and N such that the N 1 s _i, and the GCD (greatest common divisor) of.

)을 이용하여 x = r² mod N 을 연산하고 서명 요청자에 전송한다. 대응 과정에서, 서명 요청자는 부분 집합

를 서명자에 전송한다. 반응 과정에서, 서명자는 반응값

를 서명 요청자에 전송한다. 마지막의 검증 과정에서, 서명 요청자는 y²과

을 비교하여 서명자를 검증한다.In the arrangement of FIG. 3B, the signer has a random value r (

X = r ² Compute mod N and send it to the signature requester. In response, the signing requester is a subset

Is sent to the signer. In the course of the reaction, the signer

Is sent to the signature requester. At the end of the verification process, y ² person signing the request and

Compare signers to verify signers.

에 오류가 발생한다고 가정하면,

은 다음과 같이 유도될 수 있다. 즉, 단일 비트 플립이 발생하면, s_j는 프로토콜의 세 번째 단계인 반응 과정에서

로 바뀌게 된다. 여기서,

이다. 여러 번의 시행 착오를 통해 서명 요청자는 다음의 정보를 수집할 수 있다. 즉, 프로토콜의 첫 번째 단계인 약정 과정에서

, 프로토콜의 세 번째 단계인 반응 과정에서

의 값을 얻을 수 있다. 서명 요청자는 수학식 2와 같은 연산을 수행할 수 있다.In these protocols,

Suppose an error occurs in

Can be derived as follows. In other words, when a single bit flip occurs, s _j is the third step of the protocol.

Will change to here,

to be. After several trials and errors, the requestor can collect the following information: In other words, in the contract process, the first step of the protocol,

In the reaction process, the third step of the protocol,

You can get the value of. The signature requestor may perform an operation as shown in Equation 2.

의 값을 계산할 수 없다. 결국, 도 3b의 개인 식별 방법이 오류 주입 공격에 안전함이 증명된다.However, since the signing requester cannot know the signer's secret value T _A ,

Cannot calculate the value of. As a result, the personal identification method of FIG. 3B proves safe to error injection attacks.

의 집합을 저장한다. 여기서,

을 만족하는데, gcd는 최대 공약수를 의미한다. 또한, 서명자는 공개키에 대한 집합

를 저장한다. 서명자와 서명 요청자는 보안 파라미터인 l, t(l≤t)의 값을 공유한다.FIG. 4A illustrates the Feige Fiat Shamir personal identification protocol. In Fig. 4a, the signer stores the n-bit law N (= p · q), and the reversible element

Save the set of. here,

Gcd stands for the greatest common divisor. Also, the signer is a set of public keys.

Save it. The signer and the signing requester share the security parameters l and t (l≤t).

, 세 번째 단계에서

의 값을 얻을 수 있다. 서명 요청자는 수학식 3의 과정을 통해 s_j의 값을 도출할 수 있다.In the above protocol, if there is an error injection attack from the signing requester,

, In the third stage

You can get the value of. The signature requestor can derive the value of s _j through the process of Equation 3.

4B illustrates a Fiat Shamir personal identification method secured against an error injection attack according to another embodiment of the present invention.

의 집합 및 비밀값

를 저장한다. 여기서,

을 만족한다. 또한, 서명자는 공개키

(1≤i≤t)를 저장한다. 서명자와 서명 요청자는 보안 파라미터인 l, t(l≤t)의 값을 공유한다.In Fig. 4b, the signer stores the n-bit law N (= p · q), and the reversible element

Set and secret

Save it. here,

To satisfy. The signer also has a public key.

(1 ≦ i ≦ t). The signer and the signing requester share the security parameters l and t (l≤t).

)과

를 이용하여 x = sr² mod N 을 연산하고 서명 요청자에 전송한다. 대응 과정에서, 서명 요청자는 집합

를 서명자에 전송한다. 반응 과정에서, 서명자는 반응값

를 서명 요청자에 전송한다. 마지막의 검증 과정에서, 서명 요청자는 y²과

을 비교하여 서명자를 검증한다.In the arrangement of FIG. 4B, the signer has a random value r (

)and

Using x = sr ² Compute mod N and send it to the signature requester. In response, the signing requester must

Is sent to the signer. In the course of the reaction, the signer

Is sent to the signature requester. At the end of the verification process, y ² person signing the request and

Compare signers to verify signers.

The invention can be implemented via software. Preferably, a program for executing a Fiat Shamir personal identification method safe for an error injection attack according to embodiments of the present invention may be provided by recording a program on a computer readable recording medium. When implemented in software, the constituent means of the present invention are code segments that perform the necessary work. The program or code segments may be stored on a processor readable medium or transmitted by a computer data signal coupled with a carrier on a transmission medium or network.

Computer-readable recording media include all kinds of recording devices that store data that can be read by a computer system. Examples of the computer readable recording medium include ROM, RAM, CD-ROM, DVD 占 ROM, DVD-RAM, magnetic tape, floppy disk, hard disk, optical data storage, and the like. The computer readable recording medium can also be distributed over network coupled computer devices so that the computer readable code is stored and executed in a distributed fashion.

Although the present invention has been described with reference to the embodiments illustrated in the drawings, this is merely exemplary and will be understood by those skilled in the art that various modifications and variations may be made therefrom. And, such modifications should be considered to be within the technical protection scope of the present invention. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

Claims (12)

Let N be the open value, and for known integers l and t (l≤t)

S ₁ modN, s ₂ modN,... calculating x = r ² mod N using a random value r at a signer storing a plurality of secret keys including t values corresponding to s _t modN and a secret value T _A ;
The signer receiving a randomly selected subset S from a set of natural numbers of l or less in the signature requester;
In the signer, a response value is calculated using the elements of the secret value T _A and the subset S and sent to the signature requester, so that the signature requester has y ² and

Comparing and signifying the signer
Including, Fiat Shamir personal identification method secure to the error injection attack. The method of claim 1,
The secret value T _A is

Fiat Shamir personal identification method, characterized in that the safe against the error injection attack. The method of claim 1,
The reaction value is

Fiat Shamir personal identification method, characterized in that the safe against the error injection attack. The method of claim 1,
N is a product of the secret key p and q, p and q are different prime numbers, Fiat Shamir personal identification method that is secure against error injection attack. The method of claim 1,
The greatest common divisor of s _i and N is 1, wherein Fiat Shamir's method of identification is safe. Let N be the public,

S ₁ modN, s ₂ modN,... secret keys and secret values containing t values corresponding to s _t modN

In the signer that stores the random value r and

Calculating x = sr ² mod N using and transmitting it to the signature requester;
A set selected from the signature requester

Receiving by the signer;
The signer computes a response using the secret value T _A and the elements of the set S and sends it to the signature requester, whereby y ² and

Comparing and signifying the signer
Including, Fiat Shamir personal identification method secure to the error injection attack. The method according to claim 6,
The secret value T _A is

Fiat Shamir personal identification method, characterized in that the safe against the error injection attack. The method according to claim 6,
The reaction value is

Fiat Shamir personal identification method, characterized in that the safe against the error injection attack. The method according to claim 6,
The greatest common divisor of s _i and N is 1, wherein Fiat Shamir's method of identification is safe. A computer-readable recording medium having recorded thereon a program for executing the method of claim 1 on a computer system. An apparatus for identifying a self by transmitting a response value to a signature requestor,
Let N be the open value, and for known integers l and t (l≤t)

S ₁ modN, s ₂ modN,... a memory unit for storing a plurality of secret keys and a secret value T _A including t values corresponding to s _t modN;
A contract value transmitter for calculating x = r ² mod N using a random value r and transmitting the result to the signature requester;
A corresponding value receiver for receiving a randomly selected subset S from a set consisting of a natural number of l or less in the signature requester; And
_A response value transmitter for calculating a response value using the secret value T _A and the elements of the subset S and transmitting the response value to the signature requester
Included, Fiat Shamir personal identification device safe against injecting attacks. An apparatus for identifying a self by transmitting a response value to a signature requestor,
Let N be the public,

S ₁ modN, s ₂ modN,... a memory unit for storing a plurality of secret keys and a secret value T _A including t values corresponding to s _t modN;
Random values r and

A contract value transmitter configured to calculate x = sr ² mod N using and transmit the result to the signature requester;
A set selected from the signature requester

Corresponding value receiving unit for receiving; And
_A response value transmitter for calculating a response value using the secret value T _A and the elements of the set S and transmitting the response value to the signature requester.
Included, Fiat Shamir personal identification device safe against injecting attacks.

Images