DE102015211566B4 - A method, component and computer program product for determining a derived key - Google Patents

Abstract

The present invention relates to a method for determining a derived key (DK) from a key (K) and a derivation parameter (DP), in which a puzzle (PC) is first determined by means of the key (K) and / or the derivation parameter (DP) which is to be solved before the derived key is calculated from the solution (PS) of the puzzle and the key (K) and / or the derivative parameter (DP).

Description

Passwords or cryptographic keys are the basis for cryptographic algorithms. In practice, these are often chosen weakly, so that automated attacks such as brute force attacks or dictionary attacks pose serious threats to the systems or data protected by the corresponding passwords or keys.

In order to make such attacks more difficult, it is known to use key extraction functions in addition to the so-called salting, in which the key calculation is intentionally elaborate, so that the million-fold execution of the key calculation required for an attack results in the costs of the attack exceeding its usefulness. Such key derivation functions are known as intentionally slow password-based key derivation function. Examples are known under the names PBKDF2 and bcrypt.

The known deliberately slowed down key derivation functions, however, have two fundamental problems. On the one hand, inexpensive standard hardware available in large quantities, for example modern graphics processors, is able to neutralize the slowing down effect of the key derivation functions by means of parallelization. Brute force attacks and dictionary attacks are also a serious threat to slowed down key derivation functions.

On the other hand, there is a rapidly growing number of low-power and lowest-performance devices that still need to meet modern security requirements and implement resistant key extraction functions. Examples include embedded devices, smartwatches, or home automation devices, where power consumption also plays a key role in calculating derived keys, but key calculation is often necessary to ensure the security of the network in which the devices are embedded.

Thus, while increasing the computational requirements for key derivation functions, for example, by increasing the number of iterations to be passed through for the key computation only marginally leads to the desired aggravation of attacks due to the ever-increasing (and due to modern methods such as cloud computing almost infinite) computing power, On the other hand, to a certain degree, this complexity prevents it from being used on devices with low computing power such as embedded devices.

The publication US 2007/0011453 A1 discloses for this purpose the establishment of a trusting relationship between unknown communication parties. The test partner initiates the said establishment of the trusting relationship with the verification partner. The test partner performs cryptographic calculations on the basis of an input data set in order to solve a problem.

It is therefore an object of the present invention to provide an improved key derivation function which is particularly suitable for embedded devices.

This object is achieved by a method for determining a derived key from a key and a derivation parameter, wherein by means of the key and / or the derivation parameter first a puzzle is determined which is to be solved before solving the puzzle and the key and / or the derivative parameter is derived from the derived key.

With this method, depending on the difficulty of the puzzle to be solved, the key derivation is slowed down.

By key is meant at this point a cryptographic key or a password. The key may be a key derived from the present or another cryptographic method.

With puzzle at this point is meant a mathematical puzzle or a cryptographic puzzle. Another name for this is Proof of Work. A puzzle or proof of work is a task (English: Challenge), which is to be solved by a computing unit, before the actual calculation can be performed.

In an advantageous embodiment of the invention, the solution of at least one puzzle after initial solution of this puzzle is stored in a memory and reused, if the puzzle is to be solved again at a later date. This memory is preferably a volatile memory, so that after disconnecting the device from the power supply and / or after a certain time, the intermediate value can no longer be read out by an attacker. Alternatively, it can be provided to write the solution of certain, for example, particularly complicated puzzles via an external interface in the memory.

This ensures that slow devices, but usually get the correct password or the correct key and therefore need to perform the calculation only a few times, in a renewed request the Time-consuming puzzles do not need to be redone, but can rely on the stored value and the authorization process can be significantly accelerated. Writing jigsaw puzzles from an external source into memory enables low-performing devices to handle the most complex puzzle challenges

The method may be iteratively designed to further slow down the key derivation function and to make attacks using, for example, puzzle lookup tables difficult.

The present invention further relates to a component, in particular an embedded device having means for implementing the method according to the invention, and a data processing system with such a component and a computer program product.

In the following, embodiments of the present invention will be explained in more detail with reference to a drawing.

The single figure shows a schematic representation of a key derivation function 100 , This receives as input value a key or a password K and a derivation parameter DP. A Puzzle Creation Function (Puzzle Challenge Builder PCB) 110 generates a puzzle PC based on at least one of these values from the puzzle solver (Puzzle Solver) 120 is solved. The puzzle solution PS is sent to an optional concatenator 130 which, by concatenating the puzzle solution with the derivative parameter DP, increases the resistance of the method against certain attacks and / or serves to ensure a minimum length of the parameter passed to the next stage. Finally, the derived key DK is calculated from the key or password K and the puzzle solution PS (possibly linked with the derivation parameter DP), in the example of the figure by an HMAC-SHA256 function 140 , Of course, any other cryptographic functions may be used instead of HMAC-SHA256, and of course it is possible to pre-process the puzzle solution PS in any manner before contacting the unit 140 is handed over.

The process occurring in the individual components is described in more detail below. The starting point for this is the consideration of the known function PBKDF2. This generates a derived key DK as follows: DK = PBKDF2 (PRF, Password, Salt, c, dkLen) where PRF is a pseudo-random function; Password the master password or output key value from which the derived key is generated; Salt the well-known cryptographic salt value; c is the number of desired repetitions of the key derivation algorithm by which the delay is effected; and dkLen the target length of the derived key.

In c iterations of the method, c values are calculated: U1 = PRF (Password, Salt || INT 32 BE (i)) U2 = PRF (Password, U1) ... Uc = PRF (Password, Uc - 1)

Finally, the derived key DK is generated by an exclusive-OR combination of the values Ui..Uc.

The parameter i serves the so-called key stretching or key expansion to the length dkLen. In general, the length of the output of the PRF does not correspond to the desired length dkLen. Therefore, the operation with different parameters i can be performed multiple times to obtain partial results. The output of the desired length dkLen results as concatenation or concatenation of the partial results.

As discussed earlier, increasing the number of iterations c increases the cost of attackers, but makes the algorithm unattractive or even impossible for systems with limited computational power.

Therefore, in one embodiment of the present invention, a key derivation function KDF is used to calculate a derived key that omits iterations and uses only an output key or password K and a derivative parameter DP as input values: DK = KDF (K, DP)

The derivative parameter DP can be a character string, a bit sequence or a counter.

As part of the calculation, a cryptographic puzzle has to be solved. For this, the solution of a cryptographic puzzle PC must be determined when calculating the derived key, for example, by "guessing" or trying out or other time-consuming procedures. Cryptographic Puzzles and DoS Resilience, Revisited, by B. Groza and Cryptographic Puzzles and DoS Resilience, Revisited, reviews the state of the art in cryptographic puzzles and proof of work functions B. Warinschi, available at http://www.auf.upt.ro/-bgroza/Papers/puz.pdf and first published in "Designs, Codes and Cryptography", Vol. 73 Issue 1, October 2014, pages 177- 207, together. In the following, only the aspects of cryptographic puzzles which are of particular importance in connection with the present invention will be referred to; Basic functions of cryptographic puzzles are well known to those skilled in the art, not least from the above-mentioned articles.

The cryptographic puzzle PC is powered by a Puzzle Challenge Builder 110 depending on K and / or DP. The puzzle solution PS has to go through the puzzle solver 120 z. B. be determined by trying out candidate values from a range of values.

Only when the puzzle has been solved, ie the output value PS of the puzzle solver 120 is present, the key derivation with in the unit 140 be calculated using HMAC-SHA256. As already mentioned numerous alternatives can be realized.

The puzzle solver 120 may have an internal memory (not shown) to cache puzzle solutions for already calculated puzzles. If there is an entry for a particular Puzzle Challenge PC, the puzzle does not have to be solved again.

In embodiments of the present invention, entries may be made in the memory via an external interface. In this way, pre-calculated entries can be stored on a severely restricted embedded device. This can be stored, for example, by a configuration tool via service access.

In one embodiment of the present invention, a puzzle challenge PC is determined depending on the output key or password K and parameter DP according to the following relationship: PC = PCB (K, DP) being PCB for the Puzzle Challenge Building feature 110 stands. As a PCB function, the HMAC-SHA256 algorithm can be used: PC = HMAC-SHA256 (K, "Puzzle Challenge" || DP)

In order to find the right solution, a test criterion is applied. For example, if the solution is a 16-bit value, there are 2 ^ 16 = 65536 possible values for PC. In one embodiment of the present invention, a puzzle check function CPC (English: Cryptographic Puzzle Check) is calculated for each of these possible values, for example according to the following rule: CPC (PC, PS) = HMAC-SHA256 (PC, PS)

In this case, 65536 intermediate results are part of the puzzle.

It is then that puzzle value selected as the solution PS, for the CPC (PC, PS) meets a predetermined criterion: So it can be z. For example, the smallest intermediate result, the largest, or the one with the median value, or that with a certain index of the sorted intermediate results. It is also possible to select one having the highest match with a given bit pattern (i.e., the largest number of common bits). For ambiguities, another criterion can be used, eg. B. a size comparison.

To be in the puzzle solver 120 To determine this value, 65536 HMAC-SHA256 calculations have to be carried out regularly, so that the solution of the puzzle calculation requires a certain amount of computation.

The derived key DK is now calculated using the following function: DK = HMAC-SHA256 (K, "Puzzle Key Derivation" || PS || DP)

Alternatively, z. For example, you can use the following function: DK = HMAC-SHA256 (HMAC-SHA256 (K, "Puzzle-Key-Derivation" || PS) || DP)

In this alternative embodiment, a key is first derived from K and PS, and then another derivative with DP takes place as a derivative parameter. If no help information is known, then the puzzle must be solved by trial and error.

As already mentioned, however, it is possible to store auxiliary information for solving the puzzle. For example, the concrete solution PC can be stored directly or the solution space to be searched is limited by suitable parameters, for example a lower and an upper limit.

Especially with repetitive checks, such auxiliary information can significantly contribute to speeding up the password or key verification. In embodiments of the invention, auxiliary or acceleration information is added to each valid password or key saved. This auxiliary or acceleration information may be the solution or a solution space constraint for one or more iterations of the key derivation function. The auxiliary or acceleration information can be obtained locally by performing a normal calculation with solving the puzzle or puzzles by guessing at the first derivation. The solutions of individual iterations are stored.

When used for password checking on a Unix-based system, eg. As an embedded Linux system, the auxiliary or acceleration information can be stored for example in the file / etc / shadow.

In an advantageous variant of the present invention, several key derivations are iteratively calculated. At least one of these iterations involves solving a cryptographic puzzle as described in detail above. It is particularly advantageous to provide cryptographic puzzles in several or even all iterations. In other words, several iterations of the KDF are performed, whereby a cryptographic puzzle has to be solved for each iteration (but at least one iteration). The solutions enter into one of the following iterations (advantageously directly into the next iteration). It may be the method of the basic variant z. B. iterated n times to determine the final derived key DK.

An advantage of the present invention is that no secret information needs to be set up in advance, so that no additional effort is required for a specific key management. The key derivation function according to the invention can therefore be used like any other key derivation function. Thus, for example, a password check can be realized using the present invention, or a key suitable for a 4-way handshake according to IEEE 802.11 can be derived from a password such as a WLAN password or a WLAN pre-shared key PSK a key derivation may be made under an authentication and key negotiation protocol such as SSL, TLS, EAP-TLS, EAP-TTLS, IKE or IKEv2 using the present invention.

As already mentioned, it is possible to store the solutions of the puzzle as auxiliary information in the calculation, for. In a cache. Alternatively, the solutions for some or all of the puzzles may be written into this cache by a corresponding provisioning component or server. In both cases, calculations, eg. As in password checks, be carried out accelerated without having to save the result itself.

The help information may be stored in a secure memory, preferably encrypted or otherwise protected. If it is stored in a volatile memory, it is automatically deleted when the device is shut down or restarted. If non-volatile memories are used, it can be provided that time-controlled or state-controlled deletion of the corresponding memory area is performed.

A particular advantage of the present invention is that the acceleration auxiliary information does not allow a direct inference to one of the critical key K or DK. It could, if it falls into the hands of an attacker, only be used to speed up a calculation or a complete password search and thus the attack. Thus, the provision or saving of the auxiliary information is thus much less critical than the provision or storage of a real key. This is in particular an advantage over conventional password-based key derivation methods (PBKDF), in which calculation can also be accelerated by auxiliary information. In conventional methods, however, this auxiliary information is inevitably key information, which would therefore have to be very expensive protected, which is why a use of conventional complex key derivation functions with a large number of slowing iterations on devices with very low processing power eliminated, whereas the key derivation function according to the invention is used such devices is suitable.

The implementation of the above-described components, phases, processes, or procedures may be accomplished by instructions that reside on computer-readable storage media or in volatile computer storage (collectively referred to as computer-readable storage). Computer-readable memories are, for example, volatile memories such as caches, buffers or RAM as well as non-volatile memories such as removable data carriers, hard disks, etc.

The described functions or steps may be in the form of at least one instruction set in / on a computer-readable memory. The functions or steps are not tied to a particular set of instructions or to a particular form of instruction set or to a particular storage medium or processor, or to particular execution schemes, and may include software, firmware, microcode, hardware, processors, integrated circuits, etc. be carried out alone or in any combination. It can be used a variety of processing strategies, such as serial processing by a single processor or multiprocessing or multitasking or parallel processing, etc.

Especially with the component 100 and in connection with the component 100 units described (puzzle generating unit 110 , Puzzle solution unit 120 , Key calculation unit 140 ) are preferably computer-executable instruction sequences or software modules, although of course it is possible to have individual units or the entire component 100 in programmable or non-programmable hardware.

The instructions and components may be stored in local memories, but it is also possible to store the instructions on a remote system and access them via network.

The term "processor" as used herein includes processing units in the broadest sense, such as servers, general purpose processors, graphics processors, digital signal processors, application specific integrated circuits (ASICs), programmable logic circuits such as FPGAs, discrete analog or digital circuits, and any combinations thereof all other processing units known to the person skilled in the art or developed in the future. Processors can consist of one or more devices. If a processor consists of several devices, these can be configured for parallel or sequential processing of instructions.

The foregoing description represents only the preferred embodiments of the invention and is not intended to serve as a definition of the limits and scope of the invention. All equivalent changes and modifications are within the scope of the appended claims.

Claims (9)

Method for determining a derived key (DK) from a key (K) and a derivation parameter (DP), in which a puzzle (PC) is first determined by means of the key (K) and / or the derivation parameter (DP) to solve this is before the solution (PS) of the puzzle and the key (K) and / or the derivative parameter (DP), the derived key is calculated, characterized in that it is checked before solving the puzzle, whether for this puzzle a solution in one Memory is present and if so this existing solution for the key derivation uses and the puzzle is not solved. The method of claim 1, wherein the solution of at least one puzzle is written into the memory by an external component. Method according to Claim 1, in which the solution of at least one puzzle is stored in the memory after the puzzle has been solved for the first time. Method according to one of claims 1 to 3, wherein the memory is a volatile memory. Method according to one of Claims 1 to 4, in which the calculated derived key (DK) is used as the key (K) for a new execution of the method. Component ( 100 ) of a data processing system comprising at least: - means for accepting a key (K); - means for accepting a derivative parameter (DP); - a puzzle generation unit ( 110 ) which generates a puzzle (PC) from the key and / or the derivative parameter; A puzzle solution unit ( 120 ), which solves the puzzle (PC); A key calculation unit ( 140 ) which generates a derived key (DK) from the key (K) and the solution (PS) of the puzzle or a value derived therefrom; characterized by a memory and means which, before solving a puzzle, check whether there is a solution in memory for this puzzle and, if so, provide that solution as the solution (PS) of the puzzle. The component of claim 6, further comprising means for storing the solution of at least one puzzle in memory after first solving this puzzle. Data processing system comprising a component ( 100 ) according to one of claims 6 to 7. Computer program product comprising computer-executable instructions which, when loaded in a computer, are adapted to perform a method according to any one of claims 1 to 5.

Images