Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
  • H04L9/3273—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response for mutual authentication

Definitions

• the present invention relates to an authentication method using a symmetric algorithm having the main characteristic that, each time two parts are authenticated, commonly called A and B, a cryptographic calculation with a variable key, called K ', is carried out.
• the invention relates more precisely to the cryptographic calculations cited above during an authentication of the two parties, called A and B, independent of each other in the context of data exchange.
• This can be between a PC and a server, a reader and a server, a smart card and a smart card reader such as, for example, a cash dispenser when using a credit card.
• chip called A by a user who, wishing to obtain a few banknotes, goes to a place with an ATM, called B.
• the two parts A and / or B can be considered as a smart card and / or a reader.
• A who has a secret key K, chooses a random R or random number also called a message.
• A sends this hazard R to B, which also has the same secret key K.
• r is the result of the encryption of the message R with the algorithm ALG and the secret key K.
• the algorithm called ALG is a symmetric encryption algorithm. This can be the DES (Data Encryption Message), the triple DES, the IDEA, etc.
• the authentication of B by A is carried out in this way.
• this operation is not sufficient because it is vulnerable to current measurements and therefore to attacks by a possible hacker.
• An attacker, or hacker measures the electrical current consumption of the chip. According to the curve obtained, it can deduce information on the operations and the data used by the processor. In order to make precise measurements, the attacker must make several measurements and filter them.
• the hacker To obtain a relevant measurement, the hacker must perform several measurements and filter them to extract the relevant information. Due to the use of the same constant key K, all the measurements use the same key K and therefore the filtering result is characteristic of the key K.
• the invention proposes a first feature which consists of a brief modification which is carried out in the formula for calculating r ′ of the authentication protocol which is the subject of the invention.
• Part A which has the secret key K, sends a random number chosen randomly] _, to part B.
• the latter also has the same secret key K.
• B chooses a random number R2, then calculates the number K ', which is also a secret key from the following formula:
• the impossibility of attack to date stems from the fact that, since K ′ changes with each authentication, the current consumption of the calculation of r and r ′ is different with each execution of the authentication. However, the calculation of K 'remains vulnerable to attacks in current consumption.
• the invention therefore provides a second feature not related to the first described above, concerning the calculation of K '.
• K k ⁇ _ xor k2 xor ... xor k n .
• a first table k called below in the description by k [], is used; this table contains the values of the n under keys kj_.
• the first step, or step a consists in that as long as there remains an element of the array a_ette [] at the value "T", then a random number i, between 1 and n, is chosen.
• step b is the equality test of the element i of the array a_excellent [] and the value "T”, called below in the description and in the figure.
• step b If the equality test in step b is false, then the calculation system returns to the first step, or step a.
• This algorithm is not in constant time because it is possible to execute more loops than there are sub-keys k-j_.
• the invention also relates to an authentication system with a symmetric encryption algorithm between two entities or parts A and B, having the same secret key K, which implements the method described above.
• n number of sub-keys
• n ⁇ 2 number of sub-keys
• the initialization remains identical to the general case described above; it is mentioned in FIG. 2 by the reference A or 10.
• the algorithm loop is performed as follows:
• the probability of putting at the value "F” the two elements of the array a_ttle [] in two loops or tests is equal to half, or 1/2.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
• Storage Device Security (AREA)

Applications Claiming Priority (3)

Publications (1)

Family

ID=9529804

Family Applications (1)

Country Status (7)

Families Citing this family (14)

Family Cites Families (5)

• 1998
  • 1998-08-17 FR FR9810591A patent/FR2782431B1/fr not_active Expired - Fee Related
• 1999
  • 1999-08-16 CN CN99812286.6A patent/CN1323478A/zh active Pending
  • 1999-08-16 EP EP99936740A patent/EP1104607A1/de not_active Withdrawn
  • 1999-08-16 MX MXPA01001783A patent/MXPA01001783A/es unknown
  • 1999-08-16 AU AU51731/99A patent/AU5173199A/en not_active Abandoned
  • 1999-08-16 WO PCT/FR1999/001995 patent/WO2000010287A1/fr active Application Filing
  • 1999-08-16 JP JP2000565636A patent/JP2002523923A/ja active Pending

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events