EP1104607A1

EP1104607A1 - Method and device for authenticating with symmetrical algorithm

Info

Publication number: EP1104607A1
Application number: EP99936740A
Authority: EP
Inventors: Ludovic Rousseau
Original assignee: Gemplus SCA; Gemplus Card International SA; Gemplus SA
Current assignee: Thales DIS France SA
Priority date: 1998-08-17
Filing date: 1999-08-16
Publication date: 2001-06-06
Also published as: AU5173199A; FR2782431A1; CN1323478A; JP2002523923A; MXPA01001783A; WO2000010287A1; FR2782431B1

Abstract

The invention concerns a method and a system for authenticating with symmetrical algorithm essentially characterised in that, for each mutual authentication of two parties, a cryptographic computation with a variable key, referred to as K', is carried out. The main steps of said method are as follows: a) party A, possessing the secret key K, sends a random number R2 to party B, the latter also possessing the same secret key K; b) party B selects a random number R2, and computes the number K', which is also a secret key, from the following formula: K' = R2 xor K, xor being the equivalent of the exclusive or mathematical operation; c) then, B, using a symmetrical encryption algorithm ALG, computes a result r derived from the formula: r = ALG[K'](R1); d) said party B then sends r and R2 to said party A; e) said party A, using the same symmetrical encryption algorithm ALG, computes K' and r' from the following formulae: K' = R2 xor K and r' = ALG[k'](R1); f) if r is equal to r', then said party B is authenticated by said party A.

Description

SYMMETRIC ALGORITHM AUTHENTICATION METHOD AND DEVICE

The present invention relates to an authentication method using a symmetric algorithm having the main characteristic that, each time two parts are authenticated, commonly called A and B, a cryptographic calculation with a variable key, called K ', is carried out.

The invention relates more precisely to the cryptographic calculations cited above during an authentication of the two parties, called A and B, independent of each other in the context of data exchange. This can be between a PC and a server, a reader and a server, a smart card and a smart card reader such as, for example, a cash dispenser when using a credit card. chip called A by a user who, wishing to obtain a few banknotes, goes to a place with an ATM, called B.

More particularly, the two parts A and / or B can be considered as a smart card and / or a reader.

It is known to those skilled in the art that security problems are crucial for the proper functioning of devices of the cash dispenser and smart card type. These concerns are the subject of continuous and always more effective protections to make an attack more and more difficult to commit.

To explain this state of affairs, in the technological field of cryptology, it is known to name the two parties having to communicate with each other A and B. In a more technical and scientific way, the process consists of a number of steps.

In detail, A, who has a secret key K, chooses a random R or random number also called a message.

A sends this hazard R to B, which also has the same secret key K.

B calculates a result, using a symmetric ALG encryption algorithm, called r by the following formula:

r = ALG [K] (R),

r is the result of the encryption of the message R with the algorithm ALG and the secret key K. The algorithm called ALG is a symmetric encryption algorithm. This can be the DES (Data Encryption Message), the triple DES, the IDEA, etc.

This operation is possible because the secret key K is known to both parties A and B and only by A and B.

Then B sends the result r to A. The latter, A, then calculates the result r 'by the following formula: r' ≈ ALG [K] (R).

If the number r is equal to the result r 'then B is authenticated.

The authentication of B by A is carried out in this way. However, this operation is not sufficient because it is vulnerable to current measurements and therefore to attacks by a possible hacker. An attacker, or hacker, measures the electrical current consumption of the chip. According to the curve obtained, it can deduce information on the operations and the data used by the processor. In order to make precise measurements, the attacker must make several measurements and filter them.

More precisely, the problem lies in the calculation of r, ie on the formula:

r ≈ ALGtK] (R).

Indeed, current measurements are easy to perform at this level and it is therefore possible to know the data by calculation, in particular because the key K is constant.

To obtain a relevant measurement, the hacker must perform several measurements and filter them to extract the relevant information. Due to the use of the same constant key K, all the measurements use the same key K and therefore the filtering result is characteristic of the key K.

The invention proposes a first feature which consists of a brief modification which is carried out in the formula for calculating r ′ of the authentication protocol which is the subject of the invention. Part A, which has the secret key K, sends a random number chosen randomly] _, to part B. The latter also has the same secret key K. B chooses a random number R2, then calculates the number K ', which is also a secret key from the following formula:

K '= R2 xor K, xor being the "or exclusive" mathematical.

Then B calculates a result r from the formula:

r = ALG [K '] (R] _)

B then sends r and R2 to A.

The latter calculates, using the same symmetric encryption algorithm ALG, K 'and r' from the following formulas:

K '= R2 xor K and r' = ALG [K '] (Ri)

Assuming that r is equal to r ', then B is authenticated by A.

The impossibility of attack to date stems from the fact that, since K ′ changes with each authentication, the current consumption of the calculation of r and r ′ is different with each execution of the authentication. However, the calculation of K 'remains vulnerable to attacks in current consumption. The invention therefore provides a second feature not related to the first described above, concerning the calculation of K '.

Indeed, the invention uses an encryption system independent and / or dependent on the authentication system described above.

It consists of a calculation of K 'which is made random.

For this, we decompose the secret key K into a set of n sub-keys k-j_, i being the index of sub-keys by the formula:

K = kι_ xor k2 xor ... xor k _n .

Thus, the calculation of K 'is possible as being, under another formulation:

K '= R2 xor kι_ xor ... xor k _n .

Due to the commutativity of the operator xor, it is possible to change the order of calculation to obtain a variable calculation at each authentication.

In order for a link to be established between K and K ′, the algorithm used comprises an initialization phase and a subset of loops.

The initialization of the algorithm must be explained, in general first, and then by taking a particular case of explanation, which can then be transposed to generality. The initialization has for explanation the following remarks.

In general, a first table k, called below in the description by k [], is used; this table contains the values of the n under keys kj_.

A second array called a_faire, hereinafter called a_faire [], contains n booleans. Each boolean contains the true value called "True" or "T", below and in FIG. 2. The arrays k [] and a_faire [] contain the same number n of elements, representing the n sub-keys kj_ and the n booleans

The value R2 is assigned to K ', more precisely K' = R ₂ .

The algorithm loop is described below and shown in Figure 1:

The first step, or step a, consists in that as long as there remains an element of the array a_faire [] at the value "T", then a random number i, between 1 and n, is chosen.

The next step, step b, is the equality test of the element i of the array a_faire [] and the value "T", called below in the description and in the figure.

If the previous equality test is true, two operations are performed:

- The first, step c, is the assignment to variable K 'of the result of the mathematical "or exclusive" between K 'and the i ^ th element of the array k [] which is in fact the calculation of the following formula: K' = K ¹ xor k [i]

The second, step d, is the assignment to the element of index i of the table a_faire [] of the value "False", called below in the description and in the figure by "F": a_faire [i] = "F".

If the equality test in step b is false, then the calculation system returns to the first step, or step a.

This algorithm is not in constant time because it is possible to execute more loops than there are sub-keys k-j_.

The invention also relates to an authentication system with a symmetric encryption algorithm between two entities or parts A and B, having the same secret key K, which implements the method described above.

The invention will now be described with a specific embodiment which is the case where n, number of sub-keys, is equal to two, n ≈ 2, in relation to FIG. 2, a figure describing only two loops.

The initialization remains identical to the general case described above; it is mentioned in FIG. 2 by the reference A or 10. The algorithm loop is performed as follows:

Two calculations of the algorithm are possible. Either the following operation will be performed:

K '= R2 xor k] _ xor k ₂ ; Either the following operation will be performed:

K '= R2 xor k2 xor k] _;

Thus, the hacker does not know what is the calculation that will be performed in the first place and therefore cannot use several measures to perform filtering.

The probability of filling the two elements in a loop or first try is zero, or more explicitly and visually (cf. Figure 2), the probability of setting the value of "two" in the two elements of the array a_f ire [] in one try is null. It is therefore impossible to obtain in a single loop the two identical values "F", "F".

Then, the probability of putting at the value "F" the two elements of the array a_faire [] in two loops or tests is equal to half, or 1/2.

Indeed, during the first loop, a random number i equal to 1 (20) or 2 (21), i = 1 or 2, is chosen; then the value "F" is put in one of the two elements of the array a_faire []; this first loop is mentioned in FIG. 2 by the reference B. During a second loop (see Figure 2), a random number i equal to 1 or 2, i = 1 or 2, is chosen; then the value "F" is put in one of the two elements of the array a_faire [], according to the random number chosen; this second loop is mentioned in FIG. 2 by the reference C.

Thus, there are two completed cases (31, 32), that is to say two "F" values in two elements and two unfinished cases (30, 33); the calculation of K 'is not finished. The probability of obtaining this result is half.

In addition, the probability of completing two elements in three loops or tests is equal to a quarter, or 1/4 (not shown in Figure 2).

Indeed, a random number i equal to 1 or 2 is chosen; the value "F" is put either in the first element, or in the second element of the array a_faire [].

Thus, as during the second looping, there are two completed cases, that is to say two "F" values in two elements and two unfinished cases, The calculation of K 'is not finished.

Very generally, the probability of filling the two elements in k loops is equal to It is interesting to know an average S of loops to be made to fall on two elements each comprising the value "F".

For this, the mathematical expectation is calculated and is formulated as follows:

= ^Σi:, -ι

This mathematical expectation is the weighted sum of the probabilities.

Once calculated, it is three.

The conclusion is therefore: S = 3

The calculation of K 'is carried out in three loops on average.

Claims

1. Authentication method using a symmetric encryption algorithm between two entities or parts A and B, having the same secret key K, characterized in that it performs the following steps to

1 authentication: a) part A, having the secret key K, sends a random number or randomly chosen number R2 to part B, the latter also having the same secret key K; b) part B chooses a random number R2, and calculates the number K ', which is also a secret key, from the following formula:

K '= R2 xor K, xor being the equivalent of the mathematical "or exclusive"; c) then B calculates, using a symmetric ALG encryption algorithm, a result r from the formula:

r = ALG [K '] (R);

d) said part B then sends r and R2 to said part A; e) said part A calculates, using the same symmetric encryption algorithm ALG, K 'and r' from the following formulas:

K '= R ₂ xor K and r '= ALG [K'] (R ₂ );

f) if r is equal to r ', then said part B is authenticated by said part A.

2. Method according to claim 1 characterized in that the key K is broken down into a set of n sub-keys kj, i being the index of sub-keys, by the formula:

K = k _] _ xor k2 xor ... xor k _n .

3. Method according to claim 1 or 2 characterized in that it comprises a system for calculating the key K 'made random by the order of use of the sub-keys k- i being the index of sub-keys, in the formulation:

K '= R2 xor k ^ xor ... xor k _n .

4. Method according to claim 3 characterized in that the secret key K 'is calculated by means of an algorithm which comprises an initialization phase and a set of loops.

5. Method according to claim 4 characterized in that the initialization phase comprises:

- a first array k, or k [], containing the n sub-keys kj_ and

- a second array called a_faire, or a_faire [], containing n booleans, each boolean containing the true value called "True" or "T", and characterized in that the arrays k [] and a_faire [] contain the same number n of elements, represent the n subkeys k_ and the n booleans.

6. Method according to claim 4 characterized in that the loop of the algorithm comprises the following steps a) the first step consists in that as long as there remains an element of the array a_faire [] at the value "T", a random number i, between

1 and n, is then chosen; b) the second step consists in testing the element i of the array a_faire [] at the value "T"; c) if the result of the second step is true, then the third step consists of two operations: - the first is the assignment, to the variable K ', of the result of the mathematical "or exclusive" between K' and the i ^ e element of the array k [] which is the calculation of the following formula:

K '= K' xor k [i].

The second is the assignment to the element of index i of the table a_faire [] of the value "False", called below in the description and in the figure by "F": to do [i] = "F ".

7. Method according to claim 4 characterized in that the loop of the algorithm comprises the following steps a) the first step consists in that as long as there remains an element of the array to do [] at the value "T", a random number i, between 1 and n, then being chosen; b) the second step consists in testing the element i of the array a_faire [] at the value "T"; c) if the result of the second step is false then the calculation system returns to the first step.

8. Authentication system with symmetric encryption algorithm between two entities or parts A and B, having the same secret key K characterized in that it implements the authentication method according to any one of claims 1 to 7 .