EP1362451A1

EP1362451A1 - Method for securing a computer installation involving a cryptographic algorithm using boolean operations and arithmetic operations and the corresponding embedded system

Info

Publication number: EP1362451A1
Application number: EP02704839A
Authority: EP
Inventors: Louis Goubin
Original assignee: CP8
Current assignee: Thales DIS France SA
Priority date: 2001-02-15
Filing date: 2002-02-14
Publication date: 2003-11-19
Also published as: US20040139136A1; US7334133B2; WO2002065692A1; FR2820914A1

Abstract

The invention relates to a method for securing a computer installation involving a cryptographic algorithm using boolean operations and arithmetic operations, in which at least one variable is separated into several parts by means of a boolean separation using a boolean operation and an arithmetic separation using an arithmetic operation. The inventive method is characterised in that in order to move from any of said separations to the other, a predetermined number of boolean and arithmetic operations are carried on said parts and at least one variate such that, for each of the values that appear during the calculation, there is no correlation with said variable. The invention also relates to an associated embedded system.

Description

Method for securing an electronic assembly implementing a cryptographic algorithm using Boolean operations and arithmetic operations, and corresponding embedded system

Introduction

Paul Kocher et al. introduced in 1998 [5] and published in 1999 [6] the concept of "Differential Power Analysis", also known as DPA. The initial target was symmetric cryptosystems, such as DES or AES candidates, but public key cryptosystems have since proven to be equally vulnerable to DPA attacks.

In 1999, Chari et al. [2] suggested a generic countermeasure consisting in separating all the intermediate variables. A similar method of "duplication" has been proposed by Goubin et al. [4], as a special case. However, these general methods generally greatly increase the amount of memory or the computing time required, as noted by Chari et al. In addition, it has been shown that even the intermediate stages can be attacked by DPA, so that the separation of the variables must be carried out on all the stages of the algorithm. This makes the question of additional memory and computing time all the more crucial, in particular for embedded systems such as smart cards.

In 2000, Thomas Messerges [8] studied the DPA attacks applied to AES candidates. He developed a general countermeasure, consisting in masking all the inputs and outputs of each elementary operation executed by the microprocessor. This generic technique allowed him to assess the impact of these countermeasures on the five AES candidates. However, for algorithms which combine Boolean functions and arithmetic functions, we are led to use two kinds of masks. We therefore need a conversion method between Boolean masking and arithmetic masking. This is typically the case for IDEA [7] and for three of the AES candidates: MARS [1], RC6 [9] and Twofish [10].

T. Messerges [8] proposed an algorithm to perform this conversion. Unfortunately, Coron and Goubin [3] described a specific attack, showing that the "BooleanTo Arithmetic" algorithm proposed by T. Messerges is insufficient to protect against DPA. Likewise, its "ArithmeticToBoolean" algorithm is not safe either.

The object of the present invention is to propose two new algorithms "BooleanToArithmetic" and "ArithmeticToBoolean", proven to be safe against DPA attacks. Each of these algorithms uses only very simple operations: XOR (or exclusive), AND, subtraction, and the "left shift" of a register. Our “BooleanToArithmetic” algorithm uses a constant number (equal to 7) of such elementary operations, while the number of elementary operations involved in our “ArithmeticToBoolean” algorithm is proportional (it is 5R + 5) to the size (Le the number of bits K) of the processor registers.

Context

The "Differential Power Analysis" attack

“Differential Power Analysis” (DPA) is an attack which makes it possible to obtain information on the secret key (contained in a smart card for example), by carrying out a statistical analysis of the records of electrical consumption, measured over a large number calculations with the same key.

This attack requires no knowledge of the individual power consumption of each instruction, nor of the time position of each of these instructions. instructions. It is applied in exactly the same way as soon as the attacker knows the outputs of the algorithm and the corresponding consumption curves. It is based solely on the following fundamental assumption:

Fundamental assumption: // there is an intermediate variable, appearing during the calculation of the algorithm, such that the knowledge of a few bits of the key (in practice less than 32 bits) makes it possible to decide if two inputs (respectively two outputs) give or not the same value for this variable.

The masking method

The present invention is concerned with the "masking" method, suggested by Chari et al. [2].

The basic principle consists in programming the algorithm so that the fundamental assumption above is not checked any more (Le. An intermediate variable never depends on the knowledge of an easily accessible subset of the secret key) . More precisely, by using a key sharing scheme, each of the intermediate variables appearing in the cryptographic algorithm is separated into several parts. In this way, an attacker is forced to analyze distributions of several points, which makes his task exponential in the number of elements of the separation.

The conversion problem

For algorithms that combine Boolean functions and arithmetic functions, two types of masking must be used:

A boolean masking: x '= x Φ r. An arithmetic masking: A = x - r modulo 2 ^l Here, the variable x is masked by the random value r, which gives the masked value x '(or A). Our objective is to find an efficient algorithm to pass from boolean masking to arithmetic masking and vice versa, while ensuring that the intermediate variables are decorrelated from the data to be masked, which ensures resistance to DPA.

Throughout this document, it is assumed that the processor uses registers of K bits (in practice K is most of the time equal to 8, 16, 32 or 64). All arithmetic operations (such as the addition "+", the subtraction "-", or the doubling "z -> 2.z") are considered modulo 2. For reasons of simplicity, the "modulo 2" will often be omitted in the following.

To this end, the invention relates to a method for securing an electronic assembly comprising a processor and a memory, implementing a cryptographic algorithm stored in the memory and using Boolean operations and arithmetic operations, in which at least one variable is separated into several parts, according to a Boolean separation using a Boolean operation, and according to an arithmetic separation using an arithmetic operation, characterized in that, to pass from any one of these separations to the other, one performs, by means of the processor, a predetermined number of Boolean and arithmetic operations on said parts and at least one random number, so that, for each of the values appearing during the calculation, there is no correlation with said variable, the calculation resulting in a result stored in memory.

Advantageously, to pass from the Boolean separation to the arithmetic separation, the method comprises the following stages:

-separate all parts except one into at least two elements;

-calculate at least two partial results never depending on all the elements of a part; -to obtain each part except one of the arithmetic separation, group together at least two of said partial results. Advantageously, the separation of said parts into at least two elements uses a Boolean operation.

Advantageously, said grouping of two of said partial results is carried out by means of a Boolean operation.

Advantageously, the Boolean operation used for the separation of said parts into at least two elements is the "or exclusive" operation.

Advantageously, the Boolean operation used for grouping said partial results is carried out by means of the "or exclusive" operation.

Advantageously, to pass from the Boolean separation to the arithmetic separation, only the operations "or exclusive" and "subtraction" are used.

Advantageously, the Boolean separation, in two parts, using the "or exclusive" operation and the arithmetic separation, in two parts, using the "addition" operation, the method is characterized in that to pass from the Boolean separation to the 'arithmetic operation, we use five operations "or exclusive" and two operations "subtraction".

Advantageously, to move from arithmetic separation to Boolean separation, at least one variable obtained by means of a predetermined number of successive iterations is defined from an initial value which is a function of at least one hazard, by applications. successive of a transformation based on Boolean and arithmetic operations applying to said parts of the arithmetic separation and to said at least one hazard.

Advantageously, said transformation is based on the "or exclusive", "and logical" and "logical shift of a bit to the left" operations. Advantageously, each part except one of the Boolean separation is obtained by applying Boolean operations to the said variable or said variables obtained by successive iteration, to the said parts of the arithmetic separation and to the said random hazard (s).

Advantageously, the Boolean operations applied to obtain all the parts except one of the Boolean separation are the "or exclusive" operation and the "logical shift of a bit to the left" operation.

Advantageously, to secure an electronic assembly using K-bit registers, the arithmetic separation, in two parts, using the "addition" operation and the Boolean separation, in two parts, using the "or exclusive" operation, characterized in that that to pass from the boolean separation to the arithmetic operation, one uses (2K + 4) operations "or exclusive", (2K + 1) operations "and logical", and K operations "logical shift of a bit to the left" .

The invention also relates to an on-board system comprising a processor and a memory, and implementing a cryptographic algorithm stored in the memory and using boolean operations and arithmetic operations, in which at least one variable is separated into several parts, according to a boolean separation using a boolean operation, and according to an arithmetic separation using an arithmetic operation, characterized in that, to pass from any one of these separations to the other, it comprises conversion means for effecting, by means of the processor , a predetermined number of Boolean and arithmetic operations on said parts and at least one hazard, so that, for each of the values appearing during the calculation, there is no correlation with said variable, the calculation resulting in a result stored in memory.

The description which follows is accompanied by a single figure representing the constitution of a smart card suitable for executing the invention. From boolean masking to arithmetic masking

To calculate A = (x Φ r) - r, we use the following algorithm:

"BooleanToArithmetic" algorithm

Input: (x ', r) such that x = x' Φ r. Output: (A, r) such that x = A + r.

Initialize Ea a random value γ T <-x 'ΦΓ

T A- T- Γ

T A- T x 'r <-r®r A <-X' ΦΓ A <-A - Γ A <-A ΦT

The "BooleanToArithmetic" algorithm uses 2 auxiliary variables (T and T), 1 call to the random generator, and 7 elementary operations (more precisely: 5 "XOR" and 2 subtractions).

From arithmetic masking to Boolean masking

To calculate x '= (A + r) Φ r, we use the following algorithm:

"ArithmeticToBoolean" algorithm

Input: (A, r) such that x = A + r. Output: (x ', r) such that x - x' r. Initialize E to a random value γ T <-2.rx '<-TΦr

x '-TΦA

Γ <-ΓΦX '

Ω <-ΩΦΓ Γ -TΛA Ω <-ΩΦΓ

FOR k = l to K-l r <-T Λr

Γ-ΓΦΩ

T <-TΛA Γ-ΓΦT

T <-2.Γ

ENDFOR x '<-x' ΦT

The "ArithmeticToBoolean" algorithm uses 3 auxiliary variables (T, Ω and -T), 1 call to the random generator, and (5Λ. + 5) elementary operations (more precisely (2K + 4) "XOR", (2K + 1 ) "AND" and K "left shifts").

With regard to the number of hazards involved in the method according to the invention, it should be noted that there may be one or more per variable and, in the case of more than one variable, there will generally be several hazards respectively associated with said variables. variables. The single figure recalls the general constitution of a smart card 1. It includes information processing means or CPU 2, information storage means 3,4,5 of different types (RAM, EEPROM, ROM) , input / output means 6 allowing the card to cooperate with a card reader terminal, and a bus 7 allowing these different elements to interact with each other. The aforementioned conversion means, suitable for performing Boolean and arithmetic operations, include in particular at least one program stored in the information storage means 3,4,5.

Bibliography

[1] Carolynn Burwick, Don Coppersmith, Edward D'Avignon, Rosario Gennaro, Shai Halevi, Charanjit Jutla, Stephen M. Matyas, Luke O'Connor, Mohammad Peyravian, David Safford and Nevenko Zunic, "MARS - A Candidate Cipher for AES ”, Proposal for the AES, June 1998. Available at: http://www.research.ibm.com/security/mars.pdf

[2] Suresh Chari, Charantjit S. Jutla, Josyula R. Rao and Pankaj Rohatgi, "Towards Sound Approaches to Counteract Power-Analysis Attacks", in Proceedings of Advances in Cryptology - CRYPTO'99, Springer-Verlag, 1999, pp. 398-412.

[3] Jean-Sébastien Coron and Louis Goubin, "On Boolean and Arithmetic Masking against Differential Power Analysis", in Proceedings of Workshop on Cryptographie Hardware and Embedded Systems, Springer-Verlag, August 2000.

[4] Louis Goubin and Jacques Patarin, "DES and Differential Power Analysis - The Duplication Method", in Proceedings of Workshop on Cryptographie Hardware and Embedded Systems, Springer-Verlag, August 1999, pp. 158-172.

[5] Paul Kocher, Joshua Jaffe and Benjamin Jun, "Introduction to Differential Power Analysis and Related Attacks", http://www.cryptography.com dpa / technical, 1998. [6] Paul Kocher, Joshua Jaffe and Benjamin Jun, "Differential Power Analysis", in Proceedings of Advances in Cryptology - CRYPTO'99, Springer-Verlag, 1999, pp. 388-397.

[7] Xuejia Lai and James Massey, "A Proposai for a New Block Encryption Standard", in Advances in Cryptology - EUROCRYPT '90 Proceedings, Springer-Verlag, 1991, pp. 389-404.

[8] Thomas S. Messerges, "Securing the AES Finalists Against Power Analysis Attacks", in Proceedings of Fast Software Encryption Workshop 2000, Springer-Verlag, April 2000.

[9] Ronald L. Rivest, Matthew JB Robshaw, Ray Sidney and Yiqun L. Yin, "The RC6 Block Cipher", vl.l, August 20, 1998. Available at: ftp://ftp.rsasecurity.com/pub/ rsalabs / aes / rc6v 11.pdf

[10] Bruce Schneier, John Kelsey, Doug Whiting, David Wagner, Chris Hall and Niels Ferguson, "Twofish: A 128-Bit Block Cipher", June 15, 1998, AES submission available at: http: //www.counte ane. com / twofish.pdf

Claims

claims

1. Method for securing an electronic assembly implementing a cryptographic algorithm using Boolean operations and arithmetic operations, in which at least one variable is separated into several parts, according to a Boolean separation using a Boolean operation, and according to a separation arithmetic using an arithmetic operation, characterized in that, in order to pass from any one of these separations to the other, a predetermined number of boolean and arithmetic operations are carried out on said parts and at least one random number, so that that, for each of the values appearing during the calculation, there is no correlation with said variable.

2. Method according to claim 1, characterized in that, to pass from the Boolean separation to the arithmetic separation, the method comprises the following stages:

-separate all parts except one into at least two elements;

-calculate at least two partial results never depending on all the elements of a part;

-to obtain each part except one of the arithmetic separation, group together at least two of said partial results.

3. Method according to claim 2, characterized in that the separation of said parts into at least two elements uses a Boolean operation.

4. Method according to claim 2, characterized in that said grouping of two of said partial results is carried out by means of a Boolean operation.

5. Method according to claim 3, characterized in that the Boolean operation used for the separation of said parts into at least two elements is the "or exclusive" operation.

6. Method according to claim 4, characterized in that the Boolean operation used for grouping said partial results is carried out by means of the "or exclusive" operation.

7. Method according to claim 6, characterized in that to pass from the Boolean separation to the arithmetic separation, only the operations "or exclusive" and "subtraction" are used.

8. Method according to claim 6, the Boolean separation, in two parts, using the "or exclusive" operation and the arithmetic separation, in two parts, using the "addition" operation, characterized in that to pass from the separation boolean to the arithmetic operation, we use five "or exclusive" operations and two "subtraction" operations.

9. Method according to claim 1, characterized in that, to move from arithmetic separation to Boolean separation, at least one variable obtained by means of a predetermined number of successive iterations is defined from an initial value which is a function of at least one hazard, by successive applications of a transformation based on Boolean and arithmetic operations applying to said parts of the arithmetic separation and to said at least one hazard.

10. Method according to claim 9, characterized in that said transformation is based on the operations "or exclusive", "and logical" and "logical shift of a bit to the left".

11. Method according to claim 9, characterized in that each part except one of the Boolean separation is obtained by applying Boolean operations to said variable or said variables obtained by successive iteration, to said parts of the arithmetic separation and to said random hazard (s).

12. Method according to claim 11, characterized in that the Boolean operations applied to obtain all the parts except one of the Boolean separation are the "or exclusive" operation and the "logical shift of a bit to the left" operation .

13. The method of claim 12, for securing an electronic assembly using registers of K bits, the arithmetic separation, in two parts, using the operation "addition" and the Boolean separation, in two parts, using the operation "or exclusive ", characterized in that to pass from the Boolean separation to the arithmetic operation, one uses (2K + 4) operations" or exclusive ", (2K + 1) operations" and logic ", and K operations" logical shift d 'one bit to the left ".

14. On-board system comprising information processing means and information storage means, and implementing a cryptographic algorithm using Boolean operations and arithmetic operations, in which at least one variable is separated into several parts, according to a Boolean separation using a Boolean operation, and according to an arithmetic separation using an arithmetic operation, characterized in that, in order to pass from any one of these separations to the other, it comprises conversion means for carrying out a predetermined number d 'Boolean and arithmetic operations on said parts and at least one random, so that, for each of the values appearing during the calculation, there is no correlation with said variable.