EP1493242A1

EP1493242A1 - Method for making secure an electronic entity with encrypted access

Info

Publication number: EP1493242A1
Application number: EP03740554A
Authority: EP
Inventors: Christophe Giraud
Original assignee: Oberthur Card Systems SA France
Current assignee: Idemia France SAS
Priority date: 2002-04-08
Filing date: 2003-04-02
Publication date: 2005-01-05
Also published as: CA2480896C; US20100322421A1; US7796750B2; CA2480896A1; US20060104438A1; WO2003085881A1; JP2005522912A; FR2838262A1; AU2003260714A1; US8180046B2; JP2011103686A; FR2838262B1

Abstract

The invention concerns a method for protecting an electronic entity with encrypted access, against DFA (Differential Fault Analysis) attacks which consists in: storing the result of a selected step (Rm, Kn) of an iterative process forming part of the cryptographic algorithm and in performing once more at least part of the steps of said iterative process up to a new computation of a result corresponding to the one which has been stored, comparing the two results and denying distribution of an encrypted message (MC) if they are different.

Description

Method for securing an electronic entity with encrypted access

The invention relates to a. method for securing an electronic entity with encrypted access, such as for example a microcircuit card, the improvement more particularly aimed at detecting attacks known by the abbreviation DFA (Differential Fault Analysis, in English). The invention is particularly aimed at securing known algorithms such as AES or DES.

Certain electronic entities with encrypted access, in particular microcircuit cards, are vulnerable to so-called DFA attacks consisting in disturbing the progress of the cryptographic algorithm so as to change the value of an intermediate result, to process the difference obtained between the message encrypted normally and the message encrypted with error and to deduce therefrom information on the secret key of the electronic entity. Errors are very easy to produce on a microcircuit card, by intervening on the external environment, for example by causing a voltage peak, by subjecting the card to a light flash (in particular using a laser beam) , by suddenly varying the frequency of the external clock, etc ...

Among the most used algorithms, we can cite the DES (Data Encryption Standard, in English) and especially the AES (Advanced Encryption Standard, in English). It is recalled that the two algorithms AES and DES have in common to apply to a message of entry a succession of groups of operations called "rounds" under the control of a series of respective sub-keys, successively developed from '' a secret initial key, specific to the electronic entity considered. It is this initial key (noted K below) that the fraudster attempts to reconstruct. Part of the algorithm is devoted to the development of sub-keys by implementing a key extension process by a function F, non-linear in the case of AES. The function is applied to said initial key, then again to the result of the application of said function and so on. The subkeys are developed from this succession of intermediate results from the initial key K.

Until now, DFA attacks have been considered unusable in practice with respect to the AES algorithm. However, studies at the origin of the invention have made it possible to demonstrate that a triple DFA type attack, in synchronism with certain applications of the F function and the start of the last "round", makes it possible to find all the bytes of the last subkey in the case where said input key K is coded on 128 bits , which is currently the case for most systems where the AES algorithm is used. Knowing this information allows you to find the entry key.

The invention offers a simple and effective defense against this type of attack. The invention relates to a method for securing an electronic entity with encrypted access, which comprises means for executing a cryptographic algorithm consisting in applying to a input message a succession of groups of so-called "round" operations making intervene a series of respective sub-keys, successively elaborated by an iterative process implemented from an initial key, characterized in that it consists in memorizing the result of a step of said iterative process, in redoing at least one part of the steps of said iterative process until the recalculation of a result corresponding to that which has been memorized, to compare the value of said memorized result with the value of the corresponding recalculated result and to prohibit the broadcasting of an encrypted message resulting from the setting implementation of said algorithm if these two values are different.

Indeed, if an error, due to a DFA attack, occurs during the iterative process of elaboration of the subkeys, then the memorized result and the corresponding recalculated result are necessarily different because it is impossible to reproduce the same twice "error" in practice.

For example, a stored result, called an intermediate result, can be one of the steps in the process known as key diversification process consisting in applying a non-linear function F to the result of the previous analogous step. One can also store one of the sub-keys and recalculate this sub-key from a previous step of said iterative process. For example, the last subkey is stored.

The invention will be better understood and other advantages thereof will appear more clearly in the light of the description which follows, given solely by way of example and made with reference to the appended drawings in which: - Figure 1 is a diagram of an electronic entity such as a microcircuit card, capable of implementing the method of the invention;

- Figure 2 is a flowchart illustrating the so-called AES algorithm;

- Figure 3 is a flowchart illustrating the implementation of the invention as a complement in the execution of the AES; and

- Figure 4 is a flowchart illustrating the DES algorithm to which the invention can also be applied.

In FIG. 1, an electronic entity 11 is shown, here forming a microcircuit card with its essential components, namely a set of contact pads 12, metallic, making it possible to connect the microcircuit 13 contained in the card to a reader. card, server or the like with which said microcircuit card will be able to exchange information after an authentication phase implementing a known secret key algorithm, for example the AES algorithm or the DES algorithm. Conventionally, the microcircuit 13 is broken down into a microprocessor 14, some of whose accesses are connected to the contact pads, and a memory M coupled to the microprocessor. When the card is coupled to an outdoor unit to fulfill a given function (financial transaction, access to a telephone or telematics service, access control, etc.), an authentication phase is implemented in the card. This process is programmed in microcircuit 13 and part of the memory

M is dedicated to him.

For example, the authentication phase implements an AES algorithm, the operation of which will be recalled with reference to FIG. 2. The AES algorithm operates on the basis of an input message ME transmitted in clear by the outdoor unit to which the electronic entity is coupled. The entity 11 also has a secret key K, stored, and the algorithm consists in transforming the message ME until obtaining an encrypted message MC following a certain number of transformations performed with the intervention of a certain number of subkeys Ko, KL K ₂ , ..., K _n -ι, K _n . On the other hand, a nonlinear function F is programmed in the electronic entity to apply successively, first to the key K, then to the result R ^ i the transformation of the key K by the function F, then to the result R ₂ of the transformation of the result Ri by the same function F and so on. The different subkeys K ₀ ... K _n are extracted from this process of extension of the key K by the function F. More precisely, it is known that the key K can be a word of 128 bits, 192 bits or 256 bits. The ME input message is a 128 bit word. All combinations are possible and a person skilled in the art chooses the combination which represents the best compromise, taking into account the context, between the speed of execution and the level of security required. Currently, however, most of the AES algorithms actually implemented use a 128-bit K key. The Ko ... K _n subkeys must be in the format of the input message. This is why, each sub-key is created from one or two successive results elaborated during the process of key extension by the function F. In the example described, the key K is coded on 192 bits. Consequently, the subkey Ko is extracted from the first two thirds of the key K, the subkey Ki is extracted from the other third of the key K and from the first thirds of the intermediate result Ri of the first transformation of this key by the function F, the subkey K ₂ is extracted from the last two thirds of the intermediate result Ri, and so on until the elaboration of the last subkey K _n .

On the processing side of the input message, the operations are as follows. Said input message ME is combined with the subkey Ko by a function or exclusive 16. After which, the result is subjected to a group of operations (here called ROUND 1) with intervention of the subkey K- | . Then, the result is again submitted to a group of operations called ROUND 2 with intervention of the subkey K ₂ , up to ROUND _n _ι, said last ROUND, with intervention of the subkey K _n _ι. All "ROUNDS", from 1 to n-1, are composed of four transformations. A ROUND _n , known as final ROUND with intervention of the subkey K _n comprises only three transformations. The result of this final round is an encrypted message MC which is sent outwards.

On the basis of the invention, it has been demonstrated that, if one is capable of causing disturbances as indicated at precise times in the course of the AES algorithm described above, one can find all the bytes of a subkey and more particularly according to the example, of the last subkey K _n as follows:

- if one causes the disturbance at the time of the application of the last function F, one arrives at finding information on the penultimate extension of the key by the function F, namely the last four bytes of the penultimate result R _m .

- if we also manage to produce a disturbance at the time of the execution of the penultimate extension by the function F, we can find the four neighboring bytes of R _m _ι.

- if we cause a disturbance at the start of the last round (ROUND _n -ι), we manage to find 8 bytes of the last key extension by the function F, that is to say R _m . These bytes belong to the subkey K _n .

- by processing the previous results, we still manage to find six more bytes distributed in the last key extension R _m by the function F.

These bytes also belong to the subkey K _n .

To find the last two bytes of the subkey K _n , it is possible to study all the possibilities until finding these last two bytes. Consequently, if the key K had been coded on 128 bits, it could have been found for sure by the sole implementation of the attack described above. It is recalled that in the majority of the AES algorithms currently implemented, the key K is effectively coded on 128 bits and there is no difference between the intermediate results Ri, R ₂ ... R _m and the subkeys Ki, K ₂ ... K _n (in this case, n = m) since each subkey is made up of the whole of a corresponding intermediate result Rj. In the example described, however, the key K has been coded on 192 bits and the attack which has been described in broad outline above does not make it possible to find the key since the result R _m is not entirely known. We cannot therefore "go back" to the key K from this incompletely known result. However, security has been considerably weakened since partial information on the key is available, which makes other attacks (for example of the DPA type) known per se more effective.

Anyway, the counter to this type of attack consists in memorizing an intermediate result Rj, for example R _m , or a subkey, for example here the last subkey K _n , to redo at least one part of the stages of elaboration of the succession of said sub-keys, that is to say essentially the process of extension of the key by the function F, until the recalculation of a result corresponding to that which has been stored. From this moment, we have two values (intermediate result or subkey) which must be identical if the entity electronics has not been subjected to any DFA attack. It suffices to compare the value of the result or stored subkey to the value of the corresponding recalculated result or subkey and prohibit the broadcast of the encrypted message MC from the final ROUND if these two values are different. This is illustrated in FIG. 3 where the AES algorithm is completed (according to one embodiment) by redoing all of the steps for developing the succession of said sub-keys and more particularly of the process of extending the key K. According to this example, the AES algorithm described with reference to FIG. 2 is executed for the first time, the result is an encrypted message MC. The last subkey K _n is stored. Then, we repeat the whole process of key extension by the function F from the secret key K of the entity. This results in determining a new value of K _n . The previously stored value and the new value are compared (equality test). If the two values are equal, the output of the message MC is authorized. If the two values do not coincide, the MC value is not retransmitted to the outside and an error message can be issued.

In the example which has just been described, the whole process of extending the key is repeated until the new calculation of the last subkey K _{n is} obtained. As we saw above, we can memorize any intermediate result Ri or subkey, and redo at least part of the stages of elaboration of the succession of subkeys until the recalculation of an intermediate result or subkey corresponding to that which has been memorized. In general, it is advantageous, if the entire key extension cycle is not repeated by the function F, to redo at least one final part of the steps for developing the succession of said sub-keys, c 'is to say more particularly a final part of the process of extension of key by the function F, until obtaining a second calculation of the last intermediate result R _m or of the last subkey.

If you do not redo the entire iterative process of key extension (from key K), you obviously have to memorize the intermediate result (or the subkey) from which you start again. The invention is not limited to securing the AES algorithm. By way of example, the DES algorithm, also known, is described in FIG. 4. Briefly, in this algorithm, the process of extending the key K is as follows. The key K (64 bits) is subjected to a P1 permutation on the bits and reduced to 56 bits. The result is a word 20 split into two 28-bit parts. Each of them is subjected to a permutation R (circular rotation on the bits) of 1 or 2 bits depending on the case. The two results are combined to form a new word 21 of 56 bits subjected to a new permutation P2 and concatenated to 48 bits to give a subkey Ki. Furthermore, the 56-bit word 21 is processed so as to undergo two circular rotations R to result in a new word 22, again subjected to the permutation P2 to generate a subkey K2 and so on until K16. In addition, the 64-bit ME input message undergoes the following transformations. It is first subjected to a P3 permutation on the bits and the result is subjected to functions constituting the ROUND 1 involving the subkey K1. We then implement other successive rounds involving other corresponding sub-keys (up to sub-key K16) and the result of the last round is subjected to a reverse permutation P3 ^" . The result of this inverse permutation is the encrypted message MC intended to be sent back. We can see that the general structure of the DES algorithm which has just been recalled above lends itself well to the implementation of the invention. sub-key K16 and redo all or part of the process of diversification of the key K composed of the permutation P1 and the rotations R. The test can even be carried out on the value of the last intermediate result (word 36) before the last permutation P2 In this case, it is this last result which is memorized and not the sub-key K16.

Of course, the invention also relates to any electronic entity, in particular any microcircuit card, comprising means for implementing the method described above.

Claims

1. Method for securing an electronic entity with encrypted access, which comprises means for executing a cryptographic algorithm consisting in applying to a input message a succession of groups of operations called "rounds" involving a series respective sub-keys (Ko ... K _n ), successively developed by an iterative process implemented from an initial die (K), characterized in that it consists in memorizing a result of an intermediate step (R _m , K _n ) of said iterative process, to repeat at least part of the steps of said iterative process until the recalculation of a result corresponding to that which has been stored, to compare the value of said stored result with the value of the result recalculated corresponding and to prohibit the broadcast of an encrypted message (MC) resulting from the implementation of said algorithm if these two values are different.

2. Method according to claim 1, characterized in that it consists in memorizing the value of a subkey (K _n ) and in redoing at least part of the steps of said iterative process until the recalculation of a sub- key corresponding to said stored subkey.

3. Method according to claim 1, characterized in that it consists in memorizing the value of an intermediate result (R _m ) of said iterative process and in redoing at least part of said iterative process until the recalculation of an intermediate result corresponding to the one that has been memorized.

4. Method according to claim 2, characterized in that it consists in memorizing the value of the last sub-key (K _n ) and in redoing at least one final part of the stages of elaboration of the succession of said sub-keys until 'to obtain a second calculation of said last subkey.

5. Method according to claim 4, characterized in that it consists in redoing all the steps for developing the succession of said sub-keys.

6. Method according to one of the preceding claims, characterized in that it applies to an algorithm known as AES, known per se.

7. Method according to one of claims 1 to 6, characterized in that it applies to a so-called DES algorithm, known per se.

8. Autonomous electronic entity characterized in that it comprises means for implementing (13) the method according to one of the preceding claims.

9. Electronic entity according to claim 8, characterized in that it is arranged in the form of a microcircuit card.