EP1949292A1

EP1949292A1 - Method for securely handling data during the running of cryptographic algorithms on embedded systems

Info

Publication number: EP1949292A1
Application number: EP06819181A
Authority: EP
Inventors: Benoit Chevallier-Mames; Mathieu Ciet; Karine Villegas; Jacques Fournier
Original assignee: Gemplus SCA
Current assignee: Thales DIS France SA
Priority date: 2005-11-04
Filing date: 2006-10-27
Publication date: 2008-07-30
Also published as: WO2007051770A1; US20100042851A1; JP2009515449A

Abstract

The invention relates to a method for handling data (A, B) between two memory areas (W, R1, R2) of an electronic component comprising at least one working memory area (W) for carrying out operations on said component bringing into play at least one of said data. The inventive method is characterized in that it involves the use of the same memory areas for executing an operation whatever the operation to be executed is in such a manner that each operation has a hidden signal trace that is identical in terms of location leakage outside this component.

Description

SECURE DATA HANDLING PROCESS DURING

EXECUTION OF CRYPTOGRAPHIC ALGORITHMS ON

EMBEDDED SYSTEMS

The present invention relates to a method for countering hidden channel type attacks during data manipulation, typically when executing cryptographic algorithms on an electronic component. These can be secret key or public key algorithms.

Such components are particularly used in applications where access to services or data is controlled, such as cryptographic applications.

These components have a programmable architecture formed around a microprocessor and memories, including a volatile programmable memory or a non-volatile memory that contains one or more secret data; it is a generalist architecture able to execute any algorithm.

These components are used in computer systems, embedded or not; they are particularly used in smart cards, for some applications thereof. These are for example banking applications, mobile phone applications including for example SIM cards, tele-toll applications, for example for television, etc. These components or cards therefore implement a cryptographic algorithm to ensure the encryption of a message (when it must remain confidential), or 1 'authentication or digital signature of a message (when one wants to ensure non-repudiation).

From this message input to the card by a host system (server, bank distributor ...) and secret numbers contained in the card, the card provides back to the host system this encrypted or signed message, which allows for example the host system to authenticate the component or the card, or to exchange data. The security of these cryptographic algorithms lies in the number (s) secret (s) contained in the map and unknown (s) of the world outside this map, as well as the way in which these secret numbers are used. . However, it appears that external attacks based on measurable physical quantities from outside the component when it is executing the cryptographic algorithm, allow malicious third parties to find the number (s) ( s) or secret data (s) contained in this card. These attacks are called hidden channel attacks ("side channel analysis" in English) and take into account the existence of an additional channel through which information can leak. The physical signals used are in particular the electromagnetic radiation, the electrical consumption or the calculation time of the component.

In particular, among these hidden channel attacks are the SPA attacks, acronym for Simple Power Analysis, based on one or even a few measurements and DPA attacks, which is the acronym for Differential Power Analysis, based on statistical analyzes from several measurements. These attacks are based for example on the fact that the current consumption of the microprocessor executing instructions varies according to the instruction or data handled.

When manipulating data for the implementation of functions involved in the execution of cryptographic algorithms, it is possible for an attacker to know which registry (s) has (have) been used, by location of active or non-active memory areas (for example, if the data addresses leak in current or electromagnetically). The attacker can then take advantage of this information to be able to use the secrets or functionalities to which he does not have access.

Conventionally, to protect against such attacks, the methods used in the prior art most often propose, for a given operation, to provide several embodiments for this operation and to perform the operation in question by using randomly the one of the intended embodiments. The objective is thus to scramble the tracks by multiplying the ways of performing the same operation, so that the various embodiments involve hidden forms of signals (or signatures or traces) different from a leakage point of view. outward information.

For example, in the case of a copy of a data in a working area of the memory for the execution of a function, it can be provided to access the words of the data to be copied so that random and copy in the disorder in the work area, the words thus accessed according to a hazard. However, if such a method makes it possible to avoid attacks of the dictionary attack type, it remains unsuitable for high-level attacks exploiting, for example, the address leakage of components or in particular providing the possibility of distinguishing the active zones from the memory or not. . Thus, from the outside, it is possible in the end, thanks to this type of attack, to know which data has been copied into the working memory area and to derive all or part of the secrets.

The claimed invention solves this drawback and proposes an alternative method for securely manipulating data when executing cryptographic algorithms on a portable or non-portable electronic component, making it possible to counter hidden channel attacks, particularly those based on a leak in address of the components or on a distinction of active or non-active memory areas, in order to deduce the functionalities that are played in the card.

The invention thus relates to a method for manipulating data between memory zones of an electronic component comprising at least one working memory zone for implementing operations on said component involving at least one of said data, said method being characterized in that it comprises the use of the same memory areas for the execution of an operation, whatever the operation to be implemented, so that each operation presents a trace identical hidden signal in terms of leakage in localization outward of said component.

According to one embodiment, the method comprises, prior to the execution of the operation, a step of configuring the memory areas to be used with the data serving as operands in said operation, said step of configuring the memory zones depending on the operation to be performed. Advantageously, the step of configuring the memory areas consists of copying one of said data into the working memory area, the copy of said data being masked and random in its execution. Advantageously, the memory areas containing said data are simultaneously active when copying one of said data in the working memory area.

According to one embodiment, the copying of one of said data in the working memory zone consists in successively accessing, in a random order, the elements of said data in their respective memory zone and in copying said elements in the memory. working memory area with replacement of one of the data elements by the data element corresponding to the data to be copied in the working memory area.

According to one embodiment, the operations implemented are operations that are part of the the execution of a public key cryptographic algorithm.

Preferably, the public key cryptographic algorithm is of the RSA type, and the operations are square and multiplication operations for modular exponentiation.

According to one embodiment, the method is implemented in a material way.

The invention also relates to a system for implementing the method according to any one of the preceding claims, wherein the component is a smart card, a smart card reader or a smart card reader.

TPM (Trused Platform Module).

Other characteristics and advantages of the present invention will emerge more clearly on reading the description which follows, given by way of illustrative and nonlimiting example and with reference to the following single figure: FIG. 1, which is a representation schematic of different memory areas of a smart card illustrating the principle of the invention.

The general principle on which the invention is based is to find alternative embodiments of several different operations, so that these variants have the same "trace" outside of the electronic component in which they are executed, in terms of leakage. address or location of active areas or not. The respective variants of the different operations are in this case inseparable from each other, which has the effect that an outside observer does not know which operation is actually performed on the component. Typically, according to the general case, the copying operation of a first or second data in a working area of the memory will be performed so that an attacker capable of determining and distinguishing access to the first and to the second data will not be able to know which data has actually been stored in the work area.

According to the invention, it is also proposed to use all the time the same memory areas to make the calculations involved in the current operation, to limit memory access and avoid leakage addresses. More particularly, there is provided a common working memory area, where the operands needed to perform the operation are copied on the fly.

FIG. 1 thus represents such a working memory zone W, as well as two memory zones R1 and R2, containing values to be processed A and B. To counteract certain possible attacks of the aforementioned type, the copying of a datum in the zone working memory is masked and random in its execution, while the computational part is intended to be always the same from an information leakage point of view to the outside.

The method of copying the data item A for example in the working memory area W consists in successively accessing, according to a randomness t, the words of A and B. In this way, during the copying of the given A in W, the memory areas R1 and R2 respectively containing the data A and B are simultaneously active, in an order that is variable depending on the hazard. As a result, it is apparent from the outside that it is not known whether it is the data coming from the memory area R1 or R2 that is copied back to W at the end of the copying process.

FIG. 1 illustrates more particularly a diagram of the algorithm implemented for the copying of the data item A in the work register W according to the principles explained above. Let A = A _k _i I | ... | | A ₀ , B = B _k -i II ... IIB ₀ and W = WkI IW _k -i II ••• I IW ₀ , where II corresponds to the concatenation, and where the X ₁ correspond to the words of the variable X. Moreover, let t be a random bit.

If t = 0 a) for j = 0 to k-1 i) W ₃ <-B _D ; W ₃ <- A ₃ b) W _k ^ O

If t = 1 a) for j = 0 to k-1

W ₃ <- A ₃ ; W _{3 + 1} ^ B ₃ b) W _k ^ O

The algorithm would work similarly to the copy of the data B in W ^m and me so we could not therefore distinguish between the copy of A in W and B copies in W, since it is the 'random' which defines the order of access to which register first. Thus, to return to the example of the copy of A in W, depending on the value 0 or 1 of the hazard t, the memory zone R1 or R2 is first accessed, but in both cases, it is This is indeed the value A which is finally copied in W. Indeed, the algorithm predicts that at each loop turn, the value B ₃ is replaced by the value A _3.

Thus, if t = 0, the value B ₃ is written first in W ₃ (step symbolized by the arrow 1 in FIG. 1), then W ₃ takes the value A ₃ , which therefore replaces the value B ₃ previously written in W ₃ (arrow 2), and so on at each loop round of the algorithm.

In the case where t = 1, W ₃ first takes the value A ₃ (as symbolized by the arrow 1 '), whereas W _{3 + i} takes the value B ₃ (arrow 2'). Then, at the next loop turn, j having been incremented, the value B ₃ copied previously is replaced by the new value A ₃

(arrow 3 '). The copying can of course be done in a non-linear way, that is to say by randomly chosen blocks.

As described above, we run through the loop implemented in the copying algorithm from j = 0 to j = k-1. According to one variant, the algorithm can be executed in the opposite direction, by decreasing j, without modifying the result. Moreover, the algorithm works with words of any size.

In both cases, we finally obtain in the working memory zone W the final value that we wanted to copy, namely the data A. The hazard t therefore advantageously allows to have two different ways of copy A into W, since according to the value of the hazard, we first access A or B first, although the value finally copied in W is always A. The electromagnetic emission type attacks on the zones whether active or not and address leaks are therefore obsolete. Of course, the same process can be used to copy the data B into W.

According to the invention, the copying of the data A or B in the working memory zone W is thus rendered more robust with respect to leakage towards the outside, since it is masked and random in its execution and this, regardless of the area accessed.

According to another aspect of the invention, the computational part involved in an operation to be implemented on the electronic component is intended to always be the same from an information leakage point of view to the outside. To do this, it is planned to always use the same memory areas regardless of the operation to be implemented, so that these operations have the same trace as a hidden signal from an information leakage point of view. outside. The operations are in this case indissociable from each other, which has the effect that an observer does not know what operation is actually performed on the electronic component. Advantageously, it is the configuration of the memory zones involved which makes it possible to obtain one operation or another.

According to an exemplary implementation, the method described above makes it possible to manipulate data in a secure manner to counter attacks of the type "Hidden channel" may advantageously be adapted for the implementation of multiplication and square operations for modular exponentiation in the context of an RSA type cryptographic algorithm. Thus, in the case of this example, the multiplication ("multiply") and square ("square") operations may have the same trace as a hidden signal, since they amount to multiplying a first memory zone by a second memory zone. If these memory zones are always the same, the traces in hidden signal seen from the outside are identical.

According to an exemplary embodiment, the memory areas R1 and W are the memory zones used for the execution of an operation. To carry out the multiplication operation of A by B, the contents of R2 are first copied to W according to the principles of copying previously described, and the contents of the memory area R1 are multiplied by the contents of the working memory area W. performing the square operation on the data item A, the content of R1 is first copied to W, still in application of the same principles already explained, and the content of the memory area R1 is multiplied by the content of the working memory area W The functional difference therefore comes from the previously copied content in the working memory area W, which is rendered inaccessible to an outside observer by the copying process described above. Moreover, the memory areas R1 and W involved in the implementation of the operations being always the same, the traces in hidden signal of these operations seen from the outside are identical. An observer can therefore only deduce which memory areas are used, namely R1 and W according to the example, but can not know what content A or B was copied previously in the working memory area W, it can not deduce which operation is implemented between multiplication or square.

The working memory area W can be initialized in a random order and / or with random values. In general, the method according to the invention is applicable to any algorithm where there would be the possibility of having at least two distinct memory zones to be applied in a calculation and where an outside observer could deduce information. sensitive knowledge of the areas used through attacks of the aforementioned type.

The method of secure manipulation of data according to the invention can be implemented by any appropriate means, hardware or software.

Claims

A method of data manipulation (A, B) between memory areas (W, R1, R2) of an electronic component comprising at least one working memory area (W) for carrying out operations on said component involving at least one of said data, said method being characterized in that it comprises the use of the same memory areas for the execution of an operation, whatever the operation to be implemented, so that each operation presents a trace identical hidden signal in terms of leakage in localization outward of said component.

2. Method according to claim 1, characterized in that it comprises, prior to the execution of the operation, a step of configuring the memory areas to be used with the data serving as operands in said operation, said configuration step memory areas depending on the operation to be performed.

3. Method according to claim 2, characterized in that the step of configuring the memory areas consists of copying one of said data (A or B) in the working memory area (W), copying said data (A or B) being masked and random in its execution.

4. Method according to claim 3, characterized in that the memory areas (R1, R2) containing said data (A, B) are simultaneously active when copying one of said data (A or B) in the memory area. working (W).

5. Method according to claim 3 or 4, characterized in that the copying of one of said data (A or B) in the working memory area (W) consists of accessing successively, in an order according to a random ( t), the elements of said data (A, B) in their respective memory area (R1, R2) and copying said elements into the working memory area (W) with replacement of one of the data elements by the element data corresponding to the data to be copied into the working memory area.

6. Method according to any one of the preceding claims, characterized in that the operations implemented are operations involved in the context of the execution of a public key cryptographic algorithm.

7. Method according to claim 6, characterized in that the public key cryptographic algorithm is RSA type.

8. Method according to claim 7, characterized in that the operations are square operations and multiplication for modular exponentiation.

9. Method according to any one of the preceding claims, characterized in that it is implemented in a material manner.

10. System for implementing the method according to any one of the preceding claims, wherein the component is a smart card, a smart card reader or a TPM (Trused Platform Module).