EP1984813A2

EP1984813A2 - Cryptographic device and method for generating pseudo-random numbers

Info

Publication number: EP1984813A2
Application number: EP07731553A
Authority: EP
Inventors: Matt Robshaw
Original assignee: France Telecom SA
Current assignee: Orange SA
Priority date: 2006-02-13
Filing date: 2007-02-01
Publication date: 2008-10-29
Also published as: WO2007093723A3; FR2897451A1; WO2007093723B1; WO2007093723A2; US20090022310A1

Abstract

The invention concerns a cryptographic device and method for generating pseudo-random numbers (1), including the following steps: subdividing initial data (1) into a plurality of words (3) with definite b- bits in a finite body GF(2<SUP>b</SUP> ), assigning said words to cells (5) of a status board (7) to form an initial status block (13a); assembling the cells (5) of said status board (7) to assign a group (11) of cells to each set of d /b words, wherein d is a multiple of b strictly higher than b; and iteratively generating from said initial status block (13a), a succession of status blocks (13b) to form a final status block (13c), such that upon each iteration each set of d/b words of a current status block (13b) is replaced by at least another set of d/b words, using, to form a next status block, at least one reference table (9) comprising substitution elements with d-bits.

Description

Title of the invention

Cryptographic device and method for generating pseudorandom numbers

Technical field of the invention

The invention relates to the field of cryptography. More specifically, the invention relates to the use of a pseudo-random number generation scheme that can be implemented in devices having a low computing power. The technique according to the invention can be applied to the implementation of a pseudo-random number generator (in English "pseudo-random number generato /" or PRNG) of low cost.

Background of the invention

In general, there are two approaches to the design of symmetric cryptographic algorithms.

The first approach is to provide "proof of security" based on the relationship between a method to "break" a code and the ability to solve what is commonly considered a difficult problem.

The second most common approach depends on careful engineering of an electronic circuit comprising several logic gate components to achieve encryption according to the desired level of security. In this case, the efficiency can be quantified by the speed of calculation or the number of logic gates necessary to produce the electronic circuit.

Currently, and after standardization of AES (Advanced Encryption Standard) type cryptographic algorithms (FIPS 197, NIST 2001), There is great interest in implementing this kind of algorithms in a wide range of applications.

AES is notable for its close observation of Shannon's known principles and two important concepts for the implementation of cryptographic algorithms, namely "confusion" and "diffusion". In a simplified way, "confusion" corresponds to the idea of "doing difficult operations" whereas "diffusion" corresponds to the idea of "propagating change or transformation" during a cryptographic calculation.

It is usually considered that one of the best ways to provide a confusing effect is to use an "S-box Substitution box", and that one of the best ways to provide a broadcast effect is to to perform some type of permutation.

Indeed, the AES algorithm takes as input a block of 16 bytes. Each byte is replaced by another byte according to a substitution box (S-box) from 8-bit to 8-bit. These bytes are then placed in a matrix where each element of the matrix is shifted cyclically to the left of a certain number of columns. Then, a matrix product is performed before adding each byte with a corresponding byte of an iteration key (round ke / in English) obtained by diversification of an encryption key.

Thus, the security of an AES type algorithm depends on an interaction between the S-box and a mixing (or broadcasting) operation of permuting bytes and structurally combining them. The interaction between these bytes is implemented accurately to ensure and provide good resistance against differential cryptanalysis or linear cryptanalysis attacks. Currently, we try to introduce cryptographic features in very limited computing environments such as for example in RFID chips.

However, algorithms for this kind of environment are done piecemeal and use low capacity cryptographic components. Indeed, it is very difficult to achieve cryptographic components having a quality comparable to those used for the implementation of an AES type algorithm in a very restricted environment.

Object and summary of the invention

The present invention relates to a cryptographic method for generating pseudo-random numbers comprising the following steps:

subdividing initial data into a plurality of b-bit words defined in a finite field GF (2 ^fc ),

assigning said words to cells of a state table to form an initial state block,

grouping the cells of said state array to assign a group of cells to each set of d / b words, where d is a multiple of b strictly greater than b, and

- iteratively generate from said initial state block, a succession of state blocks to form an end state block, so that at each iteration each set of d / b words of a block of current state is replaced by another set of d / b words, using, to form a next state block, at least one reference table with d-bit substitution elements.

Using a reference table with elements of length d strictly greater than b introduces a diffusion effect into more of the confusing effect, thus realizing a generation of pseudo-random numbers of quality with a very low calculation cost.

Note that an AES-type algorithm uses an S-box having elements of the same size as the words of an internal state block matching a b-bit input word to another output word of b-bits, and the words are used one by one. Thus, the replacement of words by substitution according to the box-S made by this kind of algorithm generates a confusion effect but no diffusion effect.

On the other hand, the substitution operation according to the reference table of the invention does not use the words one by one, but by grouping. Moreover, it will be noted that the use of a reference table or S-box having elements larger than the words of the internal state is completely contrary to the habits of the person skilled in the art.

Thus, the configuration according to the invention ensures both diffusion and confusion while saving computing time for the same level of security. This makes it possible to improve the level of security while reducing the number of logic gates ("equivalent gates" or GE in English) in the production of an electronic circuit implementing this encryption method. Thus, the technique according to the invention can be easily applied for the implementation of a pseudo-random number generator of low cost and in a very restricted environment such as a cell or RFID chip. In addition, this technique can be applied to a variety of cryptographic algorithms such as block-based, stream-based, hash, or message authentication codes. Moreover, the use of this kind of reference table with d strictly greater than b makes it possible to produce a pseudo-random number generator that is more robust to "square attack" cryptanalysis attacks to which the AES type algorithms are deemed to be sensitive. Advantageously, the iterative generation of said succession of state blocks further comprises a step for mixing the words of said current state block according to a predetermined mixing transformation.

This mix transformation guarantees a better diffusion or propagation of the bits of a state block thus improving the security of the encryption and the quality of the pseudorandom numbers generated without making the calculation steps too heavy.

This predetermined mixture transformation may comprise a multiplication in the finite field GF (2 ^fc ) of a column of said current state block by a predefined matrix in said finite field. This matrix multiplication is a linear transformation that is fairly simple to implement.

Advantageously, the iterative generation of said succession of state blocks further comprises a permutation between words on at least a part of said current state block.

This makes it possible to further increase bit propagation, which improves security.

According to a feature of the present invention, the iterative generation of said succession of state blocks further comprises a modification of at least a part of a word located in a predetermined cell of the state table.

This makes it possible to reduce any symmetry that can be installed during successive iterations, which complicates any prediction attempt and consequently improves the security of the process.

According to another feature of the present invention, the method comprises a combination by adding in the finished body of each word of said initial state block with a corresponding word in an encryption key thus improving the security level. Thus, a security similar to that of an AES type algorithm can be guaranteed with an optimal number of calculations.

Advantageously, said initial data are generated by a counter. Thus, one can easily generate pseudo-random numbers with a minimal number of operations.

The invention also relates to a cryptographic device for generating pseudo-random numbers, comprising:

subdivision means for subdividing initial data into a plurality of b-bit words defined in a finite field GF (2 ^fc ),

assignment means for assigning said words to cells of a state table to form an initial state block,

a definition means for defining and memorizing at least one reference table comprising substitution elements at d-bits, where d is a multiple of b strictly greater than b,

grouping means for grouping the cells of said state table to assign a group of cells to each set of d / b words, and

generation means for iteratively generating from said initial state block a succession of state blocks to form an end state block, so that at each iteration each set of d / b words a current state block is replaced by another set of d / b words according to said reference table to form a next state block.

The invention also relates to a pseudo-random number generator comprising a counter and a plurality of logic gates for implementing the method described briefly above.

The invention also relates to an RFID device comprising a generator as briefly described above.

Brief description of the drawings Other features and advantages of the invention will appear on reading the description given below, by way of indication but not limitation, with reference to the accompanying drawings, in which:

FIG. 1 is a flowchart illustrating the various steps of a cryptographic method according to the invention;

FIG. 2 is an example illustrating the action of a reference table according to the method of FIG. 1;

FIG. 3 very schematically illustrates a device implementing the method of FIG. 1;

FIG. 4 is a particular embodiment of the method of FIG. 1; and

FIG. 5 very schematically illustrates a pseudo-random number generator implementing the method of FIG. 4.

Detailed description of embodiments

According to the invention, FIG. 1 is a flowchart illustrating the various steps of a cryptographic method for generating pseudo-random numbers from initial data.

Step E1 comprises the division or subdivision of the message or initial data 1 into a plurality of 3-b-bit words defined in a finite field GF (2 ^fc ), where b may for example be equal to 2, 4, 8, 16, 32, 64 or 128.

In step E2, these words 3 are assigned to cells 5 of a state table 7 to form an initial state block. It should be noted that only part of these words 3 can be placed in the state table 7.

In step E3, cells 5 from state table 7 are grouped so as to assign a group 11 of cells to each set of d 1 words, where d is a multiple of b, with d> b. Each set of words then corresponds to an element of d-bits. Finally, in step E4, it is iteratively generated from the initial state block 13a, a succession of current state blocks 13b to form a last block or an end state block 13c. To do this, at least one predefined reference or substitution table 9 with substitution elements at d-bits is used. Thus, this reference table 9 makes it possible to replace a d-bit input element with a d-bit output element.

At each iteration, each set of d / b words of a current state block 13b is replaced by another set of d / b words according to the reference table 9 to form a next state block. Thus, the last state block 13c represents the pseudo-random number generated.

The fact of using a reference table having elements of length d> b introduces a diffusion effect in addition to the confounding effect and makes it possible to achieve a good level of security in a more rapid manner than a table of substitution (box-S) of the state of the art where d = b.

FIG. 2 is an example illustrating the action of a reference table 9 on a state table 7 comprising four columns and four lines (4x4). According to this example, the initial state block 13a comprises the words Aoo,..., A33 with 4-bits (that is to say è = 4) and the reference table 9 comprises elements with 8-bits ( that is, d = 8). In this case, an S-box reference table of an AES algorithm can be used.

Thus, the cells 5 of the state table 7 are grouped into groups of two cells. According to this example, the cells 5 comprising the words A ₀₀ and A ₀₁ form a first group 11a, those comprising the words A ₀₂ and AQ ₃ form a second group 11b, and those comprising the words A ₁₁ and A ₁₂ form a third group. lie, etc. In this case, the reference table 9 substitutes the words two by two. For example the words A ₀₀ and A ₀₁ are replaced by B ₀₀ and B ₀₁ and the words A02 and A03 are replaced by B ₀ 2 and B ₀₃ . Then another state block 13b is formed comprising the words B ₀₀ ,..., B ₃₃ defined by a function "S" determined by the reference table 9 as follows:

Bool lBoi = S [A ₀₀ I IA ₀₁ ], B ₀₂ 11 B ₀₃ = S [A ₀₂ I IA ₀₃ ]

B ₁₁ I | B ₁₂ = S [A ₁₁ I | A ₁₂ ], B ₁₃ | | B ₁₀ = S [A ₁₃ | | A ₁₀ ]

B ₂₀ | | B ₂₁ = S [A ₂₀ | IA ₂₁ ], B ₂₂ | | B ₂₃ = S [A ₂₂ | | ₂₃ ]

B ₃₁ | IB ₃₂ = S [A ₃₁ | IA ₃₂ ], B ₃₃ | | B ₃₀ = S [A ₃₃ | | A ₃₀ ], where the symbol "| |" between two words represents their concatenation.

Thus, it is possible to iteratively generate a succession of state blocks 13b as a function of one or more reference tables 9. It will be noted that in a restricted medium (for example RFID), it is preferable (although not mandatory). to use a single reference table 9 for all operations.

In order to ensure better propagation, the words 3 of a current state block 13b can be mixed according to a predetermined mix "MIX" transformation.

Thus, at each iteration, the substitution operation according to the reference table 9 can be followed by a mixture of b-bit words, using for example a technique similar to that used by the AES algorithm.

According to the example of FIG. 2, this MIX mixture can be produced as follows:

C _oo | | C ₁₀ | | C ₂₀ | | C ₃₀ = MIX [B ₀₀ IIB ₁₀ | | B ₂₀ | | B ₃₀ ] C ₀ II IC ₁₁ I IC ₂₁ IC ₃₁ = MIX [B ₀₁ IIB ₁₁ MB ₂₁ | | B ₃₁ ] C ₀₂ IC ₁₂ IC ₂₂ IC ₃₂ = MIX [B ₀₂ IIB ₁₂ | | B ₂₂ | | B ₃₂ ] C ₀₃ IC ₁₃ IC ₂₃ IC ₃₃ = MIX [B ₀₃ IIB ₁₃ IIB ₂₃ | | B ₃₃ ] Depending on the properties of the mixing operation MIX which depend on the matrices chosen, it may be advantageous to switch words 3 on at least a part of the current state block 13b according to a "swap" swap operation. swapt 'in English). According to the example of Figure 2, this permutation "Exchange" can be performed in the following manner:

Exchange C02I IC ₁₂ with C22I IC32 Exchange QBI IC ₁₃ with C ₂₃ 1 | C ₃₃

In addition, according to the characteristics of the electronic components used for the manufacture of a device implementing the method according to the invention, a simple incrementation counter or any other similar mechanism can be used to reduce any symmetry that can be installed. during successive iterations. For example, this may include a simple modification of at least a portion of a word located in a predetermined cell of the state array 7. For example, it is sufficient to complement a few bits located in a single cell 5 well determined and at a definite moment in the calculation.

In addition, the method according to the invention may comprise an addition combination ("exclusive-or" operation) in the finite field of each word 3 of the initial state block 13a with a corresponding word of a predefined encryption key or with alternating sequences of secret words.

FIG. 3 very schematically illustrates a device 21 implementing the method according to FIG. 1. This device 21 comprises a subdivision means 23, an assignment means 25, a definition means 27, a grouping means 29 and a means of generation 31.

The subdivision means 23 is adapted to subdivide the initial message or data into a plurality of 3-to-bit words. The means of assignment 25 is intended to assign these words 3 to the cells 5 of the state table 7 to form the initial state block 13a. The definition means 27 is intended to define and store the reference or replacement table 9 having the substitution elements at <i -bits withd> b. The grouping means 29 is intended to group the cells of the state table to assign a group 11 of cells to each set of d lb words. The generation means 31 is intended to generate iteratively from the initial state block 13a, a succession of state blocks 13b to form a final state block 13c representative of a pseudo-random number.

In the implementation of a pseudo-random number generator, the initial data 1 used to form the initial state block 13a can be generated by a simple counter.

Indeed, FIG. 4 is a flowchart illustrating a particular embodiment of a 64-bit PRNG pseudorandom number generator with ten iterations. This generator can be used in an RFID chip with a 128-bit secret key. The secret key may for example be represented by a pair of data (So, S ₁ ) where So and S ₁ a both have a length of 64 bits.

At each sequence of iterations defined by a 16-bit counter q, an output value vι of 64-bits is generated by the PRNG as a function of q, S ₀ and S ₁ (i.e. vι = f (q, S ₀ , S ₁ ) for 1 <i <2 ¹⁶ ).

Step EI1 is the initial state of a sequence of iterations (the counter q = 1). At this stage, the 64-bits of the initial data 1 are stored in a state table 7 (4x4) comprising sixteen words Aoo,..., A33 with 4-bits as illustrated in the example of FIG. 2.

In step E12, the first row of the state table 7 is summed (according to one-or-exclusive) with the current value of the four-bit four-bit counter, that is to say q = [qo | | Cϋ | | Q2I I Q3].

In step E13, three iterations of "mixtable" type operations are performed. Each "mixtable" iteration includes substitutions according to a function S determined by a reference table 9 carrying out 8-bit permutations (for example an AES-type box) and / or a "MIX" mixture inside. one or more columns, and / or "Exchange" permutations. At a given iteration number r, the current state block 13b is then defined according to the reference table 9 as follows:

Bool lBoi = S [A ₀₀ I IA ₀₁ ], B ₀₂ | | B ₀₃ = S [A ₀₂ I IA ₀₃ ]

B ₁₁ I | B ₁₂ = S [A ₁₁ I | A ₁₂ ], B ₁₃ | | B ₁₀ = S [Ai ₃ I | A ₁₀ ]

B ₂₀ | | B ₂₁ = S [A ₂₀ | IA ₂₁ ], B ₂₂ | | B ₂₃ = S [A ₂₂ | IA ₂₃ ]

B ₃₁ NB ₃₂ = S [A ₃₁ | | A ₃₂ θ r], B ₃₃ I IB ₃₀ = S [A ₃₃ MA ₃₀ ]

It will be noted that at the iteration number r, the value taken by r is added to a word (for example the word A ₃₂ ) in order to reduce any symmetry effect that may occur between the iterations.

The mixing operation MIX is a mixture within a column using a predetermined 4x4 matrix M in a finite field GF (2 ⁴ ). This operation consists in multiplying each column of the state table (7) by this matrix M.

The mixing operation MIX can be followed by a permutation of the words on the last two lines of the current state block 13b as follows:

In step E14, the 64-bits of the current state block 13b are combined by exclusive-or-addition with the sixteen (16-bit 4-bit) half-octets in S ₁ of the secret key.

In step E15, four more iterations of "mixtable" type operations are performed.

In step E16, the 64-bits of the current state block 13b are combined by exclusive-or-addition with the sixteen (16-bit 4-bit) half-octets in S ₀ of the secret key.

In step E17, three iterations of "mixtable" type operations are performed. In step E18, the 64-bits of the current state block 13b with the sixteen half-octets (4-bits) in S ₁ of the secret key are recombined by an exclusive-or-addition.

The step E19 gives the output value vι to the i ^th sequence of iterations in the following way:

Vi = [VOOI II IVO ₃ I IV ₁ Ol II IV ₁₃ I II IV ₃₃ ].

Step E20 is a test to check whether the value q of the counter is equal to (2 ¹⁶ -1). If so, the chip is destroyed in step E21, if not, q is incremented in step E22 before repeating the above steps.

FIG. 5 very schematically illustrates a PRNG pseudo-random number generator 41 implementing the method according to FIG. 4. This generator 41 comprises a counter 43 and a plurality of logic gates 45. This PRNG generator can be easily used in a chip RFID.

It should be noted that an implementation of an AES type algorithm is determined by an S-box and a RAM requiring 395 and 2337 logic gates (GE) respectively.

In contrast, in comparison with the AES algorithm, a PRNG 41 according to the example of Figures 4 and 5 divides the number of states by two and does not include iteration keys obtained by diversification. In addition, the mixing operations inside the columns require very few logic gates.

Thus, thanks to the invention, an efficient PRNG generator 41 is obtained with a good level of security and a reduced number of doors (GE) compared to the AES algorithm.

Claims

REVENDI CATI ONS

Cryptographic method for generating pseudorandom numbers (1), characterized in that it comprises the following steps:

subdividing initial data (1) into a plurality of b-bit words (3) defined in a finite field GF (2 ^fc ),

assigning said words to cells (5) of a state array (7) to form an initial state block (13a),

grouping the cells (5) of said state array (7) to assign a group (11) of cells to each set of d 1 bwords, where d is a multiple of b strictly greater than b, and

generating iteratively from said initial state block (13a) a succession of state blocks (13b) to form a final state block (13c), so that at each iteration each set of d lb words of a current state block (13b) is replaced by another set of d 1 b words, using, to form a next state block, at least one reference table (9) having substitute elements at d-bits.

2. Method according to claim 1, characterized in that the iterative generation of said succession of state blocks (13b) further comprises a step for mixing the words of said current state block according to a predetermined mixing transformation.

3. Method according to claim 2, characterized in that said predetermined mixture transformation comprises a multiplication in the finite field GF (2 ^fc ) of a column of said current state block by a predefined matrix in said finite body.

4. Method according to any one of claims 1 to 3, characterized in that the iterative generation of said succession of state blocks further comprises a permutation between words on at least a portion of said current state block.

5. Method according to any one of claims 1 to 4, characterized in that the iterative generation of said succession of state blocks further comprises a modification of at least a part of a word located in a cell (5). ) predetermined from the state table (7).

6. Method according to any one of claims 1 to 5, characterized in that it comprises a combination by adding in the finite body of each word of said initial state block (13a) with a corresponding word in an encryption key .

7. Method according to any one of claims 1 to 6, characterized in that said initial data (1) are generated by a counter.

8. Cryptographic device for generating pseudorandom numbers, characterized in that it comprises:

subdivision means (23) for subdividing initial data (1) into a plurality of b-bit words (3) defined in a finite field GF (2 ^fc ),

assignment means (25) for assigning said words to cells (5) of a state array (7) to form an initial state block (13a),

definition means (27) for defining and memorizing at least one reference table (9) comprising substitution elements at d-bits, where d is a multiple of b strictly greater than b,

grouping means (29) for grouping the cells of said state table to assign a group of cells to each set of d / b words, and generation means (31) for iteratively generating from said initial state block (13a) a succession of state blocks to form an end state block (13c) so that at each iteration each set of d 1 words of a current state block is replaced by another set of d 1 b words based on said reference table (9) to form a next state block.

9. pseudorandom number generator characterized in that it comprises a counter (43) and a plurality of logic gates (45) for implementing the method according to claims 1 to 8.

10. RFID device characterized in that it comprises a generator (41) according to claim 9.