EP2248008A2

EP2248008A2 - Countermeasure method and devices for asymmetrical cryptography with signature diagram

Info

Publication number: EP2248008A2
Application number: EP09718480A
Authority: EP
Inventors: Bruno Benteo; Benoît FEIX; Sebastien Nerot
Original assignee: Inside Contactless SA
Current assignee: Inside Secure SA
Priority date: 2008-01-23
Filing date: 2009-01-23
Publication date: 2010-11-10
Also published as: US20110170685A1; CN101911009B; WO2009109715A3; KR20100117589A; JP2011510579A; FR2926652B1; FR2926652A1; CA2712180A1; CN101911009A; WO2009109715A2

Abstract

The invention relates to a method for countermeasures in an electronic component that uses a private-key asymmetrical cryptography algorithm, including the steps of generating (102) a first output data (s1) using a primitive, and (104) a protection parameter. The method further comprises the steps of converting (106), using said protection parameter, at least one of the elements of the set including the private key and an intermediate parameter obtained from the first output data (s1) in order to provide respectively first and second operands, and generating (108, 114) a second output data (s2) from an operation in which the first and second operands are involved.

Description

COUNTER-MEASUREMENT METHOD AND DEVICES FOR ASYMMETRIC CRYPTOGRAPHY WITH SIGNATURE SCHEMA

The present invention relates to a countermeasure method in an electronic component implementing an asymmetric cryptography algorithm with a private key, resistant to attacks aimed at discovering the private key. It also relates to a microcircuit device and a portable device, in particular a smart card, implementing such a method.

Private-key asymmetric cryptography is based on the use of primitives P which are generally functions exploiting a problem with complex and one-way resolution, such as the so-called discrete logarithm problem in finite fields (DLP of English "Discrete Logarithm Problem ") or the so-called discrete logarithm on elliptic curves (ECDLP of the English" Elliptic Curves Discrete Logarithm Problem "). In other words, for an asymmetric cryptographic primitive P, involving input data x, it is simple to compute y = F (x), but knowing y and the primitive F, it is "difficult" to find the value of x. The term "difficult" here means "computationally impossible to solve". In finite fields, F is a modular exponentiation, in elliptic curves, F is a scalar multiplication on the points of the defined elliptic curve.

Signature schemes are a classic use of asymmetric cryptography. As illustrated in FIG. 1, an algorithmic application of asymmetric cryptography with a signature scheme involving the use of a private key d is generally implemented by a microcircuit 12 to authenticate the transmission of an M message by a signature of this message using the private key. The private key d is for example stored in the microcircuit 12 which includes a memory 14 including itself a secure memory space 16 provided for this purpose and a microprocessor 18 for executing the asymmetric cryptographic algorithm 10.

Microcircuit devices implementing cryptographic algorithms are sometimes attacked to determine the secret data they manipulate such as the key (s) used and possibly, in some cases, information. on the messages themselves. In particular, the algorithms of asymmetric cryptography to signature scheme are under attack to discover the private key. Auxiliary channel attacks are an important family of cryptanalysis techniques that exploit certain properties of software or hardware implementations of cryptographic algorithms.

Among the known auxiliary channel attacks, the attacks of the SPA (Simple Power Analysis) or DPA (Differential Power Analysis) type consist in measuring the incoming and outgoing currents and voltages in the microcircuit. during the execution of the asymmetric cryptographic algorithm in order to deduce the private key. The feasibility of this family of attacks has been demonstrated in the article by P. Kocher, J. Jaffe and B. Jun entitled "Differential Power Analysis" published in Advances in Cryptology in particular - Crypto 99 Proceedings, Lecture Notes In Computer Science Vol . 1666, M. Wiener, eds., Springer-Verlag, 1999.

Time attacks analyze the time taken to perform certain operations. Such attacks on asymmetric cryptographic algorithms are described in the article by P. Kocher, N. Koblitz titled "Timing attacks on implementations of Diffie-Hellman, RSA, DSS, and other Systems" published in Advances in Cryptology - Crypto 96, 16th annual international cryptology conference, Aug. 18-22, 1996 Proceedings.

Fault injection (s) attacks are also known, among which are the DFA (Differential Fault Analysis) attacks, which consist in intentionally generating faults during the execution of the algorithm. cryptography, for example by disrupting the microcircuit on which it runs. Such a disturbance may include one or more short illumination (s) of the microcircuit or the generation of one or more peak (s) of voltage on one of its contacts. It thus makes it possible, under certain conditions, to exploit the calculation and behavior errors generated in order to obtain part or all of the private key sought.

In order to combat these attacks which are varied by nature, many solutions very different from each other have been made. The invention more particularly relates to a method of countermeasure in an electronic component implementing an asymmetric cryptography algorithm with a private key d, comprising the steps of: generate a first output data using a primitive,

- generate a protection parameter a.

These algorithms generally provide for modifying the execution of the primitive using the generated protection parameter.

The protection parameter a is conventionally generated using a pseudo random data generator 20, so that the execution of the primitive by the cryptographic algorithm 10 is itself made random, for example by a technique commonly referred to as masking, which can also be renamed a method of transformation or deformation of the data since their manipulation is deformed as opposed to their raw use, performed by a countermeasure section 22 of the microprocessor 18, using the protection parameter a. Thus, the intermediate data of the cryptographic algorithm and, consequently, the measurable currents are modified by the random protection parameter and their observation does not make it possible to find the true value of the private key. On the other hand, the masking does not disturb the algorithm itself, which therefore provides the same result with or without masking.

For example, when running the asymmetric cryptographic algorithm known as RSA (named after its authors Rivest, Shamir, and Adleman), a primitive consisting of a modular exponentiation is executed. An efficient implementation of this primitive uses a binary representation of the private key d by iterating on each bit of this binary representation. In each iteration, the calculation performed and in fact the energy consumption during the calculation depends on the value of the bit concerned. Therefore, the execution of such a primitive makes the private key particularly vulnerable to the aforementioned attacks. A conventional countermeasure then consists in directly masking the private key using the protection parameter.

Thus, a known signature scheme using this RSA algorithm can be used to sign an M message by applying the modular exponentiation to the message M using the private key d as an exponent. The signature is in this case the direct result of the modular exponentiation.

On the other hand, another known signature scheme of applying the Fiat-Shamir heuristic to a zero-disclosure identification protocol can not be protected in this way. Such a signature scheme is known: it will be referred for example to its definition in the thesis presented and publicly supported by Benoît Chevallier-Marnes on November 16, 2006 at the Ecole Normale Supérieure, Paris, entitled "Cryptography with public key: constructions and security proofs", more particularly in chapters 4.1.2 and 4.2.1, pages 27-30. Likewise, the Schnorr identification protocol and the El Gamal and DSA signatures (of the "Digital Signature Algorithm") must be protected in another way. For example, the DSA algorithm, which uses this other signature scheme, comprises the steps of:

generating a first output datum using a primitive based on the discrete logarithm problem and applied using a random variable different from the private key,

generating, from an operation involving the first output datum and the private key, a second output datum, and

- return the first and second output data as a signature.

A method of countermeasure for this algorithm is described in the article by D. Naccache et al, entitled "Experimenting with faults, lattices and the DSA" published in Proceedings of the 8th International Workshop on the Practice and Practice in Public Key Cryptography 2005 (January 23-26, 2005, Les Diablerets, Switzerland), Lecture Notes in Computer Science, Vol. 3386/2005, pp 16-28, Springer Ed.

In this document, a fault injection attack (s) is described. This attack allows, by switching to 0 a number of low-order bits of the random and then calculation of the signature a number of times, to deduce the value of the private key.

Protecting the execution of the primitive by masking the hazard is not effective against the attacks by injection of fault (s) in this type of algorithm since it is not necessary to know the value of this hazard to find the private key. The article therefore provides for more complex methods, for example combining different techniques simultaneously.

It may thus be desired to provide an asymmetric attack-resistant cryptographic method of the aforementioned type that is simple to implement, in particular for signature-scheme algorithms applying the Fiat-Shamir heuristics to an identification protocol to zero disclosure of knowledge. One embodiment of the invention relates to a countermeasure method in an electronic component implementing a private key asymmetric cryptography algorithm, comprising the steps of:

generate a first output data using a primitive,

generating a protection parameter, characterized in that it further comprises the steps of:

transforming, using the protection parameter, at least one of the elements of the set consisting of the private key and an intermediate parameter obtained from the first output data, to respectively provide first and second operands, and

- Generate, from an operation involving the first and second operands, a second output data.

Thus the protection parameter is used to protect the execution of the operation following the application of the primitive, rather than the execution of the primitive itself. It is indeed more this operation that is exploited in the attacks aimed at this type of signature scheme.

According to one embodiment, the countermeasure method comprises the steps of:

- transform the private key using the protection parameter, and

generating, from a first operation involving the intermediate parameter and the transformed private key, a first intermediate data item, generating, from a second operation involving the intermediate parameter and the protection parameter, a second intermediate data item, and combining the first and second intermediate data to provide the second output data.

According to one embodiment, the countermeasure method comprises the steps of:

transforming the intermediate parameter obtained from the first output datum using the protection parameter, and

generating, from a first operation involving the transformed intermediate parameter and the private key, a first intermediate data item, generating, from a second operation involving the protection parameter and the private key, a second intermediate data item, and combining the first and second intermediate data to provide the second output data.

According to one embodiment, the intermediate parameter is the first output data item. According to one embodiment, the primitive is a modular exponentiation for the realization of a signature scheme cryptography algorithm of the DSA type.

According to one embodiment, the primitive is a scalar multiplication for the realization of an ECDSA type signature scheme cryptography algorithm.

According to one embodiment, the countermeasure method implements a signature-type asymmetric cryptographic algorithm consisting in applying the Fiat-Shamir heuristics to a zero-knowledge identification identification protocol.

According to one embodiment, the generation of the protection parameter comprises the steps of:

defining a generating function, by successive applications to at least one predetermined secret parameter stored in memory, of a sequence of values that can be determined solely from this secret parameter and from this function,

- Generate the protection parameter reproducibly from at least one value of this sequence.

According to one embodiment, the countermeasure method comprises the steps of:

defining a plurality of functions, each function being generating, by successive applications to at least one predetermined secret parameter and stored in memory, a corresponding sequence of values that can be determined solely from the corresponding secret parameter and the corresponding function,

combining the plurality of sequences of values generated using a predefined relationship to generate a new sequence of values,

- Generate the protection parameter reproducibly from at least one value of this new sequence.

According to one embodiment, the countermeasure method comprises the steps of:

defining a generating function, by successive applications to at least one predetermined secret parameter and stored in memory, of a sequence of values that can be determined solely from the secret parameter and from the function, combining the sequence of generated values with public parameters of the cryptographic algorithm to generate a new sequence of values,

According to one embodiment, the method of countermeasure comprises, after carrying out the transformation, a step of regenerating the protection parameter for use in the step of generating the second output data item.

Another embodiment of the invention consists in providing a microcircuit device, comprising a microprocessor for implementing a countermeasure method of a private key asymmetric cryptography algorithm, at least one secure memory for storage of the private key, and a data generator for generating a protection parameter, characterized in that it is configured to:

generate a first output data using a primitive,

According to one embodiment, the microcircuit device is configured to:

- transform the private key using the protection parameter, and

According to one embodiment, the microcircuit device is configured to:

generating, from a first operation involving the transformed intermediate parameter and the private key, a first intermediate data item, generating, from a second operation involving the protection parameter and the private key, a second intermediate data, and then combining the first and second intermediate data to provide the second output data.

According to one embodiment, the intermediate parameter is the first output data item.

According to one embodiment, the primitive is a modular exponentiation for the realization of a signature scheme cryptography algorithm of the DSA type.

According to one embodiment, the microprocessor implements a signature-type asymmetric cryptographic algorithm consisting in applying the Fiat-Shamir heuristics to a zero-knowledge identification identification protocol.

According to one embodiment, the data generator is configured to generate the protection parameter by:

defining a generating function, by successive applications to at least one predetermined secret parameter and stored in memory, of a sequence of values that can be determined solely from this secret parameter and this function, and

- Generating the protection parameter reproducibly from at least one value of this sequence.

According to one embodiment, the data generator is configured to:

According to one embodiment, the data generator is configured to: defining a generating function, by successive applications to at least one predetermined secret parameter and stored in memory, of a sequence of values that can be determined solely from the secret parameter and from the function,

combining the sequence of generated values with public parameters of the cryptographic algorithm to generate a new sequence of values,

According to one embodiment, the microcircuit device is configured to, after completion of the transformation, regenerate the protection parameter to use it during the step of generating the second output datum.

Another embodiment of the invention consists in providing a portable device, in particular a smart card, comprising a microcircuit device as described above.

Exemplary embodiments of the present invention will be set out in more detail in the following description, given without implied limitation in relation to the appended figures among which:

FIG. 1 previously described schematically represents the structure of a microcircuit device, of conventional type,

FIG. 2 schematically represents the structure of a microcircuit device, according to a first embodiment of the invention,

FIG. 3 schematically represents a smart card comprising the device of FIG. 2,

FIG. 4 illustrates the successive steps of a first countermeasure method implemented by the device of FIG. 2,

FIG. 5 illustrates the successive steps of a second countermeasure method implemented by the device of FIG. 2,

FIG. 6 schematically represents the structure of a microcircuit device, according to a second embodiment of the invention, and

FIG. 7 illustrates the successive steps of a countermeasure method implemented by the device of FIG. 6.

First embodiment of the invention.

The microcircuit device 12 'represented in FIG. 2 comprises, like that represented in FIG. 1, an algorithmic application of asymmetric cryptography 10, a memory 14 including a secure memory space 16 for storing, in particular, a private key d intended to be used by the application 10, a microprocessor 18 and a pseudo-random data generator 20 for the supply a protection parameter a. It also has a countermeasure section 22 ', but this provides an improvement to the existing countermeasures, in particular to the countermeasure section 22 previously described.

Furthermore, the device 12 'is for example integrated in a portable device, in particular in the form of a secure smart card chip 30, as shown in FIG.

It will be noted that, although the algorithmic application of cryptography 10 and the countermeasure section 22 'have been represented as distinct, these can in fact be intimately imbricated in the same software or hardware implementation of an algorithm of asymmetric cryptography including a countermeasure.

In the microcircuit device 12 ', the algorithmic application of asymmetric cryptography 10 is more precisely adapted for the implementation of a signature scheme of the type consisting in applying the heuristics of Fiat-Shamir to an identification protocol to zero disclosure of knowledge. It therefore comprises:

a section 10a for applying a primitive to generate a first output data if, and

a section 10b for executing an operation involving at least two operands, one obtained from the first output datum and possibly transformed by the section 22 ', the other being the private key possibly transformed by the section 22 ', to generate a second output data s2.

For a signature application using this scheme, the first and second output data constitute the signature (si, s2).

Unlike the device 12, in this device 12 'the countermeasure section 22' is configured to transform, using the protection parameter a, the private key d and / or an intermediate parameter obtained from the first data Release. In the case of a DSA signature, the intermediate parameter is the first output data itself. Different methods of countermeasure according to the invention can be implemented by the device of FIG. 2. A number of them, which are not exhaustive, will be presented with reference to FIGS. 4 and 5.

A first method of this type, performing a DSA-type signature on a message M, is illustrated in FIG. 4.

During a first step 100 of generating a pair of keys (a public key and a private key), one randomly determines:

a prime number p of L bits, with 512 <L <1024, and L divisible by 64,

a prime number q of 160 bits, chosen such that p - 1 = qz, with z an integer,

a number h, with 1 <h <p - 1, chosen in such a way that g = h ² mod

P> 1.

a number of k bits, such that 0 <d <q.

Using these numbers we calculate e = g ^d mod p.

The public key is (p, q, g, e). The private key is d.

Note that a version of the DSA signature allowing larger key sizes is provided by the NIST (for "National Institute of Standards and Technology"), some documents on the subject evoking a size of 3072 bits for L.

In a second step 102 for applying a primitive, a random number u is generated, chosen such that 0 <u <q. Section 10a then calculates a first output data if using the following modular exponentiation: if = (mod g ^u mod) mod q.

In a step 104, the pseudo-random data generator 20 generates a protection parameter a whose size of the binary representation is equal to that of the private key d. In a variant, the generator 20 generates a parameter a 'whose size is much smaller than that of d, but the binary representation of this parameter a' is concatenated as many times with itself as necessary, in order finally to provide a protection parameter a whose size of the binary representation is equal to that of d. In a variant also, the generator 20 generates a parameter a 'which is combined with other parameters of the DSA algorithm, such as q or if previously determined, using a COMB function to provide the protection parameter a. : a = COMB (a ', q, si, ...). The parameter generated by the generator 20 (a or a ') is stored in memory for use later, especially optionally as a verification parameter for the parameter a 'when combined with other parameters of the DSA algorithm to form a.

In a subsequent masking step 106, the countermeasure section 22 'transforms the private key d as follows: d = d + a.

During a step 108 of calculating an operation involving the first output datum if and the private key transformed by, a linear congruence of the following form is realized:

A = u ^"1 (H (M) + of .si) mod q, where H (M) is the result of a cryptographic hash with the known function SHA-1 on message M.

Next, an optional verification step 110 is performed if, in step 104, the parameter a 'generated by the generator 20 has been stored in memory as a verification parameter. During this step 110, the parameter a is again calculated, using the COMB function and the public and / or stored values used by this function (a ', q, si, ...).

If the value of a has changed between step 104 and step 110, it can be concluded that a fault injection attack (s) has occurred between these two steps. An alert is then transmitted by the cryptographic application 10 and the cryptographic algorithm is stopped (112) or a different security response comes into application.

If the value of a has not changed between step 104 and step 110, proceed to a step 114 in which the following calculation is performed:

B = (u ^'1 .a.s1) mod q.

We finally deduce a second output data s2, given by the relation s2 = (A - B) mod q.

In a last step 116, the cryptographic application 10 returns the value (si, s2) as the signature DSA of the message M.

Alternatively, the first method described above can be modified as follows.

In the masking step 106, the countermeasure section 22 'transforms the first output data if: if' = si + a.

In step 108, calculating the linear congruence operation involves the first transformed output data if 'and the private key d:

A = u- ¹ (H (M) + d.s1 ') mod q.

In step 114, the following calculation is performed: B = (uΛd.a) mod q.

We deduce the second output data s2, by the relation s2 = (A - B) mod q.

Alternatively also, the first method described above can be modified as follows.

In step 108, calculating the linear congruence operation involves the first output data if and the private key transformed from:

A = (H (M) + of .s1) mod q.

In step 114, the following calculation is performed:

B = (A - a.s1) mod q.

We deduce the second output data s2, by the relation s2 = (u ^" ¹ .B) mod q.

A = (H (M) + d.s1 ') mod q.

In step 114, the following calculation is performed:

B = (A - d.a) mod q.

We deduce the second output data s2, by the relation s2 = (u ^" ¹ .B) mod q.

In step 104, the pseudo-random data generator 20 generates a protection parameter a whose size of the binary representation is much smaller than that of d.

During the masking step 106, the countermeasure section 22 'transforms the private key d as follows: d = d + a.q.

In step 108, the calculation of the linear congruence operation involves the first transformed output datum if and the transformed private key of:

A = (H (M) + of .s1) mod q.

In step 114, the following calculation is performed, giving directly the value of the second output data item: S2 = (u ^'1 .A) mod q.

We can also reproduce the previous countermeasures by taking a = -a.

A second method according to the invention, carrying out an ECDSA signature of the "Elliptic Curve Digital Signature Algorithm" on a message M, is illustrated in FIG.

Let G be an elliptic curve of order q with q a prime number greater than ²¹⁶⁰ . The curve is also defined by two elements a and b which are elements of a Galois field of cardinality n.

In a first step 200 of generating a key pair (a public key and a private key), a random number of k bits, such as 0 <d <q, are randomly determined.

Using this number we calculate Q = d.G mod p, where the operator ". "Denotes the scalar product on the elliptic curve to which G belongs.

The public key is Q. The private key is d.

During a second step 202 of applying a primitive, a random number u is generated, chosen such that 0 <u <q. Section 10a then calculates a first output data if using the following scalar product: R = u. G = (x _R , y _R ). We assign indeed to if the value modulo q of the abscissa x _R of R: if = x _R mod q. If this value is zero, step 202 is repeated, generating another hazard.

During a step 204, the pseudo-random data generator 20 generates a protection parameter a whose size of the binary representation is equal to that of the private key d. In a variant, the generator 20 generates a parameter a 'whose size is much smaller than that of d, but the binary representation of this parameter a' is concatenated as many times with itself as necessary, in order finally to provide a protection parameter a whose size of the binary representation is equal to that of d. In a variant also, the generator 20 generates a parameter a 'which is combined with other parameters of the ECDSA algorithm, such as q or if previously determined, using a COMB function to provide the protection parameter a. : a = COMB (a ', q, si, ...). The parameter generated by the generator 20 (a or a ') is stored in memory for later use, especially optionally as a verification parameter for the parameter a' when combined with other parameters of the DSA algorithm to train a. The following steps 206 to 216 are identical to steps 106 to 116. They will therefore not be detailed.

Similarly, the variants proposed in the first method described above are also applicable to this second method.

Other methods according to the invention, carrying out signatures other than those mentioned above (DSA and ECDSA) can be realized. These methods differ from those mentioned above, possibly by the primitive which they implement in step 102, 202 to obtain the first output data, and by the operation of steps 108, 114 or 208, 214 making it possible to obtain the second output data.

For example, another method according to the invention can realize a Schnorr type signature. In this case, the step of calculating the first output data is identical to step 102. On the other hand, a hash function G is applied to the first output data if, to obtain an intermediate parameter c = G ( M, if). It is this intermediate parameter c which is provided by the application 10 to the countermeasure section 22 'instead of if for possible transformation. On the other hand, the linear congruence applied to steps 108, 114 is slightly modified. Indeed, whereas the linear congruence of the DSA signature is, conventionally and before adaptation according to the invention, s2 = u ^{~ 1} (H (M) + d.s1) mod q, the linear congruence of the Schnorr signature is, conventionally and before adaptation according to the invention, s2 = (u + dc) mod q. It is therefore necessary to replace d by d 'or c by c' (for example c '= c + a) in this operation to carry out a Schnorr signature using a method according to the invention.

Other methods in accordance with the invention can still be designed by a similar adaptation of the classical signatures such as those described in the thesis presented and publicly supported by Benoît Chevallier-Marnes on November 16, 2006 at the Ecole Normale Supérieure, Paris, entitled "Public key cryptography: constructions and proof of security", more particularly in chapter 4.4.

Second embodiment of the invention

The microcircuit device 12 "represented in FIG. 6 comprises, like that represented in FIG. 2, an algorithmic application of asymmetric cryptography 10, a memory 14 including a secure memory space 16, a microprocessor 18 and a countermeasure section 22 'It is for example integrated in a portable device, in particular in the form of a chip of a secure smart card 30 as However, it will be noted that, although the algorithmic application of cryptography 10 and the countermeasure section 22 'have been represented as distinct, they can in fact be closely integrated into one and the same implementation. a cryptographic algorithm including a countermeasure.

As in the microcircuit device 12 ', the algorithmic application of asymmetric cryptography 10 of the device 12 "is more precisely adapted for the implementation of a signature scheme of the type consisting in applying the heuristics of Fiat-Shamir to a identification protocol with zero knowledge disclosure, and therefore includes:

a section 10a for applying a primitive to generate a first output data if, and

a section 10b for executing an operation involving at least two operands, one obtained from the first output datum and possibly transformed, the other being the private key that may be transformed, to generate a second output datum s2.

In addition, the countermeasure section 22 'of the device 12 "is configured, like that of the device 12', to transform, using the protection parameter a, the private key d and / or an intermediate parameter obtained at From the first output data In the case of a DSA signature, the intermediate parameter is the first output data itself.

Unlike the device 12 ', in this device 12 "the pseudo-random data generator 20 of conventional type is replaced by a data generator 20" which comprises:

a section 20 "has application of a predefined function F to at least one predetermined secret parameter S for generating a sequence of determinable values solely from this secret parameter and this function F, and

a section 20 "b for providing at least one protection parameter reproducibly has a value of this sequence.

Section 20 "is actually a software or hardware implementation of the F function.

The secret parameter S is stored in the secure memory 16 and supplied at the input of the section 20 "of the generator 20", while the protection parameter a is provided, at the output of the section 20 "b, at the counter section. -measure 22 '. In this second embodiment, the parameter a is not therefore a hazard in the conventional sense mentioned in the documents of the state of the art. This is a deterministic result derived from the calculation of the function F executed by the generator 20 "on at least one secret parameter S which may be specific to the smart card 30 on which the microcircuit 12 'is disposed. secret is for example derived from a public data device 30.

Repeated application of the function F to S generates a sequence (A _n ) whose elements are at the origin of the protection parameter (s) provided by the generator. In a general manner, the generator can supply as many parameters a from values of the sequence (A _n ) as necessary according to the application of the countermeasure implemented in the card 30. This sequence (A _n ) can not be reproduced only with the knowledge of the generating function F and the initial deterministic elements that it uses (the parameter S).

Each protection parameter may be directly derived from an element A _n of the sequence (A _n ): in other words, a = A _n . Alternatively, the element A _n can be processed before providing the parameter a. For example, a may be the result of a computation a = A _n XOR k _n , where k _n is a secret constant of transformation.

Of course, if the sequence (A _n ) is cyclic and / or operates in a finite set of elements, the space of the values A _n generated will have to be large enough to resist the attacks. In fact, the greater the space considered, the better the robustness of the countermeasure.

We will first present several nonlimiting examples of sequences of values (A _n ) that can be provided by a generator 20 "according to the second embodiment of the invention .Then a second step, we will expose several possible uses of such sequences of values for the provision of protection parameters, in particular to the two countermeasure applications in asymmetric cryptography previously described with reference to FIGS. 4 and 5.

Examples of value sequence generating functions for providing protection parameters

1) Functions based on arithmetic-geometric sequences

If we define the sequence of values (A _n ) using the integer integer F function with the following relation:

A _{n + 1} = F (A _n ) = qA _n + r, where q and r are secret parameters constituting, with the initial element A ₀ of the sequence, the secret parameters S previously mentioned, it is possible to provide protection parameters resulting from an arithmetic-geometric sequence. The protection parameters are for example the elements of the sequence (A _n ).

If r = 0, it is a geometrical sequence whose term A ₁ , used at a precise stage of cryptography, can be found using the secret parameters q and A ₀ in the following way: = q'.Ao.

If q = 1, it is an arithmetic sequence which we can find a term A ₁ using the secret parameters r and A ₀ as follows: A, = ri + A ₀ .

If r is non-zero and q is different from 1, it is an arithmetic-geometric sequence whose term A _j can be found using the secret parameters q, r and A ₀ in the following way:

A, = q ^L .A ₀ + r (q ^l -1) / (q-1).

We can also reduce the space of the elements of the sequence (A _n ) by an integer m by means of the following relation:

A _{n + 1} = F (A _n ) modulo m = (qA _n + r) modulo m.

Note that if m is a prime number, this sequence takes the form of the group of inverse affine transformations on the finite field GF (m) = {0, 1 m-1}.

We can also choose m as a power of 2, to generate sequences of elements with a constant number of bits. For example, if one wants to generate sequences of parameters A, with k bits, one chooses m = 2 ^k .

Preferably, m is one of the secret parameters to be kept in the secure memory of the device.

2) Functions defining a cyclic multiplicative group

Let a cyclic group GC with m elements with a value a as generating element and the multiplication as law of internal composition:

GC = {a, a ² a ^m }. The sequence of values (A _n ) can be defined as follows:

the initial element A ₀ is chosen as being the generating element a to which the law of internal composition of the group GC is applied k times,

from element A to element A _{1 + 1} , applying k 'times the law of internal composition of the group GC.

The secret parameters S used by the generating function of the sequence (A _n ) are then for example the generating element a and the values k, k 'and m. In addition, as above, the protection parameters generated are for example the elements of the sequence (A _n ).

3) Functions Defining a Frobenius Group

Let GF (q) be a finite field, where the order q is a prime number of k bits. The group of inverse affine transformations on this finite field is a group of Frobenius. An interesting property of Frobenius groups is that no non-trivial element fixes more than one point.

In this context, the affine transformations that can be used take the form of functions y = f (x) = bx + c, where b ≠ 0 and where the operations take place in the field GF (q). It is therefore possible to define a generating function of the sequence (A _n ) applying to predetermined secret parameters q, b, c and A ₀ . By choosing for example q = 2 ¹⁶ + 1 and, in hexadecimal notation, b = 0x4cd3, c = 0x76bb, A ₀ = 0xef34, a sequence beginning with the terms A ₁ = Oxcδcf, A ₂ = Oxδbaf, A ₃ = 0x620d, A ₄ = 0x0605, A ₅ = 0xe70c, A ₆ = 0x3049, A ₇ = 0xe069, A ₈ = 0x55ee, etc.

4) Functions from a shift register with linear feedback (LFSR type register)

It is for this type of function to choose a secret parameter A ₀ , for example 16 bits, and a shift register LFSR, for example with a corresponding output of 16 bits. If the size of the register LFSR is m, then a term A _{t + m} of the sequence (A _n ) is determined by the m terms which precede it with the aid of a linear equation of the type:

A _{t + m} = α _m + O .A _t _1n-1 -A _{t + 1} + ... + A ₁ -A ^ ₁₊ _1, wherein the α, take the value 0 or 1.

5) Functions Defining a Calculation of Cyclic Redundancy Check (CRC)

For this type of function, it is a matter of choosing a secret parameter A ₀ , for example 16 bits, and a corresponding CRC polynomial among those conventionally used in CRC calculations, for example the CRC-16 polynomial (X ¹⁶ + X ¹⁵ + X ² + 1) or the CRC CCITT V41 polynomial (X ¹⁶ + X ¹² + X ⁵ + 1). A term A _{n + 1} of the sequence (A _n ) is determined as a function of the previous term A _n by the relation A _{n + 1} = F (A _n ), where F performs a calculation of CRC on the basis of the chosen polynomial.

6) Combinations of value sequences

It is indeed also possible to calculate several sequences of values, each for example according to one of the methods set out below. above, and combine them using a predefined function to generate a new sequence of values to use as protection parameters. The sequence (A _n ) is thus generated from two other sequences (A ' _n ) and (A " _n ), calculating for each index n, A _n = T (A' _n , A" _n ).

The function T in question can be a secret matrix of values, the values A ' _n and A " _n respectively denoting respectively a row and a column of this matrix.

7) Combinations involving a sequence of values and public data

The sequence (A _n ) can be generated from a first sequence (A ' _n ), also according to public data, such as for example data used during the execution of the cryptography application with countermeasure and not secret. Among these data, depending on the applications, mention may be made of the message M (in clear or encrypted), a public key e, etc. The values of the sequence used as protection parameters are then calculated using any COMB function combining all these data:

A _n = COMB (A ' _n , M, e, ...).

One advantage of this combination is that the sequence of values (A _n ) can be used not only to supply the countermeasure application of the cryptography algorithm with protection parameters, but also to detect fault injection attacks. (especially on public data). Indeed by regeneration of the sequence (A ' _n ) using the secret parameter (s), at the end of the execution of the cryptography algorithm for example, but before doing the opposite operation of the initial transformation using a regenerated protection parameter, then by using this regenerated sequence (A ' _n ) and public data as it appears at the end of execution, it is possible to check whether the application of the COMB function produces the same sequence of values (A _n ) or not and therefore if public data has been assigned or not running.

Examples of use of a sequence of values generated according to one of the preceding methods in a method of countermeasure in asymmetric cryptography, according to the second embodiment of the invention

1) General Principle of the Second Embodiment

In general, whenever an algorithmic countermeasure is used, the generation of hazards introduced by the counter- measurement is recommended, as described in the first embodiment using a pseudo random data generator 20. As mentioned with reference to FIG. 6, this generation of random events can be replaced by the non-random generation of parameters derived from one or more sequence (s) of values obtained using at least one secret parameter.

FIG. 7 illustrates an example of steps performed by a method according to the second embodiment of FIG. 6, applied to the execution of an asymmetrical cryptographic algorithm with countermeasure, using T protection parameters a. ... a _τ by execution, all the protection parameters that can be extracted from the same sequence of values (A _n ) generated by the section 20'a.

During a first step INIT carried out by the generator 20 ", a counter i is initialized to 0. This counter i is intended to keep in memory the number of times that the asymmetric cryptographic algorithm has been executed since this step of initialization INIT, as long as another initialization is not performed.

During this step, the secret parameter S (or the parameters S when there are several), from which the sequence of values must be generated, is defined. It can be kept from a previous initialization, but can also be generated on the basis of a new value on the occasion of this initialization. It is for example generated from unique identification data, such as a public data device 30. It can also be generated from parameters or physical phenomena related to the microcircuit at a given instant, which can be random. In all cases, it is stored in memory in a secure manner, to allow the microcircuit to regenerate at any time the same sequence of values (A _n ) using the function implemented by section 20 "a.

The initialization step INIT can be unique in the life cycle of the microcircuit, carried out during the design by the manufacturer, or reproduced several times, for example regularly or whenever the counter i reaches an imax value.

During a first execution EXE 1 of the asymmetric cryptographic algorithm with countermeasure, the generator 20 ", more particularly the section 20" a, is solicited one or more times to apply the secret parameter S to the predefined function F , so as to generate, in one or more times, a number T of elements of the sequence of values (A _n ): A ₁ , ... A _τ . From these first T elements, the protection parameters T _v ... a _τ are generated.

For example, for every k such that 1 <k <T, a _k = A _k .

In a variant, if there are T additional secret values SeC ₁ , ... SeC ₁ - among the secret parameters S kept in secure memory, the following additional calculation can be performed: for any k such that 1 <k≤T , a _k = Sec _k XOR A _k , where _k = Sec _k ADD A _k , or also _k = Sec _k SUB A _k , so as to transform (or deform or mask) the parameters used.

Subsequently, during an i-th EXEi execution of the cryptography algorithm with countermeasure, the generator 20 ", more particularly the section 20" a, is again requested one or more times to apply the secret parameter S to the predefined function F, so as to generate, in one or more times, a number T of additional elements of the sequence of values (A _n ): A _{T (M) +1} , ... A ₁₁ . From these additional elements T, the protection parameters λ,..., _Τ are generated, as before.

For example, for every k such that 1 <k≤T, a _k = AT _{(μ1) + k} .

Alternatively, if one has T additional secret values Sec _1, ... seC ₁ -, one can specify the following additional calculation: for all k such that 1 <k≤T, a _k = Sec _k XOR A _{T (M) + k} , or a _k = Sec _k ADD AT _(i . _{1) + k} , or also _k = Sec _k SUB AT _{(M) + k} , so as to transform (or deform or mask) the parameters used.

Whatever the method used to generate the value sequence (s) at the origin of the protection parameters, the knowledge of the method and the secret values used by the method, including the initial parameter A ₀ previously loaded in memory or during a stage of the life cycle of the microcircuit device in EEPROM memory, allows to find at any time the protection parameters generated and used in the life of the device. It is clear that this feature then allows simple and effective debugging and improved resistance to attack by fault injection.

The choice of the method used to generate the sequence of values and the protection parameter (s) is dictated by the intended application.

2) Application of the general principle of the second embodiment to the two methods described with reference to Figures 4 and 5. The method used by the first and second methods of FIGS. 4 and 5 to generate the protection parameter a or the parameter a 'during the steps 104 and 204 may be one of those recommended in the second embodiment. It is then not necessary to keep this parameter a 'and the protection parameter has in memory since they can be found at any moment from the sequence of values which is itself determined by the parameter (s) ) secret (s) and function F. This process of regenerating these parameters is even a useful step in protecting the implementation against fault injection attacks (s). Thus, the parameter a 'can be found in steps 110 and 210 without having necessarily been kept in memory during the execution of steps 104 and 204. At these steps 110 and 210, the protection parameter a can also be found. to verify that its integrity, and that of the parameters used to generate it, has been preserved. It is also useful to regenerate a to perform steps 112 and 212 that use this parameter.

It is clear that the methods of countermeasure described above allow to design asymmetric cryptographic applications protecting the private key used against attacks by auxiliary channels or by fault injection (s).

Note furthermore that the invention is not limited to the embodiments described and that, although many variants have been presented, others are also conceivable providing in particular other types of private key transformations than those which have been detailed, or other asymmetric cryptographic applications than those discussed.

Claims

A method of countermeasure in an electronic component implementing a private key asymmetric cryptography algorithm (d), comprising the steps of:

generating (102; 202) a first output datum (si) using a primitive,

generating (104; 204) a protection parameter (a), characterized in that it further comprises the steps of:

transforming (106; 206), using the protection parameter (a), at least one of the elements of the set consisting of the private key (d) and an intermediate parameter obtained from the first output data (si), for respectively providing first and second operands, and

generating (108, 114; 208, 214), from an operation involving the first and second operands, a second output datum (s2).

A method of countermeasure in an electronic component according to claim 1, comprising the steps of:

transforming (106; 206) the private key (d) using the protection parameter (a), and

generating (108; 208), from a first operation involving the intermediate parameter and the transformed private key, a first intermediate data item, generating (114; 214), from a second operation involving the intermediate parameter and the protection parameter (a), a second intermediate data, and then combining the first and second intermediate data to provide the second output data (si).

transforming (106; 206) the intermediate parameter obtained from the first output data (si) using the protection parameter (a), and

generating (108; 208), from a first operation involving the transformed intermediate parameter and the private key (d), a first intermediate data item, generating (114; 214), from a second operation involving the parameter protection (a) and the private key (d), a second intermediate data, and then combining the first and second intermediate data to provide the second output data (s2).

4. Countermeasure method in an electronic component according to any one of claims 1 to 3, wherein the intermediate parameter is the first output data (si).

5. A method of countermeasure in an electronic component according to claim 4, wherein the primitive is a modular exponentiation for the realization of a DSA-type signature scheme cryptography algorithm.

6. countermeasure method in an electronic component according to claim 4, wherein the primitive is a scalar multiplication for the realization of an ECDSA type signature scheme cryptography algorithm.

7. A method of countermeasure in an electronic component according to any one of claims 1 to 6, implementing an asymmetric cryptography algorithm signature scheme of the type consisting in applying the heuristics of Fiat-Shamir to a protocol of identification with no disclosure of knowledge.

A method of countermeasure in an electronic component according to any one of claims 1 to 7, wherein generating (104; 204) the protection parameter (a) comprises the steps of:

defining a function (20 "a) generating, by successive applications to at least one secret parameter (S) predetermined and stored in memory (16), a sequence of values ((A _n )) determinable only from this secret parameter (S) and this function (20 "a),

- generating the protection parameter (a) reproducibly from at least one value of this sequence.

A countermeasure method in an electronic component according to claim 8, comprising the steps of:

define a plurality of functions, each function being generator, by successive applications to at least one secret parameter (S) corresponding predetermined and stored in memory (16), a corresponding sequence of values ((A ¹ J, (A " _n )) determinable only from the corresponding secret parameter (S) and the corresponding function,

combining the plurality of sequences of values ((A ' _n ), (A " _n )) generated using a predefined relation to generate a new sequence of values ((A _n )),

- generating the protection parameter (a) reproducibly from at least one value of this new sequence ((A _n )).

The method of countermeasure in an electronic component according to claim 8, comprising the steps of:

- defining a generating function, by successive applications to at least one secret parameter (S) predetermined and stored in memory (16), a sequence of values ((A ' _n )) determinable only from the secret parameter (S) and the function,

- combining the sequence of values ((A ¹ J) generated with public parameters of the cryptographic algorithm to generate a new sequence of values ((A _n )),

11. A method of countermeasure in an electronic component according to any one of claims 8 to 10, comprising, after performing the transformation (106; 206), a step (110; 210) of regenerating the protection parameter ( a) for use in the step (114; 214) of generating the second output data item (s2).

12. A microcircuit device (12 ', 12 "), comprising a microprocessor (18) for implementing a countermeasure method of a private key asymmetric cryptography algorithm (d), at least one memory secure (16) for storing the private key (d), and a data generator (20, 20 ") for generating a protection parameter (a), characterized in that it is configured to:

generating (102; 202) a first output datum (si) using a primitive,

transforming (106; 206), using the protection parameter (a), at least one of the elements of the set consisting of the private key (d) and a intermediate parameter obtained from the first output data (si), for respectively providing first and second operands, and

13. Microcircuit device (12 ', 12 ") according to claim 12, configured for:

generating (108; 208), from a first operation involving the intermediate parameter and the transformed private key, a first intermediate data item, generating (114; 214), from a second operation involving the intermediate parameter and the protection parameter (a), a second intermediate data, and then combining the first and second intermediate data to provide the second output data (s2).

14. Microcircuit device (12 ', 12 ") according to claim 12, configured for:

generating (108; 208), from a first operation involving the transformed intermediate parameter and the private key (d), a first intermediate data item, generating (114; 214), from a second operation involving the parameter of protection (a) and the private key (d), a second intermediate data, and then combining the first and second intermediate data to provide the second output data (s2).

The microcircuit device (12 ', 12 ") according to any one of claims 12 to 14, wherein the intermediate parameter is the first output data (si).

The microcircuit device (12 ', 12 ") according to claim 15, wherein the primitive is a modular exponentiation for the realization of a DSA type signature scheme cryptography algorithm.

17. A microcircuit device (12 ', 12 ") according to claim 15, wherein the primitive is a scalar multiplication for the realization of an ECDSA type signature scheme cryptography algorithm.

The microcircuit device (12 ', 12 ") according to any one of claims 12 to 17, wherein the microprocessor (18) implements an asymmetric cryptography algorithm of the signature type of applying the heuristic from Fiat-Shamir to an identification protocol with zero disclosure of knowledge.

The microcircuit device (12 ") according to any one of claims 12 to 18, wherein the data generator (20") is configured to generate (104; 204) the protection parameter (a) in:

defining a function (20 "a) generating, by successive applications to at least one secret parameter (S) predetermined and stored in memory (16), a sequence of values ((A _n )) determinable only from this secret parameter (S) and this function (20 "a), and

The microcircuit device (12 ") according to claim 19, wherein the data generator (20") is configured to:

defining a plurality of functions, each function being generator, by successive applications to at least one secret parameter (S) predetermined and stored in memory (16), of a sequence of values ((A ' _n ), (A " _n )) which can only be determined from the corresponding secret parameter (S) and the corresponding function,

- combining the plurality of sequences of values ((A ¹ J, (A " _n )) generated using a predefined relation to generate a new sequence of values ((A _n )),

defining a generating function, by successive applications to at least one secret parameter (S) predetermined and stored in memory (16), a sequence of values ((A ¹ J) determinable only from the secret parameter (S) and from the function,

- combining the sequence of values ((A ' _n )) generated with public parameters of the cryptographic algorithm to generate a new sequence of values ((A _n )),

22. A microcircuit device (12 ") according to any one of claims 19 to 21, configured to regenerate (110; 210) the protection parameter (a) for carrying out the transformation (106; 206). use in the step (114; 214) of generating the second output data item (s2).

23. A portable device, in particular a chip card (30), comprising a microcircuit device (12 ', 12 ") according to any one of claims 12 to 22.