Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
  • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
  • H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
  • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
  • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
  • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
  • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
  • H04L9/0877—Generation of secret information including derivation or calculation of cryptographic keys or passwords using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]

Definitions

• Disclosure relates to the area of encryption. More particularly, the disclosure relates to the generation of basic cryptographic materials, serving to secure data exchanged between two devices. Such situations can for example be encountered in the field of Internet of Things (IoT): smart metering, smart parking, health, environmental monitoring and other applications are typical examples of system requiring data encryption. While cost and energy efficiency are the main factors contributing to the popularity of commercial devices in the field of GIoT, security features are increasingly sought after.
• the payment functions which are implemented either online or offline are also based on confidentiality of the data exchanged between the devices involved in the payment transaction itself, for example a smartphone and a payment terminal or else. a personal computer and a server of an online merchant.
• a primality test makes it possible to determine this integer is prime or not, and we stop as soon as a prime number is obtained.
• the prime number theorem ensures that a prime number is found after a reasonable number of tries.
• the method requires the use of a rapid primality test.
• a probabilistic test is implemented, such as the Miller-Rabin primality test or a variant of such a test. There is no guarantee that the number is really prime, but we only get a high probability that it is.
• these operations are now integrated as standard in many devices and / or many code libraries and used as standard.
• the aforementioned devices are equipped with chips which can implement data encryption protocols in an accelerated manner, making the latter more or less transparent for the system.
• the mere description of the mathematical principles on which the algorithm is based is not sufficient.
• the concrete implementation requires taking into account other parameters which are essential for safety.
• the pair private key, public key
• the pair must be generated by a truly random process, a process which, even if it had to be known, does not make it possible to reconstitute the private key.
• a natural solution is to use an external device, such as an HSM or a remote server, to provide a random source. Since communication has a cost, only a random number ("seed") is usually provided, from which a pseudo-random bit sequence is derived. However, the transmission of this random number by the remote server itself uses an encryption algorithm which uses ... a random number. Thus, the solution consisting in using a remote device itself comes up against the necessary prior implementation of an encryption solution based on a random number which is of course generated on the device qualified as “unsecured”. Such a flaw, hardware, allows an attacker to capture (or infer or choose) the random number and obtain all the pseudo-random bits used by the device, which is of course not desirable.
• the disclosure makes it possible to respond at least in part to the problems posed by the prior art. More particularly, the disclosure relates to a method of cogeneration of a shared cryptographic material, method implemented within a first electronic device, said first electronic device being connected to a second electronic cogeneration device and to a third device. cogeneration electronics.
• Such a method comprises: a step of determining a shared encryption material, as a function of said set of ECG cogeneration parameters; a step of transmitting said shared encryption material; a step of receiving corresponding shared encryption material from other devices; a step of calculating a shared hazard, as a function of said shared encryption equipment and of said set of ECG cogeneration parameters; a step of transmitting a masked form of said shared hazard; a step of receiving masked forms of the corresponding shared hazards from the other devices; a step of calculating the final hazard, as a function of the masked forms of said shared hazards and of said set of ECG cogeneration parameters.
• the step of determining the shared encryption material, as a function of said set of ECG cogeneration parameters comprises: a step of selecting, within a cyclic group G, a number sx, plus small than p; a step of calculating the shared encryption material by performing an operation of the number sx with the generator g of the group G.
• the operation implemented is for example a multiplication or an exponentiation and it varies as a function of the group selected, which makes it possible to increase security.
• the step of calculating the shared random, as a function of said shared encryption equipment and of said set of ECG cogeneration parameters comprises: a step of obtaining a random number rx; a step of calculating the shared random number rx from the random number rx and the shared encryption materials pkx, pky, pkz and a hash function H;
• each participant uses the data provided by the other participants and by himself to generate a shared hazard.
• the step of calculating the final hazard, as a function of the masked shapes of said shared hazards and of said set of ECG cogeneration parameters comprises: a step of adding the masked shapes; and a step of hashing, using a hash function H, the result of the previous addition, delivering the final randomness.
• the cyclic group belongs to the group comprising: Curve25519; sec256p; head 25619;
• said hash function belongs to the group comprising:
• the cogeneration method further comprises a step of verifying the validity of the final hazard comprising a generation of a random number and a calculation of a hash value of a sum of said random number and the final hazard.
• each device participating in cogeneration is able to verify that the other devices have the same final shared hazard.
• the disclosure also relates to a cogeneration device for shared cryptographic material, a method implemented within a first electronic device, said first electronic device being connected to a second electronic cogeneration device and to a third electronic control device.
• cogeneration Such a device comprises: means for determining a shared encryption material, as a function of said set of cogeneration parameters; means for transmitting said shared encryption material; means for receiving corresponding shared encryption material from other devices; means for calculating a shared hazard, as a function of said shared encryption equipment and of said set of cogeneration parameters; means for transmitting a masked form of said shared hazard; means for receiving, in masked form, the corresponding shared hazards coming from the other devices; means for calculating the final hazard, as a function of the masked forms of said shared hazards and of said set of cogeneration parameters.
• Such a device can be in the form of a user communication terminal, provided with a general-purpose processor, not necessarily secure. It can also take the form of a “secure element” or equivalent, also present within (or connected to a) user communication terminal, comprising a secure processor. It can also take the form of a remote server. It can also take the form of a payment terminal or an authentication terminal, having secure data processing components.
• the disclosure also relates to a cogeneration system of shared cryptographic material.
• a cogeneration system of shared cryptographic material comprises at least three cogeneration devices as presented above, connected together. More particularly, in one embodiment, such a system can comprise a user communication terminal, provided with a general-purpose processor, not necessarily secure; a “secure element” or equivalent, also present within (or connected to) the user communication terminal, comprising a secure processor; a remote server, connected to the communication terminal.
• These three devices each implement the method described above to result, within the framework of this system, in the generation of a definitive hazard as proposed.
• the various steps of the methods according to the present disclosure are implemented by one or more software or computer programs, comprising software instructions intended to be executed by a data processor of an execution device according to the present technique and being designed to control the execution of the various steps of the methods, implemented at the level of the communication terminal, of the electronic execution device and / or of the remote server, within the framework of a distribution of the treatments to perform and determined by scripted source codes.
• the present technique is also aimed at programs, capable of being executed by a computer or by a data processor, these programs comprising instructions for controlling the execution of the steps of the methods as mentioned above.
• a program can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other. desirable shape.
• the present technique is also aimed at an information medium readable by a data processor, and comprising instructions of a program as mentioned above.
• the information medium can be any entity or device capable of storing the program.
• the medium can include a storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or else a magnetic recording means, for example a mobile medium (memory card) or a hard disk or an SSD.
• the information medium can be a transmissible medium such as an electrical or optical signal, which can be conveyed via an electrical or optical cable, by radio or by other means.
• the program according to the present technique can in particular be downloaded from an Internet type network.
• the information medium can be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.
• the present technique is implemented by means of software and / or hardware components.
• module can correspond in this document as well to a software component, as to a hardware component or to a set of hardware and software components.
• a software component corresponds to one or more computer programs, one or more sub-programs of a program, or more generally to any element of a program or software capable of implementing a function or a set of functions, as described below for the relevant module.
• Such a software component is executed by a data processor of a physical entity (terminal, server, gateway, set-top-box, router, etc.) and is capable of accessing the material resources of this physical entity (memories, recording media, communication bus, electronic input / output cards, user interfaces, etc.).
• a hardware component corresponds to any element of a hardware set (or hardware) capable of implementing a function or a set of functions, according to what is described below for the module concerned. It may be a programmable hardware component or with an integrated processor for executing software, for example an integrated circuit, a smart card, a memory card, an electronic card for executing a firmware ( firmware), etc.
• FIG 1 shows the general principle of the cogeneration process
• FIG. 2 shows a particular embodiment of the cogeneration process of FIG. 1;
• FIG. 3 illustrates a cogeneration device
• the general principle of the present technique is based on the implementation of a tripartite generation of a random number.
• a server is called upon which will be responsible for providing such a number, with however the risk that this number (or else the pseudo-random number derived from this number) is intercepted, thus rendering the use of such a remote server unnecessary and costly.
• the proposed method overcomes this problem linked to the potential interception and / or manipulation of a random number which is generated remotely by a server. More particularly, a symmetrical method of cogeneration (in the creation sense) of a random number involving three (at least) data processing devices is proposed. The method described makes it possible to obtain a high quality random number while reducing or eliminating the risks of fraud or interception of this random number.
• the present technique relates to a method of cogeneration of a shared cryptographic material, a method implemented within a first electronic device, said electronic device being connected to a second electronic cogeneration device by means of a communication network, said second electronic device also implementing the method of cogeneration of the shared cryptographic material, the method being characterized in that it is further implemented by a third electronic cogeneration device, connected to said first electronic device cogeneration system and said second electronic cogeneration device.
• the cogeneration process is based on the common use, by the three devices which are part of the cogeneration, of a set of cogeneration parameters.
• this set of parameters comprises in particular a cyclic group G (or a subgroup of a cyclic group), of generator g and of order p.
• This set also includes a common hash function H.
• This set of cogeneration parameters is denoted ECG.
• ECG ECG cogeneration parameters
• each part of the cogeneration implements an identical process. The object of this cogeneration is to overcome the possible deficiencies of one of the three devices, in order to ultimately obtain a high quality random number, without the risk of this number being exposed or manipulated.
• the cogeneration is tripartite and that it is implemented by three electronic devices named respectively ⁇ A ⁇ , ⁇ B ⁇ and ⁇ C ⁇ .
• the device ⁇ B ⁇ is a general public device in which there is no confidence in the quality of the random numbers that it generates. This does not mean that it is a poor quality generation device, but only that this device may possibly be subjected to external disturbances and / or to manipulations making its operation uncertain, and therefore to which we do not. don't trust, as a matter of principle.
• the device ⁇ B ⁇ wishes to exchange, with the device ⁇ A ⁇ , data, in a confidential manner (that is to say that one wishes to encrypt the content of the exchanges from ⁇ A ⁇ to ⁇ B ⁇ and reciprocally.
• ⁇ C ⁇ a third device ⁇ C ⁇ is involved, which is connected to ⁇ A ⁇ and ⁇ B ⁇ .
• ⁇ A ⁇ and ⁇ C ⁇ are not subject to external disturbances, for example because ⁇ A ⁇ and ⁇ C ⁇ are remote, protected servers and they are out of reach of any disturbance , and / or because ⁇ A ⁇ and ⁇ C ⁇ are protected against external attacks and have hardware protection solutions making their monitoring or manipulation difficult or even impossible for an attacker.
• the device ⁇ A ⁇ can be a remote server, for example a banking server or even a medical server, while the device ⁇ C ⁇ can be a server (also a banking server or a specific generation server) or even a server.
• particular cogeneration device specifically dedicated to this task (it can be an independent device, integrated or connected to the device ⁇ A ⁇ or to the device ⁇ B ⁇ , such as for example a dedicated chip or even a USB dongle, well that such implementations are not privileged).
• a trusted device ⁇ A ⁇ capable of generating high quality randomness (using any known high quality generation technique.
• the method comprises several steps, some involving data exchanges between the three parties.
• the following method is implemented by each device ( ⁇ A ⁇ , ⁇ B ⁇ , ⁇ C ⁇ ), and it comprises, for a device x , belonging to the set ( ⁇ A ⁇ , ⁇ B ⁇ , ⁇ C ⁇ ): a step of determining (P10) a shared encryption material (pkx), as a function of said set of ECG cogeneration parameters; a step of transmitting (P20) said of a shared encryption material (pkx); a step of receiving (P30) of the corresponding shared encryption materials (pky, pkz) coming from the other devices; a step of calculating (P40) of a shared hazard (mx), as a function of said shared encryption materials (pkx, pky, pkz) and of said set of ECG cogeneration parameters; a step of transmitting (P50) a masked form (Ox)
• the method of the present technique makes it possible to ensure that even if ⁇ B ⁇ is compromised, the final hazard is of a sufficient quality to ensure a high efficiency of the encryption which will result from the use of this hazard.
• the method of the present technique makes it possible to ensure that the hazard transmitted by the server complementary (which by analogy could be considered as the device ⁇ C ⁇ ) is not compromised, manipulated or intercepted and for good reason: in the present technique, the device ⁇ C ⁇ never transmits any random, but a masked form of 'a shared hazard, this masked form constituting, in the end, only one component of the final hazard. As understood, this masked form is not intended to be unmasked (i.e.
• the initial hazard is masked (scrambled) to form a value which itself will be used to form the final shared hazard.
• each participant ⁇ A ⁇ , ⁇ B ⁇ , ⁇ C ⁇
• ⁇ A ⁇ , ⁇ B ⁇ , ⁇ C ⁇ is able to check that the final hazard is correct by comparing its own final hazard with the final hazard obtained by the other participants.
• two of the participants ⁇ A ⁇ and ⁇ C ⁇ are secure (a priori), it is not possible a priori to deceive them.
• the random value produced by ⁇ B ⁇ is really masked: the random value, which is masked, can therefore be initially equal to zero without any participant in the exchange being able to detect it (except the producer of this value of course). which would produce this "non-random" value (ie for example 0 or some other predetermined value) in an attempt to influence the randomness could not influence the randomness of the result.
• this "non-random" value ie for example 0 or some other predetermined value
• the process of the present technique has been described in general. Some steps of it are a function of the ECG cogeneration parameter set. In particular, it is not it is not always necessary to have a cyclic group in order to be able to implement the proposed technique, and other parameters can be used if they prove to be more suited to the concrete application situation.
• the step of determining (P10) the shared encryption material (pkx), as a function of said set of ECG cogeneration parameters comprises: a step of selecting, within the cyclic group G (or a subgroup of the cyclic group G), of a number sx, smaller than p; a step of calculating the shared encryption material (pkx) by performing an operation of the number sx with the generator g of the group G;
• the step of calculating (P40) of the shared random (mx), as a function of said shared encryption materials (pkx, pky, pkz) and of said set of ECG cogeneration parameters comprises: a step of obtaining a random number rx; a step of calculating the shared random number mx from the random number rx and the shared encryption materials pkx, pky, pkz and the hash function H;
• this calculation follows a particular rule as a function of a rank that the device has in the set of devices.
• hXY H (pkA, pkB, pkC, [sX] pkY).
• the step of calculating (P70) of the final hazard (ad), as a function of the masked forms (Ox, Oy, Oz) of said shared hazards (mx, my, mz) and of said set of ECG cogeneration parameters comprises: a step of adding the masked forms (Ox, Oy, Oz); and a step of hashing, using the hash function H, the result of the previous addition, delivering the final random (ad).
• ⁇ A] (trusted device) sends a random rT to ⁇ B ⁇ ;
• ⁇ B ⁇ responds to ⁇ A ⁇ by transmitting the result Res of the calculation H (ad, rT);
• ⁇ A ⁇ checks that H (ad, rT) matches the result H (ad, rT) that ⁇ B ⁇ transmitted.
• any hash function can be used (SHA-1, MD5, etc.).
• the use of the SHA-3 function in SHAKE128 mode in particular
• the size of the output result for example 256 bits, which represents an advantage in the context of the calculation of the hazard.
• this function it is possible to determine in advance what the size of the integer resulting from the hash will be and therefore to adapt this size, for example to the respective capacities of the devices. ⁇ A ⁇ and ⁇ B ⁇ in order to ensure a compromise between the need for security and the processing capacities, in particular of the device ⁇ B ⁇ .
• the selected output size is 256 bits. This means that the final random has a length of 256 bits.
• An electronic device capable of carrying out the hazard cogeneration treatment as presented above is presented.
• An electronic device comprises a memory 31, a processing unit 32 equipped for example with a microprocessor, and controlled by a computer program 33, implementing the method as described above.
• the present technique is implemented in the form of an application installed on this device.
• Such a device comprises, depending on the embodiments: means for determining a shared encryption material, as a function of said set of cogeneration parameters; means for transmitting said shared encryption material; means for receiving corresponding shared encryption material from other devices; means for calculating a shared hazard, as a function of said shared encryption equipment and of said set of cogeneration parameters; means for transmitting a masked form of said shared hazard; means for receiving, in masked form, the corresponding shared hazards coming from the other devices; means for calculating the final hazard, as a function of the masked forms of said shared hazards and of said set of cogeneration parameters.
• these means are implemented by means of modules and / or components, for example secure. They thus make it possible to keep confidential the data necessary for the definition of useful keys in a cryptosystem for data encryption.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Power Engineering (AREA)
• Storage Device Security (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=70456850

Family Applications (1)

Country Status (5)

Family Cites Families (1)

• 2019
  • 2019-12-05 FR FR1913816A patent/FR3104356B1/fr active Active
• 2020
  • 2020-11-25 CA CA3163728A patent/CA3163728A1/en active Pending
  • 2020-11-25 US US17/782,474 patent/US20230006812A1/en active Pending
  • 2020-11-25 EP EP20817192.6A patent/EP4070502A1/de active Pending
  • 2020-11-25 WO PCT/EP2020/083427 patent/WO2021110518A1/fr unknown

Also Published As

Similar Documents

Legal Events