JP2012230276A - Encryption processing device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve a side-channel attack resistance of a pseudo random number generator.SOLUTION: An encryption circuit of a pseudo random number generator has a one-round processing circuit of the pseudo random generator, a mask holding circuit, and a mask generating circuit. The encryption circuit performs calculations while masking data going through the one-round processing circuit of the pseudo random generator. Concretely, the mask holding circuit: includes a linear transformation circuit that is the same as one that the one-round processing circuit of the pseudo random generator has; operates with the circuit; and inputs output data from the mask generating circuit into the mask holding circuit itself. The mask generating circuit generates random numbers to mask data on calculation processes and results of calculation at a non-linear transformation circuit that the one-round processing circuit of the pseudo random generator has.

Description

  The subject matter disclosed herein relates to a technique for hardware processing of cryptographic algorithms.

  For the purpose of concealing information, an encryption algorithm for generating ciphertext data that is difficult to guess from plaintext data is used. Examples of the encryption algorithm include an American standard encryption AES (Advanced Encryption Standard) and a pseudo-random number generator Enocoro described in Patent Document 1.

  The implementation of the encryption algorithm is realized in various forms, but when attention is paid to the realization of the encryption function using hardware, it is usually realized as an encryption device incorporating a dedicated encryption circuit. Cryptographic devices are widely used in small devices such as IC cards and mobile phones.

  In recent years, however, side channel attacks have been devised that target cryptographic devices. A side channel attack refers to plaintext data input to the cryptographic device and ciphertext data output from the cryptographic device, as well as power consumption, leakage electromagnetic waves generated by the cryptographic device during the encryption process, and encryption processing time. This is an attack that uses leaked information to identify secret information such as a secret key incorporated in a cryptographic device.

  A differential analysis attack and a linear analysis attack, which are attack methods for conventional cryptographic algorithms, require tens of thousands of PCs and several years. On the other hand, the side channel attack may be performed for several days with a cryptographic device, one PC, and a measuring device such as an oscilloscope. For this reason, the side channel attack is known as a powerful attack because the cost, time, and the like are small compared to the conventional attack method.

  As a side channel attack countermeasure technique for AES, for example, a method of hiding (masking) a value during encryption processing using a random number is known (Non-Patent Document 1). Non-Patent Document 1 discloses a method for masking non-linear transformation of an AES encryption circuit. In the method disclosed in Non-Patent Document 1, it is necessary to renew information for concealment such as random numbers (mask data or simply referred to as a mask) each time nonlinear transformation is performed. The AES algorithm applies a non-linear transformation to all bits in the internal state and does not keep the same internal state. Therefore, it is not necessary to store the mask once used, and all the masks may be updated every round.

  On the other hand, paying attention to the pseudo-random number generator Enocor, the pseudo-random number generator Enocoro receives a secret key 128 bits, an initial vector 64 bits and a constant 80 bits, performs a predetermined initialization process, and then performs pseudo-bits 8 bits at a time. This is a pseudo-random number generator that outputs a random number sequence. The pseudo-random number generator Enocoro has an internal state of 272 bits, performs non-linear conversion only on some bits of the internal state, stirs the internal state while holding other bits, and part of the internal state Are output as pseudo-random numbers. The pseudo-random number generator Enocoro includes nonlinear transformation as in AES, except that the nonlinear transformation is applied to some bits in the internal state and not to other bits.

JP 2008-276728 A

E. Trichina, “Logic Design for AES SubByte Transformation On masked Data”, [online], November 2003, Cryptology ePrint Archive, [searched March 25, 2011], Internet <URL: http: //eprint.iacr .org / 2003 / 236.pdf>

  By applying the technique of Non-Patent Document 1, it is expected that the side channel attack resistance of the AES encryption circuit will be improved.

  However, Non-Patent Document 1 is premised on application to the AES algorithm, and does not mention a procedure applied to an algorithm different from AES, such as the pseudorandom number generator Enocoro.

  Furthermore, although a side channel attack countermeasure technique against AES has been reported in Non-Patent Document 1, etc., a side channel attack countermeasure technique against pseudorandom number generator Enocoro is not known. In order to use the pseudo random number generator Enocoro more safely, a countermeasure against side channel attacks is desirable.

  In the present specification, in view of the above problems, a plurality of configurations for solving the above problems are disclosed.

  For example, a pseudo random number generator Enocoro circuit is configured by using a mask generation unit, a mask holding unit, and a round processing unit. The round processing unit is a processing circuit for one round of the pseudorandom number generator Enocor including a linear conversion circuit and a non-linear conversion circuit. The mask generation unit is a circuit that generates a new mask for use in the nonlinear conversion circuit included in the round processing unit. The mask holding unit includes the same linear conversion circuit as the linear conversion circuit included in the round processing unit, and operates in synchronization with the round processing unit. The output value of the mask generation unit is input to the mask holding unit, and the value of the mask holding unit is output to the non-linear conversion circuit of the round processing unit.

  By configuring the pseudo-random number generator Enocoro circuit in this way, the mask stored in the internal state register of the pseudo-random number generator Enocoro circuit is masked, and a new mask to be used in nonlinear conversion is generated by the mask generation unit. Meanwhile, the mask used for the value stored in the internal state register can be stored in the mask holding unit. By these processes, the internal state of the pseudo random number generator Enocoro circuit is masked, and the mask can be applied to non-linear conversion. Therefore, the side channel attack resistance of the pseudo random number generator Enocoro circuit can be improved.

  According to the disclosure, it is possible to realize a pseudo random number generator Enocoro circuit that can improve resistance to side channel attacks using random numbers.

FIG. 3 is a diagram illustrating a configuration of a pseudo random number generator Enocoro circuit according to the first embodiment. It is a figure which illustrates the structure of the mask production | generation unit of Example 1. FIG. 3 is a diagram illustrating a configuration of a mask holding unit according to Embodiment 1. FIG. It is a figure which illustrates the structure of the round processing unit of Example 1. FIG.

  Embodiments of the present invention will be described with reference to the drawings. The hexagons in each figure indicate data.

  FIG. 1 is a circuit diagram of a pseudo-random number generator Enocoro that takes a countermeasure against side channel attacks using random numbers. The pseudo-random number generator Enocoro 101 includes a 272-bit S input seed 102, a 128-bit S output seed 103, and a 272-bit initial value 104 obtained by combining a secret key 128 bits, an initial vector 64 bits, and a constant 80 bits in the same order. Enter. The pseudo random number sequence 114 is a pseudo random number sequence that is output data of the pseudo random number generator Enocoro 101. Although not shown, in the pseudo-random number generator Enocoro 101, each register and each processing unit described below advance their operations in accordance with an input timing signal (clock).

  The selector 105 selects the S input seed 102 when the S input seed 102 is input to the pseudorandom number generator Enocoro 101, and selects the 272-bit S input mask register input value 116 otherwise. This selection result is output as intermediate data 115 of 272 bits.

  Similarly, the selector 106 selects the S output seed 103 when the S output seed 103 is input to the pseudo random number generator Enocoro 101, and selects the 128-bit S output mask register input value 120 otherwise. The selection result is output as 128-bit intermediate data 119.

  Similarly, the selector 107 selects the XOR (exclusive OR) value of the S input seed 102 and the initial value 104 when the S input seed 102 and the initial value 104 are input to the pseudo-random number generator Enocoro 101, In this case, the 272-bit internal state register input value 124 is selected. This selection result is output as 272-bit intermediate data 123.

  The S input mask register 108 receives 272-bit intermediate data 115 as input, stores the value, and outputs the value as a 272-bit S input mask register storage value 126.

  The S output mask register 109 receives the 128-bit intermediate data 119, stores the value, and outputs the value as a 128-bit S output mask register storage value 127.

  The internal state register 110 receives the 272-bit intermediate data 123, stores the value, and outputs the value as a 272-bit internal state register stored value 128.

  The mask generation unit 111 receives a 128-bit S output mask register stored value 127 as input, executes a predetermined mask generation process, and uses the result as a 128-bit S output mask register input value 120 and a 32-bit S output mask. 121 and 32-bit S processing masks 122 are output.

  The mask holding unit 112 receives the 272-bit S input mask register stored value 126 and the 32-bit S output mask 121 as input, performs a predetermined linear conversion, and converts the result into a 272-bit S input mask register input value 116. , A 32-bit S input mask 117, and an 8-bit final mask 118.

  The round processing unit 113 receives a 272-bit internal state register stored value 128, a 32-bit S processing mask 122, and a 32-bit S input mask 117 as inputs, performs a predetermined stirring process, and outputs the result to the internal state register. An input value 124 and 8-bit final data 125 are output.

  The result of calculating the exclusive OR of the 8-bit final mask 118 and the 8-bit final data 125 is output as an 8-bit pseudorandom number sequence 114. The pseudo random number generator Enocoro 101 receives the S input seed 102, the S output seed 103, and the initial value 104, and then initializes 96 rounds. During this initialization, the pseudo random number sequence 114 is not output.

  The bit lengths of the S output seed 103, the S output mask register 109, the intermediate data 119, the S output mask register input value 120, the S processing mask 122, and the S output mask register stored value 127 depend on the implementation method of the nonlinear transformation. It may be optional.

  Next, detailed configurations of the mask generation unit 111, the mask holding unit 112, and the round processing unit 113 will be described.

  The configuration of the mask generation unit 111 is shown in FIG. The input of the mask generation unit 111 is a 128-bit S output mask register stored value 127. The outputs of the mask generation unit 111 are a 128-bit S output mask register input value 120, a 32-bit S output mask 121, and a 32-bit S processing mask 122. The mask generation unit 111 generates a new 128-bit mask by the small random number generation unit 201. The small random number generation unit 201 may be realized using a pseudo-random number generator, or may be realized using a source of genuine random numbers.

  An example of a pseudo random number generator used for the small random number generation unit 201 is a linear feedback shift register.

  When a source of genuine random numbers is used for the small random number generation unit 201, the input S output mask register stored value 127 may be omitted.

  The output of the small random number generation unit 201 is output as the S output mask register input value 120. Further, 32 bits of the output of the small random number generation unit 201 are output as the S output mask 121, and the S processing mask 122 is output in the same manner. To do.

  The configuration of the mask holding unit 112 is shown in FIG. The inputs of the mask holding unit 112 are a 272-bit S input mask register stored value 126 and a 32-bit S output mask 121. The outputs of the mask holding unit 112 are a 272-bit S input mask register input value 116, a 32-bit S input mask 117, and an 8-bit final mask 118. In the figure, L (301) is a 16-bit input / output linear transformation.

  The mask holding unit 112 performs a data shift according to the connection shown in the figure on the S input mask register storage value 126 and the S output mask 121, and then outputs the result as an S input mask register input value 116, an S input mask 117, And it outputs as the last mask 118.

  This configuration is characterized in that the S input mask 117 that is the output of the mask holding unit 112 is input to the round processing unit 113 while the mask holding unit 112 stores the mask. Further, the mask value can be held by storing the S input mask register value 116 that is the output of the mask holding unit 112 in the S input mask register 108.

  The configuration of the round processing unit 113 is shown in FIG. The inputs of the round processing unit 113 are a 272-bit internal state register stored value 128, a 32-bit S input mask 117, and a 32-bit S processing mask 122. The output of the round processing unit 113 is a 272-bit internal state register input value 124 and an 8-bit final data 125. In the figure, S (401 to 404) represents an 8-bit input / output nonlinear conversion process, and the processes of 401 to 404 are the same. In the figure, L (405) is a 16-bit input / output linear conversion.

  S (401 to 404) masks the internal state register stored value 128, the mask used for the value (S input mask 117 in the figure), and the value and output value during the processing of S. For this purpose, a new mask (S processing mask 122 in the figure) used for the input is input, and after the conversion processing is performed, the masked value is output. S (401 to 404) performs conversion so that the XOR result between the masked value, that is, the data and the mask used for the data does not appear during the conversion. For example, this can be realized by XORing the data and a new mask and then XORing the mask used for the data.

  In addition, as an example of the mounting method of S (401-404), you may mount using the technique which nonpatent literature 1 shows, and you may mount using the technique which duplicates circuits, such as WDDL. In addition, it may be implemented by referring to a table using an IC card, a ROM, a RAM, or an FPGA (Field Programmable Gate Array).

  The round processing unit 113 receives the 272-bit internal state register stored value 128, the 32-bit S input mask 117, and the 32-bit S processing mask 122 as input, and after performing the conversion processing according to the connection shown in the figure, the round processing unit 113 is 272 bits. Internal state register input value 124 and 8-bit final data 125 are output. Although not shown, when the pseudo random number generator Enocoro 101 is initialized, XOR between the 8-bit counter value and the internal state register stored value is performed.

  Above, description of the detailed structure of the mask production | generation unit 111, the mask holding unit 112, and the round processing unit 113 is finished.

  In FIG. 1, if the bit order of inputting the S input seed 102 to the S input mask register 108 and the bit order of inputting the XOR result of the S input seed 102 and the initial value 104 to the internal state register 110 are the same, 3. As shown in FIG. 4, the processing of the mask holding unit 112 is the same as the processing of the round processing unit 113 excluding the non-linear transformation S (401 to 404), and therefore the mask storage location in the S input mask register 108 The storage location of the mask being used in the internal state register 110 can be the same.

  Therefore, when the value stored in the internal state register 110 is input to the non-linear transformation S (for example, 401), the value of the S input mask register 108 stored in a location that matches the storage location in the internal status register 110. Is input to the nonlinear transformation S, the mask can be solved correctly.

  Further, the S output mask 121 used for the output of the nonlinear transformation S is rounded by the mask holding unit 112 in the same manner as the output of the nonlinear transformation S (for example, 401) is inputted to a predetermined place in the round processing unit 113. The output of the non-linear transformation S is input to the same place where the output of the processing unit 113 is input.

  As described above, the mask stored in the S input mask register 108 can be saved in synchronization with the value using the mask stored in the internal state register 110.

  As described above, in this embodiment, the pseudo random number generator Enocoro circuit 101 is configured using the mask generation unit 111, the mask holding unit 112, and the round processing unit 113.

  In the configuration of this embodiment, a mask is applied to the value stored in the internal state register 110 of the pseudorandom number generator Enocoro circuit 101, and a new mask used in the nonlinear transformation S is generated by the mask generation unit 111, while the internal state is generated. The mask used for the value stored in the register 110 can be stored in the mask holding unit 112. By these processes, the internal state of the pseudo random number generator Enocoro circuit 101 can be masked, and the mask can be applied to non-linear transformation. Therefore, the side channel attack resistance of the pseudo random number generator Enocoro circuit 101 can be improved. .

  Furthermore, in this embodiment, it is not necessary to XOR a new mask for all bits in the internal state every round as compared with the case where the side channel attack countermeasure technique for AES is applied to the pseudorandom number generator Enocor as it is. The number of mask bits newly required by the pseudo random number generator Enocor per round can be reduced.

  Furthermore, compared with the case where the side channel attack countermeasure technology for AES is applied to the pseudo random number generator Enocor as it is, the XOR process of all the bits of the internal state and the mask can be omitted, so the circuit scale of the pseudo random number generator Enocoro can be reduced. It is made small.

  In this embodiment, the round processing unit 113 first XORs the new mask and all the bits in the internal state, then performs XOR with the currently used mask, and then performs the round processing shown in FIG. You may comprise.

  The new mask is obtained by expanding the bit width of the S processing mask 122 to 272 bits or more. The currently used mask is the S input mask register stored value 126. Although the configuration of the mask generation unit 111 is not changed, the number of bits of the S processing mask 122 as an output is expanded as described above. Although the configuration of the mask holding unit 112 is not changed, only the S processing mask 122 whose bit width is expanded is input, and the S input mask 117 for output may not be provided.

  101: Pseudorandom number generator Enocoro circuit, 105, 106, 107: Selector, 108: S input mask register, 109: S output mask register, 110: Internal state register, 111: Mask generation unit, 112: Mask holding unit, 113 : Round processing unit, 116: S input mask register input value, 117: S input mask, 118: final mask, 120: S output mask register input value, 121: S output mask, 122: S processing mask, 124: internal state Register input value, 125: final data, 126: S input mask register stored value, 127: S output mask register stored value, 128: internal state register stored value, 201: small random number generation unit, 401, 402, 403, 404: Nonlinear transformation S

Claims (8)

A circuit of a pseudo random number generator Enocoro,
Including a processing circuit for one round of a pseudo-random number generator including the linear conversion circuit 1 and the first nonlinear conversion circuit, a mask holding circuit, and a mask generation circuit,
The output of the mask generation circuit is an input to the processing circuit for one round of the pseudo random number generator and the mask holding unit,
The output of the mask holding circuit is an input to the processing circuit for one round of the pseudorandom number generator,
The processing circuit for one round of the pseudo-random number generator receives the mask output from the mask holding unit and the mask output from the mask generation unit as inputs, and the processing circuit for one round of the pseudo-random number generator An encryption processing apparatus that performs conversion processing while masking target data. The cryptographic processing device according to claim 1,
The mask holding circuit includes a second linear conversion circuit that is the same as the first linear conversion circuit, and operates in synchronization with a processing circuit for one round of the pseudo-random number generator. apparatus. The cryptographic processing apparatus according to claim 1, wherein:
The encryption processing apparatus, wherein the mask holding circuit inputs the output data of the mask generation circuit to a location that matches the output location of the nonlinear conversion circuit in the mask holding circuit. The cryptographic processing device according to any one of claims 1 to 3,
The encryption processing apparatus, wherein the mask generation circuit generates data of a calculation process of a nonlinear conversion circuit included in a processing circuit for one round of the pseudo random number generator and a random number for masking a calculation result. A cryptographic processing device according to any one of claims 1 to 4,
The encryption processing apparatus, wherein the mask generation circuit generates a mask using a pseudo-random number generation apparatus. The cryptographic processing device according to claim 5,
The number processing device, wherein the mask generation circuit generates a mask using a true random number generation device. The cryptographic processing device according to any one of claims 1 to 6,
The non-linear conversion circuit included in the processing circuit for one round of the pseudo random number generator outputs the data of the processing circuit for one round of the pseudo random number generator, the data of the mask holding circuit, and the mask generation circuit. An encryption processing apparatus, characterized in that a mask is inputted, calculation is performed without removing the mask and the mask is updated, and masked output data is output. The cryptographic processing device according to any one of claims 1 to 7,
An encryption processing apparatus, wherein a non-linear conversion circuit included in a processing circuit for one round of the pseudo-random number generator performs an arithmetic process using a mask.

Images