JP7439847B2 - Electronic information storage medium, key data setting method, and program - Google Patents

Description

The present invention relates to the technical field of IC chips and the like that are installed in IC cards and mobile devices and have an elliptic curve cryptographic calculation function.

2. Description of the Related Art Public key cryptographic calculation methods have been widely used to ensure the security of information exchanged between an IC (Integrated Circuit) chip and an external terminal. RSA (Rivest-Shamir-Adleman cryptosystem), which is currently the mainstream among public key cryptographic calculation systems, tends to have a long key length in order to improve security. However, in situations where CPU performance and memory capacity are limited, such as with IC chips, it is expected that the use of RSA will become more difficult in the future. Therefore, as a public key cryptographic calculation method to replace RSA, an elliptic curve cryptographic calculation method as disclosed in Patent Document 1, for example, is attracting attention. Elliptic curve cryptographic operations require parameters in addition to key data (private key and public key). Such parameters are disclosed to the public by public institutions, industry groups, etc., and there are multiple such parameters (NIST P-256, P-521, secp256r1, secp521r1, etc.). In addition, since the parameters used in elliptic curve cryptographic operations differ depending on the key length of the key data, both the side using the private key and the side using the public key in the elliptic curve cryptographic operation method need to know the above parameters. be.

Japanese Patent Application Publication No. 2000-181351

When initializing key data and parameters on an IC chip, the key data and parameters are each transmitted to and written into the IC chip by an issue command from an external terminal, for example. In order to reduce such communication time and write processing time, GlobalPlatform Technology Card Specification Version 2.3.1 requires that parameters and their identifiers be stored in advance in the non-volatile memory of an IC chip and used by the IC chip. A method is described in which the parameter to be specified is specified (selected) by transmitting the identifier of the parameter from an external terminal to an IC chip at the time of key issuance. However, even with this method, it is necessary to send the parameter identifier to the IC chip to identify the parameter when issuing the key, so a program that identifies the parameter based on the communication time and identifier at that time is required. It is difficult to say that it is efficient because it requires memory capacity for .

Therefore, the present invention has been made in view of the above points, and provides an electronic information storage medium, a key data setting method, and a key data setting method that can more efficiently initialize parameters used in elliptic curve cryptographic operations. and programs.

In order to solve the above problem, the invention according to claim 1 provides an electronic information storage medium capable of executing elliptic curve cryptographic operations using key data and parameters, the electronic information storage medium having a plurality of parameters and corresponding to each of the parameters. a holding means for holding a key length; a first specifying means for specifying the key length of the key data based on the key data received from an external device; and the parameters and the key length held by the holding means. , a second specifying means for specifying a parameter to be used in the elliptic curve cryptographic operation from the plurality of parameters based on the key length specified by the first specifying means; The method is characterized by comprising a setting means for setting the parameters specified by the specifying means as key data and parameters used in the elliptic curve cryptographic operation.

The invention according to claim 2 is the electronic information storage medium according to claim 1, in which when the key length specified by the first specifying means is not held by the holding means, the key length is used together with the received key data. The present invention is characterized by further comprising a response means for transmitting a response indicating that there is no parameter to be specified to the external device.

The invention according to claim 3 is the electronic information storage medium according to claim 1 or 2, wherein the holding means stores a table in which the plurality of parameters and key lengths corresponding to each of the parameters are associated with the electronic information storage medium. The parameters and the key length are held by storing them in a non-volatile memory of an information storage medium, and the second specifying means specifies a key length that matches the key length specified by the first specifying means from the table. The method is characterized in that a parameter associated with the specified key length is specified from the table as a parameter used in the elliptic curve cryptographic operation.

The invention according to claim 4 is the electronic information storage medium according to claim 1 or 2, wherein the holding means includes a first table that associates the plurality of parameters with identifiers of the parameters, and and a key length corresponding to each of the identifiers is stored in a nonvolatile memory of the electronic information storage medium to hold the parameter and the key length, and the second specifying means A key length that matches the key length identified by the first identifying means is identified from the second table, an identifier associated with the identified key length is identified from the second table, and a corresponding one is associated with the identified identifier. The attached parameter is specified from the first table as a parameter used in the elliptic curve cryptographic operation.

According to a fifth aspect of the present invention, in the electronic information storage medium according to the fourth aspect, the contents of the second table vary depending on the use of the electronic information storage medium.

The invention according to claim 6 is a key data setting method executed by an electronic information storage medium capable of performing an elliptic curve cryptographic operation using key data and parameters, the key data setting method comprising a plurality of parameters and a method corresponding to each of the parameters. a step of retaining a key length, a step of identifying a key length of the key data based on the key data received from an external device, the retained parameter and the key length, and the identified key length. identifying a parameter to be used in the elliptic curve cryptographic operation from the plurality of parameters based on the received key data and the identified parameter; The method is characterized by including a step of setting as a parameter.

The invention set forth in claim 7 provides a storage system that stores a plurality of parameters and key lengths corresponding to each of the parameters, and stores a computer included in an electronic information storage medium capable of executing elliptic curve cryptographic operations using key data and parameters. means, first specifying means for specifying the key length of the key data based on the key data received from an external device, the parameter and the key length held by the holding means, and the first specifying means a second specifying means for specifying parameters used in the elliptic curve cryptographic operation from the plurality of parameters based on the key length specified by the received key data and the second specifying means; It is characterized by functioning as a setting means for setting parameters as key data and parameters used in the elliptic curve cryptographic operation.

According to the present invention, parameters used in elliptic curve cryptographic operations can be initialized more efficiently.

1 is a diagram showing an example of a hardware configuration of an IC chip 1. FIG. 3 is a diagram showing an example of the software configuration of the IC chip 1. FIG. FIG. 3 is a diagram showing an example of a table T0 that associates a plurality of parameters with key lengths corresponding to each of the parameters. It is a diagram showing an example of a table T1 in which a plurality of parameters are associated with identifiers of the parameters, and a table T2 in which the identifiers are associated with key lengths corresponding to the respective identifiers. 3 is a flowchart showing an example of processing in the IC chip 1. FIG.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The embodiment described below is an embodiment in which the present invention is applied to an IC chip having an elliptic curve cryptographic calculation function.

[1. Configuration and functions of IC chip 1]
First, with reference to FIG. 1, the configuration and functions of an IC chip 1 according to the present embodiment will be described. An IC chip 1 is a diagram showing an example of an electronic information storage medium of the present invention. The IC chip 1 is installed in, for example, an IC card such as a credit card or a cash card, or a mobile device such as a smartphone. An IC card is also an example of an electronic information storage medium. In the case of a mobile device such as a smartphone, the IC chip 1 may be mounted on a small IC card that is removable from the mobile device, or may be installed as an eUICC (Embedded Universal Integrated Circuit Card) so that it cannot be easily removed or replaced from the mobile device. It may also be mounted on a built-in board.

FIG. 1 is a diagram showing an example of the hardware configuration of the IC chip 1, and FIG. 2 is a diagram showing an example of the software configuration of the IC chip 1. As shown in FIG. 1, the IC chip 1 includes an I/O circuit 11, a RAM (Random Access Memory) 12, an NVM (Nonvolatile Memory) 13, a ROM (Read Only Memory) 14, and a CPU (Central Processing Unit) 15 ( An example of a computer) etc. The I/O circuit 11 serves as an interface with an external terminal 2 (an example of an external device). Note that the communication between the IC chip 1 and the external terminal 2 may be non-contact communication or contact communication. In the case of contactless communication, communication between the IC chip 1 and the external terminal 2 is performed, for example, via an antenna (not shown) mounted on the IC card. The external terminal 2 may be an issuing device in a factory where the IC chip 1 is manufactured, or may be a mobile device (control unit) on which the IC chip 1 is mounted. Here, the issuing device is a device that writes a key (key data) into the IC chip 1.

The NVM 13 is a flash memory or a nonvolatile memory such as an Electrically Erasable Programmable Read-Only Memory. The NVM 13 or ROM 14 stores programs such as an operating system and applications (including the program of the present invention). Here, the applications include applications for elliptic curve cryptographic operations such as ECDSA (Elliptic Curve Digital Signature Algorithm). Note that, as described in Patent Document 1, the elliptic curve is expressed by Equation 1: y^2=x^3+ax+b. Furthermore, as shown in FIG. (an example of a second identifying means), a parameter specifying section 154 (an example of a second specifying means), a key setting section 155 (an example of a setting means), and the like.

The preset parameter holding unit 151 uses the NVM 13 to hold a plurality of parameters that can be used for elliptic curve cryptographic operations and key lengths corresponding to each of the parameters. Note that the storage location (address) of parameters and the storage location (address) of the key length in the NVM 13 are managed by the preset parameter holding unit 151. In the case where one type of parameter is determined for each key length, the preset parameter holding unit 151 stores the table T0 in the NVM 13 in which a plurality of parameters are associated with the key lengths corresponding to each parameter, thereby storing the parameters and key lengths. Good to keep. FIG. 3 is a diagram illustrating an example of a table T0 that associates a plurality of parameters with key lengths corresponding to each of the parameters. Note that the table T0 is preset in the IC chip 1 (eg, preset in the program) before the key data is written to the NVM 13.

In addition, in a case where there are multiple parameters for each key length, the preset parameter holding unit 151 stores a table T1 (an example of a first table) that associates multiple parameters with identifiers for each parameter, and It is preferable to store the parameters and key lengths by storing in the NVM 13 a table T2 (an example of a second table) in which each identifier is associated with a corresponding key length. FIG. 4 is a diagram illustrating an example of a table T1 that associates a plurality of parameters with identifiers of the respective parameters, and a table T2 that associates the identifiers with the key lengths corresponding to the respective identifiers. Here, the contents of table T2 vary depending on the use of IC chip 1. That is, which parameter is used among the plurality of parameters in the table T1 is defined in the table T2 according to the application of the IC chip 1. Note that the table T1 is preset (for example, preset in the program) before the key data is written to the NVM 13. In other words, the parameters in table T1 are in the state that has been written to the IC chip 1 when the program is written to the IC chip 1. Like table T1, table T2 is also preset (for example, preset in a program) before the key data is written to NVM 13, or preset table T2 is rewritten according to the usage of IC chip 1.

Note that one parameter includes p (prime number), a (curve parameter in equation 1 above), b (curve parameter in equation 1 above), G (base point), n (order), and h (cofactor). is included. The plurality of parameters and key lengths may be stored by being written into the NVM 13, for example, when an application programmed with an elliptic curve cryptographic calculation function is written into the NVM 13 from the issuing device during the manufacture of the IC chip 1. .

The command processing unit 152 executes processing according to a command received from the external terminal 2 via the I/O circuit 11 and transmits a response to the command to the external terminal 2 via the I/O circuit 11. A command received from the external terminal 2 is composed of an APDU (Application Protocol Data Unit) including a header consisting of at least CLA (instruction class), INS (instruction code), P1 and P2 (parameters). For example, the type of command is specified by the INS. Examples of command types include write commands, read commands, authentication commands, and the like. Furthermore, the command may include a body having Lc and Data in addition to the above header. Lc indicates the length (size) of Data. In this embodiment, the write command is used as an issue command for issuing a key. Data in this command includes key data. Further, a response (APDU) to the command is transmitted to the external terminal 2 through the I/O circuit 11. Here, the response consists of at least an SW (status word) indicating the processing result, and may also include data.

The key length specifying section 153, the parameter specifying section 154, and the key setting section 155 operate in a process when a write command including key data is received from the external terminal 2 (that is, a process according to the write command). The key length identifying unit 153 identifies the key length of the received key data. The key length of the key data can be specified from Lc included in the write command. The parameter specifying unit 154 selects a parameter used in the elliptic curve cryptographic operation from a plurality of parameters based on the plurality of parameters and key lengths held by the preset parameter holding unit 151 and the key length specified by the key length specifying unit 153. Identify the parameters that will be used. For example, the parameter identifying unit 154 identifies a key length that matches the key length identified by the key length identifying unit 153 from the table T0, and uses the parameter associated with the identified key length in the elliptic curve cryptographic operation. It is specified from table T0 as a parameter to be used. This eliminates the need for processing using parameter identifiers, making it possible to perform issuing processing in a shorter time and further saving memory. Alternatively, the parameter identifying unit 154 identifies a key length that matches the key length identified by the key length identifying unit 153 from the table T2, and identifies an identifier associated with the identified key length from the table T2. Then, the parameter identifying unit 154 identifies the parameter associated with the identified identifier from the table T1 as a parameter to be used in the elliptic curve cryptographic operation. Thereby, even if the IC chip 1 supports multiple parameters having the same key length, key data can be quickly set by determining the parameters to be used for each key length in advance in the table T2.

The key setting unit 155 sets the received key data and the parameters specified by the parameter specifying unit 154 as key data and parameters used in the elliptic curve cryptographic operation. With this setting, a set of the key data and the parameter is written to the NVM 13, or a set of the key data and reference information to the parameter is written to the NVM 13. Here, the reference information indicates a storage location (address) in the NVM 13 where the parameter is stored. Note that if the key length specified by the key length specifying unit 153 is not held in the preset parameter holding unit 151, a response (error response) indicating that there is no parameter to be used with the received key data is sent to the external terminal. 2.

[2. Operation of IC chip 1]
Next, the operation of the IC chip 1 will be explained with reference to FIG. FIG. 5 is a flowchart showing an example of processing in the IC chip 1. In the following operation example, it is assumed that the preset parameter holding unit 151 holds in advance a plurality of parameters that can be used for elliptic curve cryptographic operations and key lengths corresponding to each of the parameters.

The process shown in FIG. 5 is started when a write command (APDU) is received from the external terminal 2 (for example, an issuing device in a manufacturing factory of the IC chip 1). When the procedure shown in FIG. 5 is started, the IC chip 1 (command processing unit 152) acquires key data from the received write command (step S1). Next, the IC chip 1 (key length identification unit 153) identifies the key length of the key data acquired in step S1 (step S2). Next, the IC chip 1 (parameter specifying unit 154) selects a key length that matches the key length specified in step S2 from among the plurality of key lengths held by the preset parameter holding unit 151 (for example, table T0 or table T2). The key length is searched (step S3).

Next, the IC chip 1 (parameter specifying unit 154) determines whether or not there is a key length that matches the key length specified in step S2 as a result of the search in step S3 (step S4). If it is determined that there is no key length that matches the key length specified in step S2 (step S4: NO), the IC chip 1 (command processing unit 152) is used together with the key data acquired in step S1. A response (error response) indicating that there is no parameter is transmitted to the external terminal 2 (step S5). Note that instead of the error response, a response indicating that additional parameter settings are required after the writing of the key data is completed may be transmitted to the external terminal 2.

On the other hand, if it is determined that there is a key length that matches the key length specified in step S2 (step S4: YES), the IC chip 1 (parameter identification unit 154) A parameter corresponding to the key length is specified (step S6). Next, the IC chip 1 (key setting unit 155) sets the key data acquired in step S1 and the parameters specified in step S6 as key data and parameters used in the elliptic curve cryptographic operation (step S7). As a result, for example, a set of the key data and the parameter is written to the NVM 13. The key data and parameters set in this way are used, for example, when encrypting and decoding data in authentication processing for various transactions. Next, the IC chip 1 (command processing section 152) transmits a response indicating normal termination to the external terminal 2 (step S8).

As explained above, according to the above embodiment, the IC chip 1 holds in advance a plurality of parameters that can be used for elliptic curve cryptographic operations and key lengths corresponding to each of the parameters, and then When a write command including data is received, the key length of the received key data is specified, and multiple parameters and key lengths are stored in advance, and multiple The configuration is configured to identify the parameters used in the elliptic curve cryptographic operation from the parameters, and set the received key data and the identified parameters as the key data and parameters used in the elliptic curve cryptographic operation. It is possible to initialize the parameters used for more efficiently.

Note that in the above embodiments, the key data and parameters used for elliptic curve cryptographic operations may be set using an OTA (Over The Air) function. In this case, an issuance command including key data is transmitted from the OTA server to the mobile device equipped with the IC chip 1 by, for example, SMS (Short Message Service). Then, a write command (APDU) generated by performing protocol conversion of the issued command by the control unit of the mobile device is transmitted to the IC chip 1, and the processing shown in FIG. 5 is executed.

1 IC chip 2 External terminal 11 I/O circuit 12 RAM
13 NVM
14 ROM
15 CPU
151 Preset parameter holding section 152 Command processing section 153 Key length specifying section 154 Parameter specifying section 155 Key setting section

Claims (7)

An electronic information storage medium capable of performing elliptic curve cryptographic operations using key data and parameters,
holding means for holding a plurality of parameters and key lengths corresponding to each of the parameters;
a first identifying means for identifying the key length of the key data based on the key data received from the external device;
A step of specifying a parameter to be used in the elliptic curve cryptographic operation from the plurality of parameters based on the parameter and the key length held by the holding means and the key length specified by the first specifying means. 2 specific means;
Setting means for setting the received key data and the parameters specified by the second specifying means as key data and parameters used in the elliptic curve cryptographic operation;
An electronic information storage medium comprising: The method further includes response means for transmitting a response indicating that there is no parameter to be used with the received key data to the external device when the key length specified by the first specifying means is not held by the holding means. The electronic information storage medium according to claim 1, characterized in that: The holding means stores the parameters and the key lengths by storing in a nonvolatile memory of the electronic information storage medium a table that associates the plurality of parameters with key lengths corresponding to each of the parameters,
The second specifying means specifies from the table a key length that matches the key length specified by the first specifying means, and uses a parameter associated with the specified key length in the elliptic curve cryptographic operation. 3. The electronic information storage medium according to claim 1, wherein the electronic information storage medium is specified from the table as a parameter. The holding means stores a first table in which the plurality of parameters are associated with identifiers for each of the parameters, and a second table in which the identifiers are associated with key lengths corresponding to the respective identifiers on the electronic information storage medium. retaining the parameters and the key length by storing them in a non-volatile memory;
The second specifying means specifies from the second table a key length that matches the key length specified by the first specifying means, and specifies an identifier associated with the specified key length from the second table. 3. The electronic information storage medium according to claim 1, wherein a parameter associated with the specified identifier is specified from the first table as a parameter used in the elliptic curve cryptographic operation. 5. The electronic information storage medium according to claim 4, wherein the contents of the second table vary depending on the use of the electronic information storage medium. A key data setting method performed by an electronic information storage medium capable of performing elliptic curve cryptographic operations using key data and parameters, the method comprising:
holding a plurality of parameters and key lengths corresponding to each of the parameters;
identifying the key length of the key data based on the key data received from the external device;
identifying a parameter to be used in the elliptic curve cryptographic operation from the plurality of parameters based on the held parameter and key length, and the identified key length;
setting the received key data and the identified parameters as key data and parameters used in the elliptic curve cryptographic operation;
A key data setting method characterized by comprising: A computer included in an electronic information storage medium capable of executing elliptic curve cryptographic operations using key data and parameters,
holding means for holding a plurality of parameters and key lengths corresponding to each of the parameters;
a first identifying means for identifying the key length of the key data based on the key data received from the external device;
A step of specifying a parameter to be used in the elliptic curve cryptographic operation from the plurality of parameters based on the parameter and the key length held by the holding means and the key length specified by the first specifying means. 2 specific means;
A program that functions as a setting means for setting the received key data and the parameters specified by the second specifying means as key data and parameters used in the elliptic curve cryptographic operation.

Images