WO2003025739A1

WO2003025739A1 - Secure method for using a cryptographic algorithm and corresponding component

Info

Publication number: WO2003025739A1
Application number: PCT/FR2002/002963
Authority: WO
Inventors: Marc Joye; Karine Villegas
Original assignee: Gemplus
Priority date: 2001-09-07
Filing date: 2002-08-29
Publication date: 2003-03-27
Also published as: FR2829646A1; FR2829646B1

Abstract

The invention concerns a method which consists in storing several exponentiation computation algorithms in the electronic component prior to the first computation of yd, and in carrying out the following steps at each computation of the value yd: a) breaking down the number d into n blocks D¿i? of ri bits, n and ri being random integers, and in considering among the stored exponentiation computation algorithms, a chain of n algorithms Ai, b) using an algorithm A0 and from the r0 first bits of d and of y, calculating (I) and storing the result S?0¿; c) using an algorithm A¿j? and from the following rj bits of d, a function of S0 and/or of Sj-1, and of y, calculating (II) and storing the result Sj, the result yd corresponding to the obtained value of Sn-1.

Description

_P R _O C _EDE S CU _RI S _E OF IMPLEMENTING A CRYPTOGRAPHY ALGORITHM AND CORRESPONDING COMPONENT

The present invention relates to a secure method of implementing, in an electronic component, a cryptography algorithm using the calculation of exponentiation to the power d of a number y. The invention also relates to the corresponding electronic component.

Such components are used in applications where access to services or data is strictly controlled. They have an architecture 10 formed around a microprocessor and memories, including a program memory of type ROM ("Read Only Memory" in English) which contains the secret number (s) d.

These components are used in computer systems, embedded or not; they are used in particular in smart cards, for certain applications thereof. These are, for example, applications for accessing certain databases, banking applications, electronic toll applications, for example for television, petrol distribution or even the passage of motorway tolls.

These components or these cards therefore implement a cryptography algorithm to ensure the encryption of transmitted data and / or the decryption of received data when these must remain

25 confidential.

Generally and succinctly, these cryptographic algorithms have in particular the function of encryption or digital signature of a message applied as input (to the card) by a host system (server, bank distributor, etc.) and many secrets contained in the card, and to provide this encrypted or signed message in return to the host system, which allows for example host system to authenticate the component or card, to exchange data, ....

The characteristics of cryptography algorithms are known: calculations performed, parameters used. The only unknown is the secret number (s) contained in program memory. All the security of these cryptographic algorithms lies in this secret number (s) contained in the card and unknown to the world outside this card. This secret number cannot be deduced from the mere knowledge of the message applied as input and of the encrypted message supplied in return.

However, it appeared that external attacks based on measurable physical quantities outside the computing device when the latter is in the process of rolling out the cryptography algorithm, allow malicious third parties to find the number (s) (s) secret (s) contained in this card. These attacks are called "side channel attacks"; we distinguish among these hidden channel attacks, SPA attacks acronym for Single Power Attack and DPA attacks, acronym for Differential Power Analysis.

The principle of these hidden channel attacks is based, for example, on the fact that the current consumption of the microprocessor executing instructions varies according to the instruction or the data handled. In particular, when an instruction executed by the microprocessor requires manipulation of a data item or of a bit-by-bit instruction, there are two different current profiles depending on whether this bit is equal to "1" or "0". Typically, if the microprocessor handles a "0", at this instant of execution a first amplitude of the current consumed and if the microprocessor manipulates a "1", there is a second amplitude of the current consumed, different from the first. Thus, the hidden channel attacks exploit in this case the difference in the current consumption profile in the card during the execution of an instruction according to the value of the bit handled. For a more detailed description of hidden channel attacks, see Paul Kocher's publication "Advances in Cryptology-CRYPTO '99", vol. 1666 of Lectures Notes in Computer Science, pp 388-397, Springer Verlag 1999.

This type of attack is notably possible with the RSA algorithm named after its authors (Rivest, Shamir and Adleman), on which many cryptographic algorithms are based. The security of the RSA algorithm is based on the difficulty of factoring large numbers. These algorithms notably use exponentiation calculations with the power d, d being a secret number.

We briefly recall the main steps of the RSA algorithm.

We establish a number N which is the product of two prime numbers p and q (N = pq), as well as an exponent public or public key e and a private exponent or private or secret key d, satisfying the relation: ed = 1 (modulo λ (N)), λ (.) being the function of Carmichael. According to a first mode of operation of the so-called classic RSA algorithm, the public parameters are (N, e) and the private parameters are (N, d). Given x included in the interval] 0, N [, the public operation on x which can be for example the encryption of the message x or even the verification of the signature x, consists in calculating: y = x ^e modulo N L 'corresponding private operation which can be for example the decryption of the encrypted message y or the generation of a signature x, is then: x = y ^d modulo N Another mode of operation known as CRT mode because based on the theorem of Chinese remains ( "Chinese Remainder Theorem" (CRT in English) is four times faster than that of the classic RSA algorithm. According to this RSA CRT mode, we do not perform the modulo N calculations directly but we first perform the modulo p and modulo q calculations.

The public parameters are (N, e) but the private parameters are (p, q, d) or (p, q, d _p , d _q , i _q ) with dp = d modulo (p-1), d _q = d modulo (q-1) and i _q = q ^-1 modulo p. The public operation is carried out in the same way as for the classic operating mode; on the other hand, for the private operation, we first calculate: x = y "rnodp and = y ^q modq Then, by applying the Chinese remains theorem, oinn oobbttiieenntt xx == yy ^d mmoodd NN ppaarr x = x _q + qti _q (Xp-x _q ) modulo p]

Thus by measuring the current consumption of the card for example, during these exponentiation calculations to the power of a fraudster can deduce the series of bits making up the key d from multiple measurements.

The countermeasure methods for warding off this type of attack consist in not directly handling the secret key d.

According to a first countermeasure, we decompose d into the following form d = (d + a) -a and we then calculate y ^{(d + a)} then y ^{~ a} . But a and d being of the same order of magnitude, the computation time is then doubled.

Another countermeasure only usable in CRT mode and described in WO patent n ° 9935782 consists in expressing the private exponent d _p in the following random form: d _p * = d _p + r. (p-1), r being a random number.

However, this countermeasure cannot be applied to the classic RSA mode.

A third countermeasure consists in representing the exponent d by an addition chain. For example, a possible addition string of the number 10 is

(1,2,3,5,8,10). To calculate y ¹⁰ , we calculate Rl = yy = y ² then R2 = Rl.y = y ² .y = y ³ then R3 = R2.Rl = y ³ . y ² = y ⁵ then

R4 = R3.R2 = y ⁵ .y ³ and finally R5 = R4.Rl = y ⁸ . y ² = y ¹⁰ . Of course in reality the secret key d is a much larger number, 512 bits or more. For a more detailed description of the representations of a number by addition chains, see the publication by C. Clavier and

M. Joye CHESS'01 "Universal exponentiation algorithm: a first step to ard provable SPA resistance".

In this case of countermeasure, the size of the data to be kept in memory, in this case the addition chain, is doubled.

The aim of the present invention is therefore to protect the secret number d from hidden channel attacks occurring when d is used in exponentiation calculations, without however being penalized in terms of calculation time, memory location or still limited in the choice of the cryptography algorithm.

The subject of the invention is a secure method of implementing, in an electronic component, a cryptography algorithm using calculation means intended to perform exponentiation operations with the power d of a number y (y ^d ), d being an integer of determined size, characterized in that several exponentiation calculation algorithms are stored in said electronic component prior to the first calculation of the value y ^d , and in that it consists in carrying out the steps following each calculation of the value y ^d : a) the number d is broken down into n blocks Di of ri bits, i varying from 0 to n-1, n and the r ± being random integers, l <n <= size of d, r ₀ + ... + r _n -ι = size of d and we consider among the calculation algorithms of stored exponentiation, a chain of n algorithms Ai, b) by means of an algorithm A ₀ and from the first ro bits of d and y, the calculation

S ₀ = y ^D °

and the result S ₀ is memorized, c) it is carried out by means of an algorithm A _j and from the following r _j bits of d, a function of So and / or ... and / or of S _j _ι , and from y, j varying from 1 to n-1, the calculation

S. = y ^D ^

and the result S _{j is} stored, the result of y ^d corresponding to the value S _n -ι obtained. According to a characteristic of the invention, among the chain of n algorithms Ai, some of said algorithms are identical.

The chain of n algorithms Ai i varying from 0 to n-1, is preferably established randomly.

The chain of n algorithms Ai i varying from 0 to n- 1, can be predetermined.

According to one embodiment of the invention, the cryptography algorithm is of the classic RSA type or in CRT mode.

The invention also relates to an electronic security component, comprising calculation means, a program memory and a working memory and data communication means, characterized in that it implements the method of countermeasure according to any one of the preceding claims, and in that it comprises a generator of random numbers and in that the program memory comprises several algorithms for calculating exponentiation.

The invention also relates to a smart card comprising an electronic component as described above.

Other features and advantages of the invention will appear clearly on reading the description given by way of nonlimiting example and with reference to the appended FIG. 1 which schematically represents the elements of a smart card capable of being implemented. the invention.

The embodiments are described in the context of smart cards, but can of course be applied to any other electronic security device or component provided with cryptographic calculation means. As shown in FIG. 1, the smart card 1 comprises a microprocessor 2 coupled to a fixed memory (ROM) 3 and to a random access memory (RAM) 4, the whole forming an assembly allowing, inter alia, the execution of 'cryptographic algorithms. More precisely, the microprocessor 2 comprises the arithmetic calculation means necessary for the algorithm, as well as data transfer circuits with the memories 3 and 4. The frozen memory 3 contains the executable program of the cryptographic algorithm in the form of code source, while RAM 4 includes registers which can be updated for the storage of calculation results.

The smart card 1 also includes a communication interface 5 connected to the microprocessor 2 to allow the exchange of data with the external environment. The communication interface 5 can be of the "contact" type, being in this case formed by a set of contact pads intended to connect to a contactor of an external device, such as a card reader, and / or of the "contactless" type. In the latter case, the communication interface 5 comprises an antenna and over-the-air communication circuits allowing data transfer by wireless link. This link can also allow a transfer of power supply to the circuits of card 1.

The method according to the invention consists in calculating y ^d by means of a chain of n exponentiation algorithms applied to n blocks of bits of d. The expression exponentiation calculation algorithm is understood to mean a series of instructions allowing this calculation to be carried out; as we will see later in an example, there are several possible algorithms.

This chain of n exponentiation algorithms Ai (i varying from 0 to n-1) is established from several exponentiation algorithms that are stored before the first calculation of y ^d . The algorithms A are not necessarily all different: some may be identical. Each time the value y ^{d is} calculated, for example each time the private operation is carried out described above for the RSA algorithm, the key d comprising K bits (the size of d is K) is cut as shown below, into n blocks O ± (i varies from 0 to n- 1) of ri bits (0 or 1), n and r ± being random integers, l <n <= K generated for example by the smart card by means of a generator 6 of random numbers represented in FIG. 1:

d = d _k d _j do (binary representation of d)

To ... r, ... r _n _ι (number of bits of each block D)

with D ₀ = ro first bits of d, Dι = rχ bits following those of block D ₀ ,

Di = ri bits following those of blocks D ₀ II ... II Di_ι,

D _n _ι = r _n _ι last bits of d, with d = D ₀ II ... IID _n _ι, the symbol II meaning concatenated.

The following Di blocks are contiguous. The key d is read from left to. right; you can of course just as well read it from right to left. Similarly, you can read the bits of a block from left to right and those of another block from right to left.

We then perform the exponentiation calculation y using the chain of n algorithms: - we calculate using an algorithm o the exponentiation calculation of y from the first r ₀ bits of d and y to obtain S ₀ that we memorize:

S ₀ = y ^D ° we calculate by means of an algorithm Ai the computation of exponentiation of y from the following ri bits of d, of a function of So and of y to obtain Si which we memorize:

S ₁ = y ^{Do | Dl}

- the computation of exponentiation of y is calculated using an algorithm Ai from the following ri bits of d, of a function of So and / or of Si and / or ..., and / or of Si_ι, and from y to obtain If that one memorizes:

- the computation of exponentiation of y is calculated using an algorithm A _n -ι from the r _n _ι last bits of d, of a function of S ₀ and / or of Si and / or ..., and / or of S _n _ ₂ , and of y to obtain S _n -ι, the desired result, which is stored:

According to the algorithm A implemented, the calculation of S 1 is carried out in particular from a function of the result Si_ι of the previous algorithm without using the entire chain S ₀ , ..., Si_ ₂ of the previous results ( or a function of the previous results), or from some of these results (or a function of these results).

Furthermore, the algorithm chain is preferably determined randomly for each calculation of y ^d ; however, it can be predetermined.

This method thus makes it possible to protect oneself in the case of the implementation of a cryptography algorithm based on an exponentiation calculation of the type y ^d .

Indeed, the hidden channel attacks which are carried out after multiple measurements, consist initially, during a learning phase, of identifying the exponentiation algorithm used. To do this, the fraudster relaunches the algorithm by changing the key. Knowing this algorithm, he can then identify the bits of the real key d.

According to the invention, the calculation of y ^d is not carried out in the same way once on the other: the decomposition of d into blocks D is determined randomly once on the other because the number n of blocks and their size ri are random integers, the exponentiation calculation algorithms differ from each other (even if some are identical, there are at least two that differ) and possibly, the chain of algorithms Exponentiation also varies randomly from one calculation of y ^d to another.

It thus becomes much more difficult if not impossible to identify the exponentiation algorithm used and therefore to determine the secret exponent. We will now illustrate the method previously described by the following example which consists in carrying out the following modular exponentiation calculation: y ^d modulo p, d being a key of k bits and p being a prime number.

We break the key d into 2 blocks (n = 2), a block D ₀ of kr bits and a block Di of r bits

The calculation "y ^d modulo p" will therefore be carried out by means of two algorithms A ₀ and i making it possible to obtain S ₀ and Si respectively with Sι = y ^d modulo p.

The algorithm chosen for Ao is the "Square and Always Multiply" algorithm which ^" consists of squaring and multiplying in all cases. It is, for exponents of the same size, a constant time algorithm and with constant code, that is to say which always executes the same instructions, whatever the value of the manipulated exponent; it does not include test instructions which can give information on the value manipulated. constant time and constant code algorithm is very secure but it is costly in computation time because it sometimes performs unnecessary operations. The algorithm chosen for Ai is the "Square and Multiply" algorithm which consists in squaring and This is not a constant-time algorithm, nor a constant-code algorithm, unless you artificially add an instruction as we will see below. It is therefore an algorithm that is less secure than the previous one but faster .

We therefore first calculate So by means of Ao from 1, y, the first kr bits of d and p according to the following sequence of instructions: RO≈l

For i = kl to r in steps of (-1) R1 = R0 ² modulo p R0 = Rl * y R0 = R [complement of di]

End For S ₀ = R0

Recall that if di = 0, the complement of di is 1 and R [complement of di] = Rl, and that if d = l, the complement of di is 0 and R [complement of di] = R0.

We then continue with the calculation of Si (that is to say y ^d modulo p) by means of Ai from So, y, of the following r bits of d and of p according to the following sequence of instructions: R0 = S ₀

For i = rl to 0 in steps of (-1) R1 = R0 ² if di = l then R0 = Rl * y modulo p otherwise R0 = R1 End For Sι = R0

For the algorithm Al to be of constant code, it suffices to replace the instruction R0 = R1 by: R0 = R1 * 1 modulo p.

The invention is valid for cryptographic algorithms using exponentiation calculations such as for example the modular exponentiation calculation (y ^d modulo p) in the case of the RSA type algorithm or even the exponentiation calculation on a curve elliptical where it is customary to write the exponentiation additively. Exponentiation is then called scalar multiplication: y ^b = y * ... * y (b times) becomes b * y = y + ... + y (b times).

Claims

1. Secure method of "implementing, in an electronic component, ^" a cryptography algorithm using calculation means intended to perform exponentiation operations with the power d of a number y (y ^d ), d being an integer of determined size, characterized in that several exponentiation calculation algorithms are stored in said electronic component prior to the first calculation of the value y ^d , and in that it consists in carrying out the following steps at each calculation of the value y ^d : a) the number d is broken down into n blocks Di of ri bits, i varying from 0 to n-1, n and the x ± being random integers, Kn <= size of d, ro +. .. + r _n _ι = size of d and we consider among the stored exponentiation calculation algorithms, a chain of n algorithms i, b) we perform by means of an algorithm A ₀ and from the first ro bits of d and y, the calculation

^& o - y

and the result So is memorized, c) is carried out by means of an algorithm Aj and from the following rj bits of d, a function of S ₀ and / or ... and / or of S _j _ι, and from y, j varying from 1 to n-1, the calculation s, -y

and the result S _{j is} stored, the result of y ^d corresponding to the value S _n _ι obtained.

2. Method according to the preceding claim, characterized in that among the chain of n algorithms Ai, some of said algorithms are identical.

3. Method according to any one of the preceding claims, characterized in that the chain of n algorithms i i varying from 0 to n-1, is established randomly.

4. Method according to any one of claims 1 to 2, characterized in that the chain of n algorithms i i varying from 0 to n-1, is predetermined.

5. Method according to any one of the preceding claims, characterized in that the cryptography algorithm is of the RSA type.

6. Method according to the preceding claim, characterized in that the RSA type algorithm is of the CRT type.

7. Electronic security component, comprising calculation means (2), a program memory (3) and a working memory (4) and means for data communication (5), characterized in that it implements the countermeasure method according to any one of the preceding claims, and in that it comprises a generator (6) of random numbers and in that the program memory (3) includes several algorithms for calculating exponentiation.

8. Smart card comprising an electronic component according to the preceding claim.