WO2006005685A1

WO2006005685A1 - Storage of keys of a public key algorithm in an integrated environment

Info

Publication number: WO2006005685A1
Application number: PCT/EP2005/053084
Authority: WO
Inventors: Charles Coulier; Olwehn Morvan
Original assignee: Gemplus
Priority date: 2004-07-12
Filing date: 2005-06-29
Publication date: 2006-01-19
Also published as: FR2872936A1; FR2872936B1

Abstract

The invention concerns a method for storing a key of a public key algorithm in a portable apparatus provided with a programme interpreter written in an object-oriented language, said method comprising the following steps: creating in the apparatus at least one container object (5), storing the elements of a private key (54, 72) and at least one element (53, 73) of an associated public key; creating in the apparatus at least one key object (3) not containing any element of the private key or of the associated public key; associating the key object with at least one method for accessing the stored elements in the container object. The invention enables the space occupied by the elements of the keys to be reduced.

Description

KEY STORAGE OF A PUBLIC KEY ALGORITHM IN

AN ENVIRONMENT ON BOARD

The invention relates to the storage of keys for public key algorithms and in particular the storage of keys in embedded environments, for example in smart cards.

Public key algorithms require the implementation of a public key and a private key. These keys are mathematically linked to form a pair. While the public key is intended to be released without any restriction, the private key must remain confidential to ensure the security of the algorithm. These keys are therefore generally compartmentalized quite strictly.

Some smart cards or portable devices embark a virtual machine for example JavaCard type (registered trademark), as well as applications using public key algorithms, such as RSA (encryption, electronic signature). For this type of virtual machine, it is imposed very strict exclusive access respectively between the public key and the private key. For example, a public key object contains elements n and e (module and public exponent). The methods associated with this key object allow the user to read its elements. A private key object contains either the elements d and n if the key is stored in the standard format (where d is the private exponent and n the module), or the elements p, q, dp, dq and iq if the key is stored at CRT format. In addition, a class called KeyPair taking the JavaCard example is intended to associate a public key and a private key and thus generate mathematically related pairs of keys.

The storage and use of such keys are problematic in embedded devices and in particular in smart cards.

The stored keys occupy a large space in the memory of the device, to the detriment of other applications. This occupied space can represent a relatively large proportion of the available memory. In addition, to meet the constraint of strict independence between public keys and private keys, the module is duplicated in each of these keys. By way of example, the module of an RSA key 2048 occupies at least 256 bytes.

Some methods of attack consist in forcing the smart card to generate erroneous signatures, for example by subjecting it to disturbances in the power supply. A mathematical exploitation of an erroneous signature allows determine private elements. Some cards implement verification algorithms of the generated electronic signature. In principle, verification of the signature should be done by means of the public exhibitor. However, because of the strict independence between the public and private keys, neither the public exhibitor nor the other public elements are stored in the private key object. The security level of the verification of the generated signatures is then not optimal.

There is therefore a need for a method of storing a key of a public key algorithm in a portable apparatus provided with a program interpreter written in an object-oriented language, comprising the steps of: - creating in the apparatus at least one container object (5) storing at least one element of a private key (54, 72) and at least one element (53, 73) of an associated public key;

- Create in the device at least one key object (3) containing no element of the private key and the associated public key; associating the key object with at least one access method for the elements stored in the container object.

According to one variant, the step of associating the key object with an access method consists in associating with the object, called the public key object, a method of access to only the elements of the public key stored in the object. container object. According to another variant, the step of associating the key object with an access method consists in associating with the object, called the private key object, a method of access to only those elements of the private key stored in the access object. container object.

It can then be provided that the method further comprises the steps of:

- Create in the device at least one other key object (3) containing no element of the private key or the associated public key;

associating the other key object, called the public key object, with at least one access method for only the elements of the public key stored in the container object.

According to another variant:

the private key and the public key are associated with an RSA encryption algorithm in standard mode;

the container object stores the elements n, e and d, n being the RSA module, e being the public exponent, and d being the private exponent; the access method associated with the private key object further provides access to n and d;

the access method associated with the public key object provides access only to the elements n and e. According to yet another variant:

the private key and the public key are associated with an RSA encryption algorithm in CRT mode;

the container object stores the elements n, e, p, q, dp, dq and iq, such that dp = d modulo (p-1), dq = d modulo (q-1) and iq = q ^"1 modulo p, n being the RSA module, p and q being the distinct prime numbers, n being the RSA module and e being the public exponent;

the access method associated with the private key object further provides access to p, q, dp, dq and iq;

the access method associated with the public key object provides access only to the elements n and e.

We can also predict that the portable device is controlled by an interpreter of the Java or Javacard type.

The invention also relates to a signature method in which the private key and the public key are associated with an RSA encryption algorithm, this method comprising the steps of the above storage methods and the following steps:

generate an electronic signature associated with the private key;

- read the public exponent e by a method associated with the container object;

- check the electronic signature generated by means of the public exhibitor e;

- provide the verified electronic signature on an output of the electronic device.

The invention also relates to a portable electronic device having a memory storing an application implementing a public key algorithm, a private key stored in the memory by any of the methods above, and a computing device capable of execute said application. According to one variant, the portable electronic device is a smart card. vs

Other features and advantages of the invention will emerge clearly from the description which is given below, by way of indication and in no way limitative, with reference to the appended drawings, in which:

FIG. 1 illustrates objects stored in a smart card according to a first variant of the invention;

FIG. 2 illustrates objects stored in a smart card according to a second variant of the invention.

The invention proposes to create an object associated with a key of a public key algorithm. This object does not contain any element of the public key or the private key. A container object is created to store the elements of the private key and certain elements of the public key. An access method is associated with the key object to access the items stored in the container object.

The storage of the different elements in the same container object makes it possible in particular to reduce the memory space occupied by these elements, because of the pooling of some of them (for example the module).

The invention applies to a portable digital device (not shown), which embeds at least one application using a public key algorithm. This device also embeds a program interpreter written in object-oriented language, such as Java or JavaCard (registered trademark). The interpreter and the application are for example stored in a non-volatile memory included in the portable digital device, such as an EEPROM. The apparatus is also provided with means for executing the public key application. Figure 1 illustrates a first variant of the invention. According to this variant, a "key pair" object 1 is first created in the non-volatile memory of the device. This object 1 has a header 11 and is associated with at least one method of generating a key pair by the field 14. This method is called and generates in a known manner a pair of keys mathematically related, including a public key and a private key. It is also conceivable that the keys are created beforehand and stored during loading into the device.

An object 2 is created for the public key and an object 3 is created for the private key. Object 1 has fields 12 and 13 each including a reference to respectively the public key object 2 and to the private key object 3. The objects 2 and 3 respectively have the headers 21 and 31. The key type objects 2 and 3 are stored in a nonvolatile memory of the device. Note that these objects 2 and 3 do not contain any element of the key pair created. The method of generating the key pair also includes the creation of a container object 5, common to the public key and the private key. The objects 2 and 3 respectively have fields 22 and 32 containing references to the container object 5. Within the methods of each key object, it is possible to access predefined elements of the container object 5. This container object 5 comprises a header 51 and all the elements distributed in several fields 52 to 54. The container object 5 is also stored in a non-volatile memory of the device. The elements of the key pair are not stored in the key objects but in the container object 5. Thus, access to an element in the container object 5 can be managed simply according to the methods associated with the key objects 2 and 3 The partitioning between the public key object and the private key object is thus achieved by the respective access methods of the objects 2 and 3 to the elements of the container object 5.

In the example of FIG. 1, the elements stored in the container object 5 are associated with a standard RSA algorithm. The public key object 2 is associated with a method for accessing the public elements of the container object 5. These elements are in this case n (the module) and e (the public exponent) and are stored respectively in the fields 52 and 53. The public key object 2 is also associated with a method for accessing the public elements of the container object 5. The public key object 2 is, however, not associated with a method of accessing the public object 2. a private element of the container object 5. Thus, no method associated with the public key object 2 provides access to the elements of the private key.

The private key object 3 is associated with a method of access only to the private elements of the container object 5. The field 54 contains the private elements (in this case d corresponding to the private exponent). No access method associated with the private key object can retrieve elements of the public key.

According to the variant illustrated in FIG. 2, the apparatus stores only a private key object 6 and no public key object. Object 6 has a header 61 and a field 62 containing a reference to the container object 7. The object 6 is associated with a method of access only to the private elements (p, q, dp, dq and iq).

The container object 7 comprises a header 71 and element fields 72 and 73. The field 72 comprises the private elements p, q, dp, dq and iq (elements for RSA encryption in CRT mode, with dp = d modulo (p-1), dq = d modulo (q-1) and iq = q ^'1 modulo p) and the field 73 includes the public element e.

In these two examples, the container object 5 or 7 can store a method of retrieving public elements and in particular the public exponent e. This method is made usable only by a verification function that uses the public exponent e to test the validity of signatures generated from private elements. An invalid signature will not be applied to the output of the electronic device. An attack by fault injection during the generation of the signature will therefore be inoperative.

This cryptographic verification function can be included without unduly increasing the space occupied in the non-volatile memory of the digital apparatus. Indeed, a single copy of the exponent e is accessible by an access method of the public key object and is usable by the verification function.

Claims

1. A method of storing a key of a public key algorithm in a portable device provided with a program interpreter written in an object-oriented language, characterized in that it comprises the steps of:

- Create in the device at least one container object (5), storing at least one element of a private key (54, 72) and at least one element (53, 73) of an associated public key;

- Create in the device at least one key object (3), said private key object, containing no element of the private key and the associated public key;

associating the private key object with at least one access method to only those elements of the private key stored in the container object;

- Create in the device at least one other key object (3), called public key object, containing no element of the private key or the associated public key; associating the public key object with at least one method of access to only the elements of the public key stored in the container object.

Storage method according to claim 1, characterized in that:

the container object stores the elements n, e and d, n being the RSA module, e being the public exponent, and d being the private exponent;

the access method associated with the private key object further provides access to n and d; the access method associated with the public key object provides access only to the elements n and e.

3. Storage method according to claim 1, characterized in that:

the container object stores the elements n, e, p, q, dp, dq and iq, such that dp≈ d modulo (p-1), dq = d modulo (q-1) and iq = q ^"1 modulo p, n being the RSA module, p and q being the distinct prime numbers, n being the RSA module and e being the public exponent;

the access method associated with the private key object further provides access to p, q, dp, dq and iq; the access method associated with the public key object provides access only to the elements n and e.

4. Storage method according to any one of the preceding claims, characterized in that the portable device is controlled by an interpreter of Java or Javacard type.

5. Signature method in which the private key and the public key are associated with an RSA encryption algorithm, this method comprising the steps of the storage method according to any one of the preceding claims and the following steps:

generate an electronic signature associated with the private key;

- read the public exponent e by a method associated with the container object;

- check the electronic signature generated by means of the public exhibitor e;

6. Portable electronic device, characterized in that it has a memory storing an application implementing a public key algorithm, a private key stored in the memory by the method according to any one of claims 1 to 5 and an organ calculation capable of executing said application.

7. Portable electronic device according to claim 6, characterized in that it is a smart card.