WO2015170057A1

WO2015170057A1 - Electronic entity and method for generating a session key

Info

Publication number: WO2015170057A1
Application number: PCT/FR2015/051207
Authority: WO
Inventors: Jean-Philippe Vallieres; Florian GALDO
Original assignee: Oberthur Technologies
Priority date: 2014-05-09
Filing date: 2015-05-06
Publication date: 2015-11-12
Also published as: EP3140951A1; FR3020909B1; FR3020909A1

Abstract

The invention relates to a method for generating a session key (SK) for a secure data exchange between a first electronic entity (H) and a second electronic entity (C), characterised by the following steps: determining (E2), by means of the first electronic entity (H), a first verification word (PR_M); transmitting (E4) the first verification word (PR_M) from the first electronic entity (H) to the second electronic entity (C); incrementing (E14) a counter (SQC), by means of the second electronic entity (C), only when the first verification word (PR_M) is identical to a second verification word (PR_M*); generating (E18) a session key (SK), by means of the electronic entity (C), on the basis of the value of the counter (SQC). The invention also provides an electronic entity (C) designed such as to exchange data with another electronic entity (H).

Description

Electronic entity and method of generating session key

TECHNICAL FIELD TO WHICH THE INVENTION RELATES The present invention relates to the exchange of data between electronic entities.

It relates more particularly to an electronic entity and a method of generating a session key.

The invention applies particularly advantageously in the case where a session key is generated by the electronic entities on the basis of a pseudo-random value, such as the value of a counter of one of the electronic entities.

BACKGROUND

It is known to use session keys to secure the exchange of data between two electronic entities. These session keys are for example derived from a cryptographic key known only from the two electronic entities. So that these keys are different for each exchange session between the two electronic entities, it is expected that they are further calculated on the basis of random values generated by the electronic entities.

Note that these random values can also be used, during a mutual authentication process, as a challenge (or "challenge" according to the Anglo-Saxon name) transmitted from one electronic entity to the other electronic entity so that the latter proves its knowledge of a shared secret (generally a cryptographic key, for example one of the session keys) by returning in response the result of a calculation combining the shared secret and the random value received.

In this case, the use of random values generated respectively in each of the two electronic entities makes it necessary to exchange bidirectional data to complete the process of mutual authentication and generation of session keys (since each entity must receive the random value generated by the other entity).

To avoid this and thus allow the implementation of such processes without having to wait for an immediate return of one of the electronic entities (hereinafter called "slave"), it has been planned to use, in place of the value random generated by this electronic entity, a so-called "pseudo-random" value, based for example on the value of a counter of this electronic entity.

The other electronic entity (hereinafter referred to as the "master" or "host"), which is also aware of the value of the counter, can thus prepare in advance the data to be sent (typically in the form of commands to the user). slave electronic entity), by encrypting this data by means of the session key obtained in particular according to the value of the counter, and transmitting them in batches.

This technique is used for example for the personalization of secure electronic entities (such as microcircuit cards or secure integrated circuits) but can also be used in other contexts.

Processes as presented above are described in particular in the technical specification "GlobalPIatform Card Technology - Secure Channel Protocol 03 - Card Specification v 2.2 Amendment D", version 1 .1, September 2009.

As indicated in this document, in order to use a "pseudo-random" value each time different, the counter of the slave electronic entity is incremented as soon as the opening of a new session is requested by the master electronic entity and when a mutual authentication procedure must be initiated (INITIALIZE UPDATE command).

Because the logon request is earlier than the mutual authentication procedure, it can not be guaranteed that it does not come from a malicious third party. In such a case, even if the attempt of the malicious third party is doomed to failure since it will not be able to authenticate itself, the request of logon leads to the incrementation of the counter (necessary to the implementation of the process mutual authentication), unexpected increment for the master electronic entity.

The intrusion of the malicious third party thus causes the desynchronization of the electronic entities, which will make impossible future secure exchanges between them since at each session, the pseudo-random value generated by the electronic entity slave on the basis of the current value of the counter will not be the one expected by the master electronic entity (generated on the basis of a different value of the counter). OBJECT OF THE INVENTION

In this context, the present invention proposes an electronic entity designed to exchange data with another electronic entity, characterized in that it comprises means for receiving a first verification word from the other electronic entity, means for determining a second verification word, means for incrementing a counter of the electronic entity only in case of equality between the first verification word and the second verification word and means for generating a session key according to the value of the counter .

Thus, the counter is incremented only when the electronic entity has been able to verify the value of the verification word received from the other electronic entity, which makes it possible to ensure that the latter is the expected partner of the entity. and not a malicious third party.

In practice, and particularly in the embodiments described below, the second verification word is determined as a function of a counter value of the electronic entity. This ensures that the other electronic entity is aware of this counter value and can successfully complete the next steps of the mutual authentication process.

According to one implementation possibility, it can be provided that the electronic entity comprises a rewritable non-volatile memory designed to store the second verification word.

In this context, the electronic entity may comprise means for comparing the first verification word and the second verification word stored in the rewritable non-volatile memory; the means for incrementing the counter are then for example designed to increment the counter in case of a positive comparison by the comparison means. Since the second verification word is read in the rewritable non-volatile memory (where it has for example been stored in a previous session as indicated below), it avoids the implementation of the determination of the second word of verification at the time of comparison with the first verification word received.

It can further be provided that the means for generating the session key are designed to generate the session key according to the first word verification, as explained in the following description.

The means for generating the session key may be designed to generate the session key, during a session, before incrementing the counter by the means for incrementing the counter, as is the case for example for the channel protocol secure SCP02.

Alternatively, the means for generating the session key may be designed to generate the session key, during a session, after incrementing the counter by the means for incrementing the counter, as is the case for example for the secure channel protocol SCP03.

The invention also proposes a method for generating a session key for a secure exchange of data between a first electronic entity and a second electronic entity, characterized by the following steps:

determination by the first electronic entity of a first verification word;

transmitting the first verification word of the first electronic entity to the second electronic entity;

- incrementation of a counter by the second electronic entity only in case of equality between the first verification word and a second verification word;

- generation of a session key by the electronic entity according to the value of the counter.

As already indicated, the first verification word, such as the second verification word, can be determined according to a counter value of the electronic entity.

We can also provide a reading step in a rewritable non-volatile memory, the second verification word. The method may in fact comprise, during a previous session, a step of determining the second verification word and a step of storing the second verification word determined in the rewritable non-volatile memory.

In practice, the method comprises for example the following steps:

generation by the first electronic entity of a random value;

transmitting the random value of the first electronic entity to the second electronic entity; generating the session key according to a challenge of the first electronic entity, formed by the concatenation of the random value and the first verification word, and a challenge of the second electronic entity determined according to the value. counter.

DETAILED DESCRIPTION OF AN EXEMPLARY EMBODIMENT

The following description with reference to the accompanying drawings, given as non-limiting examples, will make it clear what the invention consists of and how it can be achieved.

In the accompanying drawings:

FIG. 1 represents the main steps of a first example of data exchange between a first electronic entity and a second electronic entity in accordance with the teachings of the invention;

FIG. 2 represents the main steps of a second example of data exchange between a first electronic entity and a second electronic entity in accordance with the teachings of the invention;

FIG. 3 presents a first example of a method for determining a pseudo-random word; and

FIG. 4 presents a second example of a method for determining a pseudo-random word.

FIG. 1 represents a first example of data exchange between a first electronic entity and a second electronic entity in accordance with the teachings of the invention.

Each of the first and second electronic entities comprises a communication interface by means of which the relevant electronic entity can transmit and / or receive data on a communication medium, where the data is represented by signals, for example electrical signals or optics.

The first electronic entity and the second electronic entity can thus exchange data either directly (their respective communication interfaces being connected to one another) or via one or more other electronic entities (for example computers), possibly connected to each other and to the first and second electronic entities by means of a computer network.

Each of the first and second electronic entities is for example an electronic device which comprises, in addition to the communication interface mentioned above, a processor and at least one memory capable of storing the data received and manipulated by the electronic entity. This memory also stores computer program instructions which, when executed, enable the electronic entity to implement the methods described below. As a variant, at least one of the electronic entities could be implemented in the form of a specific application integrated circuit (or ASIC according to the English acronym).

In the following example, the first electronic entity is a terminal H and the second electronic entity is a microcircuit card C (or ICC for "Integrated Circuit Card"). The invention however applies to other types of electronic entities. In particular, the first entity could be a remote server connected to the second electronic entity through a wireless connection, or a server directly connected to the second entity through a wired connection. For example, the second electronic entity may be a secure integrated circuit (or SE for "Secure Element"), an eSE ("embedded secure element" for embedded security element) or an eUICC ("embedded Universal Integrated Circuit Card" for universal and embedded IC card). A secure element includes a processor of its own, different from the processor of the host electronic device in which it is embedded or embedded, and includes a non-volatile memory for storing computer programs executable by the processor. The secure element is, for example, in accordance with ISO / IEC 7816 standards, Common Criteria standards and / or GlobalPIatform Card Specification v 2.2.1.

We now describe the launching phase of a mutual authentication process between the two electronic entities, at the initiative of the H terminal that here plays the role of master or host electronic entity.

During a step E2, the terminal H generates a host challenge HCH formed of a random word RAND (length M bytes), obtained by random draw within the terminal H, and a pseudo-random word PRM (length N bytes) determined in particular according to the current value of a counter managed by the microcircuit card C, as explained below. As will emerge from the description which follows, the value of the counter is known by the terminal H thanks to the preceding exchanges or, in the case of a first exchange, to the value zero or has a value predetermined shared by both entities. It may optionally be provided in addition that the terminal H can issue a command (for example of the GET DATA type) in order to obtain in response (from the microcircuit card C) the current value of the counter.

Examples of processes for determining the pseudo-random word PRM are described below with reference to FIGS. 3 and 4.

In practice, the host challenge is, for example, the concatenation of the random word RAND of length M bytes (with here M = 3) and the pseudo-random word PRM of length N bytes (with here N = 5); in particular, these lengths M, N may be such that M + N = 8 so that the host challenge is a word of 8 bytes. The size of the 8-byte host challenge should not be considered as a limiting example. Alternatively, no random word RAND is used, and in this case, M = 0 and N = 8.

The terminal H then transmits (step E4) to the card C an initialization command of the mutual authentication process, for example a command of the type INITALIZE UPDATE, accompanied by the host challenge HCH.

As already indicated, this command can be transmitted directly from the terminal H to the microcircuit card C (the communication interfaces being for example respectively a card reader equipping the terminal H and the contacts of the microcircuit card C), or by intermediary of one or more other electronic entities.

Card C receives the initialization command and the HCH host challenge at step E6. The card C can thus extract the pseudo-random word received PRM.

During a step E8, the microcircuit card C generates on its side a pseudo-random word PRM ^* using the same process and the same data (in particular the current value of the counter managed by the microcircuit card C) that during the determination of the pseudo-random word carried out in step E2 by the terminal H.

The microcircuit card then compares in step E10 the received pseudo-random word PRM and the calculated pseudo-random word PRM * -

In case of equality (which should be the case in normal operation since the two words are calculated with the same processes and from the same data), the operation continues in step E14 described below.

If there is a difference between the pseudo-random word received PRM and the word pseudo-randomly calculated PRM ^* , the emitter of the initialization command (possibly a malicious third party) does not have a correct knowledge of the data used for the generation of the pseudo-random word PRM and will therefore probably not be able to authenticate correctly. In this case, the mutual authentication process (step E12) is therefore terminated without having incremented the counter. The microcircuit card C may optionally in this case return to the terminal H an error value or failure of the initialization of the mutual authentication process.

Thus, if the initialization command comes from a malicious third party, as is generally the case when a difference is detected in step E10, the counter will not be incremented and the two electronic entities (terminal H and card C) will remain synchronized.

When the verification of step E10 is positive (equality between the received pseudo-random word PRM and the calculated pseudo-random word PRM ^* ), the counter is incremented in step E14. A new counter value must be used to generate new session keys as explained below.

Step E14 is followed by step E16 at which a pseudo-random value CCH is generated (for example by means of a key derivation process) as a function, in particular, of the current value of the counter (value after incrementation of the step E14), as well as possibly other data (eg a cryptographic key stored in the microcircuit card). The generation of the pseudo-random value CCH is for example carried out in accordance with the section "6.2.2.1 Card Challenge" in the document "GlobalPIatform Card Technology - Secure Channel Protocol 03 - Card Specification v 2.2 Amendment D" already mentioned. .

It is furthermore provided that the pseudo-random value CCH is used as a challenge of the card to the terminal H (see below the transmission step E30).

We then proceed to step E18 at which the microcircuit card generates different session keys SK. For example, each session key SK is generated, by means of a key derivation process, on the basis of a cryptographic key (called static key) K memorized in the microcircuit card C, of the host challenge HCH (received in step E6) and the pseudo-random value CCH (generated at step E16). For example, the generation of the session keys SK is performed in accordance with the "6.2.1 AES Session Keys" clause in the "GlobalPIatform Card Technology - Secure Channel Protocol 03 - Card Specification v 2.2 Amendment D" document already mentioned. The session keys are similarly generated by the terminal H. They are intended to be used as secret keys for symmetric encryption of the data to be exchanged during the session initiated by the mutual authentication process described here.

The microcircuit card C then determines in step E20 the authentication cryptogram of the card CAC, by means of a key derivation process, on the basis of one of the session keys SK, of the challenge of host HCH (received in step E6) and the pseudo-random value CCH (generated in step E16). The identification of the authentication cryptogram of the CAC card is, for example, carried out in accordance with the section "6.2.2.2 Card Authentication Cryptogram" in the "GlobalPIatform Card Technology - Secure Channel Protocol 03 - Card Specification v 2.2 Amendment D" document. "already mentioned.

The microcircuit card C then emits in step E22 its response to the initialization command (see steps E4 and E6 above), which includes the pseudo-random value CCH determined in step E16 (challenge of the card), the CAC cryptogram determined in step E20 and the current value of the SQC counter.

The terminal H receives this response in step E24, which completes the initialization phase of the mutual authentication process; the mutual authentication process can then continue, for example by sending an EXTERNAL AUTHENTICATE command.

This authentication process includes the verification, by the terminal H, the CAC cryptogram received in step E22. To do this, the terminal H determines on its side the cryptogram of the card (by means of the same process and the same data as those used by the microcircuit card C in step E20) and compares the cryptogram thus determined to the cryptogram CAC received in step E22.

FIG. 2 represents a second example of data exchange between a first electronic entity and a second electronic entity according to to the teachings of the invention. These electronic entities are for example of the same type as that envisaged above with reference to FIG. In this embodiment, the at least one second electronic entity (here a microcircuit card C) is equipped with a random access memory and a non-volatile rewritable memory, in each of which the processor of the second electronic entity can read or write data.

As for FIG. 1, the steps of FIG. 2 correspond to the launch phase of a mutual authentication process between the two electronic entities, at the initiative of the terminal H, which here acts as the master electronic entity or host.

During a step E102, the terminal H generates a host challenge HCH formed of a random word RAND, obtained by random draw within the terminal H, and a pseudo-random word PRM determined in particular according to the previous value (at the index i-1, that is to say immediately before the current value of index i) of a counter managed by the microcircuit card C, as explained below. This step may possibly be carried out at the beginning of the previous session of exchanges between the terminal H and the microcircuit card C; indeed, at the beginning of the previous session (before incrementing the counter during the previous session, to the index i-1), the counter managed by the microcircuit card C presented this previous value, immediately prior to the value that present the counter at the beginning of the current session (at index i).

As already indicated, examples of the PRM pseudo-random word determination process based on a counter value are described later with reference to FIGS. 3 and 4.

To initiate the mutual authentication process, the terminal H transmits during a step E104 an initialization command of the mutual authentication process to the card C, for example a command of the type INITALIZE UPDATE, accompanied by the challenge of host HCH.

The microcircuit card C receives the initialization command and the HCH host challenge at the step E106 and can therefore extract the received pseudo-random word PRM-

The step E106 is followed by the step E108, during which the processor of the microcircuit card C reads in the non-volatile memory of the microcircuit card C the pseudo-random word PRM ^* stored in this non-volatile memory. volatile during the previous session of exchanges between the terminal H and the microcircuit card C, as explained below for the current exchange session (see steps E1 14 and E1 16).

When it comes to the first session, the counter value is zero or has a predetermined value.

The microcircuit card C (in practice its processor) then compares in step E1 10 the pseudo-random word PRM received in step E106 and the pseudo-random word PRM ^* read in the non-volatile memory in step E108.

In case of equality (which should be the case in normal operation since the two words are calculated with the same processes and from the same data as explained below), the operation continues in step E1 14 described more low.

If there is a difference between the pseudo-random word received PRM and the pseudo-random word PRM ^* , the issuer of the initialization command (possibly a malicious third party) does not have a correct knowledge of the data used for the generation the pseudo-random word PR _M and will therefore probably not be able to authenticate correctly. In this case, the mutual authentication process (step E1 12) is therefore terminated without having incremented the counter.

Note that, according to the present embodiment, the step of generating the pseudo-random word PRM ^* by the microcircuit card C is not performed when the equality of the step E1 10 is not verified, this which avoids processing that could slow down the operation of the microcircuit card C (especially when the initialization request of the authentication process is performed by an attacker).

When the verification of the step E1 is positive (equality between the received pseudo-random word PRM and the pseudo-random word PRM ^* ), the microcircuit card C generates on its side in the step E1 14 a new word pseudo-random PRM ^* using the same process as the terminal H in step E102, but with the current value of the counter.

The new pseudo-random word PRM ^* thus determined is then temporarily stored in RAM in step E1 16.

The microcircuit card C then proceeds, during an atomic operation E1 18 (that is to say an operation which can only be totally realized or not performed as a whole, and which an attacker will not be able to force the partial realization), the incrementation of the counter and the writing of the new pseudo-random word PRM ^* in non-volatile memory (for example by copying it to from the RAM area where it was stored in step E1 16). The article "An overview of the Arjuna distributed programming system" by SK Shrivastava, GN Dixon, & GD Parrington published in IEEE Software, 8 (1), pages 66-73 (1991) describes a method for rendering a set atomic operations. One method is to check that the contents of two memory cells are changed in parallel or not. One possible implementation of this method consists in copying the contents of the two memory cells M to M ^* , modifying the contents of these two memory cells M ^* , and then, when the content is modified, modifying the position of the pointer from M to M ^* .

This avoids any discrepancy between the value of the counter at a given moment and the value of the pseudo-random word normally stored in non-volatile memory at the same time (this memorized value being however determined as already indicated on the basis of the previous value counter).

The pseudo-random value PRM ^* stored in non-volatile memory can thus be used during the next initialization of a mutual authentication process (see steps E108 and E1 10 described above).

The step E1 18 is followed by the step E120 to which is generated (for example by means of a key derivation process) a pseudo-random value CCH as a function in particular of the current value of the counter (value after incrementing the step E1 18), as well as possibly other data (eg a cryptographic key stored in the microcircuit card). It is furthermore provided that the pseudo-random value CCH is used as a challenge of the card to the terminal H.

This is followed by step E122 in which the microcircuit card generates different session keys SK. For example, each session key SK is generated, by means of a key derivation process, on the basis of a cryptographic key (called static key) K memorized in the microcircuit card C, of the host challenge HCH (received in step E106) and the pseudo-random value CCH (generated in step E120).

The microcircuit card C then determines in step E124 the authentication cryptogram of the card CAC, by means of a process of key derivation, based on one of the SK session keys, the HCH host challenge (received in step E106) and the pseudo-random value CCH (generated in step E120).

As indicated in the description relating to FIG. 1, the generation of the pseudo-random value CCH, the generation of the session keys SK and the determination of the authentication cryptogram of the card CAC are for example carried out according to what is provided. in the document "GlobalPIatform Card Technology - Secure Channel Protocol 03 - Card Specification v 2.2 Amendment D" already mentioned.

The microcircuit card C then emits at step E126 its response to the initialization command (see steps E104 and E106 above), which includes the pseudo-random value CCH determined in step E120 (challenge of the card), the CAC cryptogram determined in step E124 and the current value of the SQC counter.

The terminal H receives this response in step E128, which completes the initialization phase of the mutual authentication process; the mutual authentication process can then continue, for example by sending an EXTERNAL AUTHENTICATE command.

FIG. 3 presents a first example that can be envisaged for a method for determining a pseudo-random word as implemented above in steps E2, E8, E102 and E14.

According to this first example, an authentication message calculation function (MAC) is implemented by using as input the value of the counter SQC to be considered and a cryptographic key K, which makes it possible to obtain a piece of data (in instance an authentication code) MAC. The authentication message calculation function is for example a hash function for calculating authentication code with key (in English "keyed-hash message authentication code function" or simply "HASH-MAC function"), such as that complies with FIPS 198-1. Alternatively, it could be a symmetric cipher-based function, such as CBC-MAC or CMAC (as defined in NIST SP800-38B). For example, a hash function of the SHA-256 or SHA-3 type is used.

The cryptographic key K is a secret key stored in each of the two electronic entities (the terminal H and the microcircuit card C in the examples above) and which is therefore known only from these two electronic entities.

The pseudo-random word PRM, PRM ^* is then obtained by extracting N bytes from the MAC data, for example the leftmost N bytes (that is to say the N most significant bytes).

FIG. 4 presents a second example that can be envisaged for a method for determining a pseudo-random word as implemented above in steps E2, E8, E102 and E1 14.

According to this second example, the pseudo-random word PRM (Î-1), PRM ^* (Î-1) determined during the previous session and the SQC value of the counter to be considered, for example by concatenation, are combined. We eventually complete with zeros (eg on the right) to arrive at a word of 32 bytes.

When it is about the first session, the value of the counter SQC is null or has a predetermined value and the pseudo-random word of the preceding session is for example replaced by a specific initial value previously exchanged between the two electronic entities, for example a random value generated by the terminal H and transmitted securely to the microcircuit card C during its first initialization. The value of the pseudo-random word is, for example, a function of the serial number of the microcircuit card C which is received by the terminal H when the microcircuit C is first powered up. Note that this value, as well as all the subsequent counter values must remain secret to prevent an attacker from successfully completing the mutual authentication step.

In all cases, the combination is then applied with a one-way function, for example a hash function such as the SHA-256 function, in order to obtain a digest (or "digest" according to the English name). ). N bytes of the digest are then extracted (for example the N bytes of left) in order to obtain the pseudo-random word PRM (Î), PRM * (Ï) -

It can be provided in practice that the terminal H stores the previous values of the pseudo-random word so that in case of loss of synchronization with the microcircuit card C, it may possibly reuse the previous values stored to calculate new pseudo-random words in a resynchronization phase.

Claims

1. Electronic entity (C) designed to exchange data with another electronic entity (H), characterized in that it comprises:

means for receiving a first verification word (PRM) from the other electronic entity;

means for determining a second verification word (PRM *);

means for incrementing a counter (SQC) of the electronic entity (C) only in case of equality between the first verification word (PRM) and the second verification word (PRM *);

means for generating a session key (SK) as a function of the counter value (SQC).

An electronic entity according to claim 1, wherein the second verification word (PRM ^* ) is determined according to a counter value (SQC) of the electronic entity (C).

An electronic entity according to claim 1 or 2, comprising a rewritable non-volatile memory adapted to store the second verification word (PRM *).

An electronic entity according to claim 3, comprising means for comparing the first verification word (PRM) and the second verification word (PRM) stored in the non-volatile rewritable memory, in which the means for incrementing the counter (SQC). ) are designed to increment the counter (SQC) in case of a positive comparison by the comparison means.

5. Electronic entity according to one of claims 1 to 4, wherein the means for generating the session key (SK) are designed to generate the session key (SK) according to the first verification word (PRM) -

6. Electronic entity according to one of claims 1 to 5, wherein the means for generating the session key (SK) are designed to generate the session key (SK), during a session, before incrementing the counter (SQC) by the means for incrementing the counter (SQC).

7. Electronic entity according to one of claims 1 to 5, wherein the means for generating the session key (SK) are designed to generate the session key (SK), during a session, after incrementation of the counter (SQC) by the means for incrementing the counter (SQC).

A method for generating a session key (SK) for secure data exchange between a first electronic entity (H) and a second electronic entity (C), characterized by the steps of:

determination (E2; E102) by the first electronic entity (H) of a first verification word (PRM);

- transmitting (E4; E104) the first verification word (PRM) of the first electronic entity (H) to the second electronic entity (C);

- Incrementing (E14; E1 18) of a counter (SQC) by the second electronic entity (C) only in case of equality between the first verification word (PRM) and a second verification word (PRM *);

- generation (E18; E122) of a session key (SK) by the electronic entity (C) as a function of the counter value (SQC).

The method of claim 8, wherein the first verification word (PRM) is determined based on a counter value (SQC) of the electronic entity (C).

The method of claim 9, wherein the second verification word (PRM ^* ) is determined according to said counter value (SQC) of the electronic entity (C).

1 1. Method according to one of Claims 8 to 10, comprising a step of reading (E108), in a rewritable non-volatile memory, of the second verification word (PRM *) -

12. The method of claim 1 1, comprising, in a previous session, a step of determining (E1 14) the second verification word (PR _M *) and a storing step (E1 18) of the second verification word. (PRM *) determined in the rewritable non-volatile memory.

Method according to one of claims 8 to 12, wherein the session key (SK) is generated according to the first verification word (PRM) -

14. Method according to one of claims 8 to 13, comprising the following steps:

- generating (E2; E102) by the first electronic entity (H) a random value (RAND);

- transmitting (E4; E104) the random value (RAND) of the first electronic entity (H) to the second electronic entity (C);

- generation (E18; E122) of the session key (SK) according to a challenge (HCH) of the first electronic entity (H), formed by the concatenation of the random value (RAND) and the first verification word (PRM), and a challenge (CCH) of the second electronic entity (C) determined depending on the counter value (SQC).