The invention relates to a method of coding a secret, formed by a numerical value.
The considerable upsurge in communications by transmission of electronic messages has very quickly raised the problem of the confidentiality of the data transmitted.
Very sophisticated solutions for enciphering/deciphering these data have been proposed by means of encipherment algorithms using a single secret key, serving for encipherment/decipherment, and then a public key, with which is associated a private key, used for deciphering the data, enciphered by means of the public key.
The aforementioned solutions are satisfactory, to the extent that secret-key algorithms are hard to break, at the very least if the secret key is not compromised, and that public-key/private-key algorithms do not entail limitations as regards the dissemination of the public key and require the implementation of hardware and software means of prohibitive complexity and calculation cost with a view either to breaking the encipherment/decipherment algorithm or to retrieving the value of the private key associated with the public key.
In all events, use of a cryptographic scheme with a single secret key or a public key, with which a private key is associated, it is indispensable to prevent any compromising of the secret key or of the private key, so as to guarantee the confidentiality of the data transmitted.
Whilst satisfactory protected-access cryptographic components have been proposed, in particular integrated in the form of security processors for the cryptographic components of electronic cards, termed chip cards, exterior access by way of the input/ouput port to the security components of these electronic cards possibly being made extremely difficult or indeed practically impossible, the read/write manipulation of the secret or private keys by these components may allow the compromising of the aforementioned keys, in particular of the secret values or secrets entering into the definition of these values.
This compromising may occur through “hidden channel” attack (known as Side Channel attack), this type of attack possibly consisting for example in detecting the intensity variations of the electric current consumed by the security component or the card in the course of these manipulations, these being necessary.
The object of the present invention is to remedy the drawbacks of the risks of hidden channel attack, through the implementation of a method of coding a secret, subdivided into several mutually uncorrelated secret elements, it not being possible for the manipulation of the secret elements to enable the original secret to be retrieved, although each secret element might, as the case may be, be compromised.
The method of coding a secret formed by a numerical value, in a secret-key or public-key cryptography scheme in which this secret is divided between a plurality of a determined number of elements, of which a composition law represents the value of this secret, which is the subject of the present invention, is noteworthy in that it consists, furthermore, in recalculating a new plurality of elements of the secret without ever manipulating this secret. For this purpose it is necessary to calculate a first image of this secret by iterative application of the composition law term by term between the first image of previous rank and the composition product according to this composition law of the element of next rank and a random value of the same rank, chosen from among a first set of one and the same plurality of random values; calculate a first numerical value, the composition product of this composition law applied successively to the random values of this first set of random values; calculate a second numerical value, the composition product according to this composition law applied successively to the random values of a second set of one and the same plurality minus one of random values; calculate a second image of this secret by applying the inverse composition law to the first image of this secret and to this second numerical value, so as to produce an intermediate image of this secret, and then by applying this inverse composition law to this intermediate image and to this first numerical value, so as to produce this second image of said secret; and allocate to each of these successive elements minus the last of this plurality of elements the random value of corresponding rank of this second set of at least one random value and to the last element the numerical value of this second image.
The method of coding a secret, which is the subject of the present invention, will be better understood on reading the description and on observing the drawings hereinafter in which:
a represents, by way of illustration, a first and a second composition law applicable to numerical values and allowing the implementation of the method which is the subject of the present invention;
b represents, by way of illustration, a specific flowchart for implementing the method which is the subject of the invention, when the composition law represented in
c represents by way of illustration a specific flowchart for implementing the method which is the subject of the invention, when the composition law represented in
A more detailed description of the method of coding a secret, in accordance with the subject of the present invention, will now be given in conjunction with
In a general way, it is recalled that the subject of the method, which is the subject of the invention, is the coding of a secret s formed by a numerical value d, in a secret-key or public-key cryptography scheme. It applies more particularly to any cryptographic calculation process in which the secret s is subdivided into a plurality of a determined number of secret elements, each denoted di, which plurality of elements is dubbed hereinafter [di]1N of which a composition law denoted represents the numerical value of the secret s.
With reference to
In this relation
represents the composition product of the composition law applied to the set of N elements di.
As represented in
In step A of
With reference to step A of
[Ti=Ti−1(di
Ri)]1N→TN
In the above relation,
Step A of
In step B of
Step B of
Consequently, the second set of one and the same plurality minus one of random values is denoted [Aj]1N−1
The second numerical value satisfies relation (4):
Step C of
With reference to step D of .
In step D of
Tx=TNS2
T′=TxS1
Step D of
Consequently the step of allocations represented in step E satisfies relation (6):
{[di]1N−1=[Aj]1N−1
{dN=T′
A more detailed description of a first and of a second variant for implementing the method which is the subject of the invention will now be given in conjunction with
In a general way, it is indicated that the composition law mentioned previously is formed by a distributive arithmetic or logic operation, endowed with a neutral element. A corresponding composition law can thus be applied to any secret and to any element of a secret formed by a numerical value consisting either of an integer or of a real number.
Thus, under this assumption, for a secret s formed by a numerical value d of determined length L, each random value Ri of the first respectively Aj of the second set of random values is chosen of length less than 2L−N+1.
By way of nonlimiting example, the aforementioned composition law can consist, as represented in
It is noted, of course, that the aforementioned composition law is then endowed with an inverse operation, the exclusive OR operation unchanged, when the exclusive OR operation constitutes the aforementioned composition law, respectively the subtraction operation, when the addition operation constitutes the abovementioned composition law.
The previously mentioned composition laws and their corresponding operation are represented in the drawing of
=⊕;
=⊕
=+;
=−
In the above relation,
⊕ represents the exclusive OR operation, conducted bitwise on the integers or real numbers constituting the secret elements or secret, as well as the random numbers;
+ and − represent the addition operation and the inverse operation of subtraction for the composition law formed by arithmetic addition. Furthermore the neutral element is 0 for both operations.
A specific mode of implementation of the method which is the subject of the invention is now described in conjunction with
In step A of
[Ti=Ti−1⊕(di⊕Ri)]i=1i=N→TN
In step B of
In step C of
In step D of
Tx=TN⊕S2
T′=Tx⊕S1
Finally, the allocating step E is unchanged in relation to the allocating step E of
Furthermore, by way of nonlimiting example the aforementioned composition law can consist, as represented in
In step A of
[Ti=Ti−1+(di+Ri)]i=1i=N→TN
In step B of
In step C of
In step D of
T
x
=T
N
−S
2
T′=T
x
−S
1
With reference to
The object of the test sub-step E0 is to verify that the second image T′ is significant. The significant character of the second image T′ is obtained when the numerical value representative of the latter is strictly greater than zero.
Thus, upon a positive response to the comparison test of sub-step E0, the allocating sub-step proper E1 is called and carried out in the same manner as in the case of
Conversely, upon a negative response to the test sub-step E0, the second image T′ then being negative, a return to step A is executed so as to repeat the calculation process until a positive value representing the second image T′ is obtained.
A description of a cryptographic device security component comprising a secure processor, a nonvolatile memory, a work memory, a program memory and a bus with read-write protected access will now be given in conjunction with
In the aforementioned
The security component which is the subject of the invention is noteworthy in that the program memory PROGS comprises a computer program including a series of instructions stored in this program memory.
During the execution of these instructions, the secure processor μPS executes the steps for implementing the method of coding a secret formed by the numerical value d in any secret-key or public-key cryptography scheme, as described previously in the description in conjunction with
Thus, the security processor μPS delivers on the read-write protected access bus denoted I/O solely the secret elements denoted di successively, under the supervision of the cryptographic device, not represented in the drawing of
It is understood, in particular, that the method and the security component which are the subject of the invention operate on any secret formed by a numerical value d constituting totally or partially either a secret key in a secret-key cryptography scheme, or a private key in any public-key cryptography scheme.
Of course the aforementioned method and security component which are the subject of the invention may be implemented for the calculation of any value of access code, for identification with secret intent of an authentication, non-repudiation or signature process.
Number | Date | Country | Kind |
---|---|---|---|
07 08541 | Dec 2007 | FR | national |
Filing Document | Filing Date | Country | Kind | 371c Date |
---|---|---|---|---|
PCT/FR08/52217 | 12/5/2008 | WO | 00 | 6/3/2010 |