Patent Application
20110129084
This application claims priority to foreign French patent application No. FR 09 04642, filed on Sep. 29, 2009, the disclosure of which is incorporated by reference in its entirety.
The present invention relates to a method of executing an algorithm for protecting secret data in an electronic device such as a smart card or a cryptographic component. The secret data to be protected are, for example, variables used in operations executed by a data encryption algorithm. The invention also relates to a device for implementing this method of protecting secret data.
The operations executed by a cryptographic device cause variations of physical quantities. These variations differ according to the data processed, which can be measured by an attacker, for example by measuring the power consumption of the device or its electromagnetic radiation. An attacker can use these measurements to obtain information about the secret data handled in the device. To provide a defense against such an attacker, the designer of the device must adapt the executed operations in such a way that the measurable variations caused by them are independent of the secret data.
One method of attacking a device in order to discover the secret data contained in it, known to those skilled in the art, is the “side channel attack”. In this form of attack, the power consumption of the device is measured and this measurement is used to deduce the information contained in it. A defense against such attacks can be provided by a known protection method in which all the sensitive variables x of the algorithm are combined with a random data r. Thus each intermediate variable handled by the device can be written as a function of x and r, mr(x). One of the limitations of this solution is that it is necessary to ensure that x can be retrieved from mr(x) at any step of the algorithm in question. To achieve this, all the operations executed on the variable x must be adapted to allow for the masking method mr.
In the case of block encryption algorithms, the sensitive data x handled by this type of algorithm are masked by means of the function mr(x)=x+r, where r is a random variable and the sign ‘+’ refers to the Exclusive OR (XOR) operation.
This method, known in the prior art, is easily implemented, because all the linear or affine operations executed by the algorithm to be protected can be adapted immediately. Furthermore, this method is effective against first-order side channel attacks, in other words those using a single measurement point, such as the power consumption of the device.
One of the main problems of the prior art solution using masking with a function of the type mr(x)=x+r is that it has low resistance to higher-order side channel attacks, in other words those using a plurality of measurement points instead of a single point. This is because the information associated with two points in the measurements corresponding to the processing of the variables x1+r and x2+r is strongly correlated with x1+x2, resulting in low resistance to the more advanced forms of attack called k-th order attacks, where k is an integer greater than 1.
However, this problem can be resolved by extending the initial solution to a number k of random variables such that masking with a function mr(x)=x+r1+r2+ . . . +rk is used, where the variables r1, r2, . . . , rk are handled separately. However, this solution does not resolve the problem of an attacker using an indefinite number of measurement points, and moreover it leads to additional implementation costs which are unacceptable in practice when k is large. Furthermore, there is no known solution for implementing such a solution when k is greater than or equal to three.
None of the prior art solutions is capable of resisting known attacks of any order k greater than 1 at an additional complexity cost which is acceptable.
In order to remedy the drawbacks of the prior art, the present invention proposes a solution in which every intermediate variable x handled by operations executed in the device whose content is to be protected is masked by using affine applications of the m(x)=Rx+r type, where R is a binary invertible matrix. The operations executed by the device are adapted using the mathematical properties of the affine application. This solution enables known attacks of orders greater than one to be resisted, at a lower cost, since the known methods of inferring secret data by using the information associated with at least two measurement points corresponding to the processing of intermediate data will fail when these data are masked by an affine application, by contrast with the prior art solution.
The invention relates to any device capable of implementing cryptographic algorithms or algorithms comprising secret data, for protecting these data against access by persons acting with malicious intent. More specifically, but not exclusively, the invention can be applied to a computer, a mobile terminal, or a smart card. The invention is also applicable to any type of cryptographic algorithm, notably a public key or private key algorithm.
For this purpose, the invention proposes a method of execution including a step of protecting an electronic device by affine masking, where said device executes operations on secret variables x, said variables x being binary vectors of a given size N other than zero, said method being characterized in that said variables x are replaced, using what is known as an affine masking operation, by the following affine function: m(x)=R.x+r, where R is a random invertible binary matrix with N rows and N columns and r is a random binary vector of size N.
In a variant embodiment of the invention, said operation of affine masking of a secret variable x is executed by means of the following steps:
In a variant embodiment of the invention, said electronic device executes at least one linear operation on a set of secret variables z1, . . . , zm, producing the result z=A1z1+A2z2+ . . . +Amzm, where the variables A1, A2 . . . Am are matrices each of which commutes with the matrix R and its inverse R−1, and the operation of affine masking of said result z is carried out by means of the following steps:
z
For i varying from 2 to m,
z
In a variant embodiment of the invention, said electronic device executes at least one linear operation on a set of secret variables z1, . . . , zm of size N, producing the result z=A1z1+A2z2+ . . . +Amzm, where the variables A1, A2 . . . Am are matrices which do not commute with the matrix R and its inverse R−1, and the operation of affine masking of said result z is carried out by means of the following steps:
z
For i varying from 2 to m,
z
In a variant embodiment of the invention, said electronic device executes at least one non-linear operation S on at least one secret variable y, producing the result y′=S(y), and the operation of affine masking said result y′ is executed by means of the following steps:
In a variant embodiment of the invention, said electronic device executes a cryptographic algorithm.
The invention also includes an electronic device for executing operations on the secret variables x, comprising means to protect said variables x by applying the steps of the affine masking protection method described above.
In a variant embodiment of the invention, said device is a microcircuit card.
Other characteristics will be made clear by the following detailed description, given by way of non-limiting example with reference to the appended drawings, in which:
a is a diagram showing in a schematic way the affine masking method according to the invention applied to a linear transformation, in the case where the matrices A1, . . . , Am, which are coefficients of the linear transformation, commute with the matrices R and R−1;
b is a diagram showing in a schematic way the affine masking method according to the invention applied to a linear transformation, in the case where the matrices A1, . . . , Am, which are coefficients of the linear transformation, do not commute with the matrices R and R−1;
In order to overcome the limitations of the prior art described above, the present invention proposes a method for masking sensitive data by means of affine functions. Notably, the method according to the invention relates to the execution of a data masking algorithm for the purpose of protecting sensitive data. The masking function used in this case to protect a variable x is:
m(x)=R.x⊕r, (1)
where x is a sensitive variable, such as one handled by an encryption algorithm implemented by a cryptographic device, this variable being represented by a binary vector with N components, where N>0;
R is an invertible random binary matrix, in other words one containing no values other than 0 and 1, with a size of N×N;
r is a random vector, which is also binary, of size N;
⊕, is the “exclusive or” operation.
The method according to the invention consists, notably, in replacing a variable x with m(x) in order to make it less vulnerable to an attack. This operation is called a masking operation, and in the context of the invention it is an affine masking operation.
This method can be implemented, notably but not exclusively, in two different ways.
In a first embodiment, the affine masking function m(x) is executed by means of a correlation table T[x] which contains the set of values of m(x)=R.x ⊕r for all possible values of the variable x. For a vector x comprising N bits, therefore, there are 2N possible values. Thus the generation of the correlation table T[x] comprises the following steps:
For a given sensitive variable x handled by the device to be protected, the affine masking according to the invention is then executed by extracting the corresponding value m(x) in the table T[x].
In a second embodiment, the affine masking function m(x) can be generated directly when the sensitive variable x is to be protected. For this purpose, the invertible binary matrix R and the binary vector r are generated at random for each variable x at the instant when this variable is used in the encryption algorithm.
The variable x handled by the implemented algorithm can be subjected to linear or non-linear operations.
The method according to the invention also consists in adapting these operations in order to mask their result without requiring excessively complex calculations.
a shows in a schematic way the steps implemented in the masking of a linear combination of masked variables in the case where the matrices A1, . . . , Am commute with the matrices R and R−1.
Consider the general case of the linear operation defined by the following relation:
z=A
1
z
1
+A
2
z
2
+ . . . +A
m
z
m (2)
where z1, . . . , zm are sensitive variables of size N and
The matrices A1, . . . , Am are invertible binary matrices with N rows and N columns.
In the special case in which the variables A1, . . . , Am, z1, . . . , zm can be considered as elements of the finite Galois field GF(2N) with a cardinal number 2N, the variable R is found by randomly drawing an invertible matrix element of GF(2N). The variable r is found by randomly drawing a vector element of GF(2N). The table T is generated by tabulating the values of the application x→m(x)=Rx+r for all the vectors x belonging to GF(2N). In this case, the matrices A1, . . . , Am commute with the matrices R and R−1. It should be remembered that the matrix Ai commutes with the matrix R if AiR=RAi.
The variable z can then be masked by executing the following calculation steps.
In a first step 111, a random variable r′ is generated by random drawing of a vector from the finite field GF(2N) and the variable r″ is calculated from r′ and from the random variable r used to mask the sensitive variables z1, . . . zm according to the following relation:
r″=r′+(A1+ . . . +Am)r (3)
In a second step 112, the result of the masking
z
In a third iteration step 113, the masked variable
z
In a final step 114, the variable
b shows in a schematic way the steps implemented in the masking of a linear combination of masked variables in the case where the matrices A1, . . . , Am do not commute with the matrices R and R−1.
If the matrices A1, . . . , Am do not commute with the matrices R and R−1, the tables TR and TR-1 of the applications x→Rx and x→R−1x respectively must be generated at the same time as the table T. The tables TR and TR-1 are generated at a marginal cost in execution time in parallel with the generation of the table T.
In this case, the variable z can be masked by executing the following calculation steps.
In an initial step 120 which is executed once only at the start of the procedure, the tables
A
i
In a first step 121, a random variable r′ is generated from the finite field GF(2N) and the variable r″ is calculated from r′, from the tables
r″=(
In a second step 122, the result of the masking
z
In a third iteration step 123, the masked variable
z
In a final step 124, the variable
Thus the method according to the invention optimizes the execution of the affine masking of linear operations.
The affine masking of the result of non-linear transformations, which can also be implemented by an encryption algorithm, is processed by the masking method according to the invention in the following way.
Let S be a non-linear operation which relates the variable y to the variable y′ according to the following relation:
y′=S(y) (12)
where y is a sensitive variable and
It is then necessary to calculate the masked version
In a first step, an adapted version S′ of the linear operation S is calculated, as defined by the following relation:
S′()=R·S(R−1·(+r))+r (13)
In a second step, the result of the operation
The generation of the invertible random matrix R used by the affine masking method according to the invention must be efficient in terms of the complexity of the calculations used in order to avoid giving rise to considerable additional costs of implementation. Moreover, the matrix R must meet a security criterion, in that the number of randomly generated matrices R must be large enough to prevent any attack aimed at discovering the masking system.
The data processing device 340, and more specifically the microprocessor 310 incorporated in it, can exchange data with external devices by means of a communication interface 330.
Although, for the purposes of illustration, the input data and the output data are shown on two different arrows, the physical means of communication between the microprocessor 310 and the interface 330 can be made in the form of a single means, such as a serial communications port or a bus.
The microprocessor 310 can run software (or a computer program) which enables the data processing device 340 to execute a method according to the invention, examples of which are provided facing
In a variant, the assembly formed by the microprocessor 310, non-volatile memory 320 and random access memory 360 can be replaced with a special-purpose circuit which comprises means for implementing the different steps of the data processing method.
This microcircuit card conforms to the ISO 7816 standard, for example, and is provided with a secure microcontroller which incorporates the microprocessor (or CPU) 320 and the random access memory 360.
In a variant, the data processing device can be a flash drive, a document or a paper medium which incorporates in one of its pages a microcircuit associated with contactless communication means. Preferably, it is a portable or pocket electronic apparatus.
The method according to the invention has the notable advantage of being simple to implement while being compatible with linear and non-linear operations executed on the sensitive variables protected according to the invention.
The invention also has the advantage of yielding significantly better results than those of the known prior art solutions against known side channel attacks of orders above 2.
In fact, the prior art solution using masking based on XOR operations cannot resist second-order side channel attacks. This is due to the fact that, for any sensitive variable x, an attacker can find two intermediate variables v1 and v2 such that x=v1⊕v2, and the power consumption C(x) associated with the variable x can be predicted from |C(v1)−C(v2)|. However, this prediction is not possible if the variables v1 and v2 are masked by an affine masking method according to the invention. In fact, the correlation of C(x) with |C(v1)−C(v2)| decreases rapidly with the size n of the vector x, as shown in Table 1.2. The same conclusion can be reached if we attempt to predict C(x) from C(v1)×C(v2), as indicated in Table 1.2.
Let x1 and x2 be two random variables distributed uniformly in the space {0,1}n. Table 1.1 compares the correlations between x=x1⊕x2 and the variables x1 and x2 masked by an XOR masking method. The metrics used to analyse the performance of this method are as follows.
Cor(|HW(x1⊕r)−HW(x2⊕r)|β; HW(x)) (15)
and
Cor(|HW(x1⊕r).HW(x2⊕r)|β; HW(x)) (16)
where HW(x) is the Hamming weight of the vector x.
Table 2.1 shows the same results, applied on this occasion to the affine masking method according to the invention; the metrics used are as follows:
Cor(|HW(Rx1⊕r)−HW(Rx2⊕r)|β; HW(x)) (17)
Cor(|HW(Rx1⊕r).HW(Rx2⊕r)|β; HW(x)) (18)
Tables 1.1 and 1.2 show that the metrics in question decrease strongly when n increases in the case of the affine masking method according to the invention. The metrics defined by the relations 15, 16, 17 and 18 use the Hamming weight of a variable x, because there is a known method of approximating the power consumption related to the variable x with the Hamming weight of the same variable x.
These results show that the information associated with two (or more) points on the measurements corresponding to the intermediate data processing of the form Rx1+r and Rx2+r is much more weakly correlated with x1+x2 than in the prior art solution which has been described. The invention thus makes it possible to resist known attacks of orders greater than 1.
| Number | Date | Country | Kind |
|---|---|---|---|
| 09 04642 | Sep 2009 | FR | national |
