Patent Grant
7386123
The invention concerns a method of implementing, in an electronic component, a cryptographic algorithm.
The invention also relates to the corresponding electronic component.
Such components are used in applications where access to services or data is severely controlled. They have an architecture formed around a microprocessor and memories, including a program memory of the ROM type (“Read Only Memory” in English) which contains the secret number or numbers d.
These components are used in computer systems, on board or not; they are in particular used in chip cards, for certain applications thereof. These are for example applications of access to certain databanks, banking applications, remote payment applications, for example for television, petrol dispensing or passage through motorway tolls.
These components or cards therefore use a cryptographic algorithm for ensuring the enciphering of data sent and/or the deciphering of data received when these must remain confidential.
In general terms and briefly, the function of these cryptographic algorithms is in particular the enciphering or the digital signature of the message. From this message applied as an input to the card by a host system (server, bank dispenser etc) and many secrets contained in the card, the card in return supplies to the host system the enciphered or signed message, which for example enables the host system to authenticate the component or the card, to exchange data, etc.
The characteristics of the cryptography algorithms are known: calculations made, parameters used. The only unknown is the secret number or numbers contained in program memory. The entire security of these cryptography algorithms relates to this secret number or numbers contained in the card and unknown to the world outside this card. This secret number cannot be deduced solely from knowledge of the message applied as an input and the enciphered message supplied in return.
However, it has become clear that external attacks enable ill-intentioned third parties to find the secret number or numbers contained in this card. In the field of chip cards, amongst others, there exist several possible attacks, one of which is known as “fault attack”.
In this type of attack, the attacker injects any error during the calculation of a cryptographic algorithm, for the purpose of exploiting the presence of this error in order to extract secret information.
The error may also result from a calculation error due to the hardware implementing the cryptographic algorithm; it is nevertheless considered, in either case, that it is a case of a fault attack.
This type of attack can in particular be envisaged with the RSA algorithm (from the name of its authors) Rivest, Shamir and Adleman), which is the most used in cryptography in this field of application. The security of the RSA algorithm is based on the difficulty of factorising large numbers. These algorithms use in particular exponentiation calculations to the power of d, d being a secret number.
The principal steps of the RSA algorithm are stated briefly.
A number N is established which is the product for two prime numbers p and q (N=p·q), and a public exponent or public key e and a private exponent or private or secret key d, satisfying the equation:
e·d=1(modulo λ(N)), (1)
λ(·) being the Carmichael function.
According to a first embodiment of the so-called standard RSA algorithm, the public parameters are (N,e) and the private parameters are (N,d). Given x lying in the range ]0,N[, the public operation on x, which may for example be the enciphering of the message x or the checking of the signature x, consists of calculating:
y=xe modulo N (2)
The corresponding private operation, which may for example be the deciphering of the enciphered message or the generation of a signature x, consists of calculating:
yd modulo N (3)
with x=yd modulo N since e·d=1 (modulo λ(N)).
Another operating mode known as CRT mode since it is based on the Chinese remainder theorem (“Chinese Remainder Theorem” or CRT in English) and four times faster than that of the standard RSA algorithm, will be presented. According to this CRT mode RSA, the calculations are not performed directly modulo N but first of all calculations are performed modulo p and modulo q.
The public parameters are (N,e) but the private parameters are (p,q,d) or (p,q,dp,dq, iq) with
dp=d modulo (p−1), dqd modulo (q−1)
and iq=q−1 modulo p.
By means of equation (1), there are obtained:
edp=1 modulo (p−1) and edq=1 modulo (q−1) (4)
The public operation is performed in the same way as with the standard operating mode; on the other hand, for the private operation, there are first of all calculated:
xp=yd
next, by application of the Chinese remainder theorem, x=yd mod N is obtained by:
x=CRT(xp,xq)=xq+q[iq(xp−xq)modulo p] (5)
The RSA algorithm has been presented with two prime factors p and q in order to simplify the disclosure. It is possible to extend it to the case where N is the product of two integers p and q such that hcf(p,q)=1. In this case,
dp=d (modulo λ(p)), dq=d (modulo λ(q)),
iq remains unchanged compared with the previous case,
edp=1 (modulo λ(p)) and edq=1 (modulo λ(q)),
and the calculations of xp, xq and x are unchanged.
This extension applies both to standard mode and to CRT mode.
A description will now be given of an example of a fault attack based on the obtaining of two signatures of the same message, one correct x and the other incorrect denoted ^x.
The incorrect signature was for example obtained in the following manner. The attacker, by any method, injects an error during the calculation of xp, but not during that of xq. The value of xp is then incorrect and denoted ^xp. On the other hand, the value of xq is correct. Because of this, when the values ^xp and xq are recombined by applying the Chinese remainder theorem, the resulting signature ^x is incorrect.
It then suffices for the attacker, who of course also knows the public parameters (N,e), to calculate the highest common factor (hcf) with N, that is to say:
hcf(^x−x, N).
However, hcf(^x−x, N)=q. He then obtains the secret factor q and therefore p and dp and dq. Because of this, the RSA code is effectively broken.
In other words, if someone is capable of injecting any error during a calculation modulo p whilst the calculation modulo q is correct or vice-versa, he can completely break the RSA code.
It is also possible to break the RSA code using an incorrect signature of a known message. Several cases of fault attacks are presented in the publication “On the Importance of Checking Cryptographic Protocols for Faults” by D. Boneh, R. A. DeMillo and R. J. Lipton, Advances in Cryptology, EUROCRYPT'97, pp. 37-51, to which reference can be made.
A first countermeasure for avoiding this type of scenario consists of recalculating the entire algorithm. The values obtained at the end of the successive calculations are compared. If they are identical, it is assumed that no fault has been injected. A problem with this approach is that it does not detect a permanent fault. For example, it is not possible to discern an attack in which the error injected consists of the value of a memory bit always being fixed at 0 or at 1 (“sticky bit” in English).
Another countermeasure to the fault attack is described by Shamir in the patent document WO 98 52319.
According to this countermeasure the following algorithm is proceeded with:
1. Choose a random number r of low value,
2. Calculate:
xrp=yd modulo r.p, and
xrq=yd modulo r.q;
3. If xrp≠xrq (modulo r), then there is a fault (perhaps caused by an attack) and therefore interruption of the algorithm, otherwise
4. Apply the Chinese remainder theorem to xrp and xrq, in order to issue x as an output.
Thus the calculations are performed respectively modulo r.p and modulo r.q instead of modulo p and modulo q. Next, it is checked that the two values xrp and xrq obtained by these calculations are also modulo r. If these two values are different, it is certain that there has been an error. On the other hand, if they are equal, it can be assumed that there is no error, with a probability of 1/r of being mistaken in this assumption.
One drawback of this method is that it is probabilistic, that is to say the errors are detected with a probability of less than 1 and that consequently they are not all detected. In addition it is expensive in calculation time. Another drawback of the Shamir method is that it functions only for the CRT mode. However, it can also be envisaged using the standard mode of the RSA algorithm.
The best possible protection for protecting from fault attacks consists of checking that the value x obtained during the private operation (3) or (5) (that is to say either in standard mode or in CRT mode of the RSA algorithm) satisfies equation (2) y=xe modulo N of the public operation. This is because, when this equation is satisfied, it is possible to be sure that there has been no error during the performance of the private operation of the RSA algorithm.
However, the component or device implementing the private operation does not always have available the public exponent e, in particular when it executes only the private operation.
In the light of the above, the invention proposes a method for performing certain steps of a cryptographic algorithm using a public exponent e which is not known a priori.
This method makes it possible in particular to effect a countermeasure, in particular to fault attacks, which offers the best possible protection even when the public exponent e is not known.
The object of the invention is a method of implementing, in an electronic component, a cryptography algorithm using calculation means, principally characterised in that it consists of performing the following steps:
a) choosing a value e from amongst a given number of values ei, ei being integer numbers,
b) testing whether the value ei chosen satisfies a predetermined equation:
According to one embodiment of the invention, it consists, prior to step b), of choosing a value Y lying in the range ]0,N[and allocating to a value X the result of the operation Yd modulo N, d and N being given integer numbers, and it consists of the predetermined equation of step b) being
Xe
Preferably Y=2 is chosen.
The cryptography algorithm can be based on an algorithm of the RSA type, in particular in standard mode or in CRT mode.
According to another embodiment, the predetermined equation of step b) is: eidp=1 (modulo λ(p)), p and dp being given integer numbers and λ(.) being the Carmichael function.
The number dp can be obtained by dp=d (modulo λ(p)), d being a predetermined integer.
According to one characteristic of the invention, dq and q being given integer numbers, with hcf(p,q)=1, step b) consists of performing the following steps:
testing whether eidp=1 (modulo λ(p)),
if such is the case, and if ei<λ(p), then e=ei and storing e with a view to its use in calculations of the said cryptography algorithm,
if such is the case, and if ei≧λ(p), then testing whether eidq=1 (modulo λ(q)); if such is the case, then e=ei and storing e with a view to its use in calculations of said cryptography algorithm,
if one of the above two tests is not satisfied, reiterating the previous steps using another value of ei and if no value of ei can be attributed to e then noting that the calculations of the said cryptography algorithm using the value e cannot be made.
The number dq can be obtained by dq=d (modulo λ(q)), d being a predetermined integer.
The cryptography algorithm is advantageously based on an algorithm of the RSA type in CRT mode.
Preferably ei=216+1 or ei=3 is chosen.
According to one characteristic of the invention, a value ei having been allocated to e, it consists of obtaining, at the end of a private operation of the RSA algorithm, a value x from a value y and of the fact that the said calculation using a value e consist of checking whether y=xe modulo N, N being a predetermined integer number.
Another object of the invention is an electronic security component comprising calculation means, a program memory and a working memory and data communication means, characterised in that it implements the method as previously described.
The invention relates in particular to a chip card comprising an electronic component as described above.
Other particularities and advantages of the invention will emerge clearly from a reading of the description given by way of non-limiting example and with regard to the accompanying
The embodiments are described in the context of chip cards, but can of course apply to any other electronic security device or component provided with cryptographic calculation means.
As shown in
The chip card 1 also comprises a communication interface 5 connected to the microprocessor 2 to allow the exchange of data with the external environment. The communication interface 5 can be of the “contact” type, being in this case formed by a set of contact pins intended to connect to a contactor of an external device, such as a card reader, and/or of the “contactless” type. In the latter case, the communication interface 5 comprises an antenna and radio communication circuits allowing data transfer by wireless connection. This connection can also allow a transfer of energy supplying the circuits of the card 1.
A description will now be given of a method for validating the value of a public exponent e which is not known a priori.
It is based on the following observation: in 90% of cases, the value of e is e0=216+1, in 5% of cases the value of e is e1=3 and in other cases the value of e is other.
The method then consists of choosing e0 and verifying that e=e0; if e≠e0, then an attempt is made with e1.
It may happen that, for a certain application corresponding to 5% of other cases, e is not equal to either e0 or e1. Thus the value of e is more generally designated by ei. And the method finally consists of choosing a value ei from amongst the ei values envisaged and verifying that e=ei.
According to a first embodiment, valid for the standard or CRT modes of the RSA algorithm:
a value Y lying within a range ]0,N[, is arbitrarily chosen,
a value ei is chosen,
a calculation is made of X=Yd modulo N by (3) in standard mode or by (5) in CRT mode
if Xe
and e is stored
otherwise another value is chosen for ei.
It is possible advantageously to choose Y=2 so as to accelerate the exponentiation calculation Yd which appears in equation (3) or (5): this then amounts to making additions instead of multiplications.
Another embodiment based on equation (4) is now described; it is valid only in CRT mode but is then more effective than the previous embodiment;
a value ei is chosen,
it is tested whether eidp=1 modulo(p−1), (or whether eidp=1 (modulo λ(p)) in the general case)
if yes and if ei<p (or if ei<λ(p) in the general case), then e=ei and e is stored
if yes and if ei≧p, (or if ei≧λ(p) in the general case) then e=ei with a very high probability of around 1-2/p.
In the case where ei≧p (or if ei≧λ(p) in the general case), the ambiguity can be removed with a probability of 1 by testing whether eidq=1 modulo(q−1) (or whether eidq=1 (modulo λ(q)) in the general case). If such is the case, e=ei and e is stored.
However, in the majority of cases (ei=216+1 or ei=3), ei<p (or ei<λ(p) in the general case) since p has a size of 512 bits or more.
If one of the tests is not satisfied, another value is chosen for ei.
If for one or other embodiment there does not exist amongst the ei values a value such that e=ei, then it is not possible to make the calculations involving e.
When e is known, through one or other of these embodiments, it is then possible to verify each private operation (3) or (5) by checking that y=xe modulo N or more generally to make calculations using the value e which is stored.
As has been seen, this method can of course be applied to a countermeasure.
It is more rapid than the countermeasure described in the prior art which consists of recalculating the whole of the algorithm, that is to say making at least a second exponentiation calculation to the power of d, d being the size of N, and comparing the values obtained at the end of the successive calculations. The method according to the invention also consists of making a second exponentiation calculation but to the power of e; however, e is small.
It also makes it possible to detect a permanent fault.
It applies both in the case of the standard mode of the RSA algorithm and in the case of the CRT mode as well as the extension of these modes.
| Number | Date | Country | Kind |
|---|---|---|---|
| 01 12274 | Sep 2001 | FR | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/FR02/03021 | 9/5/2002 | WO | 00 | 10/12/2004 |
| Publishing Document | Publishing Date | Country | Kind |
|---|---|---|---|
| WO01/55838 | 8/2/2001 | WO | A |
| Number | Name | Date | Kind |
|---|---|---|---|
| 4736423 | Matyas | Apr 1988 | A |
| 5991415 | Shamir | Nov 1999 | A |
| 6144740 | Laih et al. | Nov 2000 | A |
| 6965673 | Boneh et al. | Nov 2005 | B1 |
| 20040215685 | Seifert et al. | Oct 2004 | A1 |
| 20060210066 | Villegas et al. | Sep 2006 | A1 |
| Number | Date | Country |
|---|---|---|
| 0 202 768 | Nov 1986 | EP |
| 98 52319 | Nov 1998 | WO |
| 99 35782 | Jul 1999 | WO |
| WO 9949416 | Sep 1999 | WO |
| WO 0024155 | Apr 2000 | WO |
| WO 0155838 | Aug 2001 | WO |
| Number | Date | Country | |
|---|---|---|---|
| 20050084096 A1 | Apr 2005 | US |
