Patent Application
20080130877
The present invention relates to a method for secure and compact exponentiation, with particular applications in the field of cryptography in which cryptographic algorithms are implemented in electronic devices such as chip cards.
Numerous cryptographic algorithms are based on exponentiation calculations, in an algebraic group, of type xd where x and d are a predetermined element and exponent, respectively. This is, in particular, the case of the RSA (Rivest, Shamir and Adleman) algorithm, which is based on exponentiation in the multiplicative group of the ring of integers modulo N, where N is the product of two large prime numbers. The result of the exponentiation can correspond, for example, to an encrypted or decrypted text, or signed or verified data. Other cryptographic algorithms such as the El Gamal or Diffie-Hellman algorithms rely on exponentiation in the multiplicative group of a body or in the group of points of an elliptic curve.
An electronic device provided for executing such an algorithm must contain, in its memory, on the one hand the executory part for raising x to the power of d, and on the other hand the values of x and d.
Different types of exponentiation algorithms exist. Among these, in particular, the “Square and Multiply” binary method is known.
This algorithm takes an element x and an exponent d as inputs, the binary representation of which is:
{d[t−1], d[t−2], . . . , d[1], d[0]}
where d[i] is equal to 0 or 1, and returns the element y=x̂d, which is to say x.x. . . . .x (d times).
The “Square and Multiply” algorithm can be represented as follows:
Other exponentiation algorithms are known, such as the Jacobi method, known as M, M3, the sliding window method, etc. However, these algorithms are more complex to implement and consequently less suitable for limited electronic components of chip-card type. In the rest of the description, the electronic component comprises a main central processing unit and a working memory with at least three registers (R0, R1, R2)
The “Square and Multiply” algorithm (and the algorithms mentioned above) must include counter-measures which are adapted or, in other words, secured, against attacks which aim to see the data contained and manipulated in the processes performed by the calculation device. In particular, counter-measures are provided against so-called simple or differential hidden channel attacks. Simple or differential hidden channel attack is understood to mean an attack based on a physical magnitude that can be measured from outside the device, using direct analysis (simple attack) or statistical analysis (differential attack) to reveal the data contained and manipulated in the processes of the device. These attacks therefore make it possible to reveal confidential information. These attacks were disclosed in particular by Paul Kocher (Advances in Cryptology—CRYPTO'99, vol. 1966 de Lecture Notes in Computer Science, pp. 388-397. Springer-Verlag, 1999). Among the physical magnitudes that can be exploited for this purpose are current consumption, electromagnetic field, etc. These attacks are based on the fact that the manipulation of a bit, which is to say its processing by a specific instruction, leaves a particular fingerprint on the physical magnitude in question according to its value.
The aforementioned exponentiation algorithms have had to include counter-measures for preventing these attacks from succeeding. For example, the “Square and Multiply Always” algorithm is a secure version of the “Square and Multiply” algorithm, in which the operation was conditional on the value of the bit currently being processed, thus allowing hidden channel attacks.
This algorithm takes an element x and an exponent d as inputs, the binary representation of which is:
{d[t−1], d[t−2], . . . , d[1], d[0]}
where d[i] is equal to 0 or 1, and returns the element y=x̂d, which is to say x.x. . . . .x (d times).
The “Square and Multiply Always” algorithm can be represented as follows:
The “Square and Multiply Always” algorithm is resistant to certain simple attacks (known as SPA or Simple Power Analysis) but it requires an additional register. It is important to note that the R1 register is unnecessary for the calculation itself; it is used to carry out a dummy multiplication when, in iteration i, the bit d[i] of the exponent d is equal to 0 (and, consequently, b=1), so that, regardless of the value of the bit of the exponent d, an iteration i consists of a step of squaring followed by a multiplication.
Unfortunately, although resistant to SPA attacks, the introduction of dummy operations causes another type of weakness. A class of attacks (known as “safe-error attacks”) was introduced by Sung-Ming Yen et Marc Joye (“Checking before output may not be enough against fault-based cryptanalysis”, IEEE Transactions on Computers, vol. 49, pages 967-970, 2000). When applied to the “Square and Multiply Always” algorithm, the idea is to induce a fault during the multiplication operation (step 2b) in iteration 1. If the result of the exponentiation y=x̂d is correct, this means that this multiplication operation was a dummy and, therefore, that the corresponding bit of d is equal to 0 (i.e. d[i]=0). Conversely, if the result of exponentiation is incorrect, this means that the corresponding bit of d is equal to 1 (i.e. d[1]=1). An attacker can thus retrieve the value of the exponent d bit by bit.
The invention relates to an exponentiation method having the same advantages as the “Square and Multiply Always” algorithm, namely resistance to SPA attacks but which, unlike the latter, does not perform any dummy operations.
Furthermore, the method according to the invention has the remarkable special feature of only performing multiplication operations. This is particularly useful in more limited environments such as chip cards, as only the latter operation needs to be implemented, either in software or in hardware.
Thus, this results in the following:
because the squaring operation is not necessary.
It should be remembered that on a set with additive notation, such as the group of points of an elliptic curve, the exponentiation is written as Q=d.P, where P and Q are elements of the set with additive notation (elliptic curve) and d is an exponent. This is also the case when working in the additive group of a ring or a body. The general, conventional case is used henceforth, which is to say that multiplicative notation is used, unless explicitly stated otherwise.
In a more detailed manner, the exponentiation method according to the invention is based on the following algorithm.
This algorithm takes an element x and an exponent d as inputs, the binary representation of which is:
{d[t−1], d[t−2], . . . , d[1], d[0]}
where d[i] is equal to 0 or 1, and returns the element y=x̂d, which is to say x.x. . . . .x (d times).
In multiplicative notation, the method according to the invention can be represented in the following manner:
The preceding algorithm can evidently be written in additive form. As before, it takes an element P and an exponent d as inputs, the binary representation of which is:
{d[t−1], d[t−2], . . . , d[1], d[0]}
where d[i] is equal to 0 or 1, and returns the element Q=d.P, which is to say P+P . . . +P (d times).
In this case, in additive notation, the method according to the invention can be represented in the following manner:
In certain algebraic groups, addition with the identity element 0 (equivalent to multiplication by the identity element 1 in multiplicative notation) can behave differently with regard to hidden channel measurements and consequently create a weakness. In this case, the method according to the invention can be easily adapted.
We illustrate the technique for a group with additive notation, such as, for example, the set of points of an elliptic curve. The algorithm begins at iteration i=1 in such a way that none of the registers are initialised with value 0 (known as a point at infinity for an elliptic curve) in the following manner.
Keeping the additive notation, there is a variation according to the invention which can be represented in the following manner:
It should be noted that the initialisation of this variation (step 1 above) requires register R2 to contain the value of 2.P. This value can either be pre-calculated or calculated at exponentiation time Q=d.P. In this latter case, if there is no available doubling routine, 2.P can be calculated exclusively through addition by performing ((P+T)+(P−T)) where T is a known element, distinct from P, of the subjacent group, generally an element of the public key.
The exponentiation method of the invention and its variations has the advantage of being resistant to SPA hidden channel attacks and “Safe-Error” attacks, unlike conventional exponentiation algorithms which must include counter-measures to resist these attacks.
Furthermore, and in a notable manner, the exponentiation method of the invention and its variations has the additional advantage of only performing multiplication operations (or addition operations in additive notation).
It is understood that the invention lends itself to several alternative implementation. The description has been made in the context of a chip-card type environment. It is however clear that these instructions can be applied to other applications, such as in computer terminals, network communication terminals and any other electronic device which uses cryptographic calculations.
| Number | Date | Country | Kind |
|---|---|---|---|
| 0453168 | Dec 2004 | FR | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/EP05/56663 | 12/9/2005 | WO | 00 | 6/22/2007 |
