EP1479189A1

EP1479189A1 - Cryptographic method using a data flow-symmetrical cryptographic algorithm and use in a smart card

Info

Publication number: EP1479189A1
Application number: EP03717411A
Authority: EP
Inventors: Héléna HANDSCHUH; David Pointcheval; David Naccache
Original assignee: Gemplus Card International SA; Gemplus SA
Current assignee: Thales DIS France SA
Priority date: 2002-02-21
Filing date: 2003-02-18
Publication date: 2004-11-24
Also published as: FR2836311B1; FR2836311A1; WO2003071735A1; AU2003222578A1

Abstract

The invention concerns a cryptographic method using a data block-symmetrical cryptographic algorithm such as DES in a particular sequence enabling its cryptographic strength to be increased significantly. Said method enables generating a pseudo-random number, and/or a strong random variable or data flow encryption/decryption and/or authentication of messages to be generated. It is more particularly adapted to encryption/decryption and to authentication by a smart card of data contained in a remote memory.

Description

CRYPTOGRAPHY METHOD USING A FLOW SYMMETRIC CRYPTOGRAPHIC ALGORITHM AND APPLICATION TO

A SMART CARD

The present invention relates to a cryptography method for the generation of a pseudo-random number and / or for encryption / decryption by stream and / or for data authentication, using an encryption key K and a symmetric cryptographic algorithm.

A particularly interesting application relates to chip cards which rely on a remote memory outside, typically in a card reader or in a personal computer. In this case the information contained in the remote memory is encrypted and / or authenticated.

The smart card (or more generally, the portable electronic medium) mainly contains processing means (microprocessor) and minimum necessary storage means. The remote memory contains information which can be executable code or data.

When the card needs this information, it must decrypt it and authenticate at least part of this information. It is recalled that the authentication of data makes it possible to verify that the data have not been manipulated and that the sender of this data (which affixes "the authenticator") is indeed the one expected. In the prior art, the cryptographic methods implemented in the card to decrypt and authenticate on the fly the data transmitted by the remote memory are very different. We must therefore first decipher an entire message and then authenticate at least a portion of this message. For encryption or decryption on the fly, "on the fly stream en- / decryption" in Anglo-Saxon literature, the most common solution is the use of shift registers to generate a pseudo-random mask from an encryption key, and to perform an exclusive bit-by-bit or exclusive between this mask and the data stream considered. For theft authentication, we usually use the CBC-MAC, acronym for "Cipher Block Chaining-Message Authentication Code", based on the use of the DES algorithm for each data stream, the output of a block authentication used in the authentication block of the next data stream, hence the concept of "chain". However, the data processing mechanism used in the two operations does not allow decryption and authentication to be carried out in parallel on the same data stream. Thus, in practice, we decipher an entire message, then we authenticate at least a portion of this message, which is not very effective.

In the invention, an alternative method of on-the-fly cryptography has been sought which allows decryption by streams and authentication in parallel. In the invention, a cryptography method has been sought using a symmetric flow cryptographic algorithm for encryption / decryption and for authentication. The idea underlying the invention is that by implementing the same mechanisms in the two operations, we will allow the parallel processing of the data streams to be decrypted and authenticated.

In the invention, we looked for a way to efficiently use a weak cryptographic algorithm, such as the DES ("Data Encryption Standard"), the implementation of which is inexpensive (in computation time and in memory need especially) . The idea behind the invention is to increase the cryptographic strength of this algorithm using a special mechanism.

In the invention, a solution has been sought to these various technical problems.

As characterized, the invention therefore relates to a cryptography method for the generation of a pseudo-random number and / or for encryption / decryption and / or for data authentication, using an encryption key K and an algorithm symmetric flow cryptographic, characterized in that it comprises the following stages:

-concatenation of an index provided by a counter with a first subkey, to form a first datum of length 1,

application of said first datum at the input of an encryption block corresponding to the symmetric cryptographic algorithm, with a second subkey of length k, to output a second datum,

realization of a bit-by-bit exclusive OR of said second datum with a third key of length 1, in order to provide a pseudo-random datum as a function of the encryption key K formed of said first, second and third sub-keys.

This process makes it possible to decrypt and authenticate the same message stream in parallel. This saves time and has a much simpler management of the data in the remote memory, recovered by the smart card.

This method can use for decryption a symmetric cryptographic algorithm primitive (executable code implemented in the smart card) already implemented for authentication, which reduces the memory space necessary for the corresponding executable code, and which also simplifies the setting implementation of the process (only one code to test).

In addition, advantageously, by applying as input the decryption method according to the invention, physical hazards of the card, a hazard generator is obtained which is much stronger cryptographically, and this at a lower cost.

Other characteristics and advantages of the invention are detailed in the following description, by way of non-limiting illustration and with reference to the appended drawings in which: FIG. 1 represents a flow diagram of the generation of a pseudo-random number and of stream decryption of a message m according to the method of on-the-fly cryptography of the invention; and

FIG. 2 represents a flowchart corresponding to authentication by flow of the message m, according to the on-the-fly cryptography method according to the invention.

In FIG. 1, the sequence for decrypting the streams mi and mi ₊ i of a message m has been represented according to the cryptography method of the invention, using an encryption block E, of size 1, and an encryption key. K of size greater than 1. The encryption block E corresponds to a symmetric cryptographic algorithm per block. This is for example the DES algorithm. The size of the block (number of bits entering and leaving the block) corresponds to the length of the mi message block.

This sequence includes generating a pseudo-random number from the index of message blocks. This index is equal to i for the ith block mi of the message m. It is this pseudo-random number which serves as a mask for the message flow to be deciphered.

The sequence for generating the pseudo-random number for the message stream mi is as follows:

-concatenation of the index i, supplied by a counter not shown, with a first subkey K2 of the encryption key, to form a first datum Dl = (i // K2) of length 1;

application of this first datum Dl of length 1 at the input of an encryption block E of the symmetric cryptographic algorithm, with a second subkey Kl of length k, to supply a second datum D2 = E (Kl, i // K2),

realization of a bit-by-bit exclusive OR of this second datum D2 with a third subkey K3 of length 1, to provide a pseudo-random datum D _a i _éa -i = F (K, i).

This pseudo-random datum obtained from the value i of the index is a function of the cryptographic algorithm used (encryption block or primitive E) and of the encryption key K formed of the three subkeys K1, K2, K3 .

In the following, for the sake of simplicity, the term "index" can denote both its function and its value. In practice, the index and subkey K2 each have a length of 1/2 bit and the subkey K3 has a length of 1 bit.

The strength of the symmetric flow algorithm is given by the size of the encryption key it uses. In the example, this force is given by the size k of the subkey K1 used by the encryption block E.

We know how to calculate that the cryptographic strength due to the subkey K2 is equal to 1/2; and that the cryptographic strength due to the subkey K3 is equal to 1/2.

Thus, the cryptographic strength of the cryptography method according to the invention using an encryption key K = (K1, K2, K3) in combination with the encryption block E therefore becomes equal to k + 1. Thus, although using a so-called weak algorithm, a secure cryptography process is obtained, at a lower cost.

In a practical embodiment with a DES algorithm with a cryptographic strength k equal to 56 bits, there will be 1 typically equal to 64 bits. The cryptographic strength of a method according to the invention is then 120 bits, with an encryption key K of 152 bits. We have seen that the contribution of the subkey K3 to the strength of the DES algorithm is limited to 1/2. Also, we will preferably form the subkey-K3 from a key k3 of size 1/2, which we concatenate with itself: K3 = k3 // k3. We thus have a corresponding memory space gain of 1/2 bit (we memorize k3, but we use K3).

We have seen that the flight cryptography method according to the invention provides a pseudo-random datum Daiea-i to. from the message stream index. This pseudo-random datum D _a iéa-i is used to mask the corresponding message flow mi. We therefore perform a bit-by-bit Exclusive OR, operation noted ®, between this pseudo-random datum and the message stream to be deciphered mi. The corresponding decrypted data stream, dci, is obtained at output. For the following stream of message rrii ₊ i, of index i + 1, we have the same decryption sequence. Thus, from stream to stream, we decipher the entire message m.

The cryptographic method which has just been described in relation to FIG. 1, thus comprises a method allowing the generation of a pseudo-random number Daié _a -i _/ from a simple index, that is to say in other words the content of a counter incremented with each new message flow. The decryption method comprises the sequence of supplying this pseudo-random number, which serves as a mask for the message stream to be decrypted, and which is therefore used in the bit-by-bit exclusive OR operation with this message stream. This method can also be used as an encryption method, to encrypt a message, for example if the card wants to record information in the remote memory.

Advantageously, the pseudo-random number generated according to the method of the invention can be used in the same way as in the decryption method, but to generate a strong random, from the cryptographic point of view, from a weak random , typically a physical hazard. By physical hazard is meant a hazard provided from physical characteristics, such as an electromagnetic field or the like. These physical hazards are linked to the physical structure of the circuit that generates them. They are often used in smart cards. But these are weak uncertainties on the cryptographic level. By applying a physical hazard Alea-φ at the input instead of a message stream mi, we obtain a strong hazard Alea-φF at output.

Thus, the cryptography method according to the invention allows three independent applications: the generation of a pseudo-random number D _a iéa-i / le encryption / decryption by mi message flow, and the generation of a strong hazard from a weak hazard.

FIG. 2 represents a typical example of a method of authentication on the fly of the CBC-MAC type. For each flow of a message to be authenticated, the same encryption block E is usually used with the same authentication key K4, except for the last flow which must use either at least one different authentication key and / or a block different encryption. One can also have for the last block, the use of a combination of encryption blocks, at least one of which is different from that used for the preceding blocks.

In the example, the message to be authenticated comprises p message blocks m _x to m _p .

The description of an authentication sequence

(other than the last) is as follows: at the input of the authentication sequence, there is the message block mi. A bit-by-bit exclusive Or is performed between this message block and the authentication data item ai-α _. provided by the previous authentication sequence (for the rrii-i block. The data obtained is applied at the input of the encryption block E, using the authentication key K4. At the output of this block, an authentication data is obtained This corresponding authentication datum is supplied to the following authentication sequence, in order to perform an exclusive bitwise operation with the following message block mι ₊ ι.The last authentication sequence applied to the last message block m _p is different in this that it uses, for example, a different authentication key K5; or that it successively applies the encryption block E with a first key, for example K4, then subsequently with another key, for example K5; or that the encryption block is different; or that it uses a combination of these different variants. In FIG. 2, the last authentication sequence uses the encryption block E with an authentication key K5, different from K4, for the last data stream m _p .

Such chain authentication methods are part of the state of the art.

But the advantage which one derives from a cryptography method according to the invention is that after the reception of a new message block mi, it is possible to carry out the decryption and the authentication in parallel. Furthermore, it is possible to use only one and the same encryption block E for the two methods, or a limited number of encryption blocks. This saves computation time and working memory space and executable code memory space.

The invention which has just been described is not limited to the use of DES, as a symmetric flow cryptographic algorithm. For example, you can also use the AES algorithm. The advantage of DES is that it requires little computing power and little memory space (executable code).

This invention applies in all cases where one wants to use a cryptographically weak algorithm, in general for reasons of means of limited processing or reduced available computing time, while having a very secure cryptography process.

It also applies advantageously in all areas where it is sought to achieve different independent functions at lower cost. We have seen that the cryptography process made it possible to reinforce a physical hazard, to encrypt / decrypt and authenticate messages and to generate pseudo-random numbers.

This invention is particularly applicable in the field of smart cards or more generally portable electronic devices using a remote memory, which requires the decryption and authentication of the data contained in this memory.

Claims

1. Cryptography method for the generation of a pseudo-random number and / or for encryption / decryption by flow and / or for data authentication, using an encryption key K and a symmetric block cryptographic algorithm, characterized in that it includes the following steps:

-concatenation of an index (i) provided by a counter with a first subkey (K2), to form a first datum (Dl) of length 1,

application of said first datum at the input of an encryption block (E) of said symmetric cryptographic algorithm, with a second subkey

(Kl) of length k, to provide a second datum (D2) as an output,

-realization of an exclusive bit-by-bit OR of said second datum with a third key (K3) of length

1, to output pseudo-random data (D _a ι _éa -i) as a function of the encryption key K formed from said first, second and third sub-keys.

2. Cryptography method according to claim 1, characterized in that said index (i) and said second subkey (K2) have a length 1/2.

3. cryptography method according to claim 1 or 2, characterized in that said third subkey (K3) is formed by concatenating twice the same key (k3) of length 1/2.

4. Cryptography method according to any one of the preceding claims, characterized in that for the decryption of a message m by blocks of length 1, it comprises for each message block the production of an exclusive bit-by-bit OR between the message block considered (τ ±) of index i and the pseudo-random datum (D _a i _éa -i) calculated from said index of the block in the message flow.

5. Cryptography method according to the preceding claim, characterized in that it comprises, for each message block mi to be deciphered, the authentication in parallel of said message block.

6. Cryptography method according to the preceding claim, characterized in that said authentication comprises the use of the same encryption block (E) of said cryptography algorithm.

7. Cryptography method according to the preceding claim, characterized in that said authentication comprises the use for at least the last message block, of a different authentication key, and / or of a different encryption block of said algorithm cryptography.

8. Cryptography method according to any one of claims 1 to 3, characterized in that it comprises the realization of an exclusive bit-by-bit OR of said pseudo-random datum (D _a iéa-i) with a physical random (Aléa-φ) to provide an output with a cryptographically secure hazard (Aléa-φF).

9. A cryptographic method according to any one of the preceding claims, characterized in that said symmetric cryptographic algorithm is the DES.

10. Cryptography method according to any one of the preceding claims, characterized in that said symmetric cryptographic algorithm is AES.

11. Chip card or portable electronic device comprising data processing means, storage means and at least one counter, characterized in that it implements a cryptography method according to any one of the preceding claims.

12. Chip card or portable electronic device according to the preceding claim, said storage means comprising remote memory on another physical medium, characterized in that it implements said cryptographic method to decrypt the information contained in said remote memory or to authenticate at least a portion of this information.