EP2803161A1

EP2803161A1 - Method of encryption protected against side channel attacks

Info

Publication number: EP2803161A1
Application number: EP12821282.6A
Authority: EP
Inventors: Benoit Feix; Mylène Roussellet
Original assignee: Inside Secure SA
Current assignee: Inside Secure SA
Priority date: 2012-01-11
Filing date: 2012-12-21
Publication date: 2014-11-19
Also published as: US20140351603A1; FR2985624B1; WO2013104837A1; CN104094553B; WO2013104837A8; FR2985624A1; CN104094553A

Abstract

The invention relates to a method of symmetric block encryption (CP3) executed by a microcircuit, for transforming a message (M) into an encrypted message (C), on the basis of a secret key (K, Ko), comprising a first round (RD-i), intermediate rounds (RD2, RD|, RDNM) and a last round (RDNr). According to the invention, the method comprises several executions (N1, ΝΝ,) of the first and of the last round, and a number of executions (Ni) of at least one intermediate round (RDj) which is less than the number of executions (N1, ΝΝΓ) of the first and last rounds. Application in particular to DES, triple DES, and AES methods.

Description

METHOD OF ENCRYPTION PROTECTED AGAINST

AUXILIARY CHANNEL ATTACKS

The present invention relates to a method of block ciphering executed by a microcircuit and protected against attacks by auxiliary channels, for the transformation of a message into an encrypted message, from a secret key.

The present invention particularly relates to smart card integrated circuits or hardware cryptographic components integrated on the motherboards of computers and other consumer electronic and computer equipment requiring security means (USB sticks, TV channel decoders, game consoles, etc.), known as "TPM" (Trusted Platform Module).

Such microcircuits are equipped with a CPU (central processing unit) which generally comprises an 8-bit CISC core or an 8, 16 or 32-bit RISC core. Some are equipped with a coprocessor dedicated to cryptographic computation, for example a DES (Data Encryption Standard) or AES (Advanced Encryption Standard) coprocessor. They have thousands of logical gates that switch differently depending on the operations performed. These switches create variations in current consumption of short duration, for example of a few nanoseconds, which are measurable. In particular, CMOS integrated circuits comprise logic gates that only consume current when they are switched, corresponding to the transition to 1 or 0 of a logical node. Thus, power consumption depends on the data handled by the CPU and its various peripherals: memory, data traveling on the data or address bus, cryptographic coprocessor, etc.

Such microcircuits are subjected to so-called auxiliary channel attacks, based on the observation of their current consumption, their magnetic or electromagnetic radiation. Such attacks are aimed at discovering the secret data they use, including their cryptography keys. The most common auxiliary channel attacks implement statistical analysis methods such as DPA ("Differential Power Analysis") or CPA ("Correlation Power Analysis") analysis. The DPA analysis makes it possible to find the key of a cryptographic algorithm thanks to the acquisition of numerous consumption curves of the circuit. The CPA analysis is based on a linear model of current consumption and consists in calculating a correlation coefficient between, on the one hand, the measured consumption points which form the captured consumption curves and, on the other hand, a value consumption estimate, calculated from the linear consumption model and a hypothesis on the operation performed by the microcircuit and on the value of the cryptographic key.

In order to protect such microcircuits and the encryption methods they perform against such auxiliary channel attacks, countermeasures are generally provided. The most commonly used countermeasures are masking or multiple execution. A masking countermeasure uses a random mask (binary number) that is combined with the key and / or message during the execution of the encryption process. This type of countermeasure is effective but requires a coprocessor specially designed for its implementation, in the case of execution by a coprocessor, or a program of greater complexity, in the case of execution by the CPU of the microcircuit.

On the contrary, a multiple execution countermeasure can be implemented with a conventional coprocessor that does not include countermeasure means. It simply consists in executing the encryption process several times by means of false keys. For this purpose, for example, there is provided a countermeasure program which controls the encryption program or the coprocessor, and makes it execute the encryption process several times with the false keys, so that the execution of the encryption process with the right key (ie the authentic key) is "drowned" in a set of dummy executions. The present invention more particularly relates to multiple execution countermeasures applied to symmetric type block ciphering methods such as the DES, TDES and AES methods. These classic countermeasures will be better understood after recalling the structure of these encryption methods.

FIG. 1A schematically shows the architecture of a block ciphering method CP1. The process is symmetric, which means that it uses the same secret key for encryption or decryption. The method receives as input a message M and a secret key K, and provides an encrypted message C. It comprises Nr round RDi,

RÛ ₂ ... RD RD _Nr- i, RD r executed successively. Between the first round RDi and the last round RDN, -, the method comprises intermediate rounds RD ₂ , ... RD ,, ... RDN - The method may also include an initial operation IO to prepare the message before the execution of the rounds, by means of a first transformation function, and a final operation FO to transform the result of the last round by means of a second transformation function, to obtain the encrypted message C.

Each round RD, (i being considered here as an index ranging from 1 to Nr) generally uses a subkey SK, derived from the key K or derived from the subkey used by the previous round. Each round provides the next round a secret intermediate result that is not accessible to an attacker, this result being for example stored temporarily in a protected memory. Thus, the first round RD ₁ receives, as input data, the message M or a data item resulting from the message transformation by the initial operation I0, and provides a first secret intermediate result to the next round RD ₂ . Each intermediate round RD, receives as input the secret intermediate result provided by the previous round, and provides a secret intermediate result to the next round. The last round receives as input the intermediate secret result provided by the last round RDN and provides a final result forming the encrypted message C or forming the encrypted message after transformation by the final operation FO.

The number of rounds is predetermined by standards, and is for example equal to 16 in the case of the DES process, 48 in the case of the TDES process, 10 in the case of the AES 128 process, 12 in the case of the AES 192 process and 14 in the case of the AES 256 method. Similarly, the standards define the structure of the rounds, that is to say the encryption operations they comprise. As illustrated schematically in FIG. 1B, each RD round generally comprises sub-rounds SRD1, SRD2, .... SRD _n . For example, each RD round of the DES process includes four PermutationExpansive, OR Exclusive, Substitution, and SimpleSwap sub-rounds.

As another example, FIG. 2 represents in the form of a flowchart "AES1" the classical structure of an AES encryption method. The method comprises an initial operation comprising the operation "AddRoundKey" using a first sub-key SK ₀ , nine rounds RD, (RD † to RD ₉ ) using nine other sub-keys SK, and each comprising four sub-rounds "SubBytes", "ShiftRows", "MixColumns" and "AddRoundKey", and one last round RDi ₀ including three sub-rounds "SubBytes", "ShiftRow" and "AddRoundKey" using a tenth sub-key SK ₀ .

FIG. 3 schematically represents an example of method CP2 protected against attacks by auxiliary channels by the multiple execution technique. The method comprises an initial step of generating N1 -1 false keys K ₁ , K ₂ , K _N ii, the correct key K being for example the key K ₀ . The method CP2 comprises N1 executions of the method CP1 of FIG. The CP1 process is executed a first time with the key K ₀ , then with the first false key Ki, then the second false key K ₂ , etc. until the N1 th execution with the KNI-I key. Each execution provides a result Co, CI, ... CNI-I from the corresponding key and message M. Only one of these results is valid and the others are dummy. The order in which the keys are used is random (the regular order shown in Fig. 3 being just an example) so that an attacker does not know which run uses the correct key.

However, this solution has the disadvantage of being penalizing in terms of the execution time of the encryption method. The multiple executions of the CP1 encryption method greatly slow the time of providing the result even when a processor or a fast coprocessor is available. Thus, for example, when N1 = 8, the countermeasure requires the execution of 128 rounds for a DES process and 384 rounds for a TDES process. If N1 = 32, the countermeasure requires the execution of 512 rounds for a DES process and 1536 rounds for a TDES process.

It may therefore be desirable to provide an encryption method including a multi-execution countermeasure which requires less computation time while offering good protection against attacks by auxiliary channels.

Embodiments of the invention relate to a symmetric encryption method executed by a microcircuit, for transforming a message into an encrypted message, from a secret key, comprising a first round, intermediate rounds and a last round, comprising several executions of the first and last round, respectively from the secret key and a first set of false keys, and a number of executions of at least one intermediate round less than the number of executions of the first and last rounds, respectively from the secret key and a set of false keys included in the first set of false keys.

According to one embodiment, the method comprises a second round, a penultimate round and several intermediate rounds, the first two rounds are executed a greater number of times than the intermediate rounds, and both last rounds are executed more times than the intermediate rounds.

According to one embodiment, the method comprises only one execution of at least one intermediate round.

According to one embodiment, the method comprises, for a determined number of successive rounds starting from the first, a number of executions of the decreasing rounds according to a rule of decay which is a function of the rank of the rounds considered relative to the first round, then, for a given number of successive rounds until the last one, a number of executions of the rounds growing according to a rule of growth which is function of the rank of the rounds considered relative to the last round. According to one embodiment, the decay rule is a rule in 1 / (2n), where n is a parameter depending on the rank of the rounds considered relative to the first or the last round.

According to one embodiment, each round includes sub-rounds, and the multiple execution of each round includes the multiple execution of each sub-round of the round.

According to one embodiment, each round includes sub-rounds, and the multiple execution of a round includes the multiple execution of at least one sub-round, and a single run of at least one other sub-round .

According to one embodiment, the single execution of the sub-round is a masked execution in single or multiple order. According to one embodiment, the multiple execution of the sub-round is a masked execution in simple order.

According to one embodiment, the method complies with the DES, triple DES, or AES specifications.

Embodiments of the invention also relate to a microcircuit configured to execute a symmetric encryption method, making it possible to transform a message into an encrypted message, from a secret key, the method comprising a first round, intermediate rounds, and a last round, the microcircuit being configured to execute several times the first and the last round, respectively from the secret key and a first set of false keys, and to execute at least one intermediate round a number of times lower the number of executions of the first and last rounds, respectively from the secret key and a set of false keys included in the first set of false keys.

According to one embodiment, the microcircuit is configured to execute only once at least one intermediate round.

According to one embodiment, the microcircuit is configured to execute rounds comprising sub-rounds, and to execute the same number of times all the sub-rounds of a round, during a multiple execution of a round. According to one embodiment, the microcircuit is configured to execute rounds comprising sub-rounds, and to execute only once at least one sub-round and execute several times another sub-round, during an execution. multiple of a round. According to one embodiment, the microcircuit comprises a modular coprocessor configured to execute individually encryption operations included in sub-rounds. Embodiments of encryption methods and a microcircuit according to the invention will be described in the following with reference to nonlimiting reference to the appended figures, among which:

FIG. 1A previously described represents the structure of a conventional round ciphering method,

FIG. 1B previously described represents the structure of a round of the process of FIG.

FIG. 2 previously described represents the structure of a conventional AES encryption method,

FIG. 3 previously described represents the structure of a conventional encryption method protected against attacks by auxiliary channels,

FIG. 4 represents the structure of an embodiment of an encryption method according to the invention,

FIG. 5 illustrates an advantage of the method of FIG. 4,

FIG. 6 represents the structure of an AES encryption method according to the invention; FIG. 7 represents the structure of another embodiment of an encryption method according to the invention, and

FIG. 8 represents an embodiment of a secure microcircuit according to the invention. Embodiments of the invention include the finding that all rounds of a symmetric encryption method do not require the same level of protection against aux channel attacks. The rounds most exposed to this type of attack and especially to an attack by DPA or CPA analysis are first of all the first round and the last round. Indeed, a DPA or CPA analysis can not be conduct against a round only if an entry or exit data of the round is known to the attacker, the key being the object of the attack.

However, with reference to FIG. 1A previously described, the first round RD-i receives input data that is known to an attacker. This is the message M or data resulting from the transformation of the message by the initial operation IO. The initial operation is also known to the attacker because described by applicable standards, the input data can be calculated from the message if it is not the message itself. Similarly, the last round RD _Nr provides a result known to the attacker. This is the encrypted message C or data whose encrypted message C is issued, after transformation of the data by the final operation FO. Since the final operation is also known to the attacker, this data can be retrieved from the encrypted message C, by means of the inverse function of the function used by the final operation FO. Thus, an attack on the intermediate rounds, especially from the third round or before-before-last round, is too complex to be possible today without a prior attack on the first two or two last rounds.

Embodiments of the invention thus relate to an encryption method in which the number of executions of the intermediate rounds RD, (RD2, RD3, ... RDj, RDN) is smaller than the number of executions of the first and the last round, to reduce the total number of round runs and reduce the overall execution time of the encryption process. In embodiments, the second and second-last rounds RD ₂ , RD _N are considered more exposed to attack than other intermediate rounds, and are executed more times than other rounds. intermediate. In still other embodiments, "central" intermediate rounds (ie those furthest away from the first and last rounds) are executed only once. By way of example, FIG. 4 schematically shows the structure of a block encryption method CP3 according to the invention, of symmetrical type, protected against attacks by auxiliary channels. In a conventional manner, the method provides an encrypted message C, from a message M and a secret key K, and comprises Nr rounds RD-i, RD _2l ... RD, ... RD _Nr - i, RDNr- The method may comprise an initial operation IO for preparing the message M before the execution of the rounds, and a final operation FO for transforming the result of the last round by means of a known transformation function, for obtain the encrypted message C. It also comprises an initial step of generating N1 -1 false keys Ki, K ₂ , ..., KNI-I in addition to the secret key K. The key K is for example considered as the key of rank 0 (K ₀ = K). The method thus uses an initial set of N1 keys Kj (K ₀ , Κ-ι, K ₂ , ..., KNI-I) in which only the key Ko is authentic.

According to the invention, the method CP3 comprises the following steps:

the round RDi is executed N1 times by means of N1 subkeys SK- (SK-i, ₀ , SKi _, i, SK-1, 2, ..., SK-I, NI-I) generated from the initial set of N1 keys Kj (K ₀ , KL K ₂ , ..., KNM),

the round RD ₂ is executed N2 times, with N2 <N1, by means of N2 subkeys SK _{2 j} (SK ₂ , o, SK ₂ , -I, SK _{2 2} , ..., SK _{2 N 2 -i} ) generated from a subset of key N2 K _j (Ko, Ki, K ₂ , ..., KN ₂ -I) which is included in the initial set of key N1,

- etc.,

the round RD, is executed N, times, with N, <, Ν being the number of executions of the preceding round, by means of N, subkeys SKg (SK _ii0 , βΚ ,, ι, SKi, ₂ , ..., SKi, _N ii) generated from a set of N, keys K _j (Ko, Ki, K ₂ , ..., KNM) which is included in the initial set of N1 keys,

- etc.,

the round RD _Nr- i is executed N _Nr -i times, with N _Nr -i ≥ N _NR -2, N _Nr-2 being the number of executions of the previous round, by means of N _N sub-keys SK _Nr -i, j (SK _Nr- i, o _> SK _Nr -i, i, SK _Nr -i, 2 SK (Nr-1, N _Nr -i-1) generated from a set of NN keys Kj (K ₀ , K ₁ , K ₂ , ..., K (N N -1)) which is included in the initial set of N 1 keys, and the last round RD _Nr is executed N _Nr times, with ΝΝ _Γ ≥ N _Nr -i, by means of ΝΝ _γ subkeys SK _Nr , j (SK _Nr , o, SK _Nr , i, SKNr, 2, -. - _> SK (Nr, NNr1)) generated from a set of ΝΝ _Γ keys Kj (K ₀ , Κ-ι, K ₂ K (NN)) which is included in the initial set of N1 keys. The relationship between the number of executions of each RD round is governed by a first countermeasure rule, which can be formalized in the manner indicated below, reference being made to rounds RD-ι, RD ₂ , RD ₃ , RD ₎ ... RD RD _Nr -3 _> RD _Nr -2,

RD _Nr- i, RDNr some of which are not shown in Figure 4: Rule 1:

- N1> N2> N3> N4 ...> Ni with at least N1> N2 or N2> N3,

- N _N ≥ NN ≥ ΝΝΓ-2-≥ ΝΝΓ-3 ■ ■ ■ ≥ i with at least N _Nr > N _Nr -i or N _Nr- i> N _Nr -2- Examples:

- N1>N2>N3> N4 ...> Ni and N _Nr > N _Nr-1 > N _Nr - ₂ ≥ N _Nr-3 ...> Ni

- N1 = N2>N3> N4 ...> Ni and N _Nr = N _Nr -i> N _Nr-2 . >. N _Nr-3 ...> Ni

- N1> N2 = N3> N4 ...> Ni and N _Nr > N _N = N _Nr -2.≥ N _Nr -3 -≥ Ni

- N1>N2> N3 = N4 ... = Ni and N _Nr > N _Nr-1 > N _Nr - ₂ = N _Nr-3 ... = Ni

In some embodiments, the distribution of the number of executions could be different on the first and last rounds, for example:

- N1>N2>N3> N4 ...> Nj and N _Nr = NN> N _Nr -2≥ N _Nr-3 ...> Ni According to a second rule of countermeasure, optional, defining a kind of "symmetry of the process in relation to central rounds, the number of performances in the last round is equal to the number of performances in the first round, the number of performances in the second round is equal to the number of performances in front - last round, and so on until a certain "distance" of the first and last rounds. This rule can be formalized in the manner indicated below. Rule 2

If i <Is, then N, = N _Nr -i + i,

Is being a threshold defining the "distance" of a round relative to the first and last rounds.

Example:

- N1 = N _Nr

- N2 = NN

- N3 = N _Nr-2

- etc. to the threshold Is.

The threshold Is can be chosen greater than the number of rounds to obtain a total symmetry of the process with regard to the number of execution of the rounds, relative to the central rounds.

According to a third rule of countermeasure, also optional, designated "Rule 3", the execution of certain intermediate rounds is not repeated, in particular that of the central rounds. For the implementation of this rule, we define a number of rounds to protect relative to the first and last round, designated "NRtoP". The number of rounds to be protected represents the number of rounds to be executed several times. Rounds that do not belong to the group of rounds to be protected are considered as "central" rounds and are executed only once, with the correct key Ko (ie the authentic key). Rule 3 can be formalized as indicated below.

Rule 3:

NRtoP = number of rounds to protect

If i> NRtoP and i <Nr-NRtoP, then Νρ1 Numeric example in the case of an encryption method comprising 16 rounds RDi to RD ₁₆ (Nr = 16):

NRtoP = 3 (i.e. 3 rounds to protect),

If i> 3 and i <16-3 (ie i <13), then N, = 1

In this case, rounds RD ₄ , RD ₅ , RD ₆ , RD ₇ , RD ₈ , RD ₉ , RD ₁₀ , RDn, RD 1 ₂ , RD 13 are only executed once. In some embodiments, the number of executions N, of each round RD, (for i ranging from 1 to Nr) can be determined by means of a relation which is a function of the rank i of the round considered. Rule 4 below is an example of a relation in 1 / (2 ⁿ ), where n is a variable function of i. Rule 4 includes Rule 2 with respect to rounds to be protected and includes Rule 3 with respect to rounds that are not to be protected.

Rule 4:

NRtoP = number of rounds to protect

For i from 1 to Nr do:

If i <NRtoP then n = i-1 and Nj = N1 / (2 ⁿ )

If not :

If i> Nr-NRtoP then n = Nr-i and N | = N1 / (2 ⁿ )

If not :

Ni = 1 (Rule 3)

Rule 4 can be formulated more simply by the operator "min" (i.e. "minimum of"):

NRtoP = number of rounds to protect:

For i from 1 to Nr do: If i <NRtoP or i> Nr-NRtoP, do:

n = min (i-1, Nr-i)

N | = N1 / (2 ⁿ )

If not :

(Rule 3)

Reference is now made to Appendix 1, which forms an integral part of the description. Table 1 of Annex 1 describes a numerical example of the application of Rule 4, with Nr = 16 and NRtoP = 3. If N1 = 8, it follows that: N2 = 4, N3 = 2, N4 to N13 = 1, N14 = 2, N15 = 4 and N16 = 8. If N1 = 16, it follows that N2 = 8, N3 = 4, N4 to N13 = 1, N14 = 4, N15 = 8 and N16 = 16.

Table 2 of Annex 1 describes embodiments CP31, CP32, CP33, CP34, CP35, CP36 of the CP3 encryption method implementing Rules 1 and 2. These embodiments relate to a 16-round encryption method. (Nr = 16), for example the DES method. The maximum execution number N1 is equal to 8 for the embodiments CP31 to CP34, CP36, and is equal to 12 for the embodiment CP35. The embodiment designated by the reference CP30 does not implement rule 1 and is not considered to be included in the invention since it provides no advantage in terms of calculation time. It represents the number of round executions that would require a conventional countermeasure consisting of 8 successive executions of the encryption process, which would require 8 * 16 or 128 rounds executions.

In Table 2, the column T gives the total number of execution of rounds, the column CT gives the calculation time of each embodiment CP31 to CP36 relative to the calculation time of the embodiment CP30, in percentage, or time relative calculation. This relative calculation time CT is equal to the total number of execution of rounds divided by the total number of rounds execution in the case of embodiment CP30, ie (T / 128) ^* 100. Column G or "Gain time "is the complement to 100 of the relative computation time CT, ie G = 100 - CT. Embodiments CP34, CP35, CP36 also implement rule 3 (no multiple execution of some central rounds) and embodiment CP36 also implements rule 4 with NRtoP = 3 and Nr = 8. These examples show that the time saving depends both on the distribution of the number of executions of the intermediate rounds and the maximum number of executions of the first and the last round. For example, the embodiment CP35 in which N1 = 12 offers a time saving of 55% greater than the time saving of 44% offered by the embodiment CP33 in which N1 = 8, because the rounds 6 to 11 are not executed once.

In an alternative embodiment, the rule 3 is modified so that the number of executions of the "central" rounds is fixed but greater than 1, which corresponds for example to the embodiments CP31 and CP32 where the central rounds are executed two times.

As another example, Table 3 on page 1 of Annex 1 describes the total number T of round executions as a function of the number of rounds Nr as well as the relative calculation time CT (relative to the embodiment CP30) when the Rule 4 is used to determine the number of executions, and when the number of rounds to be protected NRtoP is equal to 4.

Still to illustrate the advantages provided by a countermeasure method according to the invention, FIG. 5 represents the curve CR1 of the total number T of round executions as a function of the number of rounds Nr when the rule 4 is used, and when the number of rounds to be protected NRtoP is equal to 4. The curve takes the form of a straight line and its slope is determined by the NRtoP parameter. By way of comparison, the curve CR2 of the total number T of round executions as a function of the number of rounds Nr is also represented in the case of a conventional implementation. Reference will now be made to Appendix 2, an integral part of the description, which describes executable algorithms as exemplary embodiments of protected encryption methods according to the invention. The sub-round operations that each encryption process performs are recalled in Tables 4 and 5 of Annex 1.

Encryption application DES

The encryption method is executed using a PDES1 algorithm ("Protected DES") and a PRDES1 algorithm ("Protected Round Protected") or round algorithm. The PRDES1 round algorithm is a sub-function of the PDES1 algorithm which is called by the latter at each new iteration of the variable i, which forms a round number.

In the PDES1 algorithm, the IP swap, IP reverse inversion, and message sharing operations in two 32-bit blocks executed in steps 3, 4, 8 are known to those skilled in the art and will not be described. in detail here. A first pair of values (L ₀ , Ro) is calculated in step 4 from the message M, after permutation thereof in step 3, for the execution of the first round by the algorithm PRDES1. Then, steps 5, 6, 6.1, 6.2, 7, and 7.1 implement rule 4 described above, and thus determine the number of executions of a round according to its rank and the NRtoP parameter. Steps 6.3 and 7.2 are calls to the round function executed by the PRDES1 algorithm.

In the PRDES1 algorithm, the cryptography tables C, D, E, F (in practice bit strings), the random permutation operations, the subkey generation, the concatenation operator "|" as well as the sub-round operations described in Table 4 of Annex 1 (expansive permutation, substitution, XOR, simple permutation) are also known to those skilled in the art. The sub-rounds 1 to 4 are included in the loop 13 and are thus repeated each as many times as the number of iterations of the variable j. The variable j has N, values determined by the PDES1 algorithm. When the algorithm PRDES1 is called by the algorithm PDES1 with Ni = 1 (steps 7.1 and 7.2), the loop 13 only includes a value of j and the sub-rounds are thus executed only once with the sub key corresponding to the correct key K ₀ .

The random permutation performed in step 12 makes it possible both to select the N, first sub-keys of the set of subkeys SK ,, o to SK _Î , NI-I to form a set of subkeys SKj , _p0 to SKj, _pj for j ranging from 0 to N _r 1, where p is an element of rank j in random permutation P. When Ν, = Ν1, all subkeys are used. When Ν, = 1; only the correct SKi.o subkey is used (ie the subkey corresponding to the correct KB key). This random permutation also makes it possible to classify the subkeys in a random order for the execution of the loop 13. Thus, the first subkey used for the first iteration (j = 0) of the loop 3 is not necessarily the subkey SK _ii0 . At each new execution of the PRDES1 algorithm, the order of use of the subkeys is therefore random.

Once the round has been repeated N times, the algorithm PRDES1 returns the pair of values (L ,, Ri) which is thus a function of the initial pair of values received at the input (L, R ^), of the number i of the round ( which determines the values of the subkeys) and the number N, of execution of the round.

In the PRDES1 algorithm, the generation of subkeys needed to execute each round, from the keys KB to KNM OR from the subkeys of a previous round, can be done in several ways:

for each key K ₁ to K _{N 1 -1} , the subkeys necessary for the execution of the rounds are generated in advance and are stored in a protected memory. This method requires some memory space, which may not be suitable for some applications,

- each time a round is played, the sub-keys needed for the round are generated on the fly according to the keys or sub-keys of the round immediately previously associated with the key being used. All subkeys are generated in each round, including those whose PRDES1 algorithm does not need to be used when the round is executed a number of times less than the number of keys, so that the PRDES1 algorithm has, for the execution of the next round, of all the previous sub-keys necessary for the generation of the subkeys of the round considered.

The second aforementioned solution has been retained here and appears in step 1 1, where N1 subkeys are generated at each round from the key N1 or subkey N1 generated during the execution of the previous round, independently the number of executions of the round considered and therefore the number of subkeys whose algorithm PRDES1 really needs for the execution of the round.

It will be noted that in the case of the DES method, known methods for generating false keys make it possible to generate all the subkeys of all the false keys from the subkeys of the authentic key. Thus, instead of generating the subkeys of a false key from the previous subkeys of the same false key, the subkeys of the false key could also be generated from the subkeys of the authentic key. . In the case of the AES method, the subkeys of a false key must instead be generated from the previous subkeys of the false key.

It will be apparent to those skilled in the art that various other algorithms embodying the principles of the invention may be provided to perform the DES method, with the PDES1 and PRDES1 algorithms being only examples.

TDES Encryption Application (Triple DES)

The encryption method according to the invention is here executed using a PTDES algorithm ("TDES Protégé") in Appendix 2 and PDES1 and PRDES1 algorithms described above. The TDES encryption conventionally comprises a first DES encryption step of the message with a first key K, ie DES (M, K), then a reverse encryption step DES ^"1 , with a second key K ', of the result of the first step or DES ^"1 (DES (M, K), K '), and finally an encryption step DES, with the first key K, of the result of the second step, that is:

OF (THE ^"1 (OF (M, K), K '), K) In PTDES algorithm, the first encryption step DES (step 20) is performed by using the PDES1 algorithm itself is call to the algorithm PRDES1, after having defined the maximum number N1 of execution of rounds and the number of rounds to protect NRtoP The second step of encryption DES ^"1 can be executed by means of a method DES ^{" 1} conventional no protected against attacks by auxiliary channels (step 21 a), or by means of the algorithm PDES1 ^"1 , the inverse algorithm of the PDES1 algorithm described in Annex 2 (step 21 b). The PDES1 ^"1 algorithm is not described in Appendix 2 but can be derived from the PDES1 algorithm by replacing the IP operation of step 3 by the IPinverse operation, and replacing the IPinverse operation of the step 8 by the IP operation, and inverting the order of use of the subkeys (ie SK ₆ to SK-i) As step 21 b provides that N1 = 1 and NRtoP = 0, algorithm PDES1 ^"1 is not protected and is equivalent to a method DES ^{" 1.} Finally, the last step of DES encryption (step 22) is protected and is executed using the algorithm PDES1 which itself call to the PRDES1 algorithm, defining the maximum number N1 of round execution and the number of rounds to protect NRtoP Application to AES 128 encryption The example described in Annex 2 concerns the 10-round AES 128, but the invention can also be applied to the 12-round AES 192 and the 14-round AES 256. The method is executed using a PAES1 ("Protected AES") algorithm and a PRAES1 ("Protected AES Round") algorithm or round algorithm. The PRAES1 algorithm is a sub-function of the PAES1 algorithm which is called by the latter at each new iteration of the round number i. In the PAES1 algorithm, the steps 33, 34, 34.1, 34.2, 35, 35.1 implement the rule 4 described above, and thus determine the number of executions of a round according to its rank and the NRtoP parameter. . Steps 34.3 and 35.2 are calls to the round function performed by the PRAES algorithm. The PRAES1 algorithm executes the sub-round operations described in Table 5 in Appendix 1 (AddRoundKey, SubByte, ShiftRow and MixColumn), as known to those skilled in the art. The structure of the rounds executed by the algorithm PRAES1 is represented in FIG. 6 in the form of a flowchart "AES2". The flow chart AES2 differs from the flow chart AES1 of FIG. 2 in that the sub-rounds have been rearranged for convenience so as to eliminate the initial operation IO comprising the operation AddRoundKey. The operation AddRoundKey is integrated in the first round RD1, and at the beginning of each following round, so that it implicates, in each next rank round ij a subkey SKi.-i _j of rank i-1, j. The AddRoundKey operation is followed by the SubByte, ShiftRow, and MixColumn operations in Rounds RD1 through RD9. The last round RD10 includes two executions of the AddRoundKey operation involving the last two subkeys SK ₉ and SKi ₀ of the current key of rank j. Between these two operations are executed the operations SubByte and ShiftRow. Those skilled in the art can of course provide any other round structure meeting the specifications of the AES. In the PRAES1 algorithm, the AddRoundKey, SubByte, ShiftRow sub-rounds are included in the iterative loop 43 and are thus repeated each as many times as the number of iterations of the variable j. The MixColumn operation is also included in the loop 43 for any value of the round number i different from 10. The loop 43.6 is executed when i is equal to 10 and is included in the loop 43 only for the round 10. It includes a next generation of subkeys (step 43.6.1) and the second execution of the AddRoundKey operation (step 43.6.2).

As before, the random permutation operation executed in step 42 makes it possible both to select the N, the first subkeys of the set of subkeys SKi, ₀ to SKj Ni-1 to form a set of sub-keys. SK _iiP o to SK _iiPj for j ranging from 0 to Nj-1. When Nj = N1, all subkeys are used. When ; only the right sub-key SKj, ₀ is used (ie the subkey corresponding to the correct key K ₀ ). This random permutation operation also makes it possible to classify the subkeys in a random order for the execution of the loop 43.

It will be apparent to those skilled in the art that various other algorithms embodying the principles of the invention may also be provided for performing the AES method.

Embodiments of the invention based on the concept of modularity

In embodiments of the invention based on the concept of modularity, the multiple execution of a round includes:

- the multiple execution of one or more sub-rounds of the round considered,

- a single execution of one or more other sub-rounds of the round considered.

The rules described above, relating to the determination of the number of executions of each round, are preserved, but the way in which each round is executed several times is modified. In other words, each subset round, and more particularly each encryption operation that includes each sub-round, is considered a "module" likely to a number of executions of its own. By way of example, FIG. 7 represents an encryption method CP4 according to the invention, for example the DES method. The method CP4 is built on the same model of multiple execution of the rounds that the CP3 process, and differs from it by the fact that only the sub-round SRD3 of each round RD-i, RD ₂ RD _Nr is executed several times. The method CP4 thus comprises the following steps:

- the sub-round SRD3 of the round RD- _\ is executed N1 times while the other sub-rounds are executed only once with the key K ₀ ,

- the sub-round SRD3 of the RD ₂ round is executed N2 times, with N2 <N1, while the other sub-rounds are executed only once with the key KB,

- etc.,

- the sub-round SRD3 of the round RD, is executed N, times, with N, <Ν ι (NM being the number of executions of the preceding round) while the other sub-rounds are executed only once with the key K ₀ ,

- etc.,

- the sub-round SRD3 of the penultimate round RD _Nr- i is executed N _Nr -i times while the other sub-rounds are executed only once with the key Ko, and

- the sub-round SRD3 of the last round RD _Nr is executed N _Nr times, with N _Nr ≥ N _Nr -i, while the other sub-rounds are executed only once with the key Ko-

This embodiment makes it possible to accelerate the execution time of the encryption process even more, by limiting within the rounds executed several times the number of sub-rounds which are themselves executed several times. It can include the prediction of several independent hardware functions or "hardware modules" each executing a sub-round or a sub-round operation, instead of a single round hardware function containing all sub-rounds. This modularity makes it possible on the one hand to multiply the calls to the sub-functions during a round and to vary the number of these calls according to the round in which one is, but also to define sub-functions usable by several encryption methods. In other words, instead of providing a coprocessor dedicated to a specific encryption method, embodiments of the invention provide several hardware accelerators used by several encryption methods, each implementing a sub-round operation. Thus, in the example shown in FIG. 7, each sub-round SRD1 to SRD4 can be executed by means of a dedicated hardware accelerator.

As a precaution, a countermeasure may be provided to protect sub-rounds that are only executed once against auxiliary channel attacks. This countermeasure can in particular be a countermeasure by masking. Thus, in Figure 7, the SRD1 sub-round, SRD2, SRD4 of RDi round are protected by a random mask U1, the SRD1 sub-round, SRD2, SRD4 DR Round ₂ are protected by a random mask U2 etc., and the sub-rounds SRD1, SRD2, SRD4 of round RD _Nr are protected by a random mask LV-

The choice of the protection mode of a sub-round, by masking or multiple execution, can be made according to the nature of the operation that includes sub-round. We distinguish for this purpose the sub-rounds that include a linear operation and those that include a non-linear operation in the mathematical sense of the term. In particular, an operation whose execution rests on a determined table, stored in memory, is non-linear.

Example of masking a linear operation:

- M is a message,

- K is a secret key.

- Normal operation: C = M XOR K (combination of the message with the key)

- Protected operation (hidden): At each iteration, randomly draw a mask U having the same number of bits as the message M,

Calculate C = M XOR U (masking of the message M with the mask U),

Calculate C = C XOR K (combination of the message masked with the key),

Calculate C = C XOR U (unmasking)

The protected operation produces the same result as the unprotected operation.

Example of masking a nonlinear operation "S":

- M is a message,

- K is a secret key,

- S is a table,

- X = K XOR M.

- Normal operation:

- For i = 0 to 7 do:

S () = Y,

An attack by analysis DPA or CPA knowing M can make it possible to find the key K by predicting the value S (X,).

- Protected operation (hidden):

- Randomly pull a U mask,

- Recalculate the table S to obtain a new table S ':

- For I = 0 to 256 do

- S '(i XOR U) = S (i) XOR U

- For i = 0 to 7 do:

X'i = X XOR U

Y'i = S '(X'i)

Y = Y, XOR U

As before, the protected operation produces the same result as the unprotected operation. A masking countermeasure has the drawback of consuming a large memory space in the case of a nonlinear operation, since hiding a table with a plurality of masks requires a large memory space. Thus, to reduce the memory space used, the same mask is generally used for all the sub-rounds of the round or for all the values of the table, for example an 8-bit mask. Masking is then called "simple order" as opposed to higher order masking, which uses a plurality of random masks.

However, simple order masking introduces a weakness against higher order (s) DPA analysis attacks. On the other hand, if the nonlinear operation masked in simple order is executed several times with false keys, the operation "true" will be embedded in false operations and the result of an attack will be assimilated to noise. Some embodiments of the invention thus provide for multiple executions of non-linear operations that are masked in simple order. In this case, and advantageously, it is not necessary to provide a higher order mask because it is almost impossible, in the current state of knowledge, to perform a higher order attack on an operation performed several times with a simple order masking. In summary, in some embodiments, the linear operations are protected by multiple executions, or by multiple order masking, or by single order masking and multiple executions, while the nonlinear operations are preferably protected by single order masking and multiple executions.

Thus, in the CP4 process shown in Fig. 7, many combinations of countermeasures can be provided. Assuming that the SRD1, SRD2 and SRD4 sub-rounds are linear and that the RD3 sub-round is non-linear, the following countermeasures may for example be provided:

- Countermeasure 1: - sub-rounds SRD1, SRD2 and SRD4 are executed only once per round and are protected by single or multiple order masking,

- the sub-round SRD3 is executed several times per round, without masking

- Countermeasure 2:

- the SRD, SRD2 and SRD4 sub-rounds are executed only once per round and are protected by single or multiple order masking,

the sub-round SRD3 is executed several times per round, with a simple order masking,

- Countermeasure 3:

the sub-rounds SRD1, SRD2 and SRD4 are executed several times per round, without masking,

- Countermeasure 4:

the sub-rounds SRD1, SRD2 and SRD4 are executed several times per round, with single or multiple order masking,

- the sub-round SRD3 is executed several times per round, with a simple order masking. Countermeasure 4 offers a higher level of security than countermeasures 2 and 3 which themselves offer a level of security superior to countermeasure 1. However, in connection with the search for the best ratio between execution time and protection against attacks, countermeasures 2 and 3 already provide excellent protection. In addition, random executions can be added within these operations.

Reference will now be made to Appendix 3, which is an integral part of the description, which describes executable algorithms in the form of exemplary embodiments of protected encryption methods according to the invention implementing the concept of modularity. Encryption application DES

The method is executed using a PDES2 algorithm and a PRDES2 round algorithm in Annex 3. The PDES2 algorithm differs from the PDES1 algorithm in that it includes initial steps 54, 55 of generating a first mask U ₀ and generating left and right portions U _0, L and U _0, R of the mask, followed by a step 56 of masking the left and right parts Lo, Ro of the message M. Also, step 6.3 of call to the algorithm PRDES1 is replaced by a step 58.3 of call to the algorithm PRDES2, and step 7.2 of call to the algorithm PRDES1 is replaced by a step 59.2 of call to the PRDES2 algorithm. Finally, when all the rounds have executed using the algorithm PRDES2, a step 60 of unmasking the result is provided, before the IPInverse operation to obtain the encrypted message C. The round algorithm PRDES2 uses the same operations and has the same sub-rounds as the algorithm PRDES1, but implements the concept of modularity. It receives as input data, as before:

- the keys Ko to K _N1- 1 or subkeys of the previous round,

the pair of values (Lj.i, R) supplied by the previous execution of the PRDES2 rounding algorithm or by the step 56 of the PDES2 algorithm with respect to the initial pair of values (L, R) ,

the round number i (for the subkey calculation), and

the number of executions N, of the considered round. The round algorithm PRDES2 additionally receives, as input data, a random mask UM. This is the mask U ₀ generated by the algorithm PDES2 in step 54, or the mask UM returned by the previous execution of the algorithm PRDES2, calculated in step 78. Sub-round 1 comprises the Expansive Permutation linear operation and is executed only once in step 75 with multiple-order masking. The sub-round 2 arranged in the iterative loop 76 comprises the linear operation XOR and is executed several times in the step 76.1 with multiple-order masking. The sub-round 3 includes the non-linear operation Substitution is also present in the loop 76 and is executed several times in step 76.3 in unmasked form, preceded by a step of unmasking 76.2. The result of this operation is then masked again in step 76.4. Finally, the sub-round 4 which comprises the linear operation XOR is executed only once with multiple-order masking in step 77. A mask U, of rank i for the next round is then calculated at step 78 and an update of the mask U is performed in step 79. The algorithm then returns the result L _\ , R _\ and the mask Uj.

It will be apparent to those skilled in the art that various other algorithms embodying the principles of the invention may be provided for performing the DES method.

Application to AES encryption

The method is executed using a PAES2 algorithm and a PRAES2 rounding algorithm in Annex 3. The PAES2 algorithm differs from the PAES1 algorithm in that it comprises a step 92 of generating a mask initial random Uo and a step 93 of masking the message M. The step 34.3 of calling the algorithm PRAES1 is replaced by a step 95.3 of calling the algorithm PRAES2 and the step 35.2 of call to the PRAES1 algorithm is replaced by a step 96.2 of calling the PRAES2 algorithm. When all the rounds have been executed, the final result C is unmasked in step 97 to obtain the encrypted message C.

The PRAES2 round algorithm uses the same encryption operations and has the same sub-rounds as the PRAES1 algorithm, but implements the concept of modularity. Thus, in the PRAES2 algorithm, the sub-round 1 comprising the AddRoundKey linear operation (step 104.1) is included in the iterative loop 104 and is executed multiple times with multi-order masking. The sub-round 2 comprising the non-linear operation SubByte (step 104.3) is executed several times in non-masked form, after a step of unmasking 104.2. The result of this sub-round is then masked again in step 104.4. The sub-round 3 which comprises the linear operation ShiftRow is outside the loop 04 and is executed only once in step 105, with multiple-order masking. The sub-round 4 of the rounds 1 to 9, which includes the linear operation MixColumn (step 106.1) is also outside the loop 104 and is executed only once, with multiple-order masking. Sub-round 4 of round 10 (step 107.3.1) comprising the AddRoundKey linear operation is executed multiple times with multi-order masking within loop 107 after a new generation of subkeys (step 107.1). ) and a step of updating the mask (step 107.2).

It will be apparent to those skilled in the art that various other algorithms embodying the principles of the invention may be provided to perform the AES method. The invention is generally applicable to any symmetrical block ciphering method comprising rounds. Embodiments of the invention based on the concept of modularity apply to any such process in which each round has a plurality of sub-rounds. Embodiments of an encryption method according to the invention may implement only the second aspect of the invention relating to the modularity of the sub-rounds, without the first aspect of the invention providing a number of executions variable round according to their rank. Such embodiments may therefore comprise an identical number of executions of each round, but a different number of executions of each sub-round within a round executed several times. Sometimes, some sub-rounds being executed once, preferably in masked form, others being executed several times, in masked form or not.

A microcircuit configured to execute a method according to the invention is itself capable of various embodiments. For example, the algorithms in Appendix 2 and Appendix 3 can be run by the CPU of the main processor or in part by the CPU and a coprocessor. In particular, the PDES1, PDES2, PTDES, PAES1, PAES2 algorithms can be executed by the CPU and the rounding algorithms PRDES1, PRDES2, PRAES1, PRAES2 can be executed by a coprocessor or hardware accelerators. The PRDES2 and PRAES2 algorithms based on the principle of modularity can advantageously be executed by a modular coprocessor or several hardwares in parallel forming the equivalent of a modular coprocessor, allowing the CPU to call the sub-round functions each independently of the other, with or without masking, for single or multiple execution of these functions.

FIG. 8 schematically represents an example of an SDV secure device comprising an MCT microcircuit according to the invention, mounted on a CD medium, for example a plastic card. The microcircuit MCT comprises a processor PROC including a central processing unit (CPU), a coprocessor CPROC coupled to the processor, an ICCT communication interface coupled to the processor, a memory MEM1 coupled to the main processor, a random or pseudo-random generator RGEN coupled to the processor main and / or coprocessor. These elements PROC, CPROC, ICCT MEM1, RGEN can be integrated on the same semiconductor chip or, for some, be integrated in different semiconductor chips which are interconnected by a printed circuit or other interconnect medium.

The ICCT circuit can be of the contact type (wired communication port) or contactless (NFC interface, Wifi, Bluetooth®, etc.) or both. In certain applications, especially in the context of an authentication procedure of the SDV device, the message to be encrypted M is received via the communication interface circuit ICCT and the encrypted message C is also communicated externally by the intermediate of this interface circuit.

The memory MEM1 may comprise a volatile memory zone and an electrically programmable non-volatile memory zone. The non-volatile program memory may comprise a secure zone comprising a secret key K. The random or pseudo-random generator RGEN is used by the processor or the coprocessor to generate the false keys and / or random masks of the type described above. The coprocessor may be dedicated to executing the rounds of a determined encryption method, or may be of modular type as described above, for the execution of hardware functions allowing the processor to execute the sub-rounds independently of each other. the other.

ANNEX 1 (forming part of the description)

Table 1

Table 2

Table 3

Table 4 - DES process (see FIPS PUB 46-3 of NIST)

Sub-round Abbreviation ^) Designation Designation

(French English)

Sub-round 1 E PermutationExpansive ExpansivePermutation

Sub-round 2 XOR XOR (OR Exclusive) XOR (Exclusive OR)

Sub-round 3 S Substitution Substitution

Sub-round 4P PermutationSimple Permutation

( ^* ) Abbreviation forming the official sub-round designation in the FIPS PUB 46-3 (Federal Information Processing Standard) of the National Institute of Standards and Technology (NIST).

Table 5 - AES process (see FIPS PUB 197 from NIST)

( ^** ) Official designation used in FIPS PUB 197 of NIST.

ANNEX 2 (integral part of the description) PDES1 algorithm (protected DES)

Input data :

- key

- M message to encrypt

- N1 maximum number of executions of a round

- NRtoP number of rounds to be protected

Exit data:

Encrypted message C = DES (M, K) = PDES1 (M, K, N1, NRtoP)

Start:

(1) K ₀ = K

(2) Generate N1 -1 false keys (KK ₂ , KM-I)

(3) M = IP (M)

(4) Share M into two 32-bit blocks L ₀ and Ro

l_o = 32 strongest bits of M (top part)

Ro = 32 weakest bits of M (lower part)

(5) For i from 1 to 16 do:

(6) If (i <NRtoP) or (i> λ -NRtoP) then

(6.1) n = min (i-1, 16-i)

(6.2) Ni = N1 / ( ²ⁿ )

(6.3) (U Ri) = PRDES1 (L, R, i, N,) [Protected round]

(7) Otherwise

(7.2) (U, Ri) = PRDES1 (L, R, i, N,) [Round unprotected]

(8) C = inverse IP (R ₁₆ | L ₁₆ )

(9) Return C

End

PRDES1 algorithm (protected DES round)

Rating:

- i: rank of the treated round

- Nj: number of executions of a round of rank i

- N1 (Ni with i = 1): maximum number of executions of a round (first and last)

Input data :

- keys (Ko, Κι, K2, Kw-i) or subkeys from a previous round

- couple (Li-i, R)

- i round number

- Nj number of executions Output data:

- (Li, Ri) = PRDES1 (L _M , Ri.i, i, N,)

Start:

(10) Let C, D, E, F be four 4-byte arrays

(1 1) Generate N1 subkeys (SK _ii0 , SK _{i: 1} , SK _{i 2} , .... SK _iiN ii) for round i from the keys Ko, K1, K _Σ , KNI-I OR subkeys from a previous round

(12) Generate a random permutation P = {po, ... p / v / -} in the interval j = [0, N, - 1]

(13) For j from 0 to (Λ /, - ί) do:

(13. 1) T _R = R, TL = L, -I

(13.2) W = R

(13.3) T _R = PermutationExpansive (T _R ) [Sub-round 1]

(3.4) T _R = TR XOR SKi, _Pj [Sub-round 2]

(3.5) T _R = Substitution (T _R ) [Sub-round 3]

(13.6) T _R = SimpleSwitch (T _R ) XOR T _l [Sub-round 4]

(13.7) If pj = 0 then

C = W

D = T _R

(13.8) If pj ≠ 0 then

E = W

F = T _R

(14) Li = C, Ri = D

(15) Return (Li.Ri)

End PTDES algorithm (Triple DES protected)

Input data :

- K and K 'cryptography keys

- M message to encrypt

- N1 (N, with i = 1): maximum number of executions of a round (first and last)

- NRtoP: number of rounds to protect

Exit :

Encoded message C = TDES (M, K, K = DES (DES (M, K), Κ '), K)

= P1DES (M, K, K ', N1, NRtoP)

Start:

(20) C = PDES1 (M, K, N1, NRtoP) [Protected DES according to the invention: PDES1 algorithm] (21 a) C = DES ^"1 (C, K ') [DES ^{" 1} conventional without protection] Or , alternatively:

(21 b) C = PDES1 ^"1 ((C, K ', 1, 0) [PDES1 ^{" 1} without protection]

(22) C = PDES1 (C, K, N1, NRtoP)

(23) Return C

End

PAES1 algorithm (protected AES)

Input data :

- K cryptography key

- M message to encrypt

- N1 maximum number of executions of a round

- NRtoP number of rounds to be protected

Output data:

Ciphered message C = AES (M, K) = PAES1 (M, K, N1, NRtoP)

Start:

(30) K ₀ = K

(31) Generate N1 -1 false keys (K _1t K ₂ , K _N1 .i)

(32) R ₀ = M

(33) For i from 1 to 10 do:

(34) If (i <NRtoP) or (i> W-NRtoP) then

0-i); (R, i, Ni) [Protected Round]

(35) Otherwise

(35.1) Ni = 1

(35.2) R1 = PRAES1 (Ri-i, i, Ni) [Unprotected round] (36) C = R ₁₀

(37) Return C

End

PRAES1 algorithm (protected AES round)

Input data :

keys {K ₀ , K ₁ , K ₂ ,. ., KNI-I) OR sub-keys from a previous round

- message R, 16 bytes

- i round number

- Ni: number of executions of a round of rank i

- N1 (Ni with i = 1): maximum number of executions of a round (first and last)

Exit data:

- Ri = PRAES1 (Ri-i, i, Ni)

Start:

(40) Let C, D be two tables of 16 bytes

(41) Generate N1 subkeys (SK / o, SKj. _1t i, SK, .f, 2, ■■ ·, SKj- _1iN ii) from the keys K ₀ , K i, K ₂ , ... KNI-I or subkeys from a previous round

(42) Generate a random permutation P = {po, • ■ • PM- _Î } in the interval j = [0, Nj-1]

(43) For j from 0 to (Λ /, - 7) do:

(43.1) W = Rn

(43.2) W = AddRoundKey (W, SK _{M l} p _j ) [Sub-round 1]

(43.3) W = SubByte (W) [Sub-round 2]

(43.4) W = ShiftRow (W) [Sub-round 3]

(43.5) If (i ≠ 10) then [Sub-round 4 of rounds 1 to 9]

W = MixColumn (W)

(43.6) If (i = 10) then [Sub-round 4 of round 10]

(43.6.1) Generate N1 subkeys (SKi _0, o, SKi _0, i, SK ₁₀ 2 SK _10, NI-I) from the key K _0, K ₂ Ku, K _N1 .i or subkeys from a previous round

(43.6.2) W = AddRoundKey (W, SKi ₀ , _pj );

(43.7) If pj = 0 then C = W

(43.8) If pj ≠ 0 then D = W

(44) Ri = C

(45) Return (Ri)

End

APPENDIX 3 (integral part of the description) Embodiments implementing the concept of modularity

PDES2 algorithm (protected DES)

Input data :

- key

- M message to encrypt

- N1 maximum number of executions of a round

- NRtoP number of rounds to be protected

Exit data:

- Encrypted message C = DES (M, K) = PDES2 (M, K, N1, NRtoP)

Start:

(50) K ₀ = K

(51) Generate N1 -1 false keys (K _1t K ₂ , K _N1 .i)

(52) M = IP (M)

(53) Share M in two blocks of 32 bits L ₀ and R ₀

l_o = 32 strongest bits of M (top part)

R ₀ = 32 weakest bits of M (lower part)

(54) Generate a Uo random mask of 8 bytes

(55) Share U ₀ in two 32-bit blocks U ₀ , L and U ₀ , R

(56) 1 = L ₀ XOR U ₀ , L, Ro = Ro XOR U ₀ , R [Masking]

(57) For i from 1 to 16 do:

(58) If then , R _{M l} U, i, Ni) [Protected Round]

(59) Otherwise

(59.1) Ni = 1

RM, Un, i, Nj) [Round unprotected] (60) masking]

(61)

(62)

End PRDES2 Algorithm (protected DES round)

Rating:

- i: rank of the treated round

- Nj: number of executions of a round of rank i

- N1 (N, with i = 1): maximum number of executions of a round (first and last)

Input data :

- keys (Ko, Κι, K2, KNI-I) OR subkeys from a previous round

- couple (Li-i, Rj.i)

random mask Ui-i = (Ui-i, L, Ui-I, R)

- i round number

- N, number of executions Output data:

beginning

(70) Let C, D, E, F be four 4-byte arrays

(71) Generate N1 subkeys (SK _II0 , SK _i: i, SK _II2 , SKI _, NI-I) from the keys Ko, Ki, K2, KN I OR subkeys from a previous round

(72) Generate a random permutation P = {po, - -P - _Î } in the interval j = [0, N, -1]

(73) SI = _Î R -I, T _L = L ₁

(74) W = R _M

(75) T _R = PermutationExpansive (T _R ) [Masked Sub-Round 1]

(76) For j from 0 to (Λ /, - 7) do:

(76.1) T _R = T _R XOR SKi.pj [Sub-round 2 hidden]

(76.2) T _R = TR XOR PermutationExpansive (Ui.i _, R) [Unmasking]

(76.3) T _R = Substitution (T _R ) [Sub-round 3 unmasked]

(76.4) TR = T _R XOR Ui.1, _R [Masking]

(76.5) If ppO then

C = W

D = T _R

(76.6) If P _j ≠ 0 then

E = W

F = T _R

(77) D = PermutationSimple (D) XOR T _L [Masked Sub-Round 4]

(78) Generate a random mask Ui = (Ui, L, U ,, R) [Changing the mask for the next round]

(79) C = C XOR _Uj, U XOR i_ _Î -LR, D = D XOR PermutationSimpleiUi.-iR) _Î U XOR _R XOR Uj- _iL [correction mask]

(80) Li = C, Ri = D, Ui = Ui, _L | Ui _, R

(81) Return (L "Ri, Ui)

End PAES2 algorithm (protected AES)

Input data :

- K cryptography key

- M message to encrypt

- N1 maximum number of executions of a round

- NRtoP number of rounds to be protected

Output data:

Ciphered message C = AES (M, K) = PAES2 (M, K, N1, NRtoP)

Start:

(90) K ₀ = K

(91) Generate N1 -1 false keys (Ki, K ₂ , K _N ii)

(92) Generate a Uo random mask of 16 bytes

(93) R ₀ = M XOR U ₀ [Masking]

(94) For i from 1 to 10 do:

(95) If then , i, Ni) [Protected Round]

(96) Otherwise

(96.1) Ni = 1

(96.2) (R, U _i ) = PRAES2 (R _i-1 , Un, i, Ni) [Unprotected round] (97) C = Rio XOR U-10 [Unmasking]

(98) Return C

End

PRAES2 algorithm (protected AES round)

Input data :

- keys (K ₀ , Κι, K2, KM-I) OR subkeys from a previous round

- Rj.-i message, 16 bytes

- UM random mask

- i round number

- Nj: number of executions of a round of rank i

- N1 (Ni with i = 1): maximum number of executions of a round (first and last) Output data:

- (Ri, U _i ) = PRAES2 (R _i- i, U _i-1 , i, Ν,)

Start:

(100) Let C, D be two tables of 16 bytes

(101) Generate N1 sub-keys (SK _{i: 0,} SKJ -i, SKi _i2, .... SK _{i N} ii) for the i-round, from the key K _0l Ki, K _2, Λ / OR of subkeys from a previous round

(102) Generate a random permutation P = {po, • ■ • PM- _Î } in the interval j = [0, N, -1]

(103) W = R _M

(104) For j from 0 to (N _t -1) do:

(104.1) W = AddRoundKey (W, SKi _{, pj} ) [Masked Sub-Round 1]

(104.2) W = W XOR U [Unmasking]

(104.3) W = SubByte (W) [Sub-round 2 unmasked]

(104.4) W = W XOR A [Masking]

(104.5) If pj = 0 then C = W

(104.6) If pj ≠ 0 then D = W

(105) C = ShiftRow (C) [Sub-round 3 hidden]

(106) Generate a 16-byte random mask U [Change the mask for the next round]

(106) If (i ≠ 10) then

(106.1) C = MixColumn (C) [Rounded sub-round 4 of rounds 1-9]

(106.2) C = XOR C, XOR MixColumn (ShiftRow (UM) [Mask Correction]

(107) If (i = 10) then [Sub-round 4 of round 10]

(107.1) Generate N1 subkeys (S _, ο, SK _it i, SK _{i: 2} , S ^ _Î - _Î ) for round 10, from the keys Ko, K1, K ₂ , K _N1 .i or under of a previous round

(107.2) W = XOR Xi XOR ShiftRow (Ui - i) [Mask Correction]

(107.3) For j from 0 to (Nt-1) do:

(107.3.1) W = AddRoundKey (W, SKi _{0, Pj} ) [hidden value operation]

(107.3.2) If pj = 0 then C = W

(107.3.3) If pj ≠ 0 then D = W

(107.4) W = C

(108) R = C

(109) Return (R, Ui)

End

Claims

claims

1. A method of symmetric encryption (CP3, CP4) executed by a microcircuit (MCT), for the transformation of a message (M) into an encrypted message (C), from a secret key (K, K ₀ ) , comprising a first round (RD-i), intermediate rounds (RD ₂ , RDj, RDNM) and a last round (RDNr),

characterized in that it comprises several executions (N1, ΝΝ _Γ ) of the first and last round, respectively from the secret key (K, Ko) and a first set of false keys (Ki - KNI- I), and a number of executions (N,) of at least one intermediate round (RDj) smaller than the number of executions (N1, N _Nr ) of the first and last rounds, respectively from the secret key and a set of false keys (Ki - KNM) included in the first set of false keys.

2. Method according to claim 1, comprising a second round (RD ₂ ), a penultimate round (RDNM) and several intermediate rounds (RDj), in which the first two rounds are executed a greater number of times than the rounds. intermediaries, and the last two rounds are executed more times than the intermediate rounds.

3. Method according to one of claims 1 and 2, comprising only one execution of at least one intermediate round (RDj).

4. Method according to one of claims 1 to 3, comprising:

for a determined number (NRtoP) of successive rounds starting from the first, a number of executions of the rounds decreasing according to a rule of decay which is a function of the rank (i) of the rounds considered relative to the first round, then

- for a given number (NRtoP) of successive rounds until the last one, a number of executions of the rounds increasing according to a rule of growth which is function of the rank of the rounds considered relative to the last round.

5. The method according to claim 4, wherein the decay rule is a rule in 1 / (2 ⁿ ), n being a parameter depending on the rank of the rounds considered relative to the first or the last round.

The method according to one of claims 1 to 5, wherein each round comprises sub-rounds (SRD1-SRD4), and wherein the multiple execution of each round comprises the multiple execution of each sub-round of the round.

7. Method according to one of claims 1 to 5, wherein each round comprises sub-rounds (SRD1-SRD4), and wherein the multiple execution of a round comprises the multiple execution of at least one sub-round. -round, and a single run of at least one other sub-round.

The method of claim 7, wherein the single execution of the sub-round is a masked execution in single or multiple order.

The method of claim 7, wherein the multiple execution of the sub-round is a masked execution in simple order.

10. Method according to one of claims 1 to 9, according to the specifications

DES, triple DES, or AES.

1 1. Microcircuit (MCT) configured to execute a symmetric encryption method (CP3, CP4), for transforming a message (M) into an encrypted message (C), from a secret key (K, K ₀ ) , the method comprising a first round (RD-i), intermediate rounds (RD2, RD, RDN), and a last round (RD _NR ),

microcircuit characterized in that it is configured to execute several times (N1, ΝΝ _Γ ) the first and the last round, respectively from the secret key and a first set of false keys (K1 - K _N ii), and to run at least one intermediate round (RD,) a number of times (N,) less than the number of executions (N1, ΝΝ _Γ ) of the first and last rounds, respectively from the secret key and a set of false keys (Ki - KN, -I) included in the first set of false keys.

12. Microcircuit according to claim 1 1, configured to execute only once at least one intermediate round (RD,).

13. Microcircuit according to one of claims 1 1 and 12, configured to execute rounds comprising sub-rounds (SRD1-SRD4), and to execute the same number of times all the sub-rounds of a round, when 'Multiple execution of a round.

14. Microcircuit according to one of claims 1 1 and 12, configured to execute rounds comprising sub-rounds (SRD1 -SRD4), and to perform only once at least one sub-round and execute several times a another sub-round, when performing a multiple round.

15. Microcircuit according to one of claims 13 or 14, comprising a modular coprocessor (CPROC) configured to perform individually encryption operations included in sub-rounds.