Secure method for secret key cryptographic calculation and component using said method
View Patent ↗A secured method of cryptographic computation to generate output data from input data and from a secret key includes a derived key scheduling step to provide a derived key from the secret key according to a known key scheduling operation. The method also includes a masking step, performed before the derived key scheduling step, to mask the secret key so that the derived scheduled key is different at each implementation of the method. The present method and component can be used in transfer type applications, such as bank type applications.
1. A method for securing a cryptographic process that generates output data from input data and a private key, the method comprising:
a key scheduling process comprising a plurality of derived key scheduling steps to each provide an updated derived key from a previously derived key computed during a preceding derived key scheduling step, a first updated derived key being obtained from the private key;
masking the private key, prior to the key scheduling process, so that each updated derived key is different for each key scheduling process;
wherein, during the masking step, a randomly chosen masking parameter is mixed with the private key, to provide a masked private key, the first updated derived key being computed from the masked private key during a first derived key scheduling step; and
performing a plurality of computation steps, each using an updated derived key, and an unmasking step is executed after each computation step to eliminate a contribution of the masking parameter on a result of the previous computation step.
2. A method according to claim 1 , wherein the masking step is carried out during an initialization step.
3. A method according to claim 1 , further comprising: a computation step using an updated derived key, and an unmasking step, executed after the computation step, to eliminate a contribution of the masking parameter to a result of the computation step.
4. A method according to claim 3 wherein, during the masking step, the following operation is carried out:
K′ 0 =K 0 |X 0 ,
K′ 0 being the masked private key,
K 0 being the private key
X 0 being the masking parameter, and
the operator “|” being a mixing operator.
5. A method according to claim 4 , wherein the mixing operator comprises a two-parameter linear operator.
6. A method according to claim 4 , wherein the mixing operator comprises an XOR operator.
7. A method according to claim 4 wherein, during the unmasking step, an inverse operator of the mixing operator is used.
8. A method according to claim 1 , wherein the key scheduling process is a Data Encryption Standard (DES) type process, comprising sixteen rounds of key scheduling steps, each round using an updated derived key.
9. A method according to claim 8 wherein, at each round, a transformation is carried out, comprising:
a computation step to combine an intermediate data computed during a previous round and the updated derived key, and
an unmasking step executed after the computation step, to eliminate a contribution of the masking parameter to a result of the computation step.
10. A method for securing a cryptographic process that generates output data from input data and a private key, the method comprising:
masking the private key;
wherein, during the masking step, a randomly chosen masking parameter is mixed with the private key, to provide the masked private key, the first updated derived key being computed from the masked private key during a first derived key scheduling step;
performing a key scheduling process comprising a plurality of derived key scheduling steps to each provide an updated derived key from a previously derived key, a first updated derived key being obtained from the masked private key;
wherein each updated derived key is different for each key scheduling process; and
performing a plurality of computation steps, each using an updated derived key, and an unmasking step is executed after each computation step to eliminate a contribution of the masking parameter on a result of the previous computation step.
11. A method according to claim 10 , wherein the masking step is carried out during an initialization step.
12. A method according to claim 10 , further comprising: a computation step using an updated derived key; and an unmasking step, executed after the computation step, to eliminate a contribution of the masking parameter to a result of the computation step.
13. A method according to claim 12 wherein, during the masking step, the following operation is carried out:
K′ 0 =K 0 |X 0 ,
K′ 0 being the masked private key,
K 0 being the private key
X 0 being the masking parameter, and
the operator “|” being a mixing operator.
14. A method according to claim 13 , wherein the mixing operator comprises a two-parameter linear operator.
15. A method according to claim 13 , wherein the mixing operator comprises an XOR operator.
16. A method according to claim 13 wherein, during the unmasking step, an inverse operator of the mixing operator is used.
17. A method according to claim 10 , wherein the key scheduling process is a Data Encryption Standard (DES) type process, comprising sixteen rounds of key scheduling steps, each round using an updated derived key.
18. A method according to claim 17 wherein, at each round, a transformation is carried out, comprising:
a computation step to combine an intermediate data computed during a previous round and the updated derived key, and
an unmasking step executed after the computation step, to eliminate a contribution of the masking parameter to a result of the computation step.
19. A electronic device comprising:
a controller for securing a cryptographic process that generates output data from input data and a private key, by masking the private key, and performing a key scheduling process comprising a plurality of derived key scheduling steps to each provide an updated derived key from a previously derived key, a first updated derived key being obtained from the masked private key;
wherein each updated derived key is different for each key scheduling process;
wherein the controller masks the private key with a randomly chosen masking parameter, the first updated derived key being computed from the masked private key during a first derived key scheduling step; and
wherein the controller performs a plurality of computation steps, each using an updated derived key, and an unmasking step is executed after each computation step to eliminate a contribution of the masking parameter on a result of the previous computation step.
20. A device according to claim 19 , wherein the controller performs the masking during an initialization step.
21. A device according to claim 19 , wherein the controller performs a computation step using an updated derived key, and an unmasking step, executed after the computation step, to eliminate a contribution of the masking parameter to a result of the computation step.
22. A device according to claim 21 wherein, during the masking step, the controller performs the following operation:
K′ 0 =K 0 |X 0 ,
K′ 0 being the masked private key,
K 0 being the private key
X 0 being the masking parameter, and
the operator “|” being a mixing operator.
23. A device according to claim 22 , wherein the mixing operator comprises a two-parameter linear operator.
24. A device according to claim 22 , wherein the mixing operator comprises an XOR operator.
25. A device according to claim 22 wherein, during the unmasking step, an inverse operator of the mixing operator is used.
26. A device according to claim 19 , wherein the key scheduling process is a Data Encryption Standard (DES) type process, comprising sixteen rounds of key scheduling steps, each round using an updated derived key.
27. A device according to claim 26 wherein, at each round, the controller performs a transformation comprising:
a computation step to combine an intermediate data computed during a previous round and the updated derived key; and
an unmasking step executed after the computation step, to eliminate a contribution of the masking parameter to a result of the computation step.