Masking and unmasking methods and devices

1. A method for personalizing an electronic device, comprising:

obtaining sensitive data by way of a third-party device composed of a CPU, a memory having coded instructions stored therein for operating the CPU, and a communications bus in communication with the CPU;

at the third-party device, masking the obtained sensitive data using a masking method based on a standard cryptographic algorithm defining a ciphering algorithm, and a deciphering algorithm that uses more resources than the ciphering algorithm,

said masking including a step of masking the sensitive data by applying the deciphering algorithm to said sensitive data to obtain masked sensitive data;

storing the masked sensitive data in the electronic device so as to personalize the electronic device;

unmasking the masked sensitive data, by applying the ciphering algorithm to the masked sensitive data to obtain sensitive data in plain form,

wherein the unmasking with the ciphering algorithm comprises at least one instance of access to a table stored in a memory,

wherein the number of instances of access to the table when unmasking with the ciphering algorithm is less than the number of instances of access to this same table anticipated in the deciphering algorithm, and

wherein a plurality of instances of access to masked sensitive data is carried out, each instance of access comprising a step of unmasking by applying the ciphering algorithm to the masked sensitive data to obtain sensitive data in plain form.

2. The method according to claim 1 , wherein the electronic device is configured for also unmasking other masked data, by applying the deciphering algorithm to said other masked data to obtain said other data in plain form.

3. The method according to claim 1 , wherein the unmasking step is triggered upon receipt of a request comprising an APDU command compliant with the ISO 7816 standard, such that a response to said request is based on said sensitive data in plain form.

4. The method according to claim 1 , wherein the sensitive data in plain form are an authentication key.

5. The method according to claim 1 , wherein the standard ciphering algorithm is implemented by a cryptoprocessor, on the basis of the masked sensitive data and a key K.

6. The method according to claim 1 , wherein the electronic device is configured for also masking other data, by applying the ciphering algorithm to these other data to obtain other data in plain form.

7. The method according to claim 1 , further comprising:

applying a key stretching algorithm to a key K, to obtain a sub-key K n required as input to the step of masking with the deciphering algorithm.

8. The method according to claim 1 , wherein the standard cryptographic algorithm is compliant with the AES standard.

9. The method according to claim 1 , wherein the sensitive data are identification elements specific to the electronic device to be personalized.

10. A system, comprising:

an electronic device to be personalized; and

a third-party device, incorporating a CPU, a memory and a communications bus in communication with the CPU, the memory having stored therein at least encoded instructions that, upon execution by the CPU, causes the third-party device to function as:

a module at the third-party device that obtains sensitive data,

a module at the third-party device that masks the obtained sensitive data by operatively implementing a masking method based on a standard cryptographic algorithm defining a ciphering algorithm, and a deciphering algorithm using more resources than the ciphering algorithm, by applying the deciphering algorithm to said sensitive data to obtain masked sensitive data,

a module that stores the obtained masked sensitive data in the electronic device, so as to personalize the electronic device, and

a module that unmasks masked sensitive data by operatively applying the ciphering algorithm to the masked sensitive data to obtain sensitive data in plain form,

wherein the unmasking with the ciphering algorithm comprises at least one instance of access to a table stored in a memory,

wherein the number of instances of access to the table when unmasking with the ciphering algorithm is less than the number of instances of access to this same table anticipated in the deciphering algorithm,

wherein a plurality of instances of access to masked sensitive data is carried out, each instance of access comprising a step of unmasking by applying the ciphering algorithm to the masked sensitive data to obtain sensitive data in plain form.

11. The system according to claim 10 , further wherein the third-party device is configured to further function as:

a module that unmasks other masked data, by applying the deciphering algorithm to these other masked data to obtain other data in plain form.

12. The system according to claim 10 , wherein the third-party device is configured to further function as:

a module that masks other data, by applying the ciphering algorithm to these other data to obtain other data in plain form.

13. The system according to claim 10 , wherein the sensitive data are identification elements specific to the electronic device to be personalized.