Masking and unmasking methods and devices
Devices and methods for masking and unmasking sensitive data, based on a standard cryptographic algorithm defining a ciphering algorithm, and a deciphering algorithm using more resources than the ciphering algorithm are described. The masking of sensitive data is done by applying the deciphering algorithm to the sensitive data to obtain masked sensitive data. The unmasking of the masked sensitive data is done by applying the ciphering algorithm to the masked sensitive data to obtain sensitive data in plain form.
1. A method for personalizing an electronic device, comprising:
obtaining sensitive data by way of a third-party device composed of a CPU, a memory having coded instructions stored therein for operating the CPU, and a communications bus in communication with the CPU;
at the third-party device, obtaining a masking method selection input and masking the obtained sensitive data using a masking method based on a standard cryptographic algorithm defining a ciphering algorithm, and a deciphering algorithm that uses more resources than the ciphering algorithm,
wherein the masking method to mask the obtained sensitive data is determined, based on the masking method selection input, from a first masking method masking the obtained sensitive data by applying the ciphering algorithm to said sensitive data to obtain masked sensitive data and a second masking method masking the sensitive data by applying the deciphering algorithm to said sensitive data to obtain masked sensitive data; and
storing the masked sensitive data in the electronic device so as to personalize the electronic device,
wherein the masking method selection input depends on a frequency of use of the sensitive data.
2. The method according to claim 1 , further comprising:
unmasking the masked sensitive data, wherein the unmasking applies the other algorithm between the deciphering and ciphering algorithms than the one applied by the masking method to the masked sensitive data to obtain sensitive data in plain form.
3. The method according to claim 2 , wherein the electronic device is configured for also unmasking other masked data, by applying the ciphering or deciphering algorithm of the determined masking method to said other masked data to obtain said other data in plain form.
4. The method according to claim 2 ,
wherein an unmasking with the ciphering algorithm comprises at least one instance of access to a table stored in a memory, and
wherein the number of instances of access to the table when unmasking with the ciphering algorithm is less than the number of instances of access to this same table anticipated in the deciphering algorithm.
5. The method according to claim 2 , wherein a plurality of instances of access to masked sensitive data is carried out, each instance of access comprising a step of unmasking by applying the other algorithm to the masked sensitive data to obtain sensitive data in plain form.
6. The method according to claim 2 , wherein the unmasking step is triggered upon receipt of a request comprising an APDU command compliant with the ISO 7816 standard, such that a response to said request is based on said sensitive data in plain form.
7. The method according to claim 2 , wherein the sensitive data in plain form are an authentication key.
8. The method according to claim 2 , wherein the standard ciphering algorithm is implemented by a cryptoprocessor, on the basis of the masked sensitive data and a key K.
9. The method according to claim 1 , wherein the electronic device is configured for also masking other data, by applying the other algorithm to these other data to obtain other data in plain form.
10. The method according to claim 1 , further comprising:
applying a key stretching algorithm to a key K, to obtain a sub-key K n required as input to the step of masking with the ciphering or deciphering algorithm of the determined masking method.
11. The method according to claim 1 , wherein the sensitive data are identification elements specific to the electronic device to be personalized.
12. The method according to claim 1 , wherein the standard cryptographic algorithm is compliant with the AES standard.
13. The method according to claim 1 , wherein the masking method selection input is a user input.
14. A system, comprising:
an electronic device to be personalized; and
a third-party device, incorporating a CPU, a memory and a communications bus in communication with the CPU, the memory having stored therein at least encoded instructions that, upon execution by the CPU, causes the third-party device to function as:
a module at the third-party device that obtains sensitive data,
a module at the third-party device that obtains a masking method selection input, and masks the obtained sensitive data by operatively implementing a masking method based on a standard cryptographic algorithm defining a ciphering algorithm, and a deciphering algorithm that uses more resources than the ciphering algorithm, by applying the deciphering algorithm to said sensitive data to obtain masked sensitive data,
the masking method to mask the obtained sensitive data being determined, based on the masking method selection input, from a first masking method masking the obtained sensitive data by applying the ciphering algorithm to said sensitive data to obtain masked sensitive data and a second masking method masking the sensitive data by applying the deciphering algorithm to said sensitive data to obtain masked sensitive data,
where the masking method selection input depends on a frequency of use of the sensitive data, and
a module that stores the obtained masked sensitive data in the electronic device, so as to personalize the electronic device.
15. The system according to claim 14 , wherein the third-party device is configured to further function as:
a module that unmasks masked sensitive data by applying the other algorithm between the deciphering and ciphering algorithms than the one applied by the masking method to the masked sensitive data to obtain sensitive data in plain form.
16. The system according to claim 15 , wherein the third-party device is configured to yet further function as:
a module that unmasks other masked data, by applying the ciphering or deciphering algorithm to these other masked data to obtain other data in plain form.
17. The system according to claim 14 , wherein the third-party device is configured to further function as:
a module that masks other data, by applying the ciphering or deciphering algorithm to these other data to obtain other data in plain form.
18. The system according to claim 14 ,
wherein the sensitive data are identification elements specific to the electronic device to be personalized.