(19)
(11)EP 3 396 893 B1

(12)EUROPEAN PATENT SPECIFICATION

(45)Mention of the grant of the patent:
29.07.2020 Bulletin 2020/31

(21)Application number: 18154413.1

(22)Date of filing:  31.01.2018
(51)International Patent Classification (IPC): 
H04L 9/00(2006.01)
G06F 1/03(2006.01)
H04L 9/32(2006.01)
G06F 7/72(2006.01)
G06F 21/75(2013.01)

(54)

APPARATUS AND METHOD FOR PERFORMING OPERATION BEING SECURE AGAINST SIDE CHANNEL ATTACK

VORRICHTUNG UND VERFAHREN ZUR DURCHFÜHRUNG EINES VORGANGS, DER SICHER GEGENÜBER SEITENKANALANGRIFFEN IST

APPAREIL ET PROCÉDÉ POUR EFFECTUER UNE OPÉRATION SÉCURISÉE CONTRE UNE ATTAQUE DE CANAL LATÉRAL


(84)Designated Contracting States:
AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

(30)Priority: 28.04.2017 KR 20170055700

(43)Date of publication of application:
31.10.2018 Bulletin 2018/44

(73)Proprietor: Samsung SDS Co., Ltd.
Seoul 05510 (KR)

(72)Inventors:
  • CHOI, Kyu-Young
    05510 Seoul (KR)
  • MOON, Duk-Jae
    05510 Seoul (KR)
  • YOON, Hyo-Jin
    05510 Seoul (KR)
  • CHO, Ji-Hoon
    05510 Seoul (KR)

(74)Representative: Grünecker Patent- und Rechtsanwälte PartG mbB 
Leopoldstraße 4
80802 München
80802 München (DE)


(56)References cited: : 
EP-A1- 2 378 707
CA-C- 2 262 549
  
  • Victor Boyko ET AL: "Speeding up discrete log and factoring based schemes via precomputations" In: "ECCV 2016 conference", 1 January 1998 (1998-01-01), Springer International Publishing, Cham 032548, XP055461019, ISSN: 0302-9743 ISBN: 978-3-642-38988-7 vol. 1403, pages 221-235, DOI: 10.1007/BFb0054129, * page 223, line 26 - line 28 * * page 229, line 13 - line 17 * * page 229, line 35 * * page 230, lines 2-3 *
  • GIUSEPPE ATENIESE ET AL: "A Low-cost Standard Signatures for Energy-Harvesting Wireless Sensor Networks", ACM TRANS. EMBEDD. COMPUT. SYST. V, 1 January 2015 (2015-01-01), page 23, XP055463112, DOI: 10.1145/0000000.0000000
  • From Anonymous: "Elliptic curve point multiplication", , 19 March 2017 (2017-03-19), XP055463171, Wikipedia Retrieved from the Internet: URL:https://en.wikipedia.org/w/index.php?t itle=Elliptic_curve_point_multiplication&o ldid=771094462 [retrieved on 2018-03-27]
  
Note: Within nine months from the publication of the mention of the grant of the European patent, any person may give notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention).


Description

BACKGROUND


1. Field



[0001] The present disclosure relates to a technology for side-channel attack prevention.

2. Discussion of Related Art



[0002] As Internet of Things (IoT) devices evolve, there is a growing risk of side-channel attacks that gain important information by exploiting physical information leaked from devices during performance of mathematical computations for a key exchange, an encryption, a digital signature for encryption, etc.

[0003] A side-channel attack obtains secret information using a leakage of side-channel information (e.g., power consumption, amount of electromagnetic radiation, algorithm execution time, etc.) for computations performed during an operation of an algorithm for key exchange, encryption, digital signature, etc.

[0004] A power analysis attack, which is a form of side-channel attack, is known as the most powerful side-channel attack, and equipment for power analysis attacks is known to be a very effective attack means because of its low cost and high probability of realization. Thus, the power analysis attack is a field in which a lot of research is currently being conducted. A method of such a power analysis attack largely includes simple power analysis (SPA) and differential power analysis (DPA)

[0005] For example, an exponentiation operation or a scalar multiplication operation of a point is an essential operation in a related art encryption key exchange scheme, a public key encryption scheme, a digital signature scheme, and the like. In the case of exponentiation (or scalar multiplication) operation, when an exponent value is expressed as a bit string, a square operation and a multiplication operation are performed when each bit in the bit string is 1, and only the multiplication operation is performed when each of the bits in the bit string is 0.

[0006] The power analysis attack exploits the different power consumption requirements for the different operations performed in the case in which each bit value is 1 and in the case in which each of the bit values is 0. That is, since the power consumption for the square operation and the subsequent multiplication operation in the case in which bit value is 1 is large and the power consumption in the case in which the bit value is 0 is small, it is possible to obtain a secret value (a secret key or the like) by taking information on an exponent value, which is the secret value, through an analysis of power consumption occurring at a time of an exponentiation computation.

[0007] Related art methods for preventing such side-channel attacks are methods for protecting against only some side-channel attacks, However, a method to secure against all of the side-channel attacks has not be proposed. In addition, related art methods for preventing side-channel attacks have a problem in that they require a large amount of computation and thus cause performance degradation and time delay during generation of digital signature.

[0008] Victor Boyko ET AL, "Speeding up discrete log and factoring based schemes via precomputations", ECCV 2016 conference, Cham, Springer International Publishing, (19980101), vol. 1403, pages 221 -235, 032548, doi:10.1007/BFb0054129 presents fast and practical methods for generating randomly distributed pairs of the form (x, gx mod (p)) or (x, xe mod (N)), using precomputation. These generation schemes are of wide applicability for speeding-up public key systems that depend on exponentiation and offer a smooth memory-speed trade-off. The steps involving exponentiation in these systems can be reduced significantly in many cases. In more detail, a method according to D1 comprises a preprocessing step, in which first of all n random integers are generated. In a next step, are computed for each i and both and are stored in a table. Subsequently, whenever a pair (x, gx) is needed, a subset S c [1, n] is randomly generated such that |S|= K. Then, and, so that (k, K) is returned as a result.

[0009] CA 2 262 549 C relates to a device that generates private key/public key pairs for use with a public key security algorithm. The device includes a security parameter database, a control module, an operating system, a pre-computation device, a table T device, an online computation device, and a public key security algorithm device. By the use of precomputation offline, the device reduces the amount of discrete exponentiation with long integers done online.

[0010] GIUSEPPE ATENIESE ET AL, "A Low-cost Standard Signatures for Energy-Harvesting Wireless Sensor Networks", ACM TRANS. EMBEDD. COMPUT. SYST. V, (20150101), doi: 10.1145/0000000.0000000 relates to the general question of whether micro-scale energy harvesting techniques can be exploited to support low-cost standard security solutions on resource-constrained devices. The authors of D3 focus on guaranteeing integrity and authentication in Internet of Things (IoT) and Wireless Sensor Network (WSN) applications. In D3, techniques to make ECDSA signatures low cost and implementable on resource-constrained devices are proposed. It is shown in D3 that by combining precomputation techniques and energy harvesting capabilities of modern sensor nodes, significant improvement over prior works can be achieved.

SUMMARY



[0011] It is the object of the present application to provide an apparatus and a method for effectively preventing side-channel attacks.

[0012] This object is solved by the subject matter of the independent claims.

[0013] Preferred embodiments are defined by the dependent claims.

[0014] According to an aspect of an exemplary embodiment, there is provided an apparatus comprising: a processor configured to execute: a seed value generator configured to generate a seed value; a divider configured to divide the seed value into a plurality of blocks; a first extractor configured to extract a plurality of first parameter values from a first parameter candidate value set comprising a plurality of first parameter candidate values, each of the plurality of first parameter values respectively corresponding to one of the plurality of blocks divided from the seed value; a second extractor configured to extract a plurality of second parameter values from a second parameter candidate value set comprising a plurality of second parameter candidate values generated based on the plurality of first parameter candidate values included in the first parameter candidate value set, each of the plurality of second parameter values respectively corresponding to one of the plurality of blocks divided from the seed value; and a calculator configured to generate a first random number based on the plurality of first parameter values, generate a second random number by performing an exponentiation operation based on the first random number as an exponent or performing a scalar multiplication operation of a point based on the first random number as a scalar multiplier, and generate a third random number based on the plurality of second parameter values, wherein the processor is further configured to encrypt data or generate a digital signature for the data based on at least one of the first random number, the second random number, and the third random number.

[0015] Each of the plurality of second parameter candidate values included in the second parameter candidate value set may be generated by performing an exponentiation operation using a corresponding one of the plurality of first parameter candidate values included in the first parameter candidate value set as an exponent or by performing a scalar multiplication operation of a point using a corresponding one of the plurality of first parameter candidate values included in the first parameter candidate value set as a scalar multiplier.

[0016] The first extractor may be further configured to extract the plurality of first parameter values respectively corresponding to bit strings of the plurality of blocks divided from the seed value and positions of the blocks in the seed value from the first parameter candidate value set, and the second extractor may be further configured to extract the plurality of second parameter values respectively corresponding to bit strings in the plurality of blocks divided from the seed value and positions of the blocks in the seed value from the second parameter candidate value set.

[0017] The calculator may generate the first random number by adding the plurality of first parameter values with each other.

[0018] At least one of the second parameter candidate values included in the second parameter candidate value set may include a value resulting from multiplying one of the plurality of first parameter candidate values by a secret key.

[0019] The third random number may be equal to a product of the secret key and the second random number.

[0020] The processor may be further configured to encrypt the data or generate the digital signature for the data based on the first random number, the second random number, and the third random number.

[0021] The seed value may comprise a random bit string.

[0022] The number of the plurality of first parameter candidate values included in the first parameter candidate value set may be changeable according to a length of the seed value and a number of blocks.

[0023] According to another aspect of an exemplary embodiment, there is provided a method, comprising: generating a seed value; dividing the seed value into a plurality of blocks; extracting a plurality of first parameter values from a first parameter candidate value set comprising a plurality of first parameter candidate values, each of the plurality of first parameter values respectively corresponding to one of the plurality of blocks divided from the seed value; extracting a plurality of second parameter values from a second parameter candidate value set comprising a plurality of second parameter candidate values generated based on the plurality of first parameter candidate values included in the first parameter candidate value set, each of the plurality of second parameter values respectively corresponding to one of the plurality of blocks divided from the seed value; generating a first random number based on the plurality of first parameter values; generating a second random number by performing an exponentiation operation using the first random number as an exponent or by performing a scalar multiplication operation of a point using the first random number as a scalar multiplier; generating a third random number based on the plurality of second parameter values; and encrypting data or generating a digital signature for the data based on at least one of the first random number, the second random number, and the third random number.

[0024] Each of the plurality of second parameter candidate values included in the second parameter candidate value set may be generated by performing an exponentiation operation using a corresponding one of the plurality of first parameter candidate values included in the first parameter candidate value set as an exponent or by performing a scalar multiplication operation of a point using a corresponding one of the plurality of first parameter candidate values included in the first parameter candidate value set as a scalar multiplier.

[0025] The extracting of the plurality of first parameter values may extract the plurality of first parameter values respectively corresponding to bit strings of the plurality of blocks divided from the seed value and positions of the blocks in the seed value from the first parameter candidate value set, and the extracting the plurality of second parameter values may extract the plurality of second parameter values respectively corresponding to bit strings in the plurality of blocks divided from the seed value and positions of the blocks in the seed value from the second parameter candidate value set.

[0026] The generating of the first random number generates the first random number by adding the plurality of first parameter values with each other.

[0027] At least one of the second parameter candidate values included in the second parameter candidate value set may include a value resulting from multiplying one of the plurality of first parameter candidate values by a secret key.

[0028] The third random number may be equal to a product of the secret key and the second random number.

[0029] The encrypting the data or the generating the digital signature for the data may be based on at least one of the first random number, the second random number, and the third random number.

[0030] The seed value may comprise a random bit string.

[0031] The number of the plurality of first parameter candidate values included in the first parameter candidate value set may be changeable according to a length of the seed value and a number of blocks.

[0032] According to an aspect of an exemplary embodiment, there is provided a non-transitory computer readable medium having stored thereon a program for causing a computer to execute a method, comprising: generating a seed value; dividing the seed value into a plurality of blocks; extracting a plurality of first parameter values from a first parameter candidate value set comprising a plurality of first parameter candidate values, each of the plurality of first parameter values respectively corresponding to one of the plurality of blocks divided from the seed value; extracting a plurality of second parameter values from a second parameter candidate value set comprising a plurality of second parameter candidate values generated based on the plurality of first parameter values included in the first parameter candidate value set, each of the plurality of second parameter values respectively corresponding to one of the plurality of blocks divided from the seed value; generating a first random number based on the plurality of first parameter values; generating a second random number by performing an exponentiation operation using the first random number as an exponent or by performing a scalar multiplication operation of a point using the first random number as a scalar multiplier; generating a third random number based on the plurality of second parameter values; and encrypting data or generating a digital signature for the data based on at least one of the first random number, the second random number, and the third random number.

[0033] According to an aspect of an exemplary embodiment, there is provided an apparatus comprising: a processor configured to: receive a seed value; divide the seed value into a plurality of blocks; extract, for each of the plurality of blocks, a first parameter value from a first parameter candidate value set comprising a plurality of first parameter candidate values, by using a number of the respective block and a value in the respective block as a first index; extract, for each of the plurality of blocks, a second parameter value from a second parameter candidate value set comprising a plurality of second parameter candidate values generated based on the plurality of first parameter candidate values, by using a number of the respective block and a value in the respective block as a second index, the plurality of second parameter values; generate a first random number based the first parameter values for each of the plurality of blocks; generate a second random number by performing one of an exponentiation operation based on the first random number as an exponent or a scalar multiplication operation of a point based on the first random number as a scalar multiplier; generate a third random number based on the second parameter values; for each of the plurality of blocks; and apply at least one of the first random number, the second random number, and the third random number to encrypt data or generate a digital signature for the data.

[0034] A number of the first parameter candidate values included in the first parameter candidate value set or a number of the second parameter candidate values included in the second parameter candidate value set may change according to a length of the seed value and a total number of the plurality of blocks.

BRIEF DESCRIPTION OF THE DRAWINGS



[0035] The above and other objects, features and advantages of the present disclosure will become more apparent to those of ordinary skill in the art by describing exemplary embodiments thereof in detail with reference to the accompanying drawings, in which:

FIG. 1 is a configuration diagram illustrating a computation apparatus according to an exemplary embodiment of the present disclosure;

FIG. 2 is a table showing one example of a first parameter candidate value set according to an exemplary embodiment of the present disclosure;

FIG. 3 is a diagram illustrating an example of an extraction of the first parameter value according to an exemplary embodiment of the present disclosure;

FIG. 4 is a table showing an example of a second parameter candidate value set according to an exemplary embodiment of the present disclosure;

FIG. 5 is a table showing another example of the second parameter candidate value set according to an exemplary embodiment of the present disclosure;

FIG. 6 is a diagram illustrating one example of an extraction of the second parameter value according to an exemplary embodiment of the present disclosure;

FIG. 7 is a diagram illustrating another example of the extraction of the second parameter value according to an exemplary embodiment of the present disclosure; and

FIG. 8 is a flowchart illustrating a computation method according to an exemplary embodiment of the present disclosure.


DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS



[0036] Hereinafter, detailed exemplary embodiments of the present disclosure will be described with reference to the accompanying drawings. The following detailed description is provided for a more comprehensive understanding of methods, devices and/or systems described in this specification. However, the methods, devices, and/or systems are only examples, and the present disclosure is not limited thereto.

[0037] In the description of the present disclosure, detailed descriptions of related well-known functions that are determined to unnecessarily obscure the gist of the present disclosure will be omitted.

[0038] Unless the context clearly indicates otherwise, the singular forms include the plural forms. It should be understood that the terms "comprises" or "includes," when used herein, specify the presence of some features, numbers, steps, operations, elements, and/or combinations thereof, but do not preclude the presence or possibility of addition of one or more other features, numbers, steps, operations, elements, and/or combinations thereof.

[0039] FIG. 1 is a configuration diagram illustrating a computation apparatus according to an exemplary embodiment of the present disclosure.

[0040] Referring to FIG. 1, a computation apparatus 100 includes a seed value generator 110, a divider 120, a first extractor 130, a second extractor 140, and a calculator 150.

[0041] The seed value generator 110 generates a seed value. According to an exemplary embodiment, the seed value may be formed by a random bit string.

[0042] In this case, the seed value generator 110 may generate the seed value, for example, by sequentially generating arbitrary bit values.

[0043] In another example, the seed value generator 110 may generate the seed value by converting an ID obtained from an external device into an arbitrary bit string. In this case, a hash function, for example, SHA-256, may be used to convert the obtained ID into the arbitrary bit string.

[0044] However, a seed value generation method of the seed value generator 110 is not particularly limited, and the seed value generator 110 may generate the seed value using various known methods capable of generating a sequence of arbitrary bits of a predetermined length.

[0045] The divider 120 divides the seed value generated by the seed value generator 110 into a plurality of blocks.

[0046] Specifically, according to an exemplary embodiment of the present disclosure, the divider 120 may divide the seed value by a predetermined size to generate the plurality of blocks. In this case, the number of blocks generated by the divider 120 may be changed according to an exemplary embodiment.

[0047] For example, when the seed value generated by the seed value generator 110 is a bit string with a length of 256 bits, the divider 120 may divide the seed value into units of 8 bits to generate 32 blocks.

[0048] The first extractor 130 extracts a plurality of first parameter values that respectively correspond to the plurality of blocks generated by the divider 120 from a first parameter candidate value set including a plurality of first parameter candidate values.

[0049] In this case, the plurality of first parameter candidate values included in the first parameter candidate value set may be random values generated in advance and stored in a storage.

[0050] According to an exemplary embodiment of the present disclosure, the first parameter candidate value set may include 2n×m first parameter candidate values. Here, m represents the number of blocks generated by the divider 120, and n represents a length of a bit string included in each of the generated blocks. Moreover, the number of the first parameter candidate values included in the first parameter candidate value set may be changed according to the length of the seed value generated by the seed value generator 110 and the number of blocks generated by the divider 120.

[0051] According to an exemplary embodiment of the present disclosure, the first extractor 130 may extract first parameter values respectively corresponding to bit strings in the plurality of blocks generated by the divider 120 and positions of the blocks in the seed value from the first parameter candidate value set.

[0052] Specifically, each of the first parameter candidate values included in the first parameter candidate value set may be indexed to one of 2n different bit strings, each having a length of n bits, and a position of a block including the one of 2n different bit string in the seed value. Accordingly, the first extractor 130 may compare the bit string included in each of the blocks generated by the divider 120 and the position of each of the blocks generated by the divider 120 in the seed value with an index value of each of the first parameter candidate values included in the first parameter candidate value set to extract a corresponding first parameter candidate value as a first parameter value.

[0053] FIG. 2 is a table showing one example of the first parameter candidate value set according to an exemplary embodiment of the present disclosure.

[0054] In the example shown in FIG. 2, a seed value generated by the seed value generator 110 has a length of 256 bits and that the divider 120 divides the seed value into 32 blocks, each having a length of 8 bits. Thus, a first parameter candidate value set 210 shown in FIG. 2 includes 28×32 first parameter candidate values.

[0055] Meanwhile, each of the first parameter candidate values included in the first parameter candidate value set 210 corresponds to one of 256 bit strings, each having a length of 8 bits, and a position of a block including a corresponding bit string in the seed value.

[0056] Specifically, k1,1 is a first parameter candidate value indexed to a bit string of 00000000 and the first block (i.e., 1 block) in the seed value, and k256,32 is a first parameter candidate value indexed to a bit string of 11111111 and the 32nd block (i.e., 32 block) in the seed value.

[0057] FIG. 3 is a diagram illustrating an example of an extraction of the first parameter value according to an exemplary embodiment of the present disclosure.

[0058] In the example shown in FIG. 3, a seed value 310 generated by the seed value generator 110 has a length of 256 bits and the divider 120 divides the seed value 310 into 32 blocks, each having a length of 8 bits. In addition, a first parameter candidate value set 330 may be same as the first parameter candidate value set 210 shown in FIG. 2. However, according to another embodiment, the first parameter candidate value set may be different from the first parameter candidate value set 210 shown in FIG. 2.

[0059] In the example shown in FIG. 3, when a bit string included in a first block among the 32 blocks generated by dividing the seed value 310 is "1111110," the first extractor 130 may extract a first parameter candidate value k255,1 that corresponds to "1 block" and the bit string of "1111110" from the first parameter candidate value set 330 as a first parameter value corresponding to the first block.

[0060] Further, when a bit string included in a second block among the 32 blocks generated by dividing the seed value 310 is "00000010," the first extractor 130 may extract a first parameter candidate value k3,2 that corresponds to "2 block" and the bit string of "00000010" from the first parameter candidate value set 330 as a first parameter value corresponding to the second block.

[0061] In the same way, the first extractor 130 may extract first parameter values that respectively correspond to all of the 32 blocks, which are generated by dividing the seed value 310, from the first parameter candidate value set 330.

[0062] Accordingly, {k255,1, k3,2, k1,3, ..., k3,30, k256,31, k255,32} are obtained as the first parameter values extracted by the first extractor 130 in the example shown in FIG. 3.

[0063] Referring back to FIG. 1, the second extractor 140 extracts a plurality of second parameter values that respectively correspond to the plurality of blocks generated by the divider 120 from a second parameter candidate value set including a plurality of second parameter candidate values generated by using each of the plurality of first parameter candidate values included in the first parameter candidate value set.

[0064] In this case, according to an exemplary embodiment of the present disclosure, second parameter candidate values (ri,j) included in the second parameter candidate value set may be generated by performing, for example, an exponentiation operation using each of first parameter candidate values (ki,j) included in the first parameter candidate value set, as shown in the following Equation 1, or by performing a scalar multiplication operation of a point using each of the first parameter candidate values (ki,j) included in the first parameter candidate value set, as shown in the following Equations 2 and 3.



[0065] In Equation 1, p represents an arbitrary prime number and g represents a generator of a multiplicative group having p as an order.





[0066] In Equations 2 and 3, p represents an arbitrary prime number and P represents a generator of an additive group having p as an order.

[0067] In addition, at least some of the second parameter candidate values included in the second parameter candidate value set may include a value multiplied by a secret key used for encryption of data or digital signature generation associated with the data.

[0068] Specifically, some of the second parameter candidate values included in the second parameter candidate value set may be, for example, values obtained by multiplying each value that is obtained through an exponentiation operation or a scalar multiplication operation of a point using some of the first parameter candidate values included in the first parameter candidate value set, by the secret key.

[0069] In another example, some of the second parameter candidate values included in the second parameter candidate value set may be values obtained by performing an exponentiation operation or a scalar multiplication operation of a point using each of some of the first parameter candidate values included in the first parameter candidate value set. In this case, the remaining second parameter candidate values included in the second parameter candidate value set may be values obtained by multiplying each value, which is obtained by performing an exponentiation operation or a scalar multiplication operation of a point using each of the remaining first parameter candidate values included in the first parameter candidate value set by the secret key.

[0070] Meanwhile, in an exemplary embodiment, the second parameter candidate value set may include 2n×m second parameter candidate values. That is, the number of the second parameter candidate values included in the second parameter candidate value set may be changed according to the length of the seed value generated by the seed value generator 110 and the number of blocks generated by the divider 120.

[0071] Meanwhile, according to an exemplary embodiment, the second extractor 140 may extract second parameter values respectively corresponding to bit strings of the plurality of blocks generated by the divider 120 and positions of the blocks in the seed value from the second parameter candidate value set.

[0072] Specifically, each of the second parameter candidate values included in the second parameter candidate value set may be indexed to one of 2n different bit strings, each having a length of n bits, and a position of a block including the one of 2n different bit string in the seed value. Accordingly, the second extractor 140 may compare the bit string included in each of the blocks generated by the divider 120 and the position of each of the blocks generated by the divider 120 in the seed value with an index value of each of the second parameter candidate values included in the second parameter candidate value set to extract a corresponding second parameter candidate value as a second parameter value.

[0073] FIG. 4 is a table showing an example of a second parameter candidate value set according to an exemplary embodiment of the present disclosure.

[0074] Specifically, FIG. 4 shows an example of the second parameter candidate value set including second parameter candidate values generated from the first parameter candidate values included in the first parameter candidate value set 210 shown in FIG. 2.

[0075] Referring to FIG. 4, a second parameter candidate value set 410 includes the same number (i.e., 28x32) of second parameter candidate values as the number of first parameter candidate values included in the first parameter candidate value set 210 shown in FIG. 2.

[0076] In addition, the second parameter candidate values included in the second parameter candidate value set 410 are each indexed using one of 32 blocks and one of different bit strings, each having a length of 8 bits. In this case, each of the second parameter candidate values included in the second parameter candidate value set 410 may have the same index value as that of a corresponding first parameter candidate value included in the first parameter candidate value set 210.

[0077] Specifically, a second parameter candidate value r1,1 is a value generated using the first parameter candidate value k1,1 included in the first parameter candidate value set 210, and is indexed to a bit string of "00000000" and the first block (i.e., 1 block) in the same way as the first parameter candidate value k1,1.

[0078] In addition, a second parameter candidate value cr1,32 is a value generated using a first parameter candidate value k1, 32 included in the first parameter candidate value set 210, and is indexed to a bit string of "00000000" and the 32nd block (i.e., 32 block) in the same way as the first parameter candidate value k1,32.

[0079] Meanwhile, except for second parameter candidate values (i.e., cr1,32, cr2,32, cr3,32,..., cr255,32, cr256,32) having "32 block" as index values in the second parameter candidate value set 410, the remaining second parameter candidate values in the second parameter candidate value set 410 may have values equal to values obtained by being generated through an exponentiation operation using each first parameter candidate value of the first parameter candidate value set 210 that has the same index value as the second parameter candidate values.

[0080] However, according to an exemplary embodiment, the second parameter candidate values (i.e., cr1,32, cr2,32, cr3,32, ..., cr255,32, cr256,32) having "32 block" as index values in the second parameter candidate value set 410 have values equal to values obtained by multiplying each of values obtained through an exponentiation operation using each of the first parameter candidate values (i.e., k1,32, k2,32, k3,32, ..., k255,32, k256,32) in the first parameter candidate value set 210 that have the same index values as the second parameter candidate values by a secret key c.

[0081] Meanwhile, in the example shown in FIG. 4, the second parameter candidate values (i.e., cr1,32, cr2,32, cr3,32, ..., cr256,32) having "32 block" as index values are shown as having the values generated by multiplying each of the first parameter candidate values (i.e., r1,32, r2,32, r3,32, ..., r255,32, r256,32) having the same index values as the second parameter candidate values by the secret key c, but the second parameter candidate values are not limited thereto. Specifically, second parameter candidate values included in the second parameter candidate value set which have a specific block as their index values may have values equal to values obtained by multiplying each first parameter candidate value having an identical block as an index values by the secret key c.

[0082] FIG. 5 is a table showing another example of the second parameter candidate value set according to an exemplary embodiment of the present disclosure.

[0083] Specifically, FIG. 5 shows an example of the second parameter candidate value set including second parameter candidate values generated from the first parameter candidate values contained in the first parameter candidate value set 210 shown in FIG. 2.

[0084] Referring to FIG. 5, a second parameter candidate value set 510 includes the same number (i.e., 28×32) of second parameter candidate values as the number of first parameter candidate values included in the first parameter candidate value set 210 shown in FIG. 2.

[0085] In addition, the second parameter candidate values included in the second parameter candidate value set 510 are each indexed using one of 32 blocks and one of different bit strings, each having a length of 8 bits. In this case, each of the second parameter candidate values included in the second parameter candidate value set 510 has the same index value as that of a corresponding first parameter candidate value included in the first parameter candidate value set 210.

[0086] Specifically, a second parameter candidate value cr1,1 is a value generated using the first parameter candidate value k1,1 included in the first parameter candidate value set 210 and is indexed to the bit string of "00000000" and the first block (i.e., 1 block) in the same way as the first parameter candidate value k1,1.

[0087] In addition, the second parameter candidate value cr1,32 is a second parameter candidate value generated using the first parameter candidate value k1,32 in the first parameter candidate value set 210 and is indexed to the bit string of "00000000" and the 32nd block (i.e., 32 block) in the same way as the first parameter candidate value k1,32.

[0088] Meanwhile, the second parameter candidate values included in the second parameter candidate value set 510 have values equal to values obtained by multiplying values, which are generated through a scalar multiplication operation of a point using each of the first parameter candidate values having the same index values as those of the second parameter candidate values in the first parameter candidate value set 210, by the secret key c.

[0089] FIG. 6 is a diagram illustrating one example of the extraction of the second parameter value according to an exemplary embodiment of the present disclosure.

[0090] In the example shown in FIG. 6, a seed value 610 is the same as the seed values 310 shown in FIG. 3 and that the divider 120 divides the seed value 610 into 32 blocks, each having a length of 8 bits. In addition, a second parameter candidate value set 630 is the same as the second parameter candidate value set 410 shown in FIG. 4.

[0091] In the example shown in FIG. 6, when a bit string included in a first block of the 32 blocks generated by dividing the seed value 610 is "1111110," the second extractor 140 may extract a second parameter candidate value r255,1 that corresponds to "1 block" and the bit string of "1111110" from the second parameter candidate value set 630 as a second parameter value corresponding to the first block.

[0092] In addition, when a bit string included in a second block of the blocks generated by dividing the seed value 610 is "00000010," the second extractor 140 may extract a second parameter candidate value r3,2 that corresponds to "2 block" and the bit string of "00000010" from the second parameter candidate value set 630 as a second parameter value corresponding to the second block.

[0093] In the same way, the second extractor 140 may extract second parameter values that respectively correspond to the 32 blocks generated by dividing the seed value 610 from the second parameter candidate value set 630.

[0094] Accordingly, {r255,1, r3,2, r1,3, ..., r3,30, r256,31, cr255,32} are obtained as the second parameter values extracted by the second extractor 140 in the example shown in FIG. 6.

[0095] FIG. 7 is a diagram illustrating another example of the extraction of the second parameter value according to an exemplary embodiment of the present disclosure.

[0096] In the example shown in FIG. 7, a seed value 710 is the same as the seed value 310 shown in FIG. 3 and that the divider 120 divides the seed value 710 into 32 blocks, each having a length of 8 bits. In addition, a second parameter candidate value set 730 is the same as the first parameter candidate value set 510 shown in FIG. 5.

[0097] In the example shown in FIG. 7, when a bit string included in the first block of the 32 blocks generated by dividing the seed value 710 is "1111110," the second extractor 140 may extract a second parameter candidate value cr255,1 that corresponds to "1 block" and the bit string of "1111110" from the second parameter candidate value set 730 as a second parameter value corresponding to the first block.

[0098] In addition, when a bit string included in the second block of the blocks generated by dividing the seed value 710 is "00000010," the second extractor 140 may extract a second parameter candidate value cr3,2 that corresponds to "2 block" and the bit string of "00000010" from the second parameter candidate value set 730 as a second parameter value corresponding to the second block.

[0099] In the same way, the second extractor 140 may extract parameter values that respectively correspond to the 32 blocks generated by dividing the seed value 710 from the second parameter candidate value set 730.

[0100] Accordingly, {cr255,1, cr3,2, cr1,3, ..., cr3,30, cr256,31, cr255,32} are obtained as the second parameter values extracted by the second extractor 140 in the example shown in FIG. 7.

[0101] Referring back to FIG. 1, the calculator 150 generates a first random number using the first parameter values extracted by the first extractor 130.

[0102] In this case, according to an exemplary embodiment of the present disclosure, the calculator 150 may generate the first random number by adding the first parameter values extracted from the first parameter candidate value set with each other. For example, the calculator 150 may use the following Equation 4 to generate a first random number k from the first parameter values extracted in the example shown in FIG. 3.



[0103] Meanwhile the calculator 150 may generate the first random number k using various types of one-way function other than the foregoing Equation 4.

[0104] In addition, the calculator 150 may generate a second random number by performing an exponentiation operation using the first random number as an exponent or by performing a scalar multiplication operation of a point using the first random number as a scalar multiplier.

[0105] For example, the calculator 150 may use the following Equation 5 to generate a second random number r from the first random number k.



[0106] In Equation 5, p is an arbitrary prime number and g is a generator of a multiplicative group having p as an order.

[0107] In another example, the calculator 150 may use the following Equations 6 and 7 to generate the second random number r from the first random number k.





[0108] In Equations 6 and 7, p is an arbitrary prime number and P is a generator of an additive group having p as an order.

[0109] Meanwhile, the calculator 150 may generate a third random number using the second parameter values extracted from the second parameter candidate value set.

[0110] Specifically, according to an exemplary embodiment of the present disclosure, the calculator 150 may generate the third random number by multiplying or adding the second parameter values extracted from the second parameter candidate value set with each other.

[0111] For example, the calculator 150 may use the following Equation 8 to generate a third random number cr from the second parameter values extracted in the example shown in FIG. 6.



[0112] In another example, the calculator 150 may use the following Equation 9 to generate the third random number cr from the second parameter values extracted in the example shown in FIG. 7.



[0113] That is, the third random number cr generated by the calculator 150 is equal to a product of the secret key c multiplied by the second random number r.

[0114] According to another exemplary embodiment, the calculator 150 may generate the third random number cr from the second parameter values using various forms of one-way function, capable of generating a value equal to the second random number r multiplied by the secret key c, other than the addition or multiplication of the second parameter values, as shown in the foregoing Equation 4 and Equation 6.

[0115] Meanwhile, according to an exemplary embodiment of the present disclosure, the one or more processors of the computing device 100 may encrypt data or generate a digital signature using the generated first random number k, second random number r, and third random number cr. According to exemplary embodiment, the calculator 150 may encrypt data or generate a digital signature using the generated first random number k, second random number r, and third random number cr. According to another exemplary embodiment, another component or another element of the one or more processors of the computing device 100 may encrypt data or generate a digital signature using the generated first random number k, second random number r, and third random number cr.

[0116] Specifically, the calculator 150 may encrypt data or generate a digital signature using various types of encryption algorithm or digital signature generation algorithm which require an exponentiation operation or a scalar multiplication operation of a point, and an operation of multiplying a value generated through the exponentiation operation or the scalar multiplication operation of a point by a secret key for encryption or digital signature generation. In this manner, according to an exemplary embodiment, since a direct exponentiation operation or a direct scalar multiplication operation of a point is not performed for a key exchange, an encryption, or a digital signature for encryption, exploitation of physical information leaked from devices by side-channel attacks during performance of mathematical computations is prevented.

[0117] For example, the calculator 150 may generate a digital signature using a digital signature algorithm (DSA), which is one digital signature scheme.

[0118] Specifically, a digital signature according to the DSA is generated as follows:
  1. 1) A random integer k is selected (k∈[1,q-1])
  2. 2) r=(gk mod p) mod q is computed (where p is an arbitrary prime number, q is a prime divisor of p-1, and g is a generator of a multiplicative group having p as an order)
  3. 3) s=k-1(H(m)+cr) mod q is computed (where c is a secret key, m is a message, and H() is a hash function)
  4. 4) A signature value (r,s) is output for a message


[0119] In this case, the calculator 150 may use the first random number as a random integer k and use the second random number as the signature value r. In addition, the calculator 150 may use the third random number cr to generate the signature value s. That is, the third random number cr for generating the signature value s may be obtained through another operation, such as a multiplication operation, which is secure against side-channel attack and uses the second parameter values extracted from the second parameter candidate value set, rather than through an operation by multiplying the signature value r by the secret key c. Therefore, the secret key c used to generate the signature value s is not exposed by a side-channel attack.

[0120] In another example, the calculator 150 may generate a digital signature using an elliptic curve digital signature algorithm (ECDSA), which is one digital signature scheme.

[0121] Specifically, a digital signature according to the ECDSA is generated as follows:
  1. 1) A random integer k (k∈[1,q-1]) is selected (where q is a prime divisor of p-1 and p is an arbitrary prime number)
  2. 2) k·P=(x, y) is computed (where P is a generator of an additive group having p as an order)
  3. 3) r=x mod p is computed
  4. 4) s=k-1(H(m)+cr) mod (p-1) is computed (where c is a secret key, m is a message, and H() is a hash function)
  5. 5) A signature value (r,s) is output for a message


[0122] In this case, the calculator 150 may use the first random number as the random integer k, and use the second random number as the signature value r. In addition, the calculator 150 may use the third random number cr to generate the signature value s. That is, the third random number cr used to generate the signature value s may be obtained through an operation, such as an addition operation, which is secure against side-channel attack and uses the second parameter values extracted from the second parameter candidate value set, rather than through the operation of multiplying the signature value r by the secret key c. Therefore, the secret key c used to generate the signature value s is not exposed by a side-channel attack.

[0123] Meanwhile, in an exemplary embodiment, the seed value generator 110, the divider 120, the first extractor 130, the second extractor 140, and the calculator 150, which are shown in FIG. 1, may be implemented on one or more computing devices including one or more processors and a computer-readable recording medium connected to the one or more processors. The computer-readable recording medium may be provided inside or outside the processor, and may be connected to the processor by various well-known means. The processor in the computing device may enable the computing device to operate according to the exemplary embodiments described in the specification. For example, the processor may execute instructions stored in the computer readable recording medium, and the instructions stored in the computer readable recording medium, when executed by the processor, may cause a series of operational steps to be performed on the computing device according to the exemplary embodiments of the present disclosure described in the specification.

[0124] FIG. 8 is a flowchart illustrating a computation method according to an exemplary embodiment of the present disclosure.

[0125] The computation method shown in FIG. 8 may be performed by the computation apparatus 100 illustrated in FIG. 1.

[0126] Referring to FIG. 8, the computation apparatus 100 generates a seed value formed by a random bit string (810).

[0127] Then, the computation apparatus 100 divides the generated seed value into a plurality of blocks (820).

[0128] The computation apparatus 100 extracts a plurality of first parameter values that respectively correspond to the plurality of generated blocks from a first parameter candidate value set including a plurality of first parameter candidate values (830).

[0129] In this case, according to an exemplary embodiment of the present disclosure, the computation apparatus 100 may extract first parameter values respectively corresponding to bit strings in the plurality of generated blocks and positions of the blocks in the seed value from the first parameter candidate value set.

[0130] Thereafter, the computation apparatus 100 generates a first random number from the first parameter values (840).

[0131] In this case, according to an exemplary embodiment of the present disclosure, the computation apparatus 100 may generate the first random number by adding the first parameter values with each other.

[0132] Then, the computation apparatus 100 generates a second random number using the generated first random number (850).

[0133] In this case, according to an exemplary embodiment of the present disclosure, the computation apparatus 100 may generate the second random number through an exponentiation operation using the first random number as an exponent or through a scalar multiplication operation of a point using the first random number as a scalar multiplier.

[0134] Then, the computation apparatus 100 extracts a plurality of second parameter values that respectively correspond to the plurality of generated blocks from a second parameter candidate value set including a plurality of second parameter candidate values generated using each of a plurality of first parameter candidate values included in the first parameter candidate value set (860).

[0135] In this case, according to an exemplary embodiment of the present disclosure, the second parameter candidate values included in the second parameter candidate value set may generated by performing an exponentiation operation using each of the plurality of first parameter candidate values included in the first parameter candidate value set as an exponent or by performing a scalar multiplication operation of a point using each of the plurality of first parameter candidate values included in the first parameter candidate value set as a scalar multiplier. In addition, at least some of the second parameter candidate values included in the second parameter candidate value set may include a value multiplied by a secret key used for encryption or digital signature generation.

[0136] In addition, according to an exemplary embodiment, the computation apparatus 100 may extract second parameter values respectively corresponding to bit strings in the plurality of generated blocks and positions of the blocks in the seed value from the second parameter candidate value set.

[0137] Thereafter, the computation apparatus 100 generates a third random number using the second parameter values (870).

[0138] According to an exemplary embodiment of the present disclosure, the computation apparatus 100 may generate the third random number by multiplying or adding the second parameter values with each other.

[0139] Meanwhile, according to an exemplary embodiment of the preset disclosure, the computation apparatus 100 may encrypt data or generate a digital signature using the generated first, second and third random numbers.

[0140] While the flowchart shown in FIG. 8 illustrates the method as being performed in a plurality of operations according to an exemplary embodiment, at least some of the operations may be performed in a different order, performed in combination with each other, omitted or performed in sub-operations.

[0141] According to the exemplary embodiments of the present disclosure, it is possible to generate values equal to values obtained through an exponentiation operation or a scalar multiplication operation of a point using values extracted from previously generated parameter candidate value sets and an operation secure against side-channel attack, thereby improving security against a side-channel attack without degrading performance.

[0142] Methods according to various exemplary embodiments of the present disclosure described above may be embodied as an application type that may be installed in electronic devices, i.e., IoT devices.

[0143] The methods according to the various exemplary embodiments of the present disclosure described above may also be embodied by merely upgrading software or hardware of electronic devices, i.e., IoT devices.

[0144] According to an exemplary embodiment, the elements, components, methods or operations described herein may be implemented using hardware components, software components, or a combination thereof. For example, the hardware components may include a processing device. According to an exemplary embodiment, the display apparatus may include a processing device, such as the image processor or the controller, that may be implemented using one or more general-purpose or special purpose computers, such as, for example, a hardware processor, a CPU, a hardware controller, an ALU, a DSP, a microcomputer, an FPGA, a PLU, a microprocessor or any other device capable of responding to and executing instructions in a defined manner. The processing device may run an operating system (OS) and one or more software applications that run on the OS. The processing device also may access, store, manipulate, process, and create data in response to execution of the software. For purpose of simplicity, the description of a processing device is used as singular; however, one skilled in the art will appreciated that a processing device may include multiple processing elements and multiple types of processing elements. For example, a processing device may include multiple processors or a processor and a controller. In addition, different processing configurations are possible, such a parallel processors.

[0145] Meanwhile, the exemplary embodiments of the present disclosure may include a computer readable recording medium including a program for executing methods described in this specification on a computer. The computer readable recording medium may include a program instruction, a local data file, a local data structure, and/or combinations and subcombinations thereof. The medium may be specially designed and constructed for the purpose of the present disclosure, or may be well-known and available to those having skill in the computer software arts. Examples of the computer readable recording medium include magnetic media such as a hard disk, a floppy disk, and a magnetic tape, optical media such as a compact disc read-only memory (CD-ROM) and a digital versatile disc (DVD)-ROM, magneto-optical media such as a floptical disk, and a hardware device such as ROM, random-access memory (RAM), and a flash memory, which is specially designed to store and execute program commands. Examples of the program commands include an advanced language code which the computer can execute using an interpreter as well as a machine language code made by compilers.

[0146] Each of elements according to the above-described various exemplary embodiments (e.g., modules or programs) may include a single entity or a plurality of entities, and some of corresponding sub elements described above may be omitted or other types of sub elements may be further included in the various exemplary embodiments. Alternatively or additionally, some elements (e.g., modules or programs) may be integrated into one entity and then may equally or similarly perform a function performed by each of corresponding elements that are not integrated. Operations performed by modules, programs, or other types of elements according to the various exemplary embodiments may be sequentially, in parallel, or heuristically executed or at least some operations may be executed in different sequences or may be omitted, or other types of operations may be added.

[0147] While the present disclosure has been described above in detail with reference to representative exemplary embodiments, it should be understood by those skilled in the art that the exemplary embodiments may be variously modified without departing from the scope of the present disclosure. Therefore, the scope of the present disclosure is defined not by the described exemplary embodiments but by the appended claims.


Claims

1. An apparatus (100) adapted to improve security against side-channel attacks, comprising:

a processor configured to execute:

a seed value generator (110) configured to generate a seed value (310);

a divider (120) configured to divide the seed value (310) into a plurality of blocks;

a first extractor (130) configured to extract a plurality of first parameter values from a first parameter candidate value set (210) comprising a plurality of first parameter candidate values, each of the plurality of first parameter values respectively corresponding to one of the plurality of blocks divided from the seed value (310);

a second extractor (140) configured to extract a plurality of second parameter values from a second parameter candidate value set (410) comprising a plurality of second parameter candidate values generated based on the plurality of first parameter candidate values included in the first parameter candidate value set (210), each of the plurality of second parameter values respectively corresponding to one of the plurality of blocks divided from the seed value (310), wherein at least one of the second parameter candidate values included in the second parameter candidate value set (410) includes a value resulting from multiplying one of the plurality of first parameter candidate values by a secret key; and

a calculator (150) configured to generate a first random number based on the plurality of first parameter values, generate a second random number by performing an exponentiation operation based on the first random number as an exponent or performing a scalar multiplication operation of a point based on the first random number as a scalar multiplier, and generate a third random number based on the plurality of second parameter values,

wherein the processor is further configured to encrypt data or generate a digital signature for the data based on the first random number, the second random number, and the third random number.


 
2. The apparatus (100) of claim 1, wherein each of the plurality of second parameter candidate values included in the second parameter candidate value set (410) is generated by performing an exponentiation operation using a corresponding one of the plurality of first parameter candidate values included in the first parameter candidate value set (210) as an exponent or by performing a scalar multiplication operation of a point using a corresponding one of the plurality of first parameter candidate values included in the first parameter candidate value set (210) as a scalar multiplier,
wherein the calculator (150) generates the first random number by adding the plurality of first parameter values with each other.
 
3. The apparatus (100) of claim 1 or 2, wherein
the first extractor (130) is further configured to extract the plurality of first parameter values respectively corresponding to bit strings of the plurality of blocks divided from the seed value (310) and positions of the blocks in the seed value (310) from the first parameter candidate value set (210), and
the second extractor (140) is further configured to extract the plurality of second parameter values respectively corresponding to bit strings in the plurality of blocks divided from the seed value (310) and positions of the blocks in the seed value (310) from the second parameter candidate value set (410).
 
4. The apparatus of one of claims 1 to 3,
wherein the third random number is equal to a product of the secret key and the second random number.
 
5. The apparatus (100) of one of claims 1 to 4, wherein the seed value (310) comprises a random bit string.
 
6. The apparatus (100) of one of claims 1 to 5, wherein the number of the plurality of first parameter candidate values included in the first parameter candidate value set (210) is changeable according to a length of the seed value (310) and a number of blocks.
 
7. A method for improving security against side-channel attacks, comprising:

generating (810) a seed value (310);

dividing (820) the seed value (310) into a plurality of blocks;

extracting (830) a plurality of first parameter values from a first parameter candidate value set (210) comprising a plurality of first parameter candidate values, each of the plurality of first parameter values respectively corresponding to one of the plurality of blocks divided from the seed value (310);

extracting (860) a plurality of second parameter values from a second parameter candidate value set (410) comprising a plurality of second parameter candidate values generated based on the plurality of first parameter candidate values included in the first parameter candidate value set (210), each of the plurality of second parameter values respectively corresponding to one of the plurality of blocks divided from the seed value (310), wherein at least one of the second parameter candidate values included in the second parameter candidate value set (410) includes a value resulting from multiplying one of the plurality of first parameter candidate values by a secret key;

generating (840) a first random number based on the plurality of first parameter values;

generating (850) a second random number by performing an exponentiation operation using the first random number as an exponent or by performing a scalar multiplication operation of a point using the first random number as a scalar multiplier;

generating (870) a third random number based on the plurality of second parameter values; and

encrypting data or generating a digital signature for the data based on the first random number, the second random number, and the third random number.


 
8. The method of claim 7, wherein each of the plurality of second parameter candidate values included in the second parameter candidate value set (410) is generated by performing an exponentiation operation using a corresponding one of the plurality of first parameter candidate values included in the first parameter candidate value set (210) as an exponent or by performing a scalar multiplication operation of a point using a corresponding one of the plurality of first parameter candidate values included in the first parameter candidate value set (210) as a scalar multiplier.
 
9. The method of claim 7 or 8, wherein the extracting (830) of the plurality of first parameter values extracts the plurality of first parameter values respectively corresponding to bit strings of the plurality of blocks divided from the seed value (310) and positions of the blocks in the seed value (310) from the first parameter candidate value set (210), and the extracting (860) the plurality of second parameter values extracts the plurality of second parameter values respectively corresponding to bit strings in the plurality of blocks divided from the seed value (310) and positions of the blocks in the seed value (310) from the second parameter candidate value set (410).
 
10. The method of claim 8, wherein the generating (840) of the first random number generates the first random number by adding the plurality of first parameter values with each other.
 
11. The method of one of claims 7 to 10,
wherein the third random number is equal to a product of the secret key and the second random number.
 
12. The method of one of claims 7 to 11, wherein the seed value (310) comprises a random bit string.
 
13. The method of one of claims 7 to 12, wherein the number of the plurality of first parameter candidate values included in the first parameter candidate value set (210) is changeable according to a length of the seed value (310) and a number of blocks.
 


Ansprüche

1. Vorrichtung (100), die ausgebildet ist, die Sicherheit gegenüber Seitenkanalangriffen zu erhöhen, mit:

einem Prozessor, der ausgebildet ist zum Ausführen von:

einem Anfangswertgenerator (110), der ausgebildet ist, einen Anfangswert (310) zu erzeugen;

einem Teiler (120), der ausgebildet ist, den Anfangswert (310) in mehrere Blöcke zu unterteilen;

einem ersten Extraktor (130), der ausgebildet ist, mehrere erste Parameterwerte aus einer ersten Parameterkandidatenwertegruppe (210) mit mehreren ersten Parameterkandidatenwerten zu extrahieren, wobei jeder der mehreren ersten Parameterwerte einem der mehreren Blöcke, die aus dem Anfangswert (310) unterteilt sind, zugeordnet ist;

einem zweiten Extraktor (140), der ausgebildet ist, mehrere zweite Parameterwerte aus einer zweiten Parameterkandidatenwertegruppe (410) mit mehreren zweiten Parameterkandidatenwerten, die auf der Grundlage der mehreren ersten Parameterkandidatenwerte erzeugt sind, die in der ersten Parameterkandidatenwertegruppe (210) enthalten sind, zu extrahieren, wobei jeder der mehreren zweiten Parameterwerte einem der mehreren Blöcke, die aus dem Anfangswert (310) unterteilt sind, zugeordnet ist, wobei mindestens einer der zweiten Parameterkandidatenwerte, die in der zweiten Parameterkandidatenwertegruppe (410) enthalten sind, einen Wert beinhaltet, der sich aus dem Multiplizieren eines der mehreren ersten Parameterkandidatenwerte mit einem geheimen Schlüssel ergibt; und

einem Kalkulator (150), der ausgebildet ist, eine erste Zufallszahl auf der Grundlage der mehreren ersten Parameterwerte zu erzeugen, eine zweite Zufallszahl durch Ausführen einer Exponentenbildung auf der Grundlage der ersten Zufallszahl als ein Exponent oder durch Ausführen einer skalaren Multiplikation eines Punktes auf der Grundlage der ersten Zufallszahl als ein skalarer Multiplikator zu erzeugen, und eine dritte Zufallszahl auf der Grundlage der mehreren zweiten Parameterwerte zu erzeugen,

wobei der Prozessor ferner ausgebildet ist, auf der Grundlage der ersten Zufallszahl, der zweiten Zufallszahl und der dritten Zufallszahl Daten zu verschlüsseln oder eine digitale Signatur für die Daten zu erzeugen.


 
2. Vorrichtung (100) nach Anspruch 1, wobei jeder der mehreren zweiten Parameterkandidatenwerte, die in der zweiten Parameterkandidatenwertegruppe (410) enthalten sind, erzeugt wird, indem eine Exponentenbildung unter Anwendung eines entsprechenden der mehreren ersten Parameterkandidatenwerte, die in der ersten Parameterkandidatenwertegruppe (210) enthalten sind, als Exponent ausgeführt wird, oder indem eine skalare Multiplikation eines Punktes unter Anwendung eines entsprechenden der mehreren ersten Parameterkandidatenwerte, die in der ersten Parameterkandidatenwertegruppe (210) enthalten sind, als ein skalarer Multiplikator ausgeführt wird,
wobei der Kalkulator (150) die erste Zufallszahl durch Addieren der mehreren ersten Parameterwerte erzeugt.
 
3. Vorrichtung (100) nach Anspruch 1 oder 2, wobei
der erste Extraktor (130) ferner ausgebildet ist, die mehreren ersten Parameterwerte, die Bitfolgen der mehreren Blöcke, die aus dem Anfangswert (310) unterteilt sind, und Positionen der Blöcke in dem Anfangswert (310) aus der ersten Parameterkandidatenwertegruppe (210) entsprechen, zu extrahieren, und
der zweite Extraktor (140) ferner ausgebildet ist, die mehreren zweiten Parameterwerte, die Bitfolgen in den mehreren Blöcken, die aus dem Anfangswert (310) unterteilt sind, und Positionen der Blöcke in dem Anfangswert (310) entsprechen, aus der zweiten Parameterkandidatenwertegruppe (410) zu extrahieren.
 
4. Vorrichtung nach einem der Ansprüche 1 bis 3,
wobei die dritte Zufallszahl gleich einem Produkt des geheimen Schlüssels und der zweiten Zufallszahl ist.
 
5. Vorrichtung (100) nach einem der Ansprüche 1 bis 4, wobei der Anfangswert (310) eine zufällige Bitfolge umfasst.
 
6. Vorrichtung (100) nach einem der Ansprüche 1 bis 5, wobei die Anzahl der mehreren ersten Parameterkandidatenwerte, die in der ersten Parameterkandidatenwertegruppe (210) enthalten sind, entsprechend einer Länge des Anfangswerts (310) und einer Anzahl von Blöcken veränderbar ist.
 
7. Verfahren zur Erhöhung der Sicherheit gegenüber Seitenkanalangriffen, mit:

Erzeugen (810) eines Anfangswerts (310);

Unterteilen (820) des Anfangswerts (310) in mehrere Blöcke;

Extrahieren (830) mehrerer erster Parameterwerte aus einer ersten Parameterkandidatenwertegruppe (210), die mehrere erste Parameterkandidatenwerte enthält, wobei jeder der mehreren ersten Parameterwerte einem der mehreren Blöcke, die aus dem Anfangswert (310) unterteilt werden, zugeordnet wird;

Extrahieren (860) mehrerer zweiter Parameterwerte aus einer zweiten Parameterkandidatenwertegruppe (410), die mehrere zweite Parameterkandidatenwerte enthält, die auf der Grundlage der mehreren ersten Parameterwerte erzeugt werden, die in der ersten Parameterkandidatenwertegruppe (210) enthalten sind, wobei jeder der mehreren zweiten Parameterwerte einem der mehreren Blöcke, die aus dem Anfangswert (310) unterteilt werden, zugeordnet wird, wobei mindestens einer der zweiten Parameterkandidatenwerte, die in der zweiten Parameterkandidatenwertegruppe (410) enthalten sind, einen Wert enthält, der sich aus dem Multiplizieren eines der mehreren ersten Parameterkandidatenwerte mit einem geheimen Schlüssel ergibt;

Erzeugen (840) einer ersten Zufallszahl auf der Grundlage der mehreren ersten Parameterwerte;

Erzeugen (850) einer zweiten Zufallszahl durch Ausführen einer Exponentenbildung unter Anwendung der ersten Zufallszahl als Exponent oder durch Ausführen einer skalaren Multiplikation eines Punktes unter Anwendung der ersten Zufallszahl als skalarer Multiplikator;

Erzeugen (870) einer dritten Zufallszahl auf der Grundlage der mehreren zweiten Parameterwerte; und

Verschlüsseln von Daten oder Erzeugen einer digitalen Signatur für die Daten auf der Grundlage der ersten Zufallszahl, der zweiten Zufallszahl und der dritten Zufallszahl.


 
8. Verfahren nach Anspruch 7, wobei jeder der mehreren zweiten Parameterkandidatenwerte, die in der zweiten Parameterkandidatenwertegruppe (410) enthalten sind, erzeugt wird, indem eine Exponentenbildung unter Anwendung eines entsprechenden der mehreren ersten Parameterkandidatenwerte, die in der ersten Parameterkandidatenwertegruppe (210) enthalten sind, als Exponent ausgeführt wird, oder indem eine skalare Multiplikation eines Punktes unter Anwendung eines entsprechenden der mehreren ersten Parameterkandidatenwerte, die in der ersten Parameterkandidatenwertegruppe (210) enthalten sind, als skalarer Multiplikator ausgeführt wird.
 
9. Verfahren nach Anspruch 7 oder 8, wobei das Extrahieren (830) der mehreren ersten Parameterwerte durch Extrahierung der mehreren ersten Parameterwerte, die Bitfolgen der mehreren Blöcke, die aus dem Anfangswert (310) unterteilt sind, und Positionen der Blöcke in dem Anfangswert (310) entsprechen, aus der ersten Parameterkandidatenwertegruppe (210) erfolgt, und
das Extrahieren (860) der mehreren zweiten Parameterwerte durch Extrahierung der mehreren zweiten Parameterwerte, die Bitfolgen in den mehreren Blöcken, die aus dem Anfangswert (310) unterteilt sind, und Positionen der Blöcke in dem Anfangswert (310) entsprechen, aus der zweiten Parameterkandidatenwertegruppe (410) erfolgt.
 
10. Verfahren nach Anspruch 8, wobei beim Erzeugen (840) der ersten Zufallszahl die erste Zufallszahl erzeugt wird, indem die mehreren ersten Parameterwerte addiert werden.
 
11. Verfahren nach einem der Ansprüche 7 bis 10,
wobei die dritte Zufallszahl gleich einem Produkt aus dem geheimen Schlüssels und der zweiten Zufallszahl ist.
 
12. Verfahren nach einem der Ansprüche 7 bis 11, wobei der Anfangswert (310) eine zufällige Bitfolge umfasst.
 
13. Verfahren nach einem der Ansprüche 7 bis 12, wobei die Anzahl der mehreren ersten Parameterkandidatenwerte, die in der ersten Parameterkandidatenwertegruppe (210) enthalten sind, gemäß einer Länge des Anfangswerts (310) und einer Anzahl von Blöcken veränderbar ist.
 


Revendications

1. Appareil (100) adapté pour améliorer une sécurité contre des attaques par canal auxiliaire, comprenant :

un processeur configuré pour exécuter :

un générateur de valeur de départ (110) configuré pour générer une valeur de départ (310) ;

un diviseur (120) configuré pour diviser la valeur de départ (310) en une pluralité de blocs ;

un premier extracteur (130) configuré pour extraire une pluralité de premières valeurs de paramètre à partir d'un premier ensemble de valeurs candidates de paramètre (210) comprenant une pluralité de premières valeurs candidates de paramètre, chacune de la pluralité de premières valeurs de paramètre correspondant respectivement à l'un de la pluralité de blocs divisés à partir de la valeur de départ (310) ;

un second extracteur (140) configuré pour extraire une pluralité de secondes valeurs de paramètre à partir d'un second ensemble de valeurs candidates de paramètre (410) comprenant une pluralité de secondes valeurs candidates de paramètre générées sur la base de la pluralité de premières valeurs candidates de paramètre incluses dans le premier ensemble de valeurs candidates de paramètre (210), chacune de la pluralité de secondes valeurs de paramètre correspondant respectivement à l'un de la pluralité de blocs divisés à partir de la valeur de départ (310), dans lequel au moins une des secondes valeurs candidates de paramètre incluses dans le second ensemble de valeurs candidates de paramètre (410) comprend une valeur résultant d'une multiplication de l'une de la pluralité de premières valeurs candidates de paramètre par une clé secrète ; et

un calculateur (150) configuré pour générer un premier nombre aléatoire sur la base de la pluralité de premières valeurs de paramètre, générer un deuxième nombre aléatoire en effectuant une opération d'exponentiation sur la base du premier nombre aléatoire en tant qu'exposant ou en effectuant une opération de multiplication scalaire d'un point sur la base du premier nombre aléatoire en tant que multiplicateur scalaire, et générer un troisième nombre aléatoire sur la base de la pluralité de secondes valeurs de paramètre,

dans lequel le processeur est en outre configuré pour crypter des données ou générer une signature numérique pour les données sur la base du premier nombre aléatoire, du deuxième nombre aléatoire, et du troisième nombre aléatoire.


 
2. Appareil (100) selon la revendication 1, dans lequel chacune de la pluralité de secondes valeurs candidates de paramètre incluses dans le second ensemble de valeurs candidates de paramètre (410) est générée en effectuant une opération d'exponentiation en utilisant une valeur correspondante de la pluralité de premières valeurs candidates de paramètre incluses dans le premier ensemble de valeurs candidates de paramètre (210) en tant qu'exposant ou en effectuant une opération de multiplication scalaire d'un point en utilisant une valeur correspondante de la pluralité de premières valeurs candidates de paramètre incluses dans le premier ensemble de valeurs candidates de paramètre (210) en tant que multiplicateur scalaire,
dans lequel le calculateur (150) génère le premier nombre aléatoire en additionnant la pluralité de premières valeurs de paramètre les unes avec les autres.
 
3. Appareil (100) selon la revendication 1 ou 2, dans lequel
le premier extracteur (130) est en outre configuré pour extraire la pluralité de premières valeurs de paramètre correspondant respectivement à des chaînes de bits de la pluralité de blocs divisés à partir de la valeur de départ (310) et des positions des blocs dans la valeur de départ (310) à partir du premier ensemble de valeurs candidates de paramètre (210), et
le second extracteur (140) est en outre configuré pour extraire la pluralité de secondes valeurs de paramètre correspondant respectivement à des chaînes de bits dans la pluralité de blocs divisés à partir de la valeur de départ (310) et des positions des blocs dans la valeur de départ (310) à partir du second ensemble de valeurs candidates de paramètre (410).
 
4. Appareil selon l'une des revendications 1 à 3,
dans lequel le troisième nombre aléatoire est égal à un produit de la clé secrète et du deuxième nombre aléatoire.
 
5. Appareil (100) selon l'une des revendications 1 à 4, dans lequel la valeur de départ (310) comprend une chaîne de bits aléatoires.
 
6. Appareil (100) selon l'une des revendications 1 à 5, dans lequel le nombre de la pluralité de premières valeurs candidates de paramètre incluses dans le premier ensemble de valeurs candidates de paramètre (210) peut être changé en fonction d'une longueur de la valeur de départ (310) et d'un nombre de blocs.
 
7. Procédé pour améliorer une sécurité contre des attaques par canal auxiliaire, comprenant les étapes consistant à :

générer (810) une valeur de départ (310) ;

diviser (820) la valeur de départ (310) en une pluralité de blocs ;

extraire (830) une pluralité de premières valeurs de paramètre à partir d'un premier ensemble de valeurs candidates de paramètre (210) comprenant une pluralité de premières valeurs candidates de paramètre, chacune de la pluralité de premières valeurs de paramètre correspondant respectivement à l'un de la pluralité de blocs divisés à partir de la valeur de départ (310) ;

extraire (860) une pluralité de secondes valeurs de paramètre à partir d'un second ensemble de valeurs candidates de paramètre (410) comprenant une pluralité de secondes valeurs candidates de paramètre générées sur la base de la pluralité de premières valeurs candidates de paramètre incluses dans le premier ensemble de valeurs candidates de paramètre (210), chacune de la pluralité de secondes valeurs de paramètre correspondant respectivement à l'un de la pluralité de blocs divisés à partir de la valeur de départ (310), dans lequel au moins une des secondes valeurs candidates de paramètre incluses dans le second ensemble de valeurs candidates de paramètre (410) comprend une valeur résultant d'une multiplication de l'une de la pluralité de premières valeurs candidates de paramètre par une clé secrète ;

générer (840) un premier nombre aléatoire sur la base de la pluralité de premières valeurs de paramètre ;

générer (850) un deuxième nombre aléatoire en effectuant une opération d'exponentiation en utilisant le premier nombre aléatoire en tant qu'exposant ou en effectuant une opération de multiplication scalaire d'un point en utilisant le premier nombre aléatoire en tant que multiplicateur scalaire ;

générer (870) un troisième nombre aléatoire sur la base de la pluralité de secondes valeurs de paramètre ; et

crypter des données ou générer une signature numérique pour les données sur la base du premier nombre aléatoire, du deuxième nombre aléatoire, et du troisième nombre aléatoire.


 
8. Procédé selon la revendication 7, dans lequel chacune de la pluralité de secondes valeurs candidates de paramètre incluses dans le second ensemble de valeurs candidates de paramètre (410) est générée en effectuant une opération d'exponentiation en utilisant une valeur correspondante de la pluralité de premières valeurs candidates de paramètre incluses dans le premier ensemble de valeurs candidates de paramètre (210) en tant qu'exposant ou en effectuant une opération de multiplication scalaire d'un point en utilisant une valeur correspondante de la pluralité de premières valeurs candidates de paramètre incluses dans le premier ensemble de valeurs candidates de paramètre (210) en tant que multiplicateur scalaire.
 
9. Procédé selon la revendication 7 ou 8, dans lequel l'extraction (830) de la pluralité de premières valeurs de paramètre extrait la pluralité de premières valeurs de paramètre correspondant respectivement à des chaînes de bits de la pluralité de blocs divisés à partir de la valeur de départ (310) et des positions des blocs dans la valeur de départ (310) à partir du premier ensemble de valeurs candidates de paramètre (210), et
l'extraction (860) de la pluralité de secondes valeurs de paramètre extrait la pluralité de secondes valeurs de paramètre correspondant respectivement à des chaînes de bits dans la pluralité de blocs divisés à partir de la valeur de départ (310) et des positions des blocs dans la valeur de départ (310) à partir du second ensemble de valeurs candidates de paramètre (410).
 
10. Procédé selon la revendication 8, dans lequel la génération (840) du premier nombre aléatoire génère le premier nombre aléatoire en additionnant la pluralité de premières valeurs de paramètre les unes avec les autres.
 
11. Procédé selon l'une des revendications 7 à 10,
dans lequel le troisième nombre aléatoire est égal à un produit de la clé secrète et du deuxième nombre aléatoire.
 
12. Procédé selon l'une des revendications 7 à 11, dans lequel la valeur de départ (310) comprend une chaîne de bits aléatoires.
 
13. Procédé selon l'une des revendications 7 à 12, dans lequel le nombre de la pluralité de premières valeurs candidates de paramètre incluses dans le premier ensemble de valeurs candidates de paramètre (210) peut être changé en fonction d'une longueur de la valeur de départ (310) et d'un nombre de blocs.
 




Drawing





























Cited references

REFERENCES CITED IN THE DESCRIPTION



This list of references cited by the applicant is for the reader's convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPO disclaims all liability in this regard.

Patent documents cited in the description




Non-patent literature cited in the description