The present invention relates to a method of securely implementing a functional module in an electronic component.
The invention also relates to the corresponding electronic component.
The term “functional module” is used to designate a hardware module dedicated to executing a function that can be an algorithm, said hardware module being included in an electronic component; it can also be a software module constituted by a program for performing a function that can be an algorithm, said software module being implemented in an electronic component.
Such components are used, in particular, in applications in which access to services or to data is strictly controlled, such as cryptography applications.
Such a component has a programmable architecture formed around a microprocessor and memories, including a non-volatile memory that contains one or more items of secret data; it is a general architecture suitable for executing any algorithm. Such a component can also be supplemented by a “hardware” architecture, i.e. an architecture having one or more co-processors dedicated to executing specific computations or to executing a single algorithm, and that offers the advantage of executing the algorithm more rapidly than a software architecture does.
For example, when the algorithm is the secret-key cryptography algorithm known as the “Data Encryption Standard” (DES) which can be used to encrypt a message, execution is in the range 1000 times faster to 10,000 times faster than when it is performed by a co-processor.
Such components are used in computer systems that can be on-board or otherwise. In particular, they are used in smart cards, for certain applications thereof. For example, such applications are database access applications, banking applications, mobile telephone applications including, for example, SIM cards, remote payment applications, e.g. for television channels, gasoline dispensing, or indeed going through highway turnpikes.
Such components or such cards thus implement a cryptography algorithm for encrypting, authenticating, or digitally signing a message when said message must remain confidential.
On the basis of such a message as input into the card by a host system (server, automatic teller, etc.) and of secret numbers contained in the card, the card sends back to the host system said encrypted message, as authenticated or signed, thereby making it possible, for example, for the host system to authenticate the component or the card, or to interchange data.
The characteristics (i.e. the computations performed, and the parameters used) of the encryption algorithms can be known. The only unknown quantity is the secret number(s). The entire security of such algorithms lies in said secret number(s) contained in the card and unknown to the world outside the card. The secret number cannot be deduced merely by knowledge of the message as input and of the encrypted message as sent back. The mathematical security of the encryption algorithms can be increased by using secret numbers of large size, so that the theoretical computation time for computing said keys is too long for present-day computing means.
Unfortunately, it has appeared that external attacks based on physical magnitudes that can be measured outside the component while said component is running the cryptography algorithm, make it possible for dishonest third parties to find the secret number(s) or the secret data contained in said card. Such attacks are known as “side channel attacks”. The physical signals used are, in particular, the temperature, electromagnetic radiation, electricity consumption, or computing time of the component.
Among such side channel attacks, mention can be made of Single Power Analysis (SPA) attacks which are based on one or possibly a few measurements, and of Differential Power Analysis (DPA) attacks which are based on statistical analyses resulting from numerous measurements. Such attacks make use, for example, of the fact that the consumption of current by the microprocessor and/or by the co-processor executing the instructions varies depending on the instruction or the data being handled.
Methods of attack by injecting faults have also been developed. Such methods comprise, inter alia, bombarding the component with laser or with light, generating interference electromagnetic fields, injecting voltage peaks into the power supply of the component, or injecting an atypical clock signal or “clock glitching”. The effect of such faults is to corrupt the target portions in the execution of the cryptographic algorithm, which then makes it possible to retrieve the secret key mathematically.
In order to counter fault injection attacks, a first alternative is to protect the component or the smart card with screens. The screens can prove to be insufficient: they can, in particular be by-passed or present sensitivity that is too low to guarantee effective protection.
A second alternative for protecting a component or a smart card is to used sensors serving to deactivate the circuit in the event of attack. When a fault injection attack is detected, it is possible either to inhibit the circuit or to prevent the fraudster from carrying out illegal operations.
The “multi-rail” encoding method is known, in particular, for detecting fault injections and for not delivering any information by current measurement. The “dual rail” (DR) encoding method is a particular case of multi-rail encoding. In the DR method, the communications channel uses two communications connections per bit to be encoded. A 0 can thus be encoded by the combination 1-0 on the two communications connections, and a 1 can be encoded by the combination 0-1 on said connections. The Hamming weight of the encoding words is thus always constant, regardless of the sequence of bits processed. Detection of a code word having a combination 1-1 or 0-0 on a pair of connections is associated with a fault.
Furthermore, dual rail is often associated with the following method: between two code words, the combinations go transiently through the state 0-0. Fluctuations in the Hamming distance between the successive combinations can then be made constant. Thus, the electricity consumption for each pair is identical over time. Reading consumption of current then no longer gives any information usable for deducing the secret numbers or the secret data.
In particular, that solution suffers from the drawback of requiring a number of connections that is twice as large as the number of bits of data that are handled.