Method And Device For Securing Block Ciphers Against Template Attacks

• US 20130156180A1
• Filed: 12/12/2012
• Published: 06/20/2013
• Est. Priority Date: 12/14/2011
• Status: Abandoned Application

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Hess, Erwin
• Application Number:
  US13/711,724
• Publication Number:
  US 20130156180A1
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 2209/08 Randomization, e.g. dummy operations or using noise
• CPC Class Codes: H04L 9/003 for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA]
• CPC Class Codes: H04L 9/0618 Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

A method for securing a block cipher F, encrypted with a working key K₀, against template attacks is provided. A working permutation F(K₀) fixed by the block cipher F and the working key K₀, and a number N of dummy permutations G(K₁), . . . , G(K_n) are provided. The N dummy permutations G(K₁), . . . , G(K_n) are fixed by N dummy keys K₁, . . . , K_n and the block cipher F or the inverse F⁻¹ of the block cipher F. The working permutation F(K₀) and the N dummy permutations G(K₁), . . . , (G(K_n) are chained to form a chain H in such a way that the chain H and the working permutation F(K₀) produce an identical image (H=F(K₀)). A block cipher F, in which a fixed key K₀ is used, is protected against template attacks as a result. A computer program product and a device for securing a block cipher F against template attacks are also proposed.

Claims

1. A method for securing a block cipher (F), encrypted with a working key (K₀), against template attacks, the method comprising:

a) providing a working permutation (F(K₀)) fixed by the block cipher (F) and the working key (K₀),

b) providing a number N of dummy permutations (G(K₁), . . . , (G(K_n)) that are fixed by N dummy keys (K₁, . . . , K_n) and the block cipher (F) or an inverse (F<sup>−

1</sup>) of the block cipher (F), and

c) chaining the working permutation (F(K₀)) and the dummy permutations (G(K₁), . . . , (G(K_n)) to form a chain such that the chain and the working permutation (F(K₀)) produce an identical image.

2. The method of claim 1, wherein the number N of dummy permutations (G(K₁), . . . , (G(K_n)) is provided such that each chain of N dummy permutations (G(K₁), . . . , G(K_n)) produces a pre-image set of the block cipher (F).

3. The method of claim 2, wherein the chain of N dummy permutations is achieved by a first model having (g₁ o g₁⁻

1) o (g₂ o g₂<sup>−

1</sup>) o . . . o (g_n o g_n<sup>−

1</sup>), where g_i=G(K_i), wherein G designates the block cipher (F) or the inverse (F<sup>−

1</sup>) of the block cipher, and wherein K_i, where iε

[1, . . . , n], designates the N dummy keys (K₁, . . . , K_n).

4. The method of claim 2, wherein the chain of N dummy permutations is achieved by a second model having (g₁ o g₂ o . . . o g_n) o (g_n⁻

1 o . . . o g₂<sup>−

1</sup> o g₁<sup>−

1</sup>), where g_i=G(K_i), wherein G designates the block cipher (F) or the inverse (F<sup>−

1</sup>) of the block cipher, and wherein K_i, where iε

[1, . . . , n], designates the N dummy keys (K₁, . . . , K_n).

5. The method of claim 2, wherein the chain of N dummy permutations is achieved by a third model having (g₁ o g₂ o g₃⁻

1) o (g₃ o g₂<sup>−

1</sup> o g₁⁻

) o (g₄ o g₅ o g₆<sup>−

1</sup>) o (g₆ o g₅<sup>−

1</sup> o g₄<sup>−

1</sup>) o . . . , where g_i=G(K_i), wherein G designates the block cipher (F) or the inverse (F<sup>−

1</sup>) of the block cipher, and wherein K_i, where i ε

[1, . . . , n], designates the N dummy keys (K₁, . . . , K_n).

6. The method of claim 5, wherein an implementation of a triple DES encryption is secured using the third model.

7. The method of claim 1, wherein the N dummy keys (K₁, . . . , K_n) are permutated before each application of steps a) to c).

8. The method of claim 1, wherein the N dummy keys (K₁, . . . , K_n) are re-formed before each application of steps a) to c).

9. The method of claim 1, wherein the working key (K₀) is permanently allocated to the block cipher (F).

10. A computer program product for securing a block cipher (F), encrypted with a working key (K₀), against template attacks, the computer program product being embodied in non-transitory computer readable media and executable by a processor to:

provide a working permutation (F(K₀)) fixed by the block cipher (F) and the working key (Kd₀),

provide a number N of dummy permutations (G(K₁), . . . , (G(K_n)) that are fixed by N dummy keys (K₁, . . . , K_n) and the block cipher (F) or an inverse (F<sup>−

1</sup>) of the block cipher (F), and

chain the working permutation (F(K₀)) and the dummy permutations (G(K₁), . . . , (G(K_n)) to form a chain such that the chain and the working permutation (F(K₀)) produce an identical image.

11. The computer program product of claim 10, wherein the number N of dummy permutations (G(K₁), . . . , (G (K_n)) is provided such that each chain of N dummy permutations (G(K₁), . . . , G(K_n)) produces a pre-image set of the block cipher (F).

12. The computer program product of claim 11, wherein the chain of N dummy permutations is achieved by a first model having (g₁ o g₁⁻

1) o (g₂ o g₂<sup>−

1</sup>) o . . . o (g_n o g_n<sup>−

1</sup>), where g_i=G(K_i), wherein G designates the block cipher (F) or the inverse (F<sup>−

1</sup>) of the block cipher, and wherein K_i, where iε

[1, . . . , n], designates the N dummy keys (K₁, . . . , K_n).

13. The computer program product of claim 11, wherein the chain of N dummy permutations is achieved by a second model having (g₁ o g₂ o . . . o g_n) o (g_n⁻

1 o . . . o g₂<sup>−

1</sup> o g₁<sup>−

1</sup>), where g_i=G(K_i), wherein G designates the block cipher (F) or the inverse (F<sup>−

1</sup>) of the block cipher, and wherein K_i, where iε

[1, . . . , n], designates the N dummy keys (K₁, . . . , K_n).

14. The computer program product of claim 11, wherein the chain of N dummy permutations is achieved by a third model having (g₂ o g₂ o g₃⁻

1) o (g₃ o g₂<sup>−

1</sup> o g₁<sup>−

1</sup>) o (g₄ o g₅ o g₆<sup>−

1</sup>) o (g₆ o g₅<sup>−

1</sup> o g₄<sup>−

1</sup>) o . . . , where g_i=G(K_i), wherein G designates the block cipher (F) or the inverse (F<sup>−

1</sup>) of the block cipher, and wherein K_i, where iε

[1, n], designates the N dummy keys (K₁, . . . , K_n).

15. The computer program product of claim 14, wherein an implementation of a triple DES encryption is secured using the third model.

16. The computer program product of claim 10, wherein the N dummy keys (K₁, . . . , K_n) are permutated before each application of steps a) to c).

17. The computer program product of claim 10, wherein the N dummy keys (K₁, . . . , K_n) are re-formed before each application of steps a) to c).

18. The computer program product of claim 10, wherein the working key (K₀) is permanently allocated to the block cipher (F).