Bricks, Amélie

The present invention relates to a method for protecting the execution of SM4 cryptographic process against side-channel attacks by applying 32-bits masks to the inputs of the cryptographic operation and to the round keys. In order to make such a masking compatible with the 8-bit Sbox used by the tau transformation, the present invention generates all masks for all inputs and round keys from a single mask by applying to it a circular permutation shifting the mask to the right or the left by n*8 bits, with n in {0, ...,31} to get masked input values X' and masked round keys RK' such that when computing the value X'_i+1⊕X'_i+2⊕X'_i+3⊕RK'_i the result will be a 32-bits word composed of four 8-bit chunks all masked by the same mask M₀_xor. Then the invention replaces the Sbox to be used in SM4 algorithm by a masked Sbox, called SboxM incorporating M_0xor as input mask and another predefined mask as output mask.

The invention provides a method for detecting a side channel attack on an integrated circuit (100). For each input command received (400) and processed (401) by the integrated circuit, obtaining (403) at least a first piece of information and a second piece of information, and these pieces of information are accumulated (404) for N input commands. Input values are determined (405), comprising a first input based on the first pieces of information and a second input based on the second pieces of information. A classification model is applied (406) to the determined input values to output a classification result and a side channel attack is detected (407) based on the classification result. The first and second pieces of information are of different information types.

The invention provides a method for monitoring Direct Memory Access, DMA, operations performed by a peripheral device on a main memory of a computer system, the peripheral device being controlled by a driver executed on the computer system. Upon detection of a command for execution of DMA operations based on a descriptor table, the descriptor table comprising at least one descriptor describing a DMA operation, the method comprises checking (304) compliance of the at least one descriptor with predefined security rules, wherein said descriptor table is stored by the driver in a memory section accessible to the driver. In case of positive check, the at least one descriptor is duplicated (306) to obtain a copy of the descriptor table stored in the main memory, outside of the memory section accessible to the driver. Then, a memory address of the copy of the descriptor table is stored (307) in a part of the memory section accessible to the peripheral device and the command for execution is forwarded (308) to the peripheral device.

The invention provides a method for verifying an ECDSA signature. A point R is defined by u1*G+u2*Q, G being a base point, Q being a public key point, u1 and u2 are scalar expressed as a series of bits u1[k] and u2[k], and the method comprises:- determining (202) coordinates for G, Q and G+Q with a common initial value Z_initial;- initializing (204) a first scalar variable λ to 1;- initializing (204) an accumulating variable and iterating the following steps for k varying between 1 and n-2 :- updating (209) the accumulating variable by applying a function to a previous value of the accumulating variable, the function being selected based on u1[k] and u2[k] ;- updating (210) λ so that a current value of the Z coordinate of the accumulating variable is equal to Z_intiial multiplied by the first scalar variable λ.

The present invention relates to a method for protecting against cloning attacks a client application comprising a standard implementation of a cryptographic algorithm taking as input a reference cryptographic key ,a client device storing instead of said reference cryptographic key and said client application:• a bound whitebox cryptographic key generated by a bound whitebox cryptographic key generator of a server device, from said reference cryptographic key, depending on a reference secret binding parameter,• a modified client application comprising a whitebox-protected implementation of said cryptographic algorithm configured to take as inputs said stored bound whitebox cryptographic key and an input secret binding parameter, and delivering a result equal to the result of the execution of the cryptographic algorithm using as input said reference cryptographic key when said input secret binding parameter used as input is equal to said reference secret binding parameter, and delivering a different result otherwise,said method being performed by the client device when executing the modified client application and comprising:- retrieving (S1) a runtime secret binding parameter,- executing (S2) said whitebox-protected implementation of said cryptographic algorithm using as inputs said bound whitebox cryptographic key and said runtime secret binding parameter.

The present invention relates to a method for filtering a message comprising arguments, to be exchanged between a client device and an application server, performed by an applicative gateway connected to said client device and said application server and configured for applying a positive filtering, and by an applicative risk computer connected to said applicative gateway and configured for applying a negative filtering, said method comprising, performed by said applicative gateway :• during a configuration phase:obtaining (S0) an Application Programming Interface (API) description file comprising templates of message arguments and indicating for each template whether an argument matching said template shall be subject or not to a negative filtering by the applicative risk computer,• at runtime:o receiving (S1) a message from said client device or application server,o applying (S2) a positive filtering to said received message,o generating (S3) from said received message a message extract, wherein said message extract comprises arguments of said received message which require a negative filtering by the applicative risk computer according to said obtained API description file, and wherein said message extract does not comprise arguments of said received message which do not require a negative filtering by the applicative risk computer according to said obtained API description file,∘ sending (S4) said generated message extract to said applicative risk computer,∘ receiving (S6) from the applicative risk computer a risk score computed by the applicative risk computer from said message extract,∘ when said received risk score is above a predetermined threshold, triggering a security countermeasure (S7).

The present invention relates to a cryptographic method for reinforcing security of an initial encryption multivariate public key cryptosystem to generate a modified encryption multivariate public key cryptosystem, wherein said initial encryption multivariate public key cryptosystem comprises :• a secret transformation which transforms a first input value A represented by a first input vector of n variables a₁, ..., a_n in K, into a first output value B represented by a first output vector of m variables b₁, ..., b_m in K through a set of m secret multivariate polynomials of degree t (A₁(a₁, ... ,a_n), ..., A_m(a₁, ..., a_n)) over said finite field or ring K, and which is defined as (A₁(a₁, ...,a_n), ..., A_m(a₁, ..., an)) = (b₁, ..., b_m) corresponding to a secret system of m polynomial equations A_j(a₁,...,a_n) = b_j for j an integer in {1 ,... ,m},• a public transformation which transforms a second input value X represented by a second input vector of n variables x₁, ..., x_n in K, into a second output value Y represented by a second output vector of m variables y₁, ..., y_m in K through a set of m multivariate polynomials of degree t (P₁(x₁, ... ,x_n), ..., P_m(x₁, ..., x_n)) over K, with n and m integers, and which is defined as (P₁(x₁, ... ,x_n), ..., P_m(x₁, ..., x_n)) = (y₁, ..., y_m) corresponding to a public system of m polynomial equations P_j(x₁,...,x_n) = y_j for j an integer in {1,... ,m},• secret linear transformations S and T which verify X = S.A and Y = T.B and which are to be used to decrypt any ciphertext encrypted using said public transformation,wherein said modified encryption multivariate public key cryptosystem is generated by adding to said initial encryption multivariate public key cryptosystem an internal or external perturbation, wherein adding an internal, respectively external, perturbation comprises: determining (E1) t*r secret linear forms L₁, ..., L_r, L'₁, ..., L'_r in said first input vector, and for j in {1,... ,m}, adding (E2) to equation j of said secret, respectively public, system of polynomial equations a linear combination of r products of t of said determined secret linear forms such that b_j = A'_j(a1,. . ,a_n) with A'_j = A_j+∑i=1rαi,j∏k=1tLik or yj=P′jx1,…,xn with P′j=Pj+∑i=1rαi,j∏k=1tLik.

The present invention relates to a method for securing against side channel attacks an execution of a cryptographic process comprising either: - an elliptic curve scalar multiplication operation of a secret key k with a first point P of an elliptic curve, thereby computing a scalar multiplication operation result Q = k.P, with k a scalar, or - a modular exponentiation operation of a base P, which is a first positive integer number, with a secret key k, k being an integer, computing a modular exponentiation operation result Q = P<k> mod m. The main idea of the invention is to store pre-computed results of an ECC scalar multiplication Si=si.P or of an exponentiation Si= P<si> mod m and then, for computing a target result of a scalar multiplication k.P or of an exponentiation P<k> mod m, to compute the difference between the target result and a pre-computed result (k-s).P or P<k-s>. The target result can then be easily obtained by combining the pre-computed result and the computed difference.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …