White-box elliptic curve cryptography implementation

Abstract

The present invention provides a microprocessor device comprising an implementation of a cryptographic operation configured to process parameters and produce an output, wherein at least some of the parameters are obfuscated so that the cryptographic operation processes the obfuscated parameters, characterized in that the obfuscated parameters are obfuscated by encrypting them according to an additively homomorphic cryptosystem.

Description

Technical Field

[0001] The present invention relates to cryptography, more specifically to white box cryptography WBC, and in particular to white box cryptography (WBC) on elliptic curve EC (elliptic curve cryptography ECC), also known as EC-WBC or WBC-ECC. More specifically, the present invention relates to a microprocessor device for implementing cryptographic operations. Background Art

[0002] Microprocessor devices or environments that implement cryptographic operations are usually classified as black box, gray box, or white box. In a black box environment, attackers cannot access the operations due to the use of fully sealed hardware modules, so the secret information processed by the cryptographic operations is protected from attack. In a white box environment, the attacker has full access to the device or environment that implements the cryptographic operations. The attacker can inspect, stop, step through, and modify the implementation while it is running. Therefore, appropriate countermeasures must be implemented to protect the confidential information processed in the cryptographic operations.

[0003] As understood in this application, the implementation of cryptographic operations may generally be in the form of software or hardware, or a hybrid of hardware and software.

[0004] 1. Elliptic curves can be described as follows.

[0005] p, a, b: parameters of the elliptic curve E given by the Weierstrass equation

[0006] y 2 =x 3 +a*x+b mod p

[0007] G = (Gx, Gy): the generating point of the cyclic subgroup

[0008] q = ord(G) = the order of point G

[0009] h: cofactor of G, i.e., q*h=ord(E)

[0010] Known cryptographic operations on elliptic curves include, for example: ECDSA key generation; ECDSA signature generation; ECDSA signature verification; ECDH key generation; ECDH key exchange; EC-Schnorr key generation; EC-Schnorr signature generation; EC-Schnorr signature verification. Listed examples of known cryptographic operations on elliptic curves will be explained below using notations used in conjunction with the description of the present invention.

[0011] 2.1 Standard ECDSA key generation input:-

[0012] Output: private key d, public key P

[0013] process:

[0014] Cryptographically generate a secure random number d in {1,2,...,q-1}

[0015] P = d * G

[0016] Output d, P

[0017] 2.2 Standard ECDSA signature generation input: private key d, hash(m) value of message m (hash value of m)

[0018] Output: signature parameters r, s

[0019] process:

[0020] Cryptographically generate a secure random number u (temporary key) in {1,2,...,q-1}

[0021] Calculate Q = u * G

[0022] r = Qx mod q. If r == 0, start over.

[0023] s = (hash(m) + r*d) / u mod q. If s == 0, restart.

[0024] Output r, s

[0025] 2.3 Standard ECDSA signature verification Input: public key P, hash (m) of message m, signature to be verified (r, s) Output: TRUE if the signature is valid, otherwise FALSE Process:

[0026] ·Search for r and s in {1,2,...,q-1}. If not found, output false and terminate. ·u=hash(m) / s modq, v=r / s mod q

[0027] Q = u*G + v*P. If Q is a point at infinity, output false and terminate.

[0028] ·r'=Qx mod q

[0029] If r == r', then output true, otherwise output false

[0030] 2.4 Standard ECDH Key Generation This is the same as Section 2.1.

[0031] 2.5 Standard ECDH key exchange

[0032] Input: private key d, other party's public key P

[0033] Output: public secret point R

[0034] process:

[0035] Output R = d*P

[0036] 2.6 Standard EC-Schnorr Key Generation

[0037] This is the same as Section 2.1.

[0038] 2.7 Standard EC-Schnorr Signature Generation

[0039] Input: private key d, message m

[0040] Output: signature parameters r, s

[0041] process:

[0042] Cryptographically generate a secure random number u (temporary key) in the range {1,2,...,q-1}

[0043] Calculate Q = u * G

[0044] r = hash(m||Qx) (|| = concatenation) (i.e., || = cascade). If r mod q =

[0045] 0, then restart.

[0046] ·s=k+r*d mod q. If s==0, start over.

[0047] Output r, s

[0048] 2.8 Standard EC-Schnorr Signature Verification

[0049] Input: public key P, message m, signature to be verified (r, s)

[0050] Output: True if the signature is valid, false otherwise

[0051] process:

[0052] Check that r is in the correct range for the hash function and that s is in the range {1,2,...,q-1}

[0053] If not, output false and terminate.

[0054] Q = s*Gr*P. If Q is a point at infinity, the output is false and the process terminates.

[0055] ·r'=hash(m||Qx)(||=concatenation)

[0056] If r == r', then output TRUE, otherwise output FALSE

[0057] Prior Art

[0058] A typical countermeasure to protect (cryptographic) operations running in a white-box environment is to obfuscate critical parameters handled by the operation, such as secret keys.

[0059] Irdeto's prior art document [1] EP2553866A1 discloses a method for verifying a digital signature according to the DSA or ECDSA standard, wherein the signature S consists of an output pair S=(r, s), where r is derived using a generator function G, and s is derived using a hash function H(M) of a message M, a private key d, and r. According to EP2553866A1, the signature S=(r, s) is calculated using the transformed parameters. Using f -1 The generator function G is transformed and thus obfuscated, and the secret key d is transformed and thus obfuscated using f, where f is the same secret number for G and d. The operations for computing r and S are hidden, but provide the same result S=(r, s) compared to the corresponding non-hidden operations, because the obfuscation factor f cancels out internally.

[0060] Philips' prior art document [2] EP3376705A1 discloses an electronic point multiplication device for calculating the point multiplication on an elliptic curve between a multiplier k and a base point G on an elliptic curve E, which is used in cryptographic protocols (e.g., ECDSA signature calculations). According to the scheme of EP3376705A1, (i) a plurality of pre-computed auxiliary points Gi are derived from the base point G, and (ii) a plurality of derived hash values ​​hi are derived from the hash value h of the message M, and a plurality of blinded base multipliers are derived from these data. The dot product k*G of the original base point G and the original multiplier k is calculated by calculating the dot addition of: (i) the dot product of multiple blind base multipliers and the original base point G; and (ii) multiple dot products of blind auxiliary multipliers and the auxiliary point Gi, wherein the blinding of the multiple blind base multipliers in (i) and the blinding of the blind auxiliary multipliers in (ii) can be a weighted sum of mutual corrections (claim 9) to obtain the correct overall result k*G.

[0061] NXP's prior art document [3] EP3249520A1 discloses a system and method for elliptic curve scalar multiplication between a scalar K and a base point G on an elliptic curve in a non-secure processor. Here, a preliminary calculation is performed in the secure processor, wherein the scalar K is divided into m2 random values ​​ki, a mask value is selected, and the same number of elliptic curve points Gi as the mask value is calculated using the mask value. Still in the secure processor, a scalar multiplication is performed, wherein the previously applied mask value is partially removed. In the non-secure processor, the derivatives of the pre-computed split-off ki of the scalar K and the pre-computed elliptic curve points Gi are combined into m1 multiplied elliptic curve points Pi, and the multiplied elliptic curve points Pi are sent back to the secure processor.

[0062] NXP's prior art document [4] EP3125145A1 discloses a method for obfuscating software code for implementing an elliptic curve cryptography (ECC) point multiplication function, wherein an ECC parameter serving as a multiplier d is transformed into an array having values ​​of -1, 0, and +1 while maintaining the same d value; an ECC point multiplication function is generated using the transformed multiplier, wherein the generated ECC point multiplication function operation is a separated variable operation.

[0063] [5] The Paillier cryptosystem was first proposed in Pascal Paillier's paper "Public-Key Cryptosystems Based on Composite Degree Residuosity Classes", in Stern J. (eds) Advances in Cryptology—EUROCRYPT'99. Lecture Notes in Computer Science, vol 1592, Springer, Berlin, Heidelberg, 1999. There are two ways to describe probabilistic asymmetric public key cryptosystems (Scheme 1 and Scheme 3).

[0064] In [6] Yehuda Lindell's paper "Fast Secure Two-Party ECDSA signing" (IACR preprint server 2017 / 552), a cryptographic protocol for generating ECDSA signatures by two parties is constructed using the Paillier cryptosystem. Each party shares an ECDSA private key and cannot perform signing operations independently, but the two parties can jointly generate an ECDSA signature.

[0065] References [1]–[4] disclose a method for performing a cryptographic operation of transformation, masking, blinding or obfuscation in an unsecure environment, i.e., in a white-box environment. Each of the schemes [1] and [2] follows the principle of transforming, masking or blinding different parameters in a coordinated manner so that the transformation, masking or blinding cancels out in the overall result. In [3], partial demasking in a secure environment is used to ensure a correct overall result.

[0066] According to the solution of document [1] EP2553866A1, which defines the present invention, the signature S=(r, s) is calculated using obfuscated (referred to as: transformed) parameters in document [1]. Here, a complex and mutually consistent transformation of the parameters is required. In [3], a complex partial unmasking is required.

[0067] Purpose of the Invention

[0068] What is needed is a system or scheme that can compute cryptographic operations using hidden, blinded, encrypted, transformed or otherwise obfuscated parameters (particularly the secret key d) similar to those computed using plaintext parameters that are not hidden, blinded, encrypted, transformed or otherwise obfuscated.

[0069] For example, consider the case where the EC-Schnorr signature component s is computed according to the rule s = k + r*d mod q. If the key d is obfuscated as d#, then d# cannot be used directly in the computation. Therefore, the challenge is to compute the parameter s without revealing the plaintext key d (and the temporary key k). This means performing complex transformations on all the parameters involved and using the transformed parameters for the computation. At some point in the computation, a re-transformation is necessary, such as at the final stage when returning to the original parameter s. Preferably, such re-transformations are performed rarely, and most of the computation is done using the transformed parameters, which do not reveal the true plaintext value of the plaintext parameter.

[0070] The object of the present invention is to provide a method and a system for computing cryptographic operations using obfuscated parameters, which provide similar results to cryptographic operations performed using unobfuscated parameters, without requiring case-by-case compensatory measures to be taken. Summary of the invention

[0071] The objects of the invention are achieved by a system having the features listed below and as claimed in claim 1. Embodiments of the invention are further described below and in the dependent claims.

[0072] The present invention provides a microprocessor device comprising an implementation of a cryptographic operation for processing parameters and generating an output. Here, at least some of the parameters processed by the cryptographic operation are obfuscated, more precisely obfuscated so that the cryptographic operation can process obfuscated parameters (rather than plain text parameters as in the case of the original cryptographic operation). The cryptographic operation may be an algorithm (detailed examples and embodiments of the cryptographic operation will be further described below) and may include an encryption step. The obfuscation of the parameters may also be (but does not necessarily have to be) encryption and is a measure to turn the implementation into a white box implementation. Obfuscation is not part of the process or algorithm of the cryptographic operation, but a separate additional measure.

[0073] The invention is characterized in that the obfuscated parameters are obfuscated in such a way that they are encrypted according to an additively homomorphic cryptosystem.

[0074] In the above example of EC-Schnorr signature component s = k + r * d mod q, assume that k# and d# are encrypted using additive homomorphic cryptography. Then, by calculating s# = (k#) * (d#) r , then decrypt s# according to the homomorphic cryptosystem, and finally reduce q modulo q to get the result s. When calculating s#, the homomorphic property is used: the addition of plaintext parameters corresponds to a specific group operation (here, multiplication) of the encrypted parameters. Therefore, the calculation of s can be completed without revealing the plaintext parameters k and d.

[0075] The advantages of using a homomorphic cryptosystem are:

[0076] 1) The parameters are mathematically encrypted using a strong cryptographic system and not merely obscured using mathematically weak techniques,

[0077] 2) it provides the possibility to perform almost all computations with encrypted parameters (without revealing the plaintext secret parameters),

[0078] 3) It provides a simple possibility to introduce further random blinding values ​​into the encrypted parameters,

[0079] 4) Decryption operations are only required in a small portion of the computation and can be done using a fixed security key.

[0080] The solution of the invention thus enables the computation of cryptographic operations using masked, blinded, encrypted, transformed or otherwise obfuscated parameters without requiring cumbersome case-by-case alignment or unmasking between different parameters as required in known solutions of the prior art.

[0081] According to one embodiment of the present invention, the additive homomorphic cryptographic system includes an encryption function Enc and a decryption function Dec, wherein the encryption function Enc and the decryption function Dec comply with the rule Dec(Enc(m))=m, and, because they are additively homomorphic, they also comply with the rule Dec(Enc(m 1 )*Enc(m 2 ))=m 1 +m 2 .

[0082] In conjunction with the present invention, being encrypted means being processed by an encryption function Enc, and being decrypted means being processed by a decryption function Dec.

[0083] According to one embodiment of the present invention, the additive homomorphic cryptographic system is implemented as the Paillier cryptographic system. Other cryptographic systems with additive homomorphic properties are also generally applicable to the present invention. However, compared with some other suitable cryptographic systems, the Paillier cryptographic system has a lower complexity. This lower complexity helps to produce the obfuscated implementation of the cryptographic operation. This is especially true when it is not a parameter of the cryptographic operation that is obfuscated but multiple parameters or even all parameters are obfuscated.

[0084] It is emphasized here that the microprocessor system includes two different interwoven cryptosystems, i.e., the first cryptosystem is an operational cryptosystem that implements cryptographic operations (e.g., key generation, signature generation, key exchange), and the second cryptosystem is an obfuscated cryptosystem (an additively homomorphic cryptosystem, such as the Paillier cryptosystem). Therefore, the use of an additively homomorphic cryptosystem (e.g., Paillier or a similarly suitable cryptosystem) results in a white-box secure implementation of the operational cryptosystem.

[0085] According to an embodiment of the present invention, the Paillier cryptographic system includes: (1) an encryption public key consisting of a pair of {n, g} and (2) a decryption private key consisting of a pair of {λ, μ} or {α, μ}. In this article, the Paillier cryptographic system can be implemented according to Scheme 1, using a decryption private key consisting of a pair of {λ, μ}; or can be implemented according to Scheme 3, using a decryption private key consisting of a pair of {α, μ}.

[0086] According to an embodiment of the present invention, depending on the type of cryptographic operation (e.g., key generation, key exchange, or signature generation), the parameters or outputs processed by the cryptographic operation include at least a secret key, such as key d or key d1 further described below. Here, for example, in key generation, key exchange, and signature generation, at least the secret key is obfuscated in a manner in which the secret key is encrypted according to an additive homomorphic cryptosystem (by an encryption function). In addition to or in place of the secret key, the value derived from the secret key is also obfuscated in a manner in which the value derived from the secret key is encrypted according to an additive homomorphic cryptosystem (by an encryption function). An example of such a derived value derived from the secret key is the values ​​v1 and v2 generated by the signature as further described below. Detailed examples of obfuscated parameters of obfuscated (white box) operations implemented by key generation, signature generation, and key exchange will be further described below.

[0087] According to an embodiment of the present invention, an operational cryptographic system includes at least one pre-computed parameter processed in a cryptographic operation, and wherein at least one pre-computed parameter is obfuscated in a manner encrypted in accordance with an additive homomorphic cryptographic system with a random number or / and a value derived from the pre-computed parameter. In a key generation process or a key exchange process, examples of pre-computed parameters are parameters ci and m1 as further described below. In a signature generation process, examples of pre-computed parameters are parameters fj and m2 as further described below. In a signature generation process, an example of a derived parameter derived from a pre-computed value is parameter v1. Certain derived parameters may be derived from a secret key and a pre-computed parameter.

[0088] According to an embodiment of the present invention, the operational cryptographic system is a system based on elliptic curve EC or a system based on non-elliptic curve, in particular one of the following systems: ECDSA; EC-Schnorr; EC Diffie Hellman ECDH; EdDSA, ECGDSA, KCDSA, SM2; DSA; Schnorr signature scheme; ElGamal signature scheme; Diffie Hellman DH key exchange. Detailed embodiments of the various exemplary operational cryptographic systems listed above are further given below.

[0089] According to some embodiments of the invention, the cryptographic operation is a key generation operation performed in accordance with an operational cryptographic system (e.g., ECDSA, ECDH, EC-Schnorr), the output of which is a cryptographic key (e.g., d; d1), and at least the output cryptographic key is encrypted in accordance with an additive homomorphic cryptographic system. Alternatively or additionally, as described above, one or more parameters derived from such cryptographic key, one or more pre-computed parameters, or one or more values ​​derived from pre-computed parameters are obfuscated by encryption using an additive homomorphic cryptographic system.

[0090] According to some other embodiments of the present invention, the cryptographic operation is a cryptographic signature generation operation performed in accordance with an operational cryptographic system (e.g., ECDSA, EC-Schnorr), the operational cryptographic system is constructed to generate a cryptographic signature (e.g., {r, s} in the example below) based on a secret key (secretkey) (e.g., d; d1), the output of which is a cryptographic signature {r, s}, and at least the secret key or / and a value derived from the secret key (e.g., v1, v2 in signature generation) is encrypted in accordance with an additive homomorphic cryptographic system. Alternatively or additionally, as described above, one or more parameters derived from such a cryptographic key, one or more pre-computed parameters, or one or more values ​​derived from the pre-computed parameters are obfuscated by encryption using an additive homomorphic cryptographic system.

[0091] According to other embodiments of the present invention, the cryptographic operation is a key exchange operation between at least two or more different parties performed in accordance with an operational cryptographic system (e.g., ECDH), the output of which is a common secret key (R) shared between the different parties and calculated based on its own secret key (d; d1) and the public key (P) of the other party, and at least the secret key (d; d1) of each party is encrypted in accordance with an additive homomorphic cryptography. Alternatively or additionally, as described above, one or more parameters derived from such a cryptographic key, one or more pre-computed parameters, or one or more values ​​derived from the pre-computed parameters are obfuscated by encryption using an additive homomorphic cryptographic system.

[0092] According to some embodiments, the microprocessor device may include various cryptographic operations as described above in addition to being combined with each other.

[0093] According to some embodiments, the microprocessor device may include key generation operations and key exchange operations. For example, this is a preferred combination in case the cryptographic operations are performed according to the operational cryptographic system EC-Diffie-Hellman ECDH.

[0094] According to some embodiments, the microprocessor device may include all of the key generation operation, the signature generation operation and the signature verification operation. For example, this is a preferred combination in the case where the cryptographic operation is performed in accordance with the operational cryptographic system ECDSA or EC-Schnorr. Here, preferably, the signature verification operation only uses public key parameters. Therefore, no additional encryption of the parameters of the operation is required to obfuscate them. Therefore, the obfuscated parameters of the key generation operation and the signature generation operation are sufficient.

[0095] The present invention also provides a method for implementing an obfuscated cryptographic operation in a microprocessor device configured to process obfuscated parameters and generate an output, the method comprising the following steps:

[0096] - providing a microprocessor device with a partial implementation of cryptographic operations lacking at least some parameters,

[0097] - obfuscating at least some of the missing parameters in a processing device (such as a PC, a computer, a server or a hardware security module HSM) outside the microprocessor device and transmitting the obfuscated parameters from the processing device to the microprocessor device,

[0098] - Implement the missing obfuscated parameters in this partial implementation to produce the obfuscated cryptographic operations.

[0099] The method is characterized in that the obfuscated parameters are obfuscated by encryption according to an additively homomorphic cryptosystem, such as the Paillier cryptosystem or another suitable additively homomorphic cryptosystem.

[0100] In the method, according to some embodiments, the additive homomorphic cryptographic system includes an encryption function Enc and a decryption function Dec, wherein at least some or all of the encryption functions Enc in the additive homomorphic cryptographic system are calculated outside the microprocessor device, for example, in a personal computer PC, a computer or a server or a hardware security module HSM.

[0101] After the obfuscated cryptographic operation is implemented in the microprocessor device, the microprocessor device can be operated to perform the cryptographic operation and generate an output. Here, the cryptographic operation is calculated using external pre-computed obfuscated parameters obfuscated according to the additive homomorphic cryptosystem. With respect to parameters defined as sufficiently critical (such as secret keys and / or pre-computed values ​​or values ​​derived therefrom), the microprocessor device does not use the plain text versions of these parameters for calculation, but only uses the obfuscated parameters obfuscated by encryption according to the additive homomorphic cryptosystem. Thus, possible side channel information generated by the microprocessor device during operation is reduced or prevented.

[0102] According to an embodiment of the invention, the cryptographic operation performed in the microprocessor device is key generation, key exchange or signature generation.

[0103] Paillier cryptosystem

[0104] In the following, the Paillier cryptographic system will be described. The Paillier cryptographic system provides two different schemes that are particularly suitable for the present invention, namely, Scheme 1 and Scheme 3. Scheme 1 will be fully described below. Scheme 3 will be described on the basis of the description of Scheme 1 to highlight the differences between Scheme 1 and Scheme 3. Then, embodiments of the present invention in different cryptographic systems will be described.

[0105] 3.1 Paillier cryptographic system setup (Scheme 1)

[0106] Choose two different prime numbers p 1 and p 2 , so that their product n = p 1 *p 2 and Φ(n)=(p 1 -1)*(p 2 -1) are coprime, and n is large enough to prevent factorization.

[0107] All encrypted values ​​are The multiplicative subgroup of The order of the multiplicative subgroup is ord(Γ)=n*Φ(n).

[0108] Note that the nth root of unity forms a subgroup with ord(U)=n And includes all elements (1+n) x mod n 2 =(1+x*n)mod n 2 , 0≤x <n。

[0109] For any element u in U, define the function L(u)=(u-1) / n.

[0110] · Select a random element in Γ with order ord(g)=α*n, α>0.

[0111] Let λ = lcm(p 1 -1, p 1 –1), where lcm = the lowest common multiple. Then g λ mod n 2 is the nth root of unity, and μ=L(g λ mod n 2) are relatively prime to n.

[0112] The encryption public key is a (n, g) pair.

[0113] The decryption private key is a (λ, μ) pair.

[0114] 3.2 Paillier encryption (Scheme 1)

[0115] Input: encryption public key (n, g), message 0≤m <n

[0116] Output: c = Paillier-Enc(m)∈Γ

[0117] process:

[0118] ·Choose a random number coprime to n 0≤t <n。

[0119] Calculate c = g m *t n mod n 2

[0120] Output c

[0121] 3.3 Paillier decryption (Scheme 1)

[0122] Input: decryption private key (λ, μ), public modulus n, encrypted ciphertext c∈Γ

[0123] Output: Plaintext message m = Paillier-Dec(c)

[0124] process:

[0125] Output m = L(c λ mod n 2 ) / μmod n

[0126] 3.4 Characteristics of the Paillier cryptosystem

[0127] This section describes all the properties of the Paillier cryptosystem used by the G+D white-box ECC implementation.

[0128] ·(3.4.1)Paillier-Dec(Paillier-Enc(m 1 )*Paillier-Enc(m 2 )mod n 2 )=m 1 +

[0129] m 2 mod n,

[0130] That is, the product of two ciphertexts decrypts to the sum of their corresponding plaintexts.

[0131] If n is chosen such that m 1 +m 2 <n, then the modular reduction on the right - hand side of the equation can be omitted.

[0132] ·(3.4.2)Paillier - Dec(Paillier - Enc(m 1 ) k mod n 2 ) = k * m 1 mod n,

[0133] That is, the power of the ciphertext with a number decrypts to the product of the corresponding plaintext and that number.

[0134] If n is chosen such that k * m 1 <n, then the modular reduction on the right - hand side of the equation can be omitted.

[0135] ·(3.4.3)L(Paillier - Enc(m / μ mod n) λ mod n 2 ) = m mod n,

[0136] That is, decrypting Paillier - Enc(m / μ mod n) involves exponentiating with the secret exponent λ, subtracting 1, and finally multiplying by the public parameter 1 / n mod 2 bitlen(n) .

[0137] Therefore, addition and multiple multiplications in the ECC implementation can be replaced by modular multiplications and exponentiations with the corresponding encrypted parameters.

[0138] Scheme 3 of the Paillier cryptosystem provides a faster decryption function. Their differences will be briefly described below:

[0139] · This scheme works in the subgroup generated by an element g of order ord(g)=α * n, α|λ rather than in the whole group

[0140] · The private key is the pair (α, μ), where μ = L(g α mod n 2 )

[0141] · Encryption: c = g m+t*n mod n 2 , where the random number 0 ≤ t < n.

[0142] · Decryption: m = L(c α mod n 2 ) / μ mod n

[0143] The secret key parameter α needs to be large enough to prevent common cryptanalytic attacks, but it can be chosen to be much smaller than λ.

[0144] Formulas (3.4.1), (3.4.2) and (3.4.3) also apply to Scheme 3, where, in (3.4.3), λ must be replaced by α.

[0145] The present invention is applicable to different cryptographic systems, such as ECDSA, ECDH and EC-Schnorr cryptographic systems. The present invention is particularly applicable to cryptographic operations on elliptic curves, such as: ECDSA key generation; ECDSA signature generation; ECDSA signature verification; ECDH key generation; ECDH key exchange; EC-Schnorr key generation; EC-Schnorr signature generation; EC-Schnorr signature verification. The present invention implemented in the examples of cryptographic operations on the known elliptic curves listed above will be described in detail below. The main ideas of the present invention exemplarily described below can also be used to implement white boxes and key agreement protocols for other ECC-based cryptographic systems, such as encryption systems based on EdDSA, ECGDSA, KCDSA, SM2, EC. The present invention can also be applied to other examples of cryptographic operations, and the elliptic curve environment may or may not be used here. DETAILED DESCRIPTION

[0146] Some examples of cryptographic operations (such as key agreement and signature generation) are shown without reference to the accompanying drawings. In addition, signature verification operations corresponding to the signature generation process are disclosed.

[0147] The following describes how to use Paillier encryption to construct a white-box ECC implementation of an embodiment of the present invention.

[0148] All Paillier encryption is done outside the device. During the initial setup phase, the encrypted parameters are sent to the device.

[0149] In addition, it is preferred to transmit a common modulus n and some other useful values ​​(e.g.

[0150] 1 / n mod 2 bitlen(n) ). There is no need to transmit the generator function g, since it is not needed when performing computations on the device.

[0151] The device performs modular multiplication and modular exponentiation operations using the Paillier encrypted parameters, respectively. This corresponds to the addition and (respectively) multiplication of the unencrypted parameters. The size of the Paillier modulus n is carefully chosen so that the result of these additions and (resp.) multiplications is always less than n.

[0152] At certain points in the implementation, a Paillier decryption Dec of a blinded value is needed, e.g., to produce a final result to be output. This Paillier decryption may be implemented, e.g., as a white-box secure exponentiation with fixed secrets λ and α performed on the device. Such an exponentiation may be provided, e.g., by a white-box secure RSA implementation. For example, in cases where it is necessary to exit (or leave) the Paillier encryption scheme, e.g., when computing the final result of a cryptographic operation, or in certain cases for certain intermediate results, a white-box secure exponentiation with a secret power λ (lambda) or α (alpha) may be needed, e.g., to exit (or leave) the Paillier encryption scheme.

[0153] If the encrypted parameter Paillier-Enc(m / μ mod n) must be decrypted on the device, the parameter μ is not required (see (3.4.3)). If all Paillier decryptions performed on the device are not required

[0154] μ, then this parameter does not need to be transmitted to the device. Otherwise, a white-box secure multiplication with 1 / μ mod n needs to be performed on the device.

[0155] The white-box secure secret powers λ and α (and optionally the white-box secure parameter 1 / μ mod n) are also transmitted to the device. For example, in the case where it is necessary to exit (or leave) the Paillier encryption scheme, such as when computing the final result of a cryptographic operation, or for some intermediate results, a white-box secure exponentiation with the secret power λ or α is needed to exit (or leave) the Paillier encryption scheme.

[0156] In the following, possible implementations of the ECDSA, ECDH and EC-Schnorr cryptosystems are described. The main idea of ​​this description can also be used for other ECC-based cryptosystems or white-box implementations of other cryptosystems, such as those based on

[0157] The encryption schemes and key agreement protocols of EdDSA, ECGDSA, KCDSA, SM2, EC, other cryptographic systems are, for example, DSA, ElGamal signature scheme, Schnorr signature scheme, Diffie Hellman key exchange. In addition, the description given may be modified compared to the described method of using the homomorphic properties of the Paillier cryptographic system.

[0158] 2.1 White-box ECDSA key generation

[0159] (4.1. Settings) External device settings

[0160] · Generate Paillier encryption parameters n as described in Section 3 1 , λ 1 and α 1 , μ 1 .

[0161] · Generate a random number 0 < m 1 < q.

[0162] · Generate a large table of random numbers 0 ≤ c i < q.

[0163] · Calculate the curve point K i = c i *G.

[0164] · Paillier encryption of c i / m 1 mod q:

[0165] Generate a randomized k i ∈Γ 1 , where Paillier - Dec(k i ) mod q = c i / m 1 mod q.

[0166] · Paillier encryption of 1:

[0167] Generate a randomized l 1 ∈Γ 1 , where Paillier - Dec(l 1 ) mod q = 1.

[0168] (4.1. Transmission) Transmit to the device

[0169] · The public Paillier parameter n 1

[0170] · The white - box - secure secret Paillier parameters λ 1 and α 1 (and optionally 1 / μ 1 mod n 1 )

[0171] · The curve point K i and the Paillier - encrypted parameter k i

[0172] · l 1 = Paillier - encrypted 1

[0173] · The obfuscated parameter m 1

[0174] (4.1. Calculation) Calculation on the device

[0175] enter:

[0176] · Parameter n of (4.1. Transmission) 1 , K i , k i

[0177] process:

[0178] Generate random number rand[i]

[0179] Calculate the curve point P = Σ i rand[i]*K i If P is a point at infinity, start over.

[0180] Calculate d 1 =Π i k i rand[i] mod n 1 2

[0181] Output:

[0182] Encrypted secret key d 1 and the public key P

[0183] Remark:

[0184] The generated secret key d is (Σ i rand[i]*c i )mod q

[0185] ·Paillier-Dec(d 1 )mod q=d / m 1 mod q

[0186] 2.2 White-box ECDSA signature generation

[0187] (4.2. Settings) External device settings

[0188] The following parameters are used to calculate the ephemeral key used in ECDSA signature generation.

[0189] Generate the Paillier encryption parameter n as described in Section 3 2 , 2 and α 2 , μ 2 .

[0190] Generate a random number 0 <m 2 <q。

[0191] Generate a random number 0≤fj <Large table of q.

[0192] · Calculate curve point E j = f j * G.

[0193] · f j * m 2 Paillier encryption of f * m mod q: Generate randomized e j ∈Γ 2 , where Paillier - Dec(e j )

[0194] mod q = f j * m 2 mod q.

[0195] (4.2. Transmission) Transmit to the device

[0196] · Public Paillier parameter n 2

[0197] · White - box secure secret Paillier parameters λ 2 and α 2 (and optionally 1 / μ 2 mod n 2 )

[0198] · Curve point E j and Paillier - encrypted parameter e j

[0199] · Confused parameter m 2

[0200] (4.2. Calculation) Calculation on the device

[0201] Input:

[0202] · Parameters n 1 、λ 1 and α 1 , optionally 1 / μ 1 mod n 1 、l 1 、m 1

[0203] · Encrypted secret key d generated in (4.1. Calculation) 1

[0204] · All parameters in (4.2. Transmission)

[0205] · hash(m) of message m

[0206] Procedure:

[0207] Generate a random number rand[j]

[0208] Calculate the curve point Q = Σ j rand[j]*E j If Q is at infinity, start over.

[0209] Calculate the encrypted temporary key u 2 =Π j e j rand[j] mod n 2 2

[0210] Calculate the first signature parameter r = Qx mod q. If r == 0, restart.

[0211] Generate two random numbers z 1 and z 2 , and calculate z = z 1 *z 2 mod q. If z == 0, repeat z 1 and z 2 Generation of.

[0212] Modular exponentiation using power z: Calculate v 2 =u 2 z mod n 2 2

[0213] Calculate Paillier-Dec(v 2 )

[0214] ·w 2 =Paillier-Dec(v 2 )mod q

[0215] Calculate h 1 =(hash(m)*z 1 )*m 2 mod q

[0216] Calculate r 1 =((r*z 1 )*m 1 )*m 2 mod q

[0217] Calculate v 1 =(l 1 ) h1 *(d 1 ) r1 mod n1 2

[0218] Calculate Paillier-Dec(v 1 )

[0219] ·w 1 =Paillier-Dec(v 1 )mod q

[0220] ·Calculate the second signature parameter s=(w 1 / w 2 )*z 2 mod q. If s == 0, restart.

[0221] Output:

[0222] Signature parameters r, s

[0223] Remark:

[0224] The temporary key u used is (Σ j rand[j]*f j )mod q

[0225] ·Paillier-Dec(u 2 )mod q=u*m 2 mod q.

[0226] ·w 2 =Paillier-Dec(v 2 )mod q=u*m 2 *z 1 *z 2 mod q

[0227] ·w 1 =Paillier-Dec(v 1 )mod q=(h+r*d)*m 2 *z 1 mod q

[0228] (4.2. Calculation) describes the process of using a key generated on the device. Of course, a key d generated outside the device can also be used. In this case, the following settings are used for the encryption of d.

[0229] (4.2. Setting the key) The device is externally set to use the externally generated key d

[0230] Generate the Paillier encryption parameter n as described in Section 3 3 , 3 and α 3 , μ3 .

[0231] · Generate a random number 0 < m 3 <q.

[0232] · d / m 3 Paillier encryption of mod q:

[0233] Generate a randomized d 3 ∈ Γ 3 , where Paillier-Dec(d 3 ) mod q = d / m 3 mod q.

[0234] · Paillier encryption of 1:

[0235] Generate a randomized l 3 ∈ Γ 3 , where Paillier-Dec(l 3 ) mod q = 1.

[0236] Then use all the parameters of (4.2. Set up the key) as the input parameters for (4.2. Calculate), rather than the parameters of (4.1. Transmit) and (4.1. Calculate).

[0237] 2.3 ECDSA signature verification

[0238] This function only uses the public key parameters. Therefore, no additional encryption is required for these parameters.

[0239] 2.4 White-box ECDH key generation

[0240] (4.4. Set up) Settings outside the device

[0241] This process is similar to (4.1. Set up), but there is one difference: the cofactor h is also included in the calculation.

[0242] · Generate the Paillier encryption parameters n 1 , λ 1 and α 1 , μ 1 .

[0243] · Generate a random number 0 < m 1 <q.

[0244] · Generate a random number 0 ≤ c i <q large table.

[0245] · Calculate the curve point K i = c i * G.

[0246] ·c i / (h*m 1 ) mod q Paillier encryption: Generate random k i ∈Γ 1 ,in

[0247] Paillier-Dec(k i )mod q=c i / (h*m 1 )mod q.

[0248] Paillier encryption of 1:

[0249] Generate randomized l 1 ∈Γ 1 , where Paillier-Dec(l 1 )mod q=1.

[0250] (4.4. Transmit) Transmit to the device

[0251] Common Paillier parameter n 1

[0252] White-box security secret Paillier parameter λ 1 and α 1 (and optionally 1 / μ 1 mod n 1 )

[0253] Curve point K i and the parameter k of the Paillier encryption i

[0254] ·l 1 = Paillier encrypted 1

[0255] The obfuscated parameter m 1

[0256] (4.4. Calculation) Calculation on the device

[0257] enter:

[0258] · Parameter n of (4.4. Transmission) 1 , K i , k i

[0259] process:

[0260] Generate random number rand[i]

[0261] Calculate the curve point P = Σ irand[i]*K i If P is a point at infinity, start over.

[0262] Calculate d 1 =Π i k i rand[i] mod n 1 2

[0263] Output:

[0264] Encrypted secret key d 1 and the public key P

[0265] Remark:

[0266] The generated secret key d is (Σ i rand[i]*c i )mod q

[0267] ·Paillier-Dec(d 1 )mod q=d / (h*m 1 )mod q

[0268] 2.5 White-box ECDH key exchange

[0269] (4.5. Calculation) Calculation on the device

[0270] enter:

[0271] · Parameter n of (4.4. Transmission) 1 , 1 and α 1 , optional 1 / μ 1 mod n 1 , l 1 、m 1

[0272] The encrypted secret key d generated in (4.4. Calculation) 1

[0273] The other party’s public key P

[0274] process:

[0275] Calculate the curve point Q = h*P

[0276] Generate a random number z and calculate z 1 =z*m 1 mod q

[0277] Calculate the curve point Q 1 =z 1 *Q

[0278] Calculate v 1 =(l 1 ) z *d 1 mod n 1 2

[0279] Calculate Paillier-Dec(v 1 )

[0280] Calculate w 1 =Paillier-Dec(v 1 ) mod q and x 1 =w 1 *m 1 mod q

[0281] Calculate R = x 1 *QQ 1

[0282] Output:

[0283] Public secret point R

[0284] Remark:

[0285] ·w 1 =Paillier-Dec(v 1 )mod q=z+d / (h*m 1 )mod q

[0286] ·x 1 =z 1 +d / h mod q

[0287] (4.5. Calculation) describes the process of using a key generated on the device. Of course, a key d generated outside the device can also be used. In this case, the following settings are made for the encryption of d.

[0288] (4.5. Setting Key) Device-External Setting for Externally Generated Secret Key d

[0289] Generate the Paillier encryption parameter n as described in Section 3 3 , 3 and α 3 , μ 3 .

[0290] Generate a random number 0 <m 3 <q。

[0291] ·d / (h*m 3 ) mod q Paillier encryption: Generates randomized d 3∈Γ 3 ,in

[0292] Paillier-Dec(d 3 )mod q=d / (h*m 3 )mod q.

[0293] Paillier encryption of 1:

[0294] Generate randomized l 3 ∈Γ 3 , where Paillier-Dec(l 3 )mod q=1.

[0295] Then use all the parameters of (4.5. Set Key) as input parameters of (4.5. Calculate) instead of the parameters of (4.4. Transfer) and (4.4. Calculate).

[0296] 2.6 White-box EC-Schnorr key generation

[0297] (4.6. Settings) External device settings

[0298] Same as (4.1. Settings), but with one exception: no need for l 1 .

[0299] (4.6.Transfer)Transfer to the device

[0300] Same as (4.1. Transfer), but with one exception: l is not required 1 .

[0301] (4.6. Calculation) Calculation on the device

[0302] Same as (4.1. Calculation).

[0303] 2.7 White-box EC-Schnorr signature generation

[0304] (4.7. Settings) External device settings

[0305] The following parameters are used to compute the ephemeral key in EC-Schnorr signature generation. This functionality is similar to (4.2. Setup) with one exception: using (1 / m 2 mod q) instead of m 2 Used for Paillier encryption.

[0306] Generate the Paillier encryption parameter n as described in Section 3 2 , 2 and α 2 , μ 2 .

[0307] · Generate a random number 0 < m 2 <q.

[0308] · Generate a random number 0 ≤ f j <q's large table.

[0309] · Calculate the curve point E j = f j * G.

[0310] · f j / m 2 mod q's Paillier encryption: Generate a randomized e j ∈Γ 2 , where Paillier - Dec(e j )

[0311] mod q = f j / m 2 mod q.

[0312] (4.7. Transmission) Transmit to the device

[0313] · Public Paillier parameter n 2

[0314] · White - box secure secret Paillier parameters λ 2 and α 2 (and optionally 1 / μ 2 mod n 2 )

[0315] · Curve point E j and Paillier encryption parameter e j

[0316] · The obfuscated parameter m 2

[0317] (4.7. Calculation) Calculation on the device

[0318] Input:

[0319] · The parameter n from (4.6. Transmission) 1 、λ 1 and α 1 , optionally 1 / μ 1 mod n 1 、m 1

[0320] · The encrypted secret key d generated in (4.6. Calculation) 1

[0321] · All parameters from (4.7. Transmission)

[0322] ·Message

[0323] process:

[0324] Generate a random number rand[j]

[0325] Calculate the curve point Q = Σ j rand[j]*E j If Q is at infinity, start over.

[0326] Calculate the encrypted temporary key u 2 =Π j e j rand[j] mod n 2 2

[0327] Calculate the first signature parameter r = hash(m||Qx). If r mod q == 0, restart.

[0328] Generate a random number z that is relatively prime to q.

[0329] Calculate z 2 =z*m 2 mod q.

[0330] Use index z 2 Modular exponentiation: Calculate v 2 =u 2 z2 mod n 2 2

[0331] Calculate Paillier-Dec(v 2 )

[0332] ·w 2 =Paillier-Dec(v 2 )mod q

[0333] Calculate r 1 =(r*z)*m 1 mod q

[0334] Use index r 1 Modular exponentiation: Calculate v 1 =d 1 r1 mod n 1 2

[0335] Calculate Paillier-Dec(v 1 )

[0336] ·w 1 =Paillier-Dec(v 1 )mod q

[0337] ·Calculate the second signature parameter s=(w 1 +w 2 ) / z mod q. If s == 0, restart.

[0338] Output:

[0339] Signature parameters r, s

[0340] Remark:

[0341] The temporary key u used is (Σ j rand[j]*f j )mod q

[0342] ·Paillier-Dec(u 2 )mod q=u / m 2 mod q.

[0343] ·w 2 =Paillier-Dec(v 2 ) mod q = u*z mod q

[0344] ·w 1 =Paillier-Dec(v 1 ) mod q = r*d*z mod q

[0345] (4.7. Calculation) describes the process of using a key generated on the device. Of course, a key d generated outside the device can also be used. In this case, the following settings are used for the encryption of d.

[0346] (4.7. Setting Key) Device external setting for externally generated key d

[0347] Generate the Paillier encryption parameter n as described in Section 3 3 , 3 and α 3 , μ 3 .

[0348] Generate a random number 0 <m 3 <q。

[0349] ·d / m 3 Paillier encryption of mod q:

[0350] Generate randomized d 3∈Γ 3 , where Paillier-Dec(d 3 )mod q=d / m 3 mod q.

[0351] Then use all the parameters of (4.7. Set Key) as input parameters of (4.7. Calculate) instead of the parameters of (4.6. Transfer) and (4.6. Calculate).

[0352] If the Paillier parameter of the secret key (n 1 , 1 and α 1 , ...) and the parameters of the temporary key (n 2 , 2 and α 2 , …), then (4.7. Calculation) can be replaced by the following process which only requires one Paillier decryption.

[0353] (4.7. Calculation of ') in (n 1 , 1 and α 1 ,…)=(n 2 , 2 and α 2 , …)

[0354] enter:

[0355] · Parameter n of (4.6. Transmission) 1 , 1 and α 1 , optional 1 / μ 1 mod n 1 、m 1

[0356] The encrypted secret key d generated in (4.6. Calculation) 1

[0357] All parameters of (4.7.Transfer)

[0358] ·Message

[0359] process:

[0360] Generate a random number rand[j]

[0361] Calculate the curve point Q = Σ j rand[j]*E j If Q is at infinity, start over.

[0362] Calculate the encrypted temporary key u 1 =Π je j rand[j] mod n 1 2

[0363] Calculate the first signature parameter r = hash(m||Qx). If r mod q == 0, restart.

[0364] Calculate v 1 =u 1 *(d 1 ) r mod n 1 2

[0365] Generate a random number z that is relatively prime to q.

[0366] Calculate z 1 =z*m 1 mod q.

[0367] Use index z 1 Modular exponentiation of: Calculate x 1 =u 1 z1 mod n 1 2

[0368] Calculate Paillier-Dec(x 1 )

[0369] Calculate the second signature parameter s = Paillier-Dec(x 1 ) / z mod q. If s == 0, restart.

[0370] Output:

[0371] Signature parameters r, s

[0372] Remark:

[0373] The temporary key u used is (Σ j rand[j]*f j )mod q

[0374] ·Paillier-Dec(u 1 )mod q=u / m 1 mod q

[0375] ·Paillier-Dec(v 1 )mod q=(u+r*d) / m 1 mod q

[0376] ·Paillier-Dec(w 1 ) mod q = (u + r * d) * z mod q

[0377] 2.8EC-Schnorr Signature Verification

[0378] This function uses only public key parameters. Therefore no additional encryption of these parameters is required.

[0379] Cited prior art

[0380] [1] EP2553866A1

[0381] [2] EP3376705A1

[0382] [3] EP3249520A1

[0383] [4] EP3125145A1

[0384] [5] Paillier cryptosystem: Pascal Paillier, “Public-Key Cryptosystems Based on Composite Degree Residuosity Classes”, in Stern J. (eds) Advances in Cryptology—EUROCRYPT '99. Lecture Notes in Computer Science, vol 1592, Springer, Berlin, Heidelberg, 1999. http: / / www.cs.tau.ac.il / ~fiat / crypt07 / papers / Pai99pai.pdf )

[0385] [6] Yehuda Lindell’s, “Fast Secure Two-Party ECDSA signing” (IACR preprint server 2017 / 552).

Claims

1. A microprocessor device comprising an implementation of a cryptographic operation configured to process a parameter and produce an output, wherein: The cryptographic operation includes one or more of a key generation operation, a signature generation operation, and a key exchange operation, and at least some of the parameters are obfuscated so that the cryptographic operation processes the obfuscated parameters, wherein the at least some of the parameters are obfuscated in a manner that encrypts the at least some of the parameters according to an additively homomorphic cryptographic system, characterized in that the parameters to be processed by the cryptographic operation include at least a secret key, and wherein the secret key is obfuscated in a manner that encrypts the secret key according to an additively homomorphic cryptographic system.

2. The microprocessor device according to claim 1, wherein: The additive homomorphic cryptographic system includes an encryption function Enc and a decryption function Dec, which conform to the rule Dec(Enc(m))=m and also conform to the rule Dec(Enc(m1)*Enc(m2))=m1+m2.

3. The microprocessor device according to claim 1, wherein: The additive homomorphic cryptosystem is implemented as a Paillier cryptosystem.

4. The microprocessor device according to claim 3, wherein: The Paillier cryptosystem includes: (1) an encryption public key consisting of a pair of {n, g} and (2) a decryption private key consisting of a pair of {λ, μ} or {α, μ}.

5. A microprocessor device as claimed in any one of claims 1 to 4, wherein: The value derived from the secret key is obfuscated in such a way that it is encrypted according to an additively homomorphic cryptosystem.

6. A microprocessor device as claimed in any one of claims 1 to 4, wherein: The operational cryptographic system comprises at least one pre-computed parameter processed in a cryptographic operation, and wherein the at least one pre-computed parameter is obfuscated in such a way that the pre-computed parameter and / or a value derived from the pre-computed parameter is encrypted according to an additively homomorphic cryptographic system.

7. The microprocessor device according to claim 6, wherein: The at least one pre-computed parameter is one of the following: - at least one pre-computed parameter that is computed externally to the device and provided to the device for subsequent key generation on the device; or - at least one pre-computed parameter computed externally to the device and provided to the device for subsequent computation on the device of a temporary key used in computation of the signature.

8. The microprocessor device according to claim 6, wherein: The operational cryptographic system is a system based on elliptic curve EC or one of the systems based on non-elliptic curves, and the operational cryptographic system is one of the following systems: ECDSA; EC-Schnorr; EC Diffie Hellman ECDH; EdDSA, ECGDSA, KCDSA, SM2; DSA; Schnorr signature scheme; ElGamal signature scheme; Diffie Hellman DH key exchange.

9. The microprocessor device according to claim 6, wherein: The cryptographic operation is one of the following: - a cryptographic generation operation performed in accordance with an operational cryptographic system, the output of which is a cryptographic key, and at least the output cryptographic key is encrypted in accordance with said additively homomorphic cryptographic system; or a cryptographic signature generation operation performed in accordance with an operational cryptographic system, the output of which is a cryptographic signature {r, s}, said operational cryptographic system being constructed to generate a cryptographic signature {r, s} based on a secret key, and at least the secret key and / or a value derived from the secret key being encrypted in accordance with said additively homomorphic cryptographic system; or - a key exchange operation between different parties performed according to an operational cryptographic system, the output of which is a common secret key shared between the different parties, and the output of which is calculated based on its own secret key and the public key of the other party, and at least the secret key of each party is encrypted according to the additively homomorphic cryptographic system.

10. A method for implementing an obfuscated cryptographic operation in a microprocessor device, the cryptographic operation comprising one or more of a key generation operation, a signature generation operation, and a key exchange operation, the obfuscated cryptographic operation being configured to process obfuscated parameters and produce an output, the method comprising the following steps: - providing a microprocessor device with a partial implementation of cryptographic operations lacking at least some parameters, - obfuscating at least some of the missing parameters in a processing device external to said microprocessor device and transmitting said at least some of the missing parameters obfuscated from said processing device to said microprocessor device, - implementing said missing at least some parameters obfuscated in said partial implementation to produce an obfuscated cryptographic operation, wherein the at least some of the missing parameters are obfuscated in such a way that they are encrypted according to an additive homomorphic cryptosystem, The method is characterized in that the parameters to be processed by the cryptographic operation include at least a secret key, and wherein the secret key is obfuscated in such a way that it is encrypted according to an additively homomorphic cryptographic system.

11. The method of claim 10, wherein the additive homomorphic cryptosystem comprises an encryption function Enc and a decryption function Dec, and wherein at least some or all of the encryption functions Enc under the additive homomorphic cryptosystem are calculated outside the microprocessor device.

12. A method of producing an output by operating a microprocessor device as claimed in any one of claims 1 to 9, the output being a cryptographic key or a shared secret key or a cryptographic signature.