Method for providing randomness for a cryptographic algorithm, method for processing data, and associated computer program

Abstract

Method for providing randomness for a cryptographic algorithm, method for processing data and associated computer program. This method for providing randomness for a cryptographic algorithm is implemented by an electronic computer comprising a core and a set of memory(ies), the set of memory(ies) including a reference memory exhibiting an intrinsic randomness in a predefined randomness generation state.The process comprises the following steps: - reading (100) a reference message from a first memory area, the first memory area being included in the reference memory, the reading step (100) being performed in the random number generation state of the reference memory; - writing (110) the reference message to a second memory area, distinct from the first memory area, the second memory area being included in the set of memory(ies); - subsequent reading (120) of the reference message from the second memory area, the reference message read from the second memory area forming the random number for the cryptographic algorithm. Figure for the abstract: Figure 2.

Description

Description Title of the invention: Method for providing a random number for a cryptographic algorithm, method for processing data and associated computer program

[0001] — The present invention relates to a method of providing a random number for an al- cryptographic algorithm, the process being implemented by an electronic computer electronics.

[0002] = The invention also relates to a method for processing data via an algorithm cryptographic using randomness, the process being implemented by a calculator electronic, and the randomness being provided by such a method of providing.

[0003] — The invention also relates to a computer program comprising ins- instructions which, when executed by a computer, implement such a method of providing or such a method of processing.

[0004] — Physically unclonable functions, also called PUFs (from the English Physical Unclonable Function), exploit an intrinsic random behavior of a electronic component to provide randomness for a cryptographic algorithm, such as than an authentication or key generation primitive. The random behavior sought is said to be "static", because - for a given component - it must be stable in the time. For example, the key generated in the component must always be the same, because if It is used for memory encryption, over time the content would no longer be de- encryptable if the generated key varied.

[0005] — This notion of reliability (or robustness) is important, and is a problem that must resolve manufacturers of unclonable physical functions. For example, for non-clonable physical functions carried out using static RAM, also called SRAM-PUF (from the English Static Random Access Memory - PUF), which exploit technological dispersions expressed by an ignition bias, have use of redundancy greater than a factor of 10 and the use of algorithms error correctors to overcome this reliability problem.

[0006] — Document US 10,572,190 B2 relates to an apparatus providing a PUF code, this device comprising a pair of non-volatile memory cells and a circuit data detection. The detection circuit is coupled to the pair of cells of non-volatile memory, reads two initial states of the pair of non-volatile memory cells volatile and generates a PUF code by comparing the two initial states of the pair of non-volatile memory cells. If one of the memory cells in the pair is found at a resistance lower than the other of the memory cells of the pair, a pulse writing will be performed on the first cell, in order to subsequently reduce its re- resistance. As a result, the resistance difference between the two cells will be widened. This mechanism makes the supply of the PUF code more stable, but requires the use of two memory cells for each random bit to be read. US 11,081,172 B1 describes a method for forming an on-chip security key. The method comprises electrically connecting in series a pair of phase change memory elements, also called PCM elements, electrically connecting a programming transistor to the pair of PCM elements, electrically connecting an input of an inverter to a common node of the pair of PCM elements, setting the PCM elements to a low resistance state, called LRS (Low Resistance State) in an initialization step, applying a reset pulse to generate a security bit and change one of the PCM elements to a high resistance state, called HRS (High Resistance State), and generating a logic "1" or "0" at the output of the inverter. In this document, a first PCM element of the pair is then initially in an LRS state and is then reprogrammed into an HRS state.Depending on its final resistance, relative to the second PCM element in the pair, the inverter will output a random value. This system then uses the variation of resistance in the HRS state, intrinsic to PCM technology, to obtain the random value, and also requires the use of two PCM elements for this purpose. US 2014 / 0140502 A1 relates to a device having a physical unclonable function (PUF), the device comprising an integrated circuit and a PCM memory, incorporated in the integrated circuit and comprising a plurality of cells, where the PCM memory is adjusted in a manner that creates a phase variation on the plurality of cells, and where the phase variation comprises the physical unclonable function. Thus this document describes a way of programming the PCM cells in such a way as to make the programmed resistance as random as possible. This is done by choosing weak programming conditions, which do not allow complete programming of the memory. The paper “Design and security evaluation of PCM-based rPUF using cyclic re-freshing strategy” by Qi Zhang et al (2018) proposes a differential reconfigurable PUF (rPUF) scheme with PCM memory, where randomness is extracted from variations in the programmed resistance from one write / erase cycle to another. However, such methods of providing randomness for a cryptographic algorithm are not optimal. The aim of the invention is then to propose a method making it possible to provide randomness more efficiently for a cryptographic algorithm. To this end, the invention relates to a method for providing a random number for a cryptographic algorithm, the method being implemented by an electronic computer. electronics comprising a core and a set of memory(ies), the set of memory(ies) comprising a reference memory having an intrinsic random character in a predefined randomness generation state, the method comprising the following steps: - reading a reference message in a first memory area, the first memory area being included in the reference memory, the reading step being carried out in the random generation state of the reference memory; - writing the reference message in a second memory area, distinct from the first memory area, the second memory area being included in the set of memory(ies); - subsequent reading of the reference message in the second memory area, the reference message read in the second memory area forming the random number for the cryptographic algorithm. With the provision method according to the invention, due to the intrinsic randomness of the reference memory in the predefined randomness generation state, the reference message read in the first memory area has a randomness, and the writing of this reference message in the second memory area then allows the subsequent reading of the reference message in the second memory area, without risk of alteration of the reference message by a new reading of the first memory area. The read reference message thus forms the randomness for the cryptographic algorithm. Preferably, when the reference memory is a phase change memory (PCM), the predefined random generation state is an initial blank state of said memory. When the reference memory is a static random access memory (SRAM), the predefined random generation state is a power-up state of said memory, i.e., the power-up state of said memory. According to other advantageous aspects of the invention, the supply method comprises one or more of the following features, taken individually or in all technically possible combinations: - the reference memory is chosen from the group consisting of: a phase change memory, and a static random access memory; - when the reference memory is the phase change memory, the predefined random generation state is an initial blank state of said memory; and when the reference memory is the static RAM, the predefined random generation state is a state when said memory is switched on; - when the reference memory is the phase change memory, the method further comprises a step of checking the state of the reference memory, to check whether the first memory area is still in the random generation state; the control step preferably comprising a control of an absence of writing in the first memory zone via a reading of an associated configuration register; and / or a memory access control prohibiting write access to the first memory zone; - the method further comprises a step of verifying the randomness comprising a reading of a portion of the reference message in the first memory zone, a reading of the portion of the reference message in the second memory zone, then a comparison of the two portions of the reference message read, the randomness being considered correct if a difference between the two portions read is less than a predefined threshold; the reference message preferably being a binary message, and the difference being the number of distinct bits between the two portions read during a bit-by-bit comparison of said portions; the difference preferably still being the Hamming weight of a comparison portion, the comparison portion being obtained via an EXCLUSIVE OR operation between the two read portions; each portion preferably still being the same batch of bits of the reference message, read in the corresponding memory zone; - the first memory area comprises word lines, bit lines, source lines and memory cells organized according to a matrix comprising rows and columns, the memory cells of the same row being selectable by a word line, the memory cells of the same column being connected to at least one bit line and at least one source line, each memory cell comprising at least one memory component capable of storing a value and at least one switch, each switch being controlled via a respective word line;and the first memory area comprises diodes for blocking writing in the memory cells, each bit line being connected to an electrical ground via a respective blocking diode, the blocking diode then being connected by its anode to the corresponding bit line and by its cathode to the electrical ground, each blocking diode being conductive when a voltage threshold is exceeded, the value of which is greater than a reading voltage of the memory cells and less than a writing voltage of the memory cells; ; each source line being preferably connected to electrical ground via a respective blocking diode, the blocking diode then being connected by its anode to the corresponding source line and by its cathode to electrical ground, the reference message preferably still being a binary message, and each memory cell being capable of storing a respective bit of the binary message; and - the reference message is a binary message comprising N bits, N being an integer; N preferably being between 256 and 8192. The invention also relates to a method for processing data via a cryptographic algorithm using a random number, the method being implemented by an electronic computer, and the random number being provided by a provision method as defined above. According to another advantageous aspect of the invention, the treatment method comprises the following characteristic: - the cryptographic algorithm is chosen from the group consisting of: an encryption algorithm; and an authentication algorithm, such as a hashing algorithm or a signature algorithm, The invention also relates to a computer program comprising software instructions which, when executed by a computer, implement a supply method or a processing method, as defined above. These characteristics and advantages of the invention will appear more clearly on reading the description which follows, given solely by way of non-limiting example, and made with reference to the appended drawings, in which: [Fig.1] [Fig.1] is a schematic representation of an electronic computer implementing the method according to the invention for providing a random number for a cryptographic algorithm, the electronic computer comprising a core and a set of memory(ies), the set of memory(ies) comprising a reference memory; [Fig.2] [Fig.2] is a flowchart of the method according to the invention for providing the random number for the cryptographic algorithm, the method comprising in particular the reading of a reference message in a first memory zone included in the reference memory, the writing of the reference message in a second memory zone distinct from the first memory zone, and the subsequent reading of the reference message in the second memory zone, the read reference message forming the random number for the cryptographic algorithm; [Fig.3] [Fig.3] is a view showing three resistance distributions for PCM memories corresponding to each of the three possible states of these memories, namely a blank state (corresponding to the Pre-forming state in English), a written state (corresponding to the SET state in English), and an erased state (corresponding to the RESET state in English); [Fig.4] [Fig.4] represents a curve illustrating a probability of a false positive as a function of a number of bits of the reference message, the false positive corresponding to the case where the reference message read forming the random number is invalid, but verified as valid during an optional random number verification step; and [Fig.5] [Fig.5] represents the reference memory of [Fig.1], according to one aspect complementary where the first memory area comprises word lines, bit lines, source lines, memory cells each capable of providing a bit of the reference message, and in addition diodes for blocking writing in the memory cells. In the remainder of the description, the expressions "substantially equal to" and "of the order of" define a relationship of equality to plus or minus 20%, more preferably to plus or minus 10%, more preferably to plus or minus 5%. In [Fig. 1], an electronic computer 10 comprises a core 12 and a set 14 of memory(ies), and a communication bus 16 interconnecting the core 12 and said set 14. The electronic computer 10 is configured to implement the method according to the invention for providing a random number for a cryptographic algorithm, described subsequently, in particular with regard to [Fig. 2]. The electronic calculator 10 comprises, for example, a multi-core processor, and then comprises several cores 12. The electronic calculator 10 is for example a system on chip, also called SOC (from the English System On Chip). The core 12 is an information processing unit core, known per se, and is typically a microcontroller core, or a processor core, such as a microprocessor core. As indicated previously, the processor is for example a multi-core processor, and the core 12 is then one of the cores of said processor. The set 14 of memory(ies) comprises at least one memory, i.e. comprises one or more memories. The set 14 comprises in particular a reference memory 18 having an intrinsic random character in a predefined randomness generation state. As an optional addition, the assembly 14 includes an additional memory 20. The reference memory 18 is a phase change memory (PCM), or a static random access memory (SRAM). When the reference memory 18 is the phase change memory (PCM), the predefined random generation state is an initial blank state of said memory (corresponding to the Pre-forming state in English). The other states of the phase change memory (PCM) are, as known per se, a written state (corresponding to the SET state in English), and an erased state (corresponding to the RESET state in English). The PCM memory is a microelectronic component used for the non-volatile storage of digital data. It exploits the amorphous-crystalline phase transition of a chalcogenide material (very often an alloy of germanium Ge, tellurium Te and antimony Sb). This transition is obtained by means of electrical pulses which produce localized heating of the material. The alloy reaches the temperature of melting, and is then cooled. If the cooling is "rapid", the material will have an amorphous phase, corresponding to the erased state (also called the OFF or RESET state in English). If, on the other hand, the cooling is "slow", the final state will be crystalline, corresponding to the written state (also called the ON or SET state in English). The amorphous state is characterized by a high electrical resistance, and is also called the high resistance state, or HRS (from the English High Resistance State). The crystalline state is characterized by a low electrical resistance, and is also called the low resistance state, or LRS (from the English Low Resistance State). Immediately after manufacturing, the PCM memory is in an intermediate state, the initial virgin state (also called Pre-forming in English), where its resistance takes random values ​​between the ON and OFF states, that is to say between the LRS and HRS states.This random resistance of the PCM memory in its initial virgin state then corresponds to the intrinsic randomness of the reference memory 18. . PCM memory is also sometimes referred to as PCRAM (Phase Change Random Access Memory), and is also called phase change memory. PCM memory is a resistive random access memory, also known as RRAM (Resistive Random Access Memory). Those skilled in the art will observe that a resistive random access memory (RRAM) of a type other than PCM memory does not appear suitable for implementing the supply method according to the invention, given that types of resistive random access memory other than PCM memory have a high initial resistance in the virgin state, which then implies difficulties in reading these other types of resistive random access memory in their virgin state. These other types of resistive random access memory are, for example, OxRAM (hafnium-Oxide Random Access Memory), also called hafnium oxide resistive random access memory; and CBRAM (conductive bridging random access memory), also called conductive bridging random access memory. When the reference memory 18 is the static random access memory (SRAM), the predefined random generation state is a state when said memory is switched on, i.e. the state when said memory is powered on. In [Fig.2], the method of providing the randomness for the cryptographic algorithm firstly comprises a step 100 of reading a reference message in a first memory area Z1, the first memory area Z1 being included in the reference memory 18. The method of providing randomness for the cryptographic algorithm is typically implemented by a computer program. The computer program comprises software instructions which, when executed by a computer, implement such a method of providing randomness. The instructions are, for example, ins- software instructions, or machine instructions, when the core 12 executing the computer program is a processor core. Alternatively, the instructions are microcontroller instructions when the core 12 executing the computer program is a microcontroller core. The reading step 100 is performed in the random generation state of the reference memory 18. When the reference memory 18 is the phase change memory (PCM), the reading step 100 is then carried out in the initial blank state of the reference memory 18. In other words, during this reading step 100, the core 12 reads the reference message in the first memory zone Z1 of the reference memory 18 which is then in its initial blank state. When the reference memory 18 is the static random access memory (SRAM), the reading step 100 is then carried out in the power-up state of the reference memory 18, that is to say in the power-up state of the reference memory 18. In other words, during this reading step 100, the core 12 reads the reference message in the first memory zone Z! of the reference memory 18 which is then in its power-up state, that is to say in its power-up state. The supply method then comprises a step 110 of writing the reference message in a second memory area Z2, distinct from the first memory area 7i. According to a first example, the second memory area Z2 is also included in the reference memory 18, and is then denoted Z2A. The writing 110, carried out by the core 12, from the first memory area Z1 to the second memory area Z2A is then marked by the arrow A in [Fig.1]. According to a second example, the second memory area Z2 is included in the additional memory 20, distinct from the reference memory 18, and the second memory area is then denoted Z2B. The writing 110, carried out by the core 12, from the first memory area Z1 of the reference memory 18 to the second memory area Z2B of the additional memory 20 is then marked by the arrow B in [Fig.1]. According to this second example, the additional memory 20 is advantageously of a type distinct from that of the reference memory 18. For example, if the reference memory 18 is the static random access memory (SRAM), the additional memory 20 is advantageously a non-volatile memory, such as a flash memory, i.e. a rewritable semiconductor mass memory. The reading 100 and writing 110 steps correspond to an initialization phase of the provisioning process, also called the enrollment phase. This phase initialization phase then allows the physical non-clonable function (PUF) to be initialized, and the reference message forms the random number, which is an intrinsic and static random number realizing the physical non-clonable function (PUF). This initialization phase is potentially executed several times during a life cycle of the computer 10, and is for example carried out again if the user resets the computer 10 in which the physical non-clonable function (PUF) is included. Those skilled in the art will observe that the step 110 of writing the reference message then makes it possible to stabilize the value of the reference message over time, and the reliability of the non-clonable physical function (PUF) then corresponds to the reliability of the first reference memory 18 or to that of the additional memory 20, depending - according to the first or the second example - on whether the second memory zone Z2A, Z2B is included in the reference memory 18, or in the additional memory 20. The supply method according to the invention then comprises a use phase, during which, during the life cycle of the computer 10, the user interrogates the physical non-clonable function (PUF), for example to obtain a cryptographic key, or to carry out a challenge-response mechanism, this depending on the type of cryptographic algorithm for which the random number is provided. In this phase of use, the supply method then comprises a step 120 of subsequent reading of the reference message in the second memory zone Z2A; Z2B, the reference message read in the second memory zone Z2A; Z2B forming the random number for the cryptographic algorithm. During this subsequent reading step 120, the core 12 simply reads the reference message contained in the second memory zone, which is, according to the first or second example, included in the reference memory 18 and noted Z2A, or included in the additional memory 20 and noted Z2B. The reference message read in the second memory zone Z2A, Z2B forms the randomness necessary for the cryptographic algorithm, this randomness serving for example as an authentication primitive or key generation. The person skilled in the art will then understand that the supply method according to the invention makes it possible to supply, that is to say to produce, or even to generate, said random number; and the random number produced, or even generated, is then obtained by reading the reference message in the second memory zone Z2A, Z2B. The reference message is for example a binary message comprising N bits. The number N, representing the size of the reference message, is an integer typically between 256 and 8192. The reference message is preferably a few kilobits, for example 1024 to 4096 bits, N then being between 1024 and 4096, which is equivalent to the usual size of a cryptographic encryption key. The size of the first memory area Z1 typically corresponds to the size of the reference message. The size of the second memory area Z2A, Z2B is then greater than or equal to that of the first memory area Z1, in order to have sufficient memory space in the second memory area Z2A, Z2B to perform the writing of the reference message during the writing step 110. The second memory area Z2A, Z2B is preferably of identical size to that of the first memory area Z1. As an optional addition, in particular when the reference memory 18 is the phase change memory (PCM), the supply method further comprises a step 130 of checking the state of the reference memory 18, to check whether the first memory area Z1 is still in the random generation state, in other words in the blank state. The control step 130 comprises, for example, a check for an absence of writing in the first memory zone Z1 via a reading of an associated configuration register; and / or a memory access check prohibiting write access to the first memory zone Z1. The check for the absence of writing in the first memory zone Z1 then amounts to verifying that the first memory zone Z1 has not undergone any writing (forming) since the reading step 100. The memory access check then amounts to prohibiting, by memory access control, any writing (forming) in the first memory zone Z1. Those skilled in the art will observe that the additional aspect described below with regard to [Fig.5] also aims to prohibit writing in the first memory zone Z1. As an optional addition, in particular if the user wishes to verify that the physical unclonable function (PUF) has not been cloned, the provisioning method further comprises a step 140 of verifying the randomness. The verification step 140 comprises a reading of a portion of the reference message in the first memory zone Z1 and a reading of the portion of the reference message in the second memory zone Z2A, Z2B; followed by a comparison of the two portions of the reference message read; the random number being considered correct if a difference between the two portions read is less than a predefined threshold. The reference message is typically a binary message, and the difference is then the number of distinct bits between the two portions read during a bit-by-bit comparison of said portions. In this example where the reference message is a binary message, the difference is advantageously the Hamming weight of a comparison portion, the comparison portion being obtained via an EXCLUSIVE OR operation between the two read portions. Each portion is typically the same batch of bits of the reference message, read in the corresponding memory area Z1, Z2A, Z2B. Those skilled in the art will observe that calculating this Hamming weight amounts to counting the number of distinct bits between the two portions read during a bit-by-bit comparison of said portions. Those skilled in the art will note that a reading error rate of the first memory zone Z1, in particular when it is a blank zone of a PCM memory forming the reference memory 18, is likely to increase with the aging of the reference memory 18 or in unfavorable pressure and temperature conditions, and that the predefined threshold, below which the random error is considered correct during the verification step 140, is then preferentially chosen taking into account this aging and / or these unfavorable pressure and temperature conditions. The two feared events of a physically unclonable function (PUF) are non-detection (the PUF is valid, but is verified as invalid), also called false negative, and false positive (the PUF is invalid, but is verified as valid). To avoid the risk of non-detection or false negatives, for example the worst case is chosen by accepting a high error rate of 50%; that is to say by considering that one bit out of two differs between the two portions read during the bit-by-bit comparison of said portions. The feared event of a false positive is the risk that there exists a message, denoted Mx, very corrupted in which half of the bits are exact by chance, and that this message Mx would validate condition 1, whereas it should not be. The probability of a false positive is nevertheless extremely low. Indeed, considering that the message Mx has a size of N bits, and then N / 2 bits are false, the probability PROB that these N / 2 false bits are equal to N / 2 bits of the reference message is expressed according to the number of combinations of N / 2 elements among a set of N elements, divided by the number of possible reference messages. This probability PROB then verifies the following equation: [Math.1] = XSL CSA UE — AE UNE PROB= LCL) - CAVE This probability PROB is represented by curve 200 in [Fig.4], which shows that this probability of a false positive decreases very quickly when the size N of the reference message increases. For example, for a reference message 64 bits long, that is to say if N is equal to 64, then the probability PROB of a false positive is already extremely low, in this case approximately equal to 2.95 x 10-8, In [Fig.3], three resistance distributions for phase change memories (PCM) are shown corresponding to each of the three possible states of these memories, namely a first distribution D1 for the written state (corresponding to the SET state in English), a second distribution D2 for the blank state (corresponding to the Pre-forming state in English), and a third distribution D3 for the erased state (corresponding to the RESET state in English). The person skilled in the art will then observe that [Fig. 3] shows that when the random number is obtained by reading the reference message in the first memory area Z1 of the reference memory 18, produced in the form of a phase change memory (PCM), which is then in its initial blank state, this random number is of very good quality, the distribution associated with the blank state, namely the second distribution D2, being a normal distribution, and with, in addition, an inter-PUF Hamming distance substantially equal to 0.4994 (i.e. sufficiently close to 0.5). However, the inventors also noticed that rereading the blank state of a phase change memory (PCM) is unreliable. Setting a resistance threshold to discriminate two binary states on the median of the second distribution D2 (corresponding to the distribution for the blank state) would imply non-deterministic quantization. Indeed, measurements then show a bit error rate of 5 to 10% between each rereading of the same blank state. Also, realizing a physical unclonable function (PUF) by simply reading the blank state of a phase change memory (PCM) would not be sufficiently reliable, without adding redundancy and / or error correction algorithms. The supply method according to the invention then makes it possible to remedy this lack of reliability, in the absence of phase change memory (PCM) redundancy and / or error correction algorithm(s). The invention also relates to a method for processing data via the cryptographic algorithm using randomness, the method being implemented by an electronic computer, the randomness being provided by the provision method according to the invention. The electronic computer implementing the processing method is, for example, the electronic computer 10 implementing the supply method. Alternatively, the electronic computer implementing the processing method is an electronic computer separate from said electronic computer 10. A cryptographic algorithm is, for example, an encryption algorithm, or an authentication algorithm, such as a hashing algorithm or a signature algorithm. These different types of cryptographic algorithm are known per se. According to a complementary aspect, in [Fig. 5], the reference memory 18, and in particular the first memory zone Z1, comprises word lines 50, also referenced WL (from the English Word Line); bit lines 52, also referenced BL (from the English Bit Line); source lines 54, also referenced SL (from the English Source Line); and memory cells 60 organized according to a matrix comprising rows 62 and columns 64. In the example of [Fig.5], an integer index i associated with rows 62 is for example between 0 and M, and an integer index j associated with columns 64 is for example between 0 and P, so that the number of rows 62 is equal to M+1, and the number of columns 64 is equal to P+1. The memory cells 60 of the same row 62 are selectable by a word line SO, and associated with the same source line 54. The word lines 50, and respectively the source lines 54, are then also referenced WL, to WLy, and respectively SL, to SLy. The memory cells 60 of the same column 64 are associated with the same bit line 52. The bit lines 52 are then also referenced BL, to BL». The memory cells 60 of the same column 64 are connected to at least one bit line 52 and at least one source line 54. Each memory cell 60 comprises at least one memory component 66 capable of storing a value and at least one switch 68, each switch 68 being connected to a respective memory component 66 and controlled via a respective word line 50. According to a complementary aspect, the first memory zone Z1 further comprises diodes 70A, 70B for blocking writing in the memory cells 60. Each bit line 52 is connected to an electrical ground 72 via a respective first blocking diode 70A. The first blocking diode 70A is then connected by its anode to the corresponding bit line 52 and by its cathode to the electrical ground 72. As an optional addition, each source line 54 is connected to electrical ground 72 via a respective second blocking diode 70B, the second blocking diode 70B then being connected by its anode to the corresponding source line 54 and by its cathode to electrical ground 72. Each blocking diode 70A, 70B is conductive when a voltage threshold is exceeded, the value of which is chosen to be greater than a reading voltage of the memory cells 60 and less than a writing voltage of the memory cells 60. The blocking diodes 70A, 70B then authorize, that is to say allow, only the reading of the associated memory cells 60, but not the writing of these. When the reference message is a binary message, each memory cell 60 is capable of storing a respective bit of the binary message. Each memory component 66 is typically a memristor, i.e. a component whose electrical resistance value changes permanently when a current is applied. Thus, data can be recorded by a control current. Such behavior is observed in particular in phase change materials. The change in resistance of a memristor depends on the amplitude and duration of the voltage pulses applied across the memristor, as well as the maximum current value that can pass through the memristor, for example for a “SET” operation, i.e. the transition from a high resistance to a low resistance. Each memristor thus has two states, namely a high state and a low state. The high state corresponds to a high resistance and is generally designated by the abbreviation HRS mentioned above. The low state corresponds to a low resistance and is generally designated by the abbreviation LRS mentioned above. A high-order value, i.e., a logic "1", is generally represented by the low state LRS of the memristor; and as a corollary, a low-order value, i.e., a logic "0", is generally represented by the high state HRS of the memristor. Alternatively, the high weight is represented by the high state HRS of the memristor; and as a corollary, the low weight is represented by the low state LRS of the memristor. The person skilled in the art will observe that the correspondence between the value of the weight and the resistive state of the memory component 66 is purely conventional. Depending on the convention chosen by the designer, the most significant can then correspond to the low state LRS, as well as to the high state HRS, and vice versa for the least significant, as is clear from the two preceding paragraphs. Each switch 68 is typically a transistor, such as a field-effect transistor, also called a FET (Field-Effect Transistor). Thus, each switch 68 has, as known per se, three electrodes, namely a gate, a source and a drain. Each switch 68 is for example an insulated-gate field-effect transistor, also called a MOSFET (Metal Oxide Semiconductor Field Effect Transistor). Each switch gate 68 is connected to a respective word line WL. Depending on the voltage level present on the word line WL, the switch 68 is turned on or off, i.e. blocked. As known per se, the word lines 50, the bit lines 52, and the source lines 54 are controlled by one or more controllers, not shown. A first controller is typically associated with the rows 62, and is then capable of controlling the word lines 50 and the source lines 54; that is to say, of applying, to these lines 50, 54, the appropriate voltages depending on the operation to be performed on the memory cells 60 of the corresponding row 62. Similarly, a second controller is associated with the columns 64, and is then capable of controlling the bit lines 52; that is to say, of applying, to these bit lines 52, the appropriate voltages depending on the operation to be performed on the memory cells 60 of the corresponding column 64. The person skilled in the art will then understand that this complementary aspect makes it possible to further improve the reliability of the randomness provided, i.e. of the non-clonable physical function (PUF), against external attacks which would aim to modify the content of the non-clonable physical function. Indeed, the blocking diodes 70A, 70B only authorize the reading of the memory cells 60, and prohibit any writing in said memory cells 60. It is thus understood that the provision method according to the invention makes it possible to provide the randomness for the cryptographic algorithm more efficiently, without the need for error correction algorithm(s) or memory redundancy presenting the randomness generation state.

Claims

Claims

1. Method of providing randomness for a cryptographic algorithm, the method being implemented by an electronic computer (10) comprising a core (12) and a set (14) of memory(ies), the set of memory(ies) (14) comprising a reference memory (18) exhibiting intrinsic randomness in a predefined state of random generation, the method comprising the following steps: - reading (100) a reference message in a first zone memory (Z1), the first memory area (Z1) being included in the reference memory (18), the reading step (100) being carried out at the random generation state of the reference memory (18); - writing (110) of the reference message in a second zone memory (Z2A; Z2B), distinct from the first memory zone (Z1), the second memory area (Z2A; Z2B) being included in the set (14) from memory(ies); - subsequent reading (120) of the reference message in the second memory area (Z2A; Z2B), the reference message read in the second memory area (Z2A; Z2B) forming the randomness for the algorithm cryptographic.

2. A method according to claim |, wherein the reference memory (18) is selected from the group consisting of: a memory phase change, and static RAM.

3. The method of claim 2, wherein when the memory of reference (18) is the phase change memory, the predefined state of random generation is an initial blank state of said memory (18); and when the reference memory (18) is static RAM, the state predefined random generation state is a state when said memory is switched on (18).

4. A method according to claim 2 or 3, wherein when the memory reference (18) is the phase change memory (PCM), the method further comprises a step (130) of controlling the state of the reference memory (18), to check whether the first memory area (Z1) is still in the random generation state; the control step (130) preferably comprising a control of a no writing in the first memory zone (Z1) via a read of an associated configuration register; and / or access control memory prohibiting write access to the first memory area {Zl).

5. A method according to any preceding claim, in which the method further comprises a step (140) of verifying the random event involving a reading of a portion of the reference message in the first memory zone (Z1), a reading of the portion of the reference message in the second memory area (Z2A; Z2B), then a comparison of the two portions of the reference message read, the randomness being considered correct if a difference between the two portions read is below a predefined threshold; the reference message preferably being a binary message, and the difference being the number of distinct bits between the two portions read during a bit-by-bit comparison of said portions; the difference preferably still being the Hamming weight of a comparison portion, the comparison portion being obtained via an EXCLUSIVE OR operation between the two read portions; each portion preferably still being the same batch of bits of the reference message, read in the corresponding memory area (Z1, Z2A:; Z1, Z2B).

6. A method according to any preceding claim, in in which the first memory area (Z1) comprises word lines (50), bit lines (52), source lines (54) and memory cells (60) organized according to a matrix comprising rows (62) and columns (64), the memory cells (60) of the same row (62) being selectable by a word line (50), memory cells (60) of the same column (64) being connected to at least one bit line (52) and at least one source line (54), each memory cell (60) comprising at least one memory component (66) capable of storing a value and at least one switch (68), each switch (68) being controlled via a respective word line (50); and the first zone memory (Z1) has write blocking diodes (70A, 70B) in the memory cells (60), each bit line (52) being connected to an electrical ground (72) via a respective blocking diode (70A), the blocking diode (70A) then being connected by its anode to the line of corresponding bit (52) and by its cathode to the electrical ground (72), each blocking diode (70A, 70B) being conductive upon overshoot of a voltage threshold whose value is greater than a voltage of reading memory cells (60) and lower than a write voltage memory cells (60); each source line (54) being preferably connected to ground electrical (72) via a respective blocking diode (70B), the blocking diode blocking (70B) then being connected by its anode to the source line (54) corresponding and by its cathode to the electrical ground (72), the reference message preferably still being a binary message, and each memory cell (60) being capable of storing a respective bit of the binary message.

7. A method according to any preceding claim, in which the reference message is a binary message comprising N bits, N being an integer; N preferably being between 256 and 8192.

8. Method for processing data via a cryptographic algorithm using a random number, the process being implemented by an electronic calculator electronics (10), in which the randomness is provided by a method according to one of any of the preceding claims.

9. The method of claim 8, wherein the crypto-algorithm graph is chosen from the group consisting of: an algorithm of encryption; and an authentication algorithm, such as an algorithm hash or signature algorithm.

10. A computer program comprising instructions which, when are executed by a computer (10), implement a method according to any one of the preceding claims.