Key generation

Abstract

A method is provided for generating an output key from an input key, using a key derivation function and an input data string. A mask is generated using the input data string. A key value is generated by, in a first iteration, selecting a bit of the mask, applying the key derivation function to the selected bit of the mask using the input key to generate secret keying material, and updating a key value with the generated secret keying material. Next, for a predetermined number of further iterations, a bit of the mask is selected that has not previously been selected, the key derivation function is applied to the selected bit of the mask using the key value to generate further secret keying material, and the key value is updated with the generated further secret keying material. The output key is subsequently generated using the key value.

Description

[0001] KEY GENERATION

[0002] Technical Field

[0003] The present invention relates to a key generation apparatus and a method for generating an output key from an input key. More generally, the invention relates to improving the security of key derivation methods against side-channel attacks.

[0004] Background

[0005] Side channel attacks, such as differential power analysis, may allow hackers to gain access to secret keys or other proprietary information from devices. Differential power analysis uses variations in the power consumption of a device, such as a chip, smart watch, or other device, to determine the contents of data being processed by the device. The target of such attacks is often secret data, such as keys used for cryptographic operations.

[0006] The idea behind differential power analysis is that different operations performed by a device will exhibit different power profiles e.g. multiplication may take more power than addition, allowing an attacker to determine what a device is doing. Further, when reading data from a memory, the ratio of 1’s and 0’s in binary data may be reflected in a power profile.

[0007] Power analysis can be difficult to detect or counter because the monitoring of the power consumed by a device may be passive. One way of countering power analysis is the use of ‘rekeying’ in which short-term keys, sometimes referred to as ephemeral keys, are used. Short-term keys may be used once or used for a small number of sessions or transactions. For example, a short-term key may be used once or for fewer than, two, three or five transactions or sessions. In other implementations, the short-term key may only be used for a predetermined period of time, such as a second, a few seconds, a minute or an hour etc. How frequently the key needs to be changed may depend on context in which the key is used. A change in the short-term key may make identifying a key being used more difficult because the attacker may not be able to obtain enough repeated power traces for the same key to determine the contents of the key. Further, even if a short-term key is compromised, a short-term key is less valuable if obtained, because it will be changed again in the future.An approach to countering power-analysis attacks is masking in which secret data being processed is XORed with random values to hide the secret data during processing. However, such approaches can be complex and may take up significant circuit area in cases where processing of masked values needs, for example, to be performed in parallel.

[0008] Accordingly, there is a desire for improved countermeasures to resist power analysis attacks on devices.

[0009] Summary

[0010] According to a first aspect of the present invention, there is provided a method for generating an output key from an input key, using a key derivation function and an input data string, the method comprising: generating a mask using the input data string; generating a key value by: in a first iteration: selecting a bit of the mask, applying the key derivation function to the selected bit of the mask using the input key to generate secret keying material, and updating a key value with the generated secret keying material, for a predetermined number of further iterations: selecting a bit of the mask that has not previously been selected, applying the key derivation function to the selected bit of the mask using the key value to generate further secret keying material, updating the key value with the generated further secret keying material; and generating the output key using the key value; and outputting the output key.

[0011] The number of iterations, including the first iteration, may be determined by a security parameter.

[0012] The security parameter may take a value between thirty-two and sixty-four. Generating the mask using the input data string may comprise generating a mask that has a size equal to the security parameter.

[0013] Generating the output key may comprise applying the key derivation function to the entire input data string using the key value to generate secret keying material and setting the generated secret keying material as the output key.

[0014] The input data string may be a salt.

[0015] Generating the output key may comprise selecting a portion of the key value and setting the selected portion of the generated key value as the output key.Selecting a portion of the generated key may comprise selecting a sequence of bits from one end of the generated key value according to a required size of the output key.

[0016] Selecting the portion of the generated key value and setting the selected portion of the generated key as the output key may be performed on a condition that a length of the input data string is shorter than or equal to a security parameter. Selecting the portion of the generated key value and setting the selected portion of the generated key as the output key may be performed on a condition that a size of the output key is set to be less than or equal to a security strength of the key derivation function. In some implementations both conditions may be applied.

[0017] Selecting a bit of the mask and each selecting of a bit of the mask that has not previously been selected may comprise selecting bits of the mask in order from one end of the mask.

[0018] Generating the mask using the input data string may comprise applying a oneway function to the input data string.

[0019] Generating a mask using the input data string may comprise applying an extendable output function to the input data string.

[0020] The key derivation function may be selected from at least one of: Shake, HKDF, SHA-based key derivation functions, and a hash of a concatenation including the input data string and the input key.

[0021] The output key may be a short-term key. The short-term key may be valid for a predetermined time period or may be valid for a predetermined number of uses. In some implementations the predetermined number may be one.

[0022] According to a second aspect of the invention there is provided a key-generation apparatus configured to generate an output key from an input key, using a key derivation function and an input data string, the key generation apparatus comprising circuitry configured to: generate a mask using the input data string; generate a key value by: in a first iteration: selecting a bit of the mask, applying the key derivation function to the selected bit of the mask using the input key to generate secret keying material, and updating a key value with the generated secret keying material, for a predetermined number of further iterations: selecting a bit of the mask that has not previously been selected, applying the key derivation function to the selected bit of the mask using thekey value to generate further secret keying material, and updating the key value with the generated further secret keying material; generating an output key using the generated key value; and outputting the output key.

[0023] According to a third aspect of the invention there is provided a program that, when executed by an information processing apparatus comprising a processor and a storage, cause the information processing apparatus to perform a method according to the first aspect of the invention.

[0024] Further features and advantages of the invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, which is made with reference to the accompanying drawings.

[0025] Brief Description of the Drawings

[0026] Figure 1 shows pseudocode for generation of a short-term key;

[0027] Figure 2 is a flow-chart showing steps of a method for generating a short-term key; and

[0028] Figure 3 is a schematic diagram of an information processing apparatus.

[0029] Detailed Description

[0030] Key derivation functions have many applications. In some cases, a key derivation function may be used to convert a key, such as a long-term key, into an output (derived) key. According to the National Institute of Standards and Technology (NIST), a key derivation function is a function that, with input of a cryptographic key or shared secret and possibly other data, generates secret keying material. Accordingly, in the example of a long-term key, a key derivation function may take the long-term key and other data and output key material in a form that is either used as or is used to derive an output key. The input data that is used in addition to the long-term key, such as the bitstring, may not be kept secret and may be referred to as a salt. For example, in the case of symmetric cryptography, it may be necessary provide the salt along with encrypted data to allow decryption of a ciphertext.

[0031] Key derivation functions may be used to generate derived or short-term keys with the aim of making methods more resilient to power analysis attacks. By regularly changing the keys, it may be more difficult for an attacker to get enough power tracesto identify a key being used. However, a difficulty with the approach just described is that the key derivation function may become a target for a power-analysis attack rather than the algorithm using the short-term key.

[0032] The following methods aim to mitigate this problem using an algorithmic approach. A detailed implementation will be described first with reference to Figure 1 and then more general steps will be described with reference to Figure 2.

[0033] Figure 1 shows pseudocode for a key derivation method. A function safe_kdf_kmac256 takes an input key, key256, a data string (salt) for use in the key derivation, data, and an output size which specifies an output length, out size. In this example, the input key, key256 is a 256-bit (32-byte) string which will be used with a key derivation function that has 256-bit security.

[0034] A security parameter, SECURITY PARAMETER, is also set. In the example shown in Figure 1, the security parameter is set to 64 bits. However, in general the security parameter may be set to any suitable length, with typical values likely to be between thirty-two and sixty-four. Very small values may not provide adequate security against side channel attacks, while larger values will increase the overall quantity of processing that needs to be performed to complete the method. In any case, this parameter does not impact the cryptographic security level of the key derivation function.

[0035] In a second line of the pseudocode, a mask, mask, of the data string, data, is generated. Any suitable extendable output function or other one-way function that can be truncated to the desired length could be used to generate the mask. In this example, Shake256 is used to generate a digest that has a length equal to the security parameter i.e. in this example 64 bits.

[0036] In the third line of the pseudocode, a key value, k, is then initialized to take the value of the input key, key256. A series of steps are then repeated to generate a new version of the key value, k. The steps are repeated through a number of iterations equal to the security parameter, SECURITY PARAMETER.

[0037] The expression in the pseudocode:

[0038] b = (mask » i) & 1starts by shifting the bits of the mask to the right by i positions. For example, if mask is 1010 (in binary) and i is 2, the result would be 0010. After the right shift, the method performs a bitwise AND operation with 1. This operation isolates the least significant bit (the rightmost bit) of the shifted value. If the least significant bit is 1, the result is 1 and if the least significant bit is 0, the result is 0.

[0039] Finally, the result of the AND operation is assigned to the variable b.

[0040] In summary, this line of code sequentially extracts the i-th bit of the mask and assigns it to b.

[0041] The expression in the pseudocode:

[0042] k = sp800_108_kmac256_kdf(k, b, 32)

[0043] applies NIST SP800-108 Key Derivation Function to the bit value, b, using the key value, k, and outputs a value that has a length of 32 bytes (256 bits). The bit value, b, could be extended to a full byte to accommodate implementation constraints (bO becomes bOOOOOOOO, bl becomes bOOOOOOOl for example). The key value, k, is updated with the result of the key derivation function. While NIST SP800-108 Key Derivation Function is used in this example, in general any key derivation function may be used. In other examples, HKDF, SHA-based key derivation functions, or a hash of a concatenation or other function of the input data string and the input key may be used.

[0044] These steps are repeated through a number of iterations equal to the security parameter, SECURITY PARAMETER.

[0045] A few things can be observed at this point. Firstly, the input key, key256, is only used once in this method to process the initial bit, b. After this, the updated value of the key value, k, is used. After the first iteration, the key value, k, can only take one of two values (because the bit b could only take one of two values). Accordingly, the recommendation above to set the security parameter to at least thirty-two reflects generating a large enough ‘space’ of possible values of the key value, k, to prevent collision in the mask that would allow side channel attacks.

[0046] Line 7 of the pseudocode provides an optional condition in the method. This step is optional and may be omitted in some implementations.

[0047] The expression in the pseudocode:If bitlen(data) <= SECURITY ? ARAMETER and out size <= 32: # out size in bytes

[0048] return k[0:out_size]

[0049] applies a condition that the bit length of the data string, data, is less than or equal to the security parameter (i.e. less than or equal to 64 bits in this example) and the output length, out_size, in bytes is less than or equal to thirty-two (i.e. the output length is less than or equal to the length of key value, k).

[0050] If the condition is satisfied, the next line of the pseudocode, return k[0:out_size], returns a slice of the key value, k. The expression ‘[0:out_size]’ specifies the portion of the key value, k, to return. So, k[0:out_size] returns elements of the key value, k, from the start of the key value, k, up to, but not including, the bit at position out size index. For example, if k = [1, 2, 3, 4, 5] and out_size = 3, then k[0:out_size] would return [1, 2, 3],

[0051] If the condition is not met, the method proceeds to the last step of the pseudocode:

[0052] return sp800_108_kmac256_kdf (k, data, out_size)

[0053] This pseudocode applies the key derivation function, in this example NIST SP800-108 Key Derivation Function, again using the key value, k, as the key. It is noted that key value, k, is now a derived key that was generated based on the data string, data. As the method described above applied the key derivation function bit-by-bit to the mask in the loop, the described method of generating a derived key is resilient to leakage of information about the input key by power analysis.

[0054] In more detail, the input key is only used in the first iteration, when the key value, k, is initialized. Subsequent iterations use updated values of the key value, k. Further, the first iteration takes place on a single binary bit value. Accordingly, even if multiple iterations of the above -de scribed method (safe_kdf_kmac256) are performed, a power trace can only be obtained for the case where the input key, key256, is applied using the key derivation function, kmac256, to the key value ‘1’ or the key value ‘O’.The limited number of available traces renders many power analysis techniques ineffective.

[0055] Further it is noted that because the bit-by-bit processing is only performed on a number of bits equal to the security parameter (in the example above, sixty-four bits) the described method may be more efficient than performing bit-by-bit processing across all bits of the input data string, data.

[0056] Figure 2 is a flowchart showing steps of a key derivation function that applies an existing key derivation function in a way that enhances resilience to power analysis attacks.

[0057] The method takes an input key, a data string, an output size and a security parameter.

[0058] In step 20, a mask is generated from the data string. The mask may be generated using any suitable one-way function, such as an extendable output function.

[0059] In step 21, a key derivation function is applied bitwise to the mask. The key derivation function may be applied to bits of the mask in sequence from one end of the mask or in any other order. Each application of the key derivation function generates secret keying material. The secret keying material generated from applying the key derivation function to the first bit is used as a key for the key derivation applied to the second bit. This process is repeated for a number of iterations equal to the security parameter. At each iteration, the secret keying material generated in the previous iteration is used as the key for the key derivation function of the current iteration. The security parameter may take a value between thirty-two and sixty-four.

[0060] At the end of step 21 a derived key has been generated.

[0061] Step 22 generates an output key if a condition is met. In some implementations, step 22 and the condition are not used, and the method proceeds unconditionally to step 23. In step 23, the key derivation function is applied to the data string using the derived key generated in step 21.

[0062] In other implementations, step 22 is applied subject to the condition being met. The condition may be that the length of the data string is less than or equal to the security parameter. The condition may further be that the output size is less than or equal to the length of the secret keying material generated in step 21.If the conditions are met, in step 22 a portion of the derived key that has a length equal to the output size may be used as the output key of the method shown in Figure 2. If the condition is not met, the method proceeds to step 23 described above.

[0063] Following step 22 or step 23, in step 24 the output key is output by the method. The output key may be used in a subsequent algorithm, such a symmetric cryptographic function as will be discussed further below.

[0064] The methods described above may be performed by hardware or software. Figure 3 is a schematic diagram showing hardware of an information processing apparatus suitable for performing the methods described above. The information processing unit may comprise one or more processor 30, a storage 31, an I / O unit 32, a network unit 33, and a power unit 34. Other components may be present but not shown as is well known in the art.

[0065] The one or more processors 30 may be configured to perform computations. The processor 30 may consist of one or more a central processing unit (CPU), a graphics processing unit (GPU) and a neural processing unit (NPU). The storage unit 31 may include both volatile (RAM) and non-volatile (ROM, SSD, HDD) memory components. The storage unit 31 may store both the instructions to be executed by the processor 30 and the data on which these instructions operate. The Input / Output Interfaces unit 32 allows the apparatus to communicate with external devices. Input interfaces may include components like a keyboard, mouse, or touchscreen for user interaction, while output interfaces may include a display, printer, or speakers. The network unit 33 may enable the apparatus to connect to networks (e.g., UAN, WAN, Wi-Fi, Bluetooth, etc.) for data exchange. The network unit 33 may include wired or wireless communication modules. The power unit 34 may provide the necessary power for all components of the apparatus. The power unit 34 may be connected to an external power source or include an internal battery for portable use.

[0066] The methods described above may also be implemented by a computer program. The computer program may comprise instructions that, when executed by an information processing apparatus, such as the information processing apparatus described above, cause the information processing apparatus to perform the methods described. The program may be stored on a non-transitory computer-readable storage medium.The methods for generating a key described above are well suited for implementation in hardware. Accordingly, the methods may be implemented by circuitry configured to perform the method. In some examples, the circuitry may be included in an embedded system, such as a smart card or a smart watch. The key derivation function may find particular use in systems that are exposed to the outside world (such as the smart card and smart watch examples) because it is in these circumstances that side-channel attacks are more likely to occur.

[0067] Embedded systems may communicate with devices that include hardware security modules. It is noted that, in some implementations, the key derivation function may be used as part of a symmetric key encryption method. In such implementations, the same key derivation method may be for both to generating a short-term or derived key from a long-term symmetric key for generation of a ciphertext, and also for generating the same short-term or derived key to decrypt the ciphertext. A salt required to generate the short-term or derived key may be provided with the ciphertext. Accordingly, the key generation methods described above may be performed by an encrypting device and a decrypting device. One of the devices may be a hardware security module.

[0068] The described short-term key generation method may find use in application specific integrated circuits (ASICs). Further the methods may be applicable to software, where the software is stored in a read-only memory (ROM). In each of these cases there may be provided a long-term key that is difficult or impossible to change. In such situations, using the above-described methods to provide side-channel attack resistance may be desirable.

[0069] Hardware security modules are typically hardware devices that act to secure cryptographic processes. Hardware security modules may be implemented as self-contained computers with interfaces. In some cases, hardware security modules are tested, validated, and certified according to one or more standards, such as FIPS 140-3.

[0070] A hardware security module may act as a hardware root of trust. A root of trust is a source that is trusted by default in a computing system. A hardware root of trust may store keys for cryptographic functions and may, for example, enable a secure boot process of the computing system. As the root of trust is inherently trusted, it should preferably be securely designed.A hardware security module may also be hardware integrated into an ASIC in a so-call integrated hardware security module.

[0071] The above-described key generation methods make use of known key derivation functions. Accordingly, the methods may make use of existing key derivation functions built into existing hardware security modules and root of trust hardware without the need to modify the existing functionality. This algorithmic approach to increasing security may allow the described methods to be more easily implemented in existing systems.

[0072] The described short-term key generation methods may find use in attestations. An attestation is a process that provides verifiable evidence that certain conditions or properties of an entity hold true. In some examples, an attestation may be a hash of some contents being attested. The attestation may be made by a trusted entity and encrypted based on a long-term key of the trusted entity. Accordingly, the described key generation methods may be used to generate a short-term or derived key from a long-term key based on a salt. The attestation may be encrypted using the short-term or derived key and the salt may be provided so that the attestation can be verified using the long-term secret key.

[0073] As noted above, the described methods may find use where software is stored in a ROM. An example of this may be the manufacture of chips for smart cards or chips for other applications. The chips may each contain a one-time programmable (OTP) memory. At the time of manufacture of the chips, the OTP memory may be empty. However, a long-term key may be built into the hardware, which long-term key is the same for all the chips. After manufacture, the chips may be configured by storing information in the OTP memory, such as keys. This configuration of the OTP memory may be performed at an outsourced assembly and test (OSAT) facility, which may not be a trusted environment. Rather than using the long-term key on the chip directly to encrypt data to be stored in the OTP memory, the above-described methods may be used to generate a derived key that is specific to the chip. For example, a chip number may be used as a salt. In this way, an adversary may be prevented from using a sidechannel attack that uses a large number of the chips to retrieve the long-term key that is built into the chip hardware because the key used to store data in each chip is different.A further use case for the above-described methods is communication between a camera sensor and a processor within a digital camera. In some cameras, a function may be provided within a digital camera to sign images captured by the camera with a signature using a secret signing key. In this way, if an image is obtained with a signature of the image, it is possible to be certain that the image was captured using the camera and that the image is not fake and has not been edited. To provide this functionality, it may be desirable to encrypt data between the camera sensor and the processor that will apply the digital signature to avoid tampering. Such encryption may be performed using symmetric encryption, due to faster processing speed associated with symmetric encryption and lower processing costs. In such cases, the described key generation methods may be used to prevent side-channel attacks on the long-term symmetric key stored by the camera sensor and the camera processor.

[0074] The above-described methods may be advantageous because they may make use of an existing key derivation function. Accordingly, the methods may be implemented using existing hardware security modules or root of trust. This may be beneficial because changing the specifications of certified hardware security modules may be slow and difficult to achieve in practice.

[0075] A further benefit is that the security parameter for the described key generation methods can be easily set and varied. This contrasts with other techniques for sidechannel protection, such as masking that may break values being processed into masked shares and then process the masked shares before recombining the masked shares to obtain an output of a cryptographic process. Increasing the order of security for masking (i.e. increasing the security parameter) typically requires generating a larger number of masked shares for each value being masked and can require substantial modification of circuitry to generate the masked shares, process the masked shares in parallel, and recombine the masked shares if the level of security is to be increased.

[0076] A further consideration is the ease of testing. At the time of writing, testing for masking techniques to prevent side-channel attacks requires implementing the masking on a device and testing the device to see if the implementation is secure. However, such testing can be time-consuming and costly.

[0077] It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, andmay also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. Furthermore, equivalents and modifications not described above may also be employed without departing from the scope of the invention, which is defined in the accompanying claims.

Claims

CLAIMS1. A method for generating an output key from an input key, using a key derivation function and an input data string, the method comprising:generating a mask using the input data string;generating a key value by:in a first iteration:selecting a bit of the mask,applying the key derivation function to the selected bit of the mask using the input key to generate secret keying material, and updating a key value with the generated secret keying material, for a predetermined number of further iterations:selecting a bit of the mask that has not previously been selected, applying the key derivation function to the selected bit of the mask using the key value to generate further secret keying material, updating the key value with the generated further secret keying material; andgenerating the output key using the key value; andoutputting the output key.

2. A method according to claim 1, wherein the number of iterations, including the first iteration, is determined by a security parameter.

3. A method according to claim 2, wherein the security parameter takes a value between thirty-two and sixty-four.

4. A method according to claim 2 or claim 3, wherein generating the mask using the input data string comprises generating a mask that has a size equal to the security parameter.

5. A method according to any preceding claim, wherein generating the output key comprises applying the key derivation function to the entire input data string using thekey value to generate secret keying material and setting the generated secret keying material as the output key.

6. A method according to any preceding claim, wherein generating the output key comprises selecting a portion of the key value and setting the selected portion of the generated key value as the output key.

7. A method according to claim 6, wherein selecting a portion of the generated key comprises selecting a sequence of bits from one end of the generated key value according to a required size of the output key.

8. A method according to claim 6 or claim 7, wherein selecting the portion of the generated key value and setting the selected portion of the generated key as the output key is performed on a condition that a length of the input data string is shorter than or equal to a security parameter.

9. A method according to any of claims 6 to 8, wherein selecting the portion of the generated key value and setting the selected portion of the generated key as the output key is performed on a condition that a size of the output key is set to be less than or equal to a security strength of the key derivation function.

10. A method according to any preceding claim, wherein selecting a bit of the mask and each selecting of a bit of the mask that has not previously been selected, comprise selecting bits of the mask in order from one end of the mask.

11. A method according to any preceding claim, wherein generating the mask using the input data string comprises applying a one-way function to the input data string.

12. A method according to claim 11, wherein generating a mask using the input data string comprises applying an extendable output function to the input data string.

13. A method according to any preceding claim, wherein the key derivation function is selected from at least one of: Shake, HKDF, SHA-based key derivation functions, and a hash of a concatenation or other function of the input data string and the input key.

14. A method according to any preceding claim wherein the output key is a shortterm key.

15. A key-generation apparatus configured to generate an output key from an input key, using a key derivation function and an input data string, the key generation apparatus comprising circuitry configured to:generate a mask using the input data string;generate a key value by:in a first iteration:selecting a bit of the mask,applying the key derivation function to the selected bit of the mask using the input key to generate secret keying material, and updating a key value with the generated secret keying material, for a predetermined number of further iterations:selecting a bit of the mask that has not previously been selected, applying the key derivation function to the selected bit of the mask using the key value to generate further secret keying material, and updating the key value with the generated further secret keying material;generating an output key using the generated key value; andoutputting the output key.

16. A program that, when executed by an information processing apparatus comprising a processor and a storage, cause the information processing apparatus to perform a method according to any of claims 1 to 14.

Images