Contactless Card Authentication Security Against Side-Channel Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing contactless communication authentication methods are vulnerable to side-channel attacks, allowing attackers to recover encryption keys and perform brute force attacks due to weaknesses in the initial phases of the authentication process.
Innovation Solution
Modifying the authentication method by eliminating the encryption step using the primary key at phase S1 and introducing variations such as using a dummy key or random bit comparisons to obscure useful encryption/decryption traces, ensuring that an encryption step is always performed and a decryption step is always attempted, even if not necessary, to prevent attackers from exploiting side-channel information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used with encryption steps at phase S1, then authentication functionality is provided, but vulnerability to side-channel attacks increases allowing key recovery
Solution Approach 1:
The patent applies preliminary action by performing dummy encryption and decryption operations before the actual authentication encryption. These preliminary operations initialize the S-boxes and prepare the cryptographic state in advance, so that when the actual authentication occurs, the side-channel leakage patterns are already established and cannot be used to recover keys. This is evident in the method where S-boxes are initialized using dummy keys K1 and K2 before the authentication key K is used.
Solution Approach 2:
The patent uses dummy keys K1 and K2 as intermediaries to mask the actual authentication key K. These dummy keys serve as mediators that perform preliminary encryption and decryption operations, creating intermediate cryptographic states that obscure the true key usage patterns. The dummy keys absorb the side-channel attacks while the actual key remains protected, as the attack traces are attributed to the dummy key operations rather than the authentication key.
2Ease of operation
If encryption operations are performed with the primary key at phase S1, then authentication proceeds normally, but information leakage about the key occurs through side-channel attacks
Solution Approach 1:
The patent converts the harmful side-channel information leakage into a beneficial security feature by deliberately performing dummy encryption and decryption operations that generate controlled leakage patterns. These dummy operations create misleading traces that attackers will analyze, while the actual authentication key operations occur in a protected state. The harm of information leakage is transformed into a security mechanism where the leakage occurs about dummy operations, not the actual key.
Solution Approach 2:
The patent changes the cryptographic parameters by introducing dummy keys K1 and K2 with different values than the authentication key K. These parameter changes in key values cause the S-box initialization and encryption operations to produce different intermediate states and leakage patterns. By varying the key parameters in dummy operations, the patent ensures that side-channel traces do not directly reveal the authentication key parameters.
3Productivity
If authentication steps are simplified without dummy operations, then processing speed increases, but security against brute force attacks decreases
Solution Approach 1:
The patent applies partial action by performing only the necessary dummy S-box initialization operations without completing full encryption and decryption cycles. The dummy operations are limited to what is sufficient to establish secure cryptographic states and mask key usage patterns, rather than performing excessive complete authentication cycles. This partial dummy action provides security protection while minimizing the processing overhead and maintaining authentication speed.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The invention relates to a method of authentication of a contactless communication circuit, PICC, by a contactless communication terminal, PCD, comprising: the determination by the PICC of a first number (A1) by encryption of a second random number (Rb); the determination by the PCD of a third number (Rb_pcd) by decryption of the first number, the determination of a fourth number (Ra_pcd| |R'b_pcd) and the determination of a fifth number (B1), comprising first and second portions (B1,1, B1,2 ; B1,1b), by encryption of the fourth number; and the determination of a sixth number (R'b) by the PICC, the determination of a seventh number (B1,2_picc) by encryption by a cipher block chaining operating mode of the sixth number with an initialization vector equal to the first portion (B1,1; B1,1b), and the interruption of the authentication if the seventh number is different from the second portion (B1,2).