Giesecke & Devrient Gmbh

Giesecke+devrient Mobile Security Gmbh

Hermann Drexler

Michael Baldischweiler

Sven Bauer

Lars Hoffmann

Jürgen Pulkus

Harald Vater

Eric Johnson

Wolfgang Rankl

Michael Lamla

Wolfgang Effing

Markus Bockes

Franz Weikmann

Helmut Kahl

Torsten Karch

Nikola Mamuzic

Sabine Weicker

A processor device has an executable implementation of a cryptographic algorithm implemented thereon, which algorithm is adapted to produce an output text from an input text employing a secret key K. The implementation of the algorithm comprises a key-dependent computing step S which comprises a key combination of input values x derived directly or indirectly from the input text with key values SubK derived directly or indirectly from the key; the key-dependent computing step S is represented by a table which is masked with input masking and/or output masking to form a masked table TabSSubK; and a new masked table TabSKneu is generated in the processor device.

Cryptographic algorithm having a key-dependent masked computing step (SBOX call)

A processor device has an executable implementation of the cryptographic algorithm DES implemented with an XOR linkage operation at the round exit and an implemented computation step S arranged to map expanded right input values r' as computation step entry values x=r&#x2032; onto exit values s=S[x]. The computation step S is implemented as a key-dependent computation step further comprises a key linkage operation for linking input values of the round with key values of the round derived directly or indirectly from the key. The computation step S is implemented as a combined key-dependent computation step T which further comprises: a permutation operation P associated with the round, arranged to be applied to exit values s of the computation step S and to supply the exit values s of the computation step in permutated form to the XOR linkage operation at the round exit.

Alternative representation of the crypto-algorithm DES

The invention provides a processor device having an executable, white-box-masked implementation of a cryptographic algorithm implemented thereon. The white-box masking comprises an affine mapping A, which is so designed that every bit in the output values w of the affine mapping A depends on at least one bit of the obfuscation values y, thereby attaining that the output values w of the affine mapping A are statistically balanced.

Hardened white box implementation 1

Methods are provided for testing and hardening software applications for the carrying out digital transactions which comprise a white-box implementation of a cryptographic algorithm. The method comprises the following steps: (a) feeding one plaintext of a plurality of plaintexts to the white-box implementation; (b) reading out and storing the contents of the at least one register of the processor stepwise while processing the machine commands of the white-box implementation stepwise; (c) repeating the steps (a) and (b) with a further plaintext of the plurality of plaintexts N-times; and (d) statistically evaluating the contents of the registers and the plaintexts, the intermediate results and/or the ciphertexts generated from the plaintexts by searching for correlations between the contents of the registers and the plaintexts, the intermediate results and/or the ciphertexts generated from the plaintexts to establish the secret key.

Method for testing and hardening software applications

A processor device has an executable implementation of a cryptographic algorithm implemented thereon that is white-box-masked by a function f. The implementation comprises an implemented computation step S by which input values x are mapped to output values s=S[x], and which is masked to a white-box-masked computation step T' by means of an invertible function f. As a mapping f there is provided a combination (f=(c1, c2, . . . )*A) of an affine mapping A having an entry width BA and a number of one or several invertible mappings c1, c2, . . . having an entry width Bc1, Bc2, . . . respectively, wherein BA=Bc1+Bc2+ . . . . Output values w are generated altogether by the mapping f. The affine mapping A is constructed by a construction method coordinated with the invertible mappings c1, c2, and etc.

Hardened white box implementation

A processor device has an executable implementation of a cryptographic algorithm implemented being white-box-masked by a function f. The implementation comprises an implemented computation step S by which input values x are mapped to output values s=S[x], and which is masked to a white-box-masked computation step T' by means of an invertible function f. As a mapping f there is provided a combination (f=(c1, c2, . . . )*A) of an affine mapping A having an entry width BA and a number of one or several invertible mappings c1, c2, . . . having an entry width Bc1, Bc2, . . . respectively, wherein BA=Bc1+Bc2+ . . . . Output values w are generated altogether by the mapping f. Multiplicities of sets Mxi, i=1, 2, . . . =Mx11, Mx12, . . . Mx21, Mx22, . . . are formed from the output values a of the affine mapping A.

Hardened white box implementation 2

The invention relates to a data carrier having a semiconductor chip. In order to prevent an attacker from determining secret data of the chip from intercepted signal patterns of the chip, security-relevant operations are performed only with commands or command strings of the operating program whose use does not permit the processed data to be inferred from the signal patterns.

Access-controlled data storage medium

The invention relates to a data carrier () having a semiconductor chip (). In order to prevent an attacker from determining secret data of the chip () from intercepted signal patterns of the chip (), security-relevant operations are performed only with commands or command strings of the operating program whose use does not permit the processed data to be inferred from the signal patterns.

In a method for protected execution of a cryptographic calculation in which a key with at least two key parameters is drawn on, an integrity check of the key is performed, in order to prevent a cryptographic attack in which conclusions are drawn as to at least one second key parameter by corrupting at least one first key parameter. A further method serves to determine a key for a cryptographic calculation with at least two key parameters provided for use in the first-mentioned method. A computer program product and a portable data carrier have corresponding features. The methods enable particularly good protection of cryptographic calculations against attacks.

Protected cryptographic calculation

The invention relates to a method for testing the authenticity of a data carrier () and/or an external device () which enters into data exchange with the data carrier (). According to the invention, the data carrier () and the external device () are each equipped with a special additional apparatus () for generating and/or testing authenticity data. Data transmission between the data carrier () and the external device () as required for authenticity testing is performed at least partly via a special transmission channel (B). The transmission channel (B) for transmitting authenticity data is separated physically or logically from a transmission channel (A) for transmitting standard data so that there is no mutual interference of data transmission via the two transmission channels (A, B). In authenticity testing, the additional apparatuses for generating and/or testing authenticity data () of the data carrier () and external device () and optionally also the transmission channel (B) for authenticity data must meet special demands which cannot be met by conventional designs. The transmission channel (B) for transmitting authenticity data is activable during the total time period between activation and deactivation of the data carrier () so that authenticity testing can be performed anytime.

Data medium authentication method

The invention relates to a data carrier having a semiconductor chip () with at least one memory. The memory contains an operating program that is able to perform at least one operation (h). In order to prevent unauthorized access to the data (x) processed with the operation (h), both said data and the operation (h) itself are disguised. The disguising of the data (x) and the operation (h) is coordinated such that the disguised operation (h, h) generates either the output data (y) of the undisguised operation (h) or disguised output data (y{circle around (x)}R) from which the output data (y) can be determined.

Access-protected data carrier

The invention relates to a data storage medium having a semiconductor chip which has at least one memory in which an operating program is stored which contains a number of commands, with each command producing signals which can be detected from outside the semiconductor chip. According to the invention the data storage medium is designed in order to split secret data, which is stored in the semiconductor chip in order to carry out security-relevant or safety-relevant operations or is generated by this semiconductor chip, into at least three data parts, with an arithmetic unit being included in order to calculate a random number and in order to divide the random number, with the first data part being the integer result of the division process, the second part being the remainder of the division process, and the third part being the random number itself.

Portable data carrier provided with access protection by dividing up codes

The invention relates to a data storage medium having a semiconductor chip which has at least one memory in which an operating program is stored which contains a number of commands, with each command producing signals which can be detected from outside the semiconductor chip. According to the invention, the data storage medium is designed such that data which is used more than once for a calculation process is scrambled using different functions.

Growing community of inventors

Munich, Germany

Hermann Drexler