EP1792435A1

EP1792435A1 - Method for securing cryptographic processing by means of decoys

Info

Publication number: EP1792435A1
Application number: EP05800594A
Authority: EP
Inventors: Patrice Hameau; Cédric MESNIL; Renaud Marlet
Original assignee: Trusted Logic SAS
Current assignee: Trusted Logic SAS
Priority date: 2004-09-22
Filing date: 2005-09-01
Publication date: 2007-06-06
Also published as: BRPI0515587A; WO2006032746A1; FR2875657A1; FR2875657B1

Abstract

The inventive method for securing a cryptographic processing against physical attacks consists in repeating entirely or partially said cryptographic processing several times, i.e. one or several times on correct data, other times on incorrect data in order to decoy an attacker, wherein the selection of iterations performed on correct or incorrect data is carried out randomly and the incorrect data is ignored in the final result of processing.

Description

_ _

METHOD OF SECURING CRYPTOGRAPHED TREATMENTS THROUGH LURES.

The present invention relates to a method for securing cryptographic processing intended to ensure the protection of data and / or programs of a computer system such as, for example, but not exclusively, an embedded system.

In general, we know that some embedded systems, such as smart cards, are designed to protect the data and programs they contain. In particular, the hardware support of these systems makes it very difficult to observe and modify not only the stored data as well as the execution of the programs.

The protection is not complete, however. These systems may be exposed to malicious actions, also known as attacks, which aim to alter the proper functioning of programs or to reveal confidential information. Some attacks, called physical, operate at the hardware level, as opposed to software attacks.

Physical observation attacks perform a passive hardware spying of a circuit. They include for example the measurement of the execution time (or the number of cycles performed by the processor), the measurement of the power consumption, the analysis of electromagnetic emissions, etc. _ _

Physical disturbance attacks change the state or hardware properties of a circuit. They include for example the disruption of the power supply (voltage peaks, ...), the bombardment by radiation (flash of light, ...), the destruction of logic gates, etc. A disturbance can confuse a program of its normal execution or modify the values of the data on which it operates (for example, by imposing values where all the bits are at 0, or at 1) in order to deceive it or to indirectly reveal certain information in the results produced or in physical emissions.

Physical disturbance attacks are often combined with observation attacks. Indeed, for the disturbance to be relevant from the point of view of the attack, it is often necessary to practice it at appropriate times of execution and thus to synchronize with the running program, which requires a physical observation.

The data specifically targeted by the attacks are the digital key data. These keys are used in processing, including cryptographic calculations (encryption, decryption, signature, etc.) to ensure the confidentiality and / or authenticity and / or integrity of texts, especially during exchanges between the program (or system) and the outside world: an encrypted text can only be read by someone who has the decryption key, a signature affixed to a text can guarantee its origin and the fact that the text does not has not been changed, etc. Some cryptographic processes, such as hash recognition, do not rely on keys.

Different key data depending on the type of processing: block of bits for standard data encryption standard (DES) processing, module and exponent for RSA processing ("Rivest-Shamir-

Adleman "), etc. The size of the key data may vary depending on the level protection sought. Indeed, a cryptographic treatment does not offer a total guarantee but a statistical guarantee (or probabilistic). Software attacks consist in exploiting the result of a large number of calculations made by the system to try to deduce the key used. In general, the larger the size of the key data, the greater the number of calculations required to retrieve the value of the key. To ensure good protection, it is made that this number of calculations is very difficult to achieve by an attacker.

However, cryptographic processing is often implemented by well-known algorithms whose execution has a characteristic "trace" detectable by a physical observation of the execution. This trace left by the execution allows an attacker to synchronize with the processes, not only to try to deduce some of the manipulated data but also to practice disturbances of the execution, disturbances which in turn allow to facilitate other observations. By repeated executions on different input data, an attacker gradually determines information about the keys, until finally know them in their entirety.

In practice, the nature of the trace left by an execution depends of course on the type of observation but also on the way the processing is implemented. In particular, in some embedded systems, such as smart cards, some implementations use specific circuits or processors (crypto-processors) that perform all or part of certain cryptographic processing. The advantages include a much lower processing time and, in general, enhanced protection against physical attacks, both from the point of view of observation and disturbance. _ _

In the absence of a crypto-processor, or if the crypto-processor performs only a part of the processing (which it may be necessary to iterate), operations related to cryptographic processing must be performed by the main processor of the system. As a result, they are more vulnerable to attack.

Among the most well-known physical attacks based on observation, we can mention the SPA ("Simple Power Analysis") and DPA ("Differential Power Analysis") attacks, which are based on a recording of the electrical consumption and which have been successfully used to discover DES keys.

In the case of SPA type attacks, finer observations, possibly correlated with time measurements, then make it possible to determine bits of the key because the operations performed (and their trace in terms of power consumption or time run) differ slightly depending on whether these bits are 0 or 1.

In the case of attacks of the DPA type, used in particular when anti-SPA measures have been taken (see below), not one but several cryptographic treatments are carried out, which are treated with statistical tools. For this, we make an assumption on the presence of a bit set to 0 in data of a particular operation of the cryptographic processing and two cryptographic processing sequences are carried out on particular data chosen to operate on this bit, equal to 0 1. The average of these two series of measurements is then averaged, then the difference of these two averages. If there is a peak in the resulting curve, the initial assumption was good (the bit was 0), otherwise the assumption was wrong. It is thus possible gradually to determine all the bits of the key.

Attacks like SPA and DPA have their counterpart in terms not of electricity consumption but of electromagnetic emissions: these are the SEMA (Simple Electromagnetic Emanation Analysis) and DEMA (Differential Electromagnetic Emanation Analysis). Although less easy to implement, these techniques are theoretically finer than those of SPA and DPA attacks because they can target their attack on a specific part of the circuit (for example, the crypto-processor) while the current analysis is global to all the circuit.

Among the attacks exploiting disturbances of execution, one finds for example the attacks of the type DFA ("Differential Fault Attacks"), initially developed against public key systems of RSA type, then extended to most types of systems to private key.

To enhance the security of a system, it is necessary to mask as much as possible the nature of the treatments carried out and to monitor the possible disturbances of execution. The most common countermeasures are:

• A random delay is introduced in the cryptographic processing. This delay can be produced by performing unnecessary operations.

• Unnecessary operations are introduced in order to make the execution time of the cryptographic processing constant, whatever the value of the manipulated data. In particular, the time does not depend on the connections made in the implementation of the processing. The values of the data to which the superfluous operations relate may also be chosen to make the power consumption constant.

• Several implementations of the same operation involved in the cryptographic processing coexist, these implementations being able to differ by their execution time and / or their electrical consumption. At the execution of the operation, a random choice determines the particular implementation to use. . _

• The execution order of the operations involved in a cryptographic process is modified with a random permutation. (For this, it may be necessary to reformulate the processing to reveal fragments whose execution order is indifferent.)

• Redundant operations are added to the cryptographic processing to calculate a "hash", for example a checksum, which is representative of the operations performed by the system. If the imprint at the end of the calculation differs from the expected value, it means that the execution has been disturbed. Security measures can then be taken, such as blocking the system or program, a common measure in the case of a smart card.

With these countermeasures, execution time, power consumption and electromagnetic emissions become less predictable (introduction of a hazard) and / or less discernible (constant time, independent of input data), and it is more difficult to synchronize with the program to observe cryptographic processing and possibly disrupt it.

However, as is frequently the case with security, the resulting protection is usually only partial or relative. Instead of aiming for an unattainable total immunity, the goal of securing is often aimed at making the task of an attacker more difficult, especially longer or more expensive.

For example, some physical measurements need a finesse that requires devices allowing high sampling (of the order of a hundred times the frequency of the processor, so in practice often more than one gigahertz) and therefore also of very large storage capacities to memorize these measurements. The difficulty is even higher _ _

when these measurements must be repeated many times, as is the case for a DPA-type attack, which may require in the range of one thousand to ten thousand measurements.

Similarly, the secure blocking of the system or program in the event of a proven disruption of execution requires the attacker to have several similar copies of the system, so that he can achieve all the measures he needs. to conclude. The sooner the disturbances are detected, and the system subsequently blocked, the more the attacker requires similar copies of the system.

The invention proposes a novel method for making it more difficult to observe cryptographic processing. The method applies to any cryptographic treatment that is to be masked. It consists in concealing at least a part of the treatment, for example an effective calculation "with similarity", that is to say to insert it among decoys constituted by superfluous similar treatments.

More precisely, the invention proposes a method of securing a cryptographic treatment against physical attacks, in which all or part of said cryptographic processing is repeated several times: one or more times on the correct data, the other times on incorrect data. to decoy an attacker, the choice of iterations made on correct or incorrect data is done randomly, and the iterations made on the incorrect data are ignored in the final result of the processing.

In the case where the number of iterations performed on the correct data is greater than or equal to two and the iterations performed on the correct data have different fingerprints and / or results, then the program may perform a particular treatment. The particular treatment of the program in the case where imprints and / or results of iterations differ may consist (1) in securing certain data and / or (2) in interrupting, definitively or not, its execution and / or, when c is physically possible, (3) to possibly warn the user of the malfunction by an audible or visual signal.

Refinements can be made concerning the number of iterated calculations:

If the cryptographic processing includes a repeated internal algorithmic pattern, the total number of iterations Nr may be equal to the number of repetitions N of said pattern, or to a multiple M of said number of repetitions N, the iterations then being grouped into N packets. of M / N repetitions of the pattern.

• The total number of iterations can also be determined based on:

public and / or invariant data specific to the cryptographic processing, especially the sizes of the key data, and / or

resources necessary to carry out said processing (said resources depending in particular on the text on which said treatment operates, and / or on the size of this text), and / or

resources available for performing said processing, in particular the execution time and / or the memory space,

- a random factor.

Refinements can also be made to the construction of incorrect data: . _

• Incorrect data may only affect key data (not text).

• The incorrect data can be deduced from the correct data by a transformation on the first and / or last key bits manipulated in the implementation of the cryptographic processing.

• When said cryptographic processing imposes specific properties for the key data it exploits, the incorrect key data may be produced from particular data stored in the system, so as to guarantee said specific properties.

• The incorrect data can be deduced from the correct data by a random transformation preserving the observable measurements of the key data (notably the Hamming weight).

Special refinements can also be made to the sequence of the iterated treatments:

• If NC iterations are performed on correct data over a total of Nr iterations, the iterations on incorrect data can be composed from NT / NC sets of different values, each of these sets being used NC times among the NTs. iterations, the choice of the iterations relating to this or that set of values (correct or incorrect) remaining random.

Refinements could also be made in the concealment of the construction of the incorrect data: _ _

• Iteration choices made on incorrect data and / or data values for iterations on incorrect data may be calculated before the first iteration.

These choices and values can be stored, with or without repetitions, in one or more tables, and the implementation of said cryptographic processing can access these tables via a function of the index of the current iteration.

The method according to the invention may also be combined with other forms of security:

• This method can be combined with other methods of securing cryptographic processing, at the level of the implementation of an elementary processing (an iteration) and / or at the level of the implementation of the repetition of the elementary processes. In particular, random delays may be inserted within each iteration and / or between each iteration.

This method may in particular be applied with a number of iterations on correct data NC equal to 2 and a total number of iterations Nr defined as follows:

• if the cryptographic processing includes a cryptographic calculation of type DES or SEED (data encryption standard of South Korea), then N-T = 16,

• if the cryptographic processing comprises a cryptographic computation type COMP 128 (GSM algorithm "Global System for Mobile Communications"), FEAL ("Fast Data Encipherment Algorithm") or IDEA ("International Data Encryption Algorithm"), then Nr = 8, _ _

If the cryptographic processing comprises a cryptographic calculation of the type AES-128, AES-192 or AES-256 (AES = "Advanced Encryption Standard"), then Nr is respectively equal to 10, 12 or 14,

If the cryptographic processing comprises a SAFER ("Secure And Fast Encryption Routine") cryptographic calculation, then β ≤ NT ≤ 10,

• if the cryptographic processing includes a cryptographic calculation of type RC5 ("Rivest Cipher 5"), then 12 ≤ NT ≤ 16.

This process can be implemented by various means:

Basic cryptographic processing may be implemented by instructions for the system processor and / or via one or more crypto¬ processors and / or via one or more cryptographic libraries provided by a third party.

The sequence of the iterations may be implemented at the software level or implemented at the hardware level using a circuit that performs the iterations in sequence and / or in parallel, and in a desynchronized manner.

The interest of the invention lies in the combinatorics created against the attacker. Indeed, the number of similar treatments performed (that is to say the number of iterations) is such that the combinatory consisting of supposing alternatively correct each of the elementary treatments (one of the iterations) is very large. After implementation of the process, it is not so much to determine "where is the treatment? Which is difficult (unless other security measures are taken for that), but "what is the correct treatment? ". It becomes very difficult for the attacker to practice . _

useful observations and realize fine synchronizations with running processing.

In addition, check that each iteration carried out on correct data produces an identical impression or result makes it possible to highlight physical disturbances of the execution and to take, if necessary, security measures, such as the blocking of the system. and / or program.

In practice, a system that duplicates cryptographic processing can only be used if it is fast enough. This is particularly the case with systems equipped with crypto-processors. For example, the execution time of a DES processing on a smart card crypto-processor can be of the order of thirty cycles, which is hundreds or even thousands of times less than an explicit processing performed by the main processor (not dedicated to cryptography).

On the other hand, the number of iterations performed on correct data must be small, otherwise the hiding effect is lost. Conversely, multiplying the number of iterations on correct data increases the possibility of detecting disturbances of execution. Since it is difficult to accurately reproduce the same perturbation of execution (thus preventing detection of the perturbation), a number of two iterations with correct data is a good compromise.

Moreover, the total number of elementary treatments performed (ie the number of iterations) does not necessarily have to be constant.

The total number Nr of elementary treatments may in particular depend on the type of cryptographic processing. In particular, if the cryptographic processing includes a particular internal subprocessing that is repeated . _

a given number of times N, then NT can be chosen equal to N. This allows, besides the indeterminacy created by the multiplication of the treatments, to deceive an attacker by revealing a signal characteristic of the cryptographic treatment (the repetition N times of the same algorithmic pattern) when in fact each repeated pattern N times is itself a complete cryptographic process.

Treatment of an encryption or decryption DES ₅ characteristic, provides a good example: In addition to a permutation of the initial and final data, the heart of this treatment is in fact constituted by 16 iterations of a virtually identical sequence of operations. The observation of the same physical signal repeating 16 times in succession is an index that betrays the presence of the DES calculation. If the DES treatment is secured by repeating it 16 times as described in the present invention, an attacker who observes the treatments may be deluded by these 16 iterations, thinking to see therein the repetition of the internal motif of the DES treatment, while 'In fact it is a complete DES treatment repeated 16 times.

According to this logic, the number of iterations NT may for example be defined as follows for the following cryptographic treatments:

• COMP 128: 8 iterations,

• DES: 16 iterations,

• FEAL: 8 iterations, • IDEA: 8 iterations,

• SEED: 16 iterations.

However, this additional lure is only effective if the attacker can confuse an iteration of the processing with other operations, that is to say on the condition that they produce a signal of the same order: execution time , power consumption, etc. _ _

In practice, a dedicated cryptographic processor may be necessary for this, especially so that each elementary cryptographic processing is fast enough. The processing time, which is small enough to be comparable to the other basic operations of the main processor, justifies not only the viability of a repeated treatment (even a hundred times, if necessary) but also the relevance of the decoy consisting in making one believe in one. programmed processing integrally on the main processor, implementing NT repetitions of a characteristic subprocessing, while it is actually performed Nr times on the dedicated cryptographic processor.

If the cryptographic treatment comprises a repeating unit N times, we can more generally adopt for NT a multiple M of N. Indeed, a repetitive treatment M times can be organized in N iterations of a group of M / N treatments, thus leaving appear the lure of a repeated pattern N times. In the case of a DES treatment, it will be possible, for example, to fix the number of iterations at 32 or 48, which will be organized in 16 iterations of a packet of 2 or 3 treatments.

The total number of iterations need not be constant for a given cryptographic processing, it may depend on public data and / or processing-specific invariant data. For example, in the case of DES processing, it can be made dependent on the size of the key; in the case of RSA encryption or decryption, it may depend on the size and / or value of the module and the exponent.

In particular, if the specification of a cryptographic treatment comprises a repeated pattern a variable number of times, for example related to the size of the key, it will be possible to adopt a number of iterations of the complete processing equal to the effective number of repetition of the pattern , or fix it to one of the numbers of . .

repetitions recommended by cryptanalysts. The number of iterations may for example be defined as follows for the following cryptographic treatments:

• AES-128: 10 iterations; AES-192: 12 iterations; ASE-256: 14 iterations. • SAFER: from 6 to 10 iterations.

• RC5: from 12 to 16 iterations.

The number of iterations can also be dynamic and depend on the resources needed to perform the processing (which may depend on the text, and in particular on its length) and / or the resources available to perform the processing (such as the execution time and / or memory space) and / or a random factor. This makes it possible to find compromises between security level (difficulty of observing and disrupting), quality of service (processing time) and cost of service (memory to be available in the system).

For this method to be effective even when the attacker can make fine observations of the execution, it must be made difficult to recognize whether an iteration is performed on correct data or on incorrect data.

The iterations on the correct data can be recognized in particular because they are repeated, either in the same group of iterations for a secure processing (case of several iterations performed on the correct data), or through several secure processes carried out on identical data. The use of additional security methods, such as the introduction of random delays, makes it more difficult to observe this repetition. But we can also protect ourselves by refining the security process which is the object of the present invention. For this, we can make sure to make the correct and incorrect data the same. - -

both by their values (for example, a few bits of difference) and in the uses made of these values.

To make values similar, incorrect data can be constructed by only slightly modifying some of the correct data in the process. However, the incorrect data must not be too close to the correct data, otherwise conclusions concerning the observation of the incorrect data would also be relevant for the correct data, and the hiding effect would be lost because the decoys are not would not be. There is therefore a trade-off to make the data incorrect enough, but not too much. For this, we can consider which types of data and which fractions of these data are the most interesting to modify.

The main purpose of securing is to conceal key data during cryptographic processing. However, cryptographic processing may depend not only on the value of keys but also the text on which it operates. However, since the execution trace left by cryptographic processing is generally more dependent on the value of the key data than text, it will be advantageous to construct the incorrect data to modify the key data and not the text. .

The choice of key data to be modified (in part or in whole) to make incorrect data may depend on the type of cryptographic processing and its implementation. In practice, physical attacks often exploit the very first or the last operations performed by the processing, which relate to bits at known positions of the key. Determining these bits then makes it possible, step by step, to determine the totality of the key. To hide the correct data, it is therefore important to first mask the bits that occur first or last in the implementation of the processing. - -

For example, in the case of the DES, it will be advantageous to modify the last bits of the key. Indeed, DES attacks by DPA make it possible to determine the bits of a key starting from the last then, knowing the last, by determining the precedent, and so on until the first. Placing incorrect bits (at least) at the end of the key makes it difficult to observe all of the key data.

In the case of keys consisting of values with particular properties, such as in the case of RSA (which is based on prime numbers), it must be ensured that the key data changes preserve these properties. Particular data, such as fully or partially calculated key data, may optionally be stored in the system to allow easy generation of modified key data that satisfies these properties.

Since key data fractions may be ignored in some cryptographic processes, for example because they are redundant, it must also be ensured that the incorrect values are sufficiently different from the correct values to ensure that the processing operationally differs. This is the case in particular DES keys, which in fact only operate 56 bits out of 64.

Some physical observations may also provide information on the value of the data manipulated during a processing, possibly related information, just to classify or compare measures. This is the case, for example, with the Hamming weight (number of bits set to 1), on which the circuit's electrical consumption depends. When modifying the data to produce incorrect data, it will be advantageous to preserve the invariants that are observable. For example, _ _

against the SPA, it will be possible to ensure that the Hamming weight of the incorrect key data is identical to that of the correct key data.

Making the values similar may also affect the number of different copies of the incorrect data used in the set of iterations. Indeed, at the risk of rendering the process ineffective, it should not be possible to identify the iterations made on the correct data simply because, compared with those relating to incorrect data, they are in small numbers and / or identical.

Thus, in the case where only one of the iterations relates to the correct data, it is good that all the iterations on incorrect data are performed with sets of different values. It is difficult to identify the correct iteration among the others. More generally, if one performs NC correct iterations on a total of NT iterations, it is good that the iterations on incorrect data are composed, as far as possible, from NT / NC sets of different values, each of these sets being used NC times among the NT iterations, the choice of the iterations relating to this or that set of values (correct or incorrect) remaining totally random. In the case where Nr and NC are imposed by other considerations, the entire division NT / NC can have a rest different from zero. One can then choose NT / NC or NT / NC + 1 sets of values, each being used NC or NC + 1 time.

For example, DES processing may advantageously be secured by 16 iterations composed from 8 different sets of values (1 with correct values, 7 with incorrect values), each used twice randomly from the 16 iterations. A fine observation could possibly reveal that the 16 iterations can be grouped into 8 pairs of iterations on identical data, but without however being able to determine which of these pairs corresponds to the correct data. . _

In practice, it is good to combine this method with other countermeasures in order to make each of the iterations different, even when they relate to equal values, for example by inserting random delays in each iteration.

To make similar uses that are made correct and incorrect data, one can precalculate certain information and values in an initial phase (before doing the first iteration) and make uniform later (during iterations) how to access these precalculated information and values, thus avoiding an observation that can easily distinguish them. In particular, the following pretreatments can be carried out:

• You can prepare the iteration choices: which are to be done on correct data, which are to be done on incorrect data.

• The actual values of the data to be used for the different iterations can be prepared: the set of values corresponding to the correct data, and the different sets of values corresponding to incorrect data.

• It is possible to make each iteration access the precomputed data in the same way. For this, one can for example prepare in one or more tables of the choices and / or values to be used for each of the iterations (with possible repetitions), and access these tables during iterations via the simple index of the current iteration, or a function of this index.

It becomes very difficult to know if an iteration operates on correct or incorrect data. It should be noted that the security method at the heart of the present invention can easily be combined with other security methods to increase the task of an attacker.

This combination can be carried out on two levels: another method can in fact be used, on the one hand, to secure an elementary processing (that is to say an iteration) and, on the other hand, to secure the sequence of repeated treatments. For example, a random delay can be introduced, on the one hand, among the operations of the elementary processing, which has an impact on each iteration and, on the other hand, between each iteration of the processing.

The method which is the subject of the present invention can obviously be implemented when there is full freedom on the implementation of the elementary treatment. But it can also be implemented when one does not have the control of the underlying elementary treatment, which can be the case when one uses a crypto-processor or a cryptographic library supplied by a third party. The processing means is then used as a "black box" at each iteration.

This security method can be implemented at the software level, by programming the sequence of the different iterations of an elementary processing. It can also be implemented at the hardware level, using a circuit that connects the different iterations.

Since the iterations are independent of one another, they can also occur in parallel. This parallelism makes it possible to make the process usable in cases where an elementary treatment can not be repeated too many times, otherwise the processing will be rendered unusable because it is too long in execution time. In the case of a parallel implementation, we can ensure desynchronize the different processes or processors performing the iterations, to scramble the observations and make it more difficult to distinguish different treatments.

Of course, the invention relates to the execution system implementing one or more cryptographic processes, in which some of the cryptographic processes are secured against physical attacks in accordance with the previously described method. In this execution system, the basic cryptographic computations of secure cryptographic processing can be implemented by instructions for the system processor and / or via a crypto-processor and / or via a cryptographic library provided by a third party. The sequence of different iterations of a basic cryptographic processing can be implemented at the software level or implemented at the hardware level, using a circuit that performs the iterations in sequence and / or in parallel, in a desynchronized manner.

Claims

_ .Referications

A method for securing cryptographic processing against physical attacks, characterized in that all or part of said cryptographic processing is repeated several times: one or more times on the correct data, the other times on incorrect data in order to lure an attacker, the choice of iterations made on correct or incorrect data being done randomly, and the iterations made on the incorrect data being ignored in the final result of the processing.

2. Method according to claim 1, characterized in that, in the case where the number of iterations performed on the correct data is greater than or equal to two, if the iterations performed on the correct data have fingerprints and / or results. different, then the program performs a particular treatment.

3. Method according to claim 2, characterized in that the particular processing of the program in the case where footprints and / or results of iterations differ (1) to secure certain data and / or (2) to interrupt, permanently or not, its execution and / or, when it is physically possible, (3) to warn the user of the malfunction by an audible or visual signal.

4. Method according to claim 1, characterized in that, if the cryptographic processing comprises a repeated internal algorithmic pattern, the total number of iterations Nr is equal to the number of repetitions N of said pattern, or to a multiple M of said number of N repetitions, the iterations then being grouped into N packets of M / N repetitions of the pattern. . -

5. Method according to claim 1, characterized in that the total number of iterations NT is determined according to:

- a random factor.

6. The method of claim I ₅ characterized in that the incorrect data relate only to the key data (not texts).

7. Method according to claim 1, characterized in that the incorrect data are deduced from the correct data by a transformation relating to the first and / or last key bits manipulated in the implementation of the cryptographic processing.

8. Method according to claim 1, characterized in that the incorrect data are deduced from the correct data by a random transformation preserving the observable measurements of the key data (in particular the Hamming weight).

The method according to claim 1, characterized in that, when said cryptographic processing imposes specific properties for the key data it exploits, the incorrect key data is produced from particular data stored in the system, such as to guarantee said specific properties. 006/032746 " ^z ^"

Method according to claim 1, characterized in that, if NC iterations are performed on correct data over a total of NT iterations, the iterations on incorrect data are composed from NT / NC sets of different values, each of these sets being used NC times among the NT iterations, the choice of the iterations relating to this or that set of values (correct or incorrect) remaining random.

11. Method according to claim 1, characterized in that the choices of the iterations performed on the incorrect data and / or the data values for the iterations on the incorrect data are calculated before the very first iteration.

12. Method according to claim 11, characterized in that said choices and / or said values are stored, with or without repetition, in one or more tables, and the implementation of said cryptographic processing accesses these tables via a function of the index of the current iteration.

13. The method as claimed in claim 1, characterized in that a combination with other methods of securing cryptographic processing takes place at the level of the implementation of an elementary processing and / or at the level of the implementation of the method. repetition of elementary treatments.

14. The method of claim 13, characterized in that random delays are inserted within each iteration and / or between each iteration. 006/032746 ^"ΔΌ"

15. Method according to one of claims 1 to 14, characterized in that the number of iterations on correct data NC is equal to 2 and the total number of iterations NT is defined as follows:

if the cryptographic processing comprises a DES or SEED type cryptographic calculation, then NT = 16,

if the cryptographic processing comprises a cryptographic calculation of COMP128, FEAL or IDEA type, then Nr = 8,

if the cryptographic processing comprises a cryptographic calculation of the type AES-128, AES-192 or AES-256, then Nr is respectively equal to 10, 12 or 14,

if the cryptographic processing comprises a SAFER type cryptographic calculation, then 6 ≤Nr 10 10,

if the cryptographic processing comprises a cryptographic calculation of the RC5 type, then 12 ≤ NT ≤ 16.

16. Execution system implementing one or more cryptographic processes, characterized in that some of said cryptographic treatments are secured against physical attacks in accordance with the method according to one of claims 1 to 15.

17. The execution system as claimed in claim 16, characterized in that the elementary cryptographic processes of the secure cryptographic processing are implemented by instructions for the processor of the system and / or via one or more crypto-processors and / or via a or several cryptographic libraries provided by a third party.

18. The execution system according to claim 16, characterized in that the sequence of the different iterations of a basic cryptographic processing is implemented at the software level or implemented at the hardware level using a circuit which performs the iterations in sequence and / or in parallel, and in a desynchronized manner.