JP4765609B2 - Cryptographic processing device - Google Patents

Description

  The present invention relates to a cryptographic processing apparatus. More specifically, the present invention relates to a cryptographic processing apparatus having improved resistance to power analysis known as cryptographic analysis processing and attack processing.

  In recent years, with the development of IC cards, network communication, electronic commerce, and the like, ensuring data transmission and reception using IC cards and communication via networks have become important issues. One method of ensuring security is encryption technology, and currently, communication using various encryption methods is actually performed.

  For example, an encryption processing module is embedded in a small device such as an IC card, and data is transmitted / received between the IC card and a reader / writer as a data reading / writing device, and authentication processing or encryption / decryption of transmitted / received data is performed. The system to do is put into practical use.

  In an IC card, for example, when data is exchanged with a reader / writer or a host computer, transmission / reception data is encrypted so that no problem occurs even if secret information stored in the IC card leaks in the process.

  One of the methods often used as this encryption method is DES (Data Encryption Standard). DES is a typical common key encryption algorithm. For example, an IC card as a data sender and a host computer have the same key, and the data transmission side encrypts the data with the key and transmits the data. Recipients decrypt the message with the same key and retrieve the message.

  Even if a malicious third party eavesdrops in the course of communication, it is difficult to decrypt and extract a message unless it has a key. In addition, the key used for encryption / decryption is stored in a non-volatile memory such as EEPROM in the IC card, and is directly transferred to the encryption engine in the IC card without going through the CPU during encryption / decryption. Under such control, security is maintained by adopting a configuration in which even key card owners and IC card development engineers cannot extract key data.

  However, in such a common key encryption process, there is a problem of key leakage due to cryptographic analysis. As a typical key analysis method, there is a power difference analysis (DPA: Differential Power Analysis). The current consumption of a device incorporating a cryptographic processing circuit generally varies depending on the calculation contents and secret information used for the calculation. However, changes in current consumption depending on these contents are small, and it was generally considered difficult to distinguish from measurement errors and noise.

  However, P.I. Kocher et al. Proposed a method of extracting key information by acquiring a large amount of current consumption waveforms, estimating keys, and statistically processing them. This is a technique called DPA (power difference analysis).

  In this DPA attack, an encryption operation is performed using about 1000 different plaintext patterns, and the current consumption waveform in each pattern is measured. Then, the estimated temporary key is set, and the actual applied key is analyzed by statistically processing the current consumption waveform based on the output value of the S box as the non-linear conversion unit constituting the DES encryption processing unit. To do.

  However, when the S box as the nonlinear conversion unit constituting the DES encryption processing unit is configured as a hardware logic circuit, it is difficult to directly measure the fluctuation of the output value of the S box. In this case, the change bit information at the time of data storage for the register for storing the output value from the S box is estimated from the consumption current waveform and statistical processing is performed to analyze the key.

  A configuration example of a general DES arithmetic circuit will be described with reference to the drawings. The DES encryption process has a structure for converting plaintext into ciphertext by repeating simple operations to which a conversion function called an F function is applied. FIG. 1 shows a basic configuration of DES encryption processing. The DES encryption processing configuration includes a round function unit 110 that performs conversion of input data, and a key schedule unit 120 that generates a key to be applied in each round of the round function unit.

  In the round function unit 110, the plaintext (64 bits) is first divided into 32 bits each of L and R after replacement in the initial replacement unit 111, and the divided L and R 32 bits are sent to the first-stage round function unit 112. The conversion process is performed based on the key K (1) input and input from the first-stage key generation unit 122 of the key schedule unit 120. The conversion process result is input to the second-stage round function unit 113 in the next stage.

  In the key schedule unit 120, first, the master key (secret key) replacing unit 121 removes the parity 8 bits of the input master key (secret key: 64 bits), and the remaining 56 bits are exchanged to execute the first stage. Input to the round key generation unit 122. The first-stage round key generation unit 122 executes a shift process of the input bit string and discards 8-bit data, generates a 48-bit round key K (1), and uses the generated round key K (1) as a round function. To the first round function unit 112 of the unit 110. The first-stage round key generation unit 122 outputs the higher-order bit string (28 bits) and the lower-order bit string (28 bits) obtained by the shift process to the second-stage round key generation unit 123 in the lower stage.

  The round function section has 16 round function sections, each of which executes the conversion process using the key input from the key schedule section 120 with the output of the previous round function section as an input, and converts the conversion result into the subsequent round function. To the output. The output converted by the 16-stage round function part is input to the reverse replacement part 114, the reverse replacement process of the initial replacement part 111 is executed, and output as ciphertext.

  In general, one 16-round function unit is set in terms of hardware, and this single round function unit is used repeatedly. In other words, the output of the upper stage is stored in a register, and the value stored in the register is used as the input of the round function section of the next stage. A configuration example of the round function section is shown in FIG.

In the configuration of the round function unit 150 shown in FIG. 2, the switch (SW1) is connected to the “a” side at the start of the DES calculation. When the DES operation is started, the plaintext is replaced by an initial replacement unit [IP (Initial Permutation)] 141, and then divided into two 32-bit data L ₀ and R _0, and a latch pulse (Latch) as a control timing based on the control clock. At the same time, the SW1 is switched to the “b” side.

By this data capture, the outputs of the L / R registers 151 and 152 are set to L ₀ and R ₀ , and then the F function unit 153 and the exclusive OR (XOR) unit 154 are applied based on these register stored values. The round operation is executed, and the result is input again to the L / R registers 151 and 152 via the switch (SW1).

Further, the next round operation is started by taking in the L / R registers 151 and 152 at the rising edge of the latch pulse in the next clock cycle and updating the output. After repeating this operation for 16 clock cycles, the operation result is output to the inverse permutation unit (IP ⁻¹ ) 142 to perform the inverse permutation conversion and output as ciphertext.

  A detailed configuration of the F function unit 153 is shown in FIG. The F function includes a plurality of S boxes (Sboxes) that perform nonlinear processing. The input value from the previous stage of the round function part, that is, R (n-1) is expanded to 48 bits by the extension part 171, and further, exclusive OR is performed with the key (48 bits) input from the key schedule part. The output is input to a plurality of S boxes 181-1 to 181-8 for executing nonlinear conversion processing by 6 bits. In each S box, for example, nonlinear conversion processing from 6 bits to 4 bits to which a conversion table is applied is executed.

  The output bits 4 × 8 = 32 bits from the S box 181-1 to 8 are input to the replacement unit 172, the bit position is exchanged, and the F function output 32 bits are generated and output.

  In the L / R registers 151 and 152 of the round function unit 150 shown in FIG. 2, data is rewritten every round. Each of the L / R registers 151 and 152 of the round function unit 150 stores 32-bit data. That is, data is held using two 32-bit registers.

Generally, current consumption is large when the register changes. When the current consumption waveform at the time of data rewriting for this register is acquired, the acquired current includes a current component having a correlation with a change bit at the time of register data update. For example, the calculation result [Round 1] after executing the first round calculation (Round 1) can be expressed as follows.
[Round 1]

In the above formula,
L ₀ : Stored value of register L151 before the start of round 1 R ₀ : Stored value of register R152 before the start of round 1 L ₁ : Stored value of register L151 after the end of round 1 R ₁ : Stored value of register R152 after the end of round 1 Stored value K ₁ : Round key applied to round 1 F (R ₀ , K ₁ ): A function of the F function unit 153 shown in FIG. 2 and a function based on the input value R ₀ and the round key K ₁ .

That, _{L 1} is a value stored in the first round after the end of the register L151 is _{R 1} is a stored value _{R 0,} and the Round 1 stored value after the end of the register R152 Round 1 before the start register R152, the input value The result of the exclusive OR operation (XOR) of the processing result in the F function unit 153 based on R ₀ and the round key K ₁ and the stored value L ₀ of the register L 151 before the start of round 1 is obtained.

Since the data in the L / R registers 151 and 152 before round 1 processing is “L ₀ ” and “R ₀ ”, the change bits at the time of data storage in the next clock cycle are the same as those after round 1 processing. It is obtained by performing an exclusive OR operation (XOR) with the data “L ₁ ” and “R ₁ ” of the L / R registers 151 and 152. That is, it is shown by the following formula.

  The above expressions (Expression 3) and (Expression 4) are expressions indicating change bits of the L / R registers 151 and 152 when the processing result of round 1 is stored.

In the DPA attack, about 1000 plaintexts are applied to execute a DES operation to obtain the current consumption waveform, and in the above (Equation 3), each of the eight S boxes of the round key “K ₁ ” is supported. A 6-bit key is assumed, and the consumption current waveform is statistically processed based on the key. With this process, a peak current is observed when the estimated key is correct. If this process is performed for all 8 S boxes, a 48-bit key can be obtained, and the remaining 8 bits can be obtained by 2 ⁸ = 256 exhaustive attacks.

  An outline of the key analysis process based on this statistical process will be described. First, a 6-bit key corresponding to each component (S1 to S8) of the noticed S box is estimated and a simulation is performed, and the value of the noticed node of the output corresponds to “0” or “1”. The plain current consumption waveform is divided into groups, the difference between the average currents of the consumption current waveforms of each group is taken, and the validity of the 6-bit key estimated based on the occurrence of the peak waveform is determined. Furthermore, the average of the consumption current of each group is acquired, and the consumption current waveform is added at the same timing with the clock signal input to the DES arithmetic circuit.

  If the estimated 6-bit key is correct, a minute current accompanying the change in the node of interest only in one group flows, and this is integrated. If the difference between the two groups is taken, the accumulated minute current becomes a peak waveform. Appear.

  In order to prevent the occurrence of such a peak current, it is effective to make the clock signal that actually performs the round operation in the DES operation circuit asynchronous with the clock signal input to the DES operation circuit. With such a setting, since the minute current of interest is not integrated at the same timing, no peak current is generated. Specifically, an oscillator having a frequency higher than that of the clock supplied to the DES arithmetic circuit is mounted, and the DES arithmetic is executed with a clock obtained by retiming the clock supplied to the DES arithmetic circuit with the clock. Occurrence can be prevented.

  However, when the round operation of the DES operation is executed, a large current accompanying the operation of the arithmetic circuit flows immediately after the start of the round operation, but does not flow thereafter. This is repeated for each round operation. Therefore, if the differential analysis of the current consumption waveform is performed for each plaintext and the addition process is performed at the steep timing of the rise of the current consumption waveform, the minute current of interest can be accumulated at almost the same timing. Processing may be possible.

  In addition to the above-described control of the clock signal, for example, a countermeasure that makes it difficult to perform differential analysis of the consumption current waveform by superimposing a noise current controlled by a random number has been proposed. However, even if such countermeasures are taken, if a DEMA (Differential Electro Magnetic Analysis) attack that can acquire changes in a local region is applied, it is not affected by noise current components controlled by random numbers. The signal can be acquired, and as a result, the key can be acquired.

  If the calculation result is stored bit by bit with a clock that has no correlation with the clock supplied to the DES calculator, the generation timing of the storage current is shifted and statistical processing becomes difficult. For example, when a 4-bit operation result of the component “S1” of the S box of the round key “K1” applied to round 1 in the 16-stage round operation constituting the DES operation is stored in the register at random timing The current accompanying the storage of each bit is also generated at random timing, and even if the statistical processing based on the correct estimation key is performed, the minute storage current at the focused bit is not integrated. For this reason, the DPA attack fails.

  This method is effective when the calculation time requirement is not strict. However, in this case, if the register value changes according to the first stored bit in the 4-bit operation result of “S1”, the round function executes the operation based on the changed value, so the first stored bit If the time difference between the last stored bit is longer than the operation time of the round function, the last stored bit value is changed and an incorrect value is stored, so that a normal DES operation cannot be performed. is there.

  The present invention has been made in view of the above-described problems, and does not complicate the processing algorithm, and does not make the processing circuit very large, so that the current consumption waveform associated with the regular processing of the cryptographic processing sequence can be reduced. An object of the present invention is to provide a cryptographic processing device that can increase the difficulty of cryptographic analysis by power analysis based on statistical processing.

Specifically, the present invention provides a cryptographic processing apparatus that has improved resistance to DPA attacks by controlling data storage timing for a register that stores the result of a 16-stage round operation executed in DES cryptographic processing. There is provided a cryptographic processing device that makes it difficult to perform statistical processing for DPA attacks by randomly controlling the register storage timing of operation results for each bit, and that can output correct operation results. Objective. To achieve this goal, for example,
Control register master and slave with different clocks,
Each of the individual components “S1” to “S8” of the S box is stored in a 4-bit output register with a plurality of different timing clocks.
By such processing, an encryption processing apparatus having improved resistance to DPA attacks is provided.

The first aspect of the present invention is:
A cryptographic processing device that performs cryptographic processing computation including repetition processing of multiple round computations,
A round calculation unit for performing round calculation;
A register for storing the round operation result of each round;
A clock signal generating section for generating a clock signal for controlling data storage timing for the register, and outputting to the register;
The clock signal generator is
A cryptography having a configuration in which a plurality of different clock signals having different timings are generated, and the generated plurality of different clock signals are selectively input to a plurality of bit data storage register circuits constituting the register. In the processing unit.

Furthermore, in one embodiment of the cryptographic processing apparatus of the present invention, the register is configured to have two latches, a master and a slave, and the clock signal generation unit is a set of control clocks for the master and slave of the register. As
(CLK1-1, CLK2-1) to (CLK1-n, CLK2-n)
The n clock sets are generated and selectively input as master and slave control clocks for a plurality of bit data storage register circuits constituting the register.

  Furthermore, in one embodiment of the cryptographic processing apparatus of the present invention, the clock signal generation unit is configured to hold a data input timing from the master to the slave as a set of control clocks for the master and slave of the register. A clock set set to be delayed from the start timing is generated and input to the master and slave of the register.

  Further, in one embodiment of the cryptographic processing device of the present invention, the clock signal generation unit is a set of control clocks for the master and slave of the register, as a non-linear conversion unit for the S box included in the round operation unit. It is configured to generate a set of four types of clocks corresponding to the output 4 bits of each component (S1 to S8) and to input to the master and slave of the plurality of bit data storage register circuits constituting the register. Features.

  Furthermore, in one embodiment of the cryptographic processing device of the present invention, the clock signal generation unit generates a plurality of clock signals having different timings based on a system clock applied in the cryptographic processing device and an output of the oscillation circuit. It is characterized by having.

  Furthermore, in one embodiment of the cryptographic processing apparatus of the present invention, the round operation unit has an S box as a non-linear conversion unit, and the register has result data of round operation processing including non-linear conversion processing by the S box. It is the structure which stores.

  Furthermore, in one embodiment of the cryptographic processing apparatus of the present invention, the cryptographic processing apparatus is configured to execute cryptographic processing calculation in accordance with a DES (Data Encryption Standard) algorithm.

  Other objects, features, and advantages of the present invention will become apparent from a more detailed description based on embodiments of the present invention described later and the accompanying drawings. In this specification, the system is a logical set configuration of a plurality of devices, and is not limited to one in which the devices of each configuration are in the same casing.

  According to the configuration of the present invention, a cryptographic processing device that increases the difficulty of cryptographic analysis by power analysis based on statistical processing of current consumption waveforms accompanying regular processing of cryptographic processing sequences without complicating the processing algorithm Is realized.

  In the configuration of the present invention, for example, in a cryptographic processing apparatus that executes a cryptographic algorithm including a repetition process of a plurality of round operations such as DES, a clock signal for controlling the data storage timing for a register that stores the result of the round operation is The master and slaves constituting the clock are different clocks (CLK1, CLK2), and further, for example, a plurality of clock signal groups (CLK1-1, CLK1-2) to (timed) by retiming with the output of the oscillator. CLK2-n, CLK2-n) are generated and selectively supplied to a master and a slave as a register configuration circuit, thereby realizing bit data capture at different timings. With this configuration, it is possible to realize a cryptographic processing apparatus that is highly resistant to DPA attacks by statistical processing of current consumption.

  Details of the cryptographic processing apparatus of the present invention will be described below. The present invention is a cryptographic processing apparatus that executes a cryptographic algorithm including a repetition process of a multi-stage round function typified by, for example, a DES (Data Encryption Standard) algorithm. The object is to provide a circuit configuration having (DPA) tolerance.

  As described above with reference to FIGS. 1 to 3, the circuit that executes the DES arithmetic processing includes a circuit that repeatedly executes a multi-stage (16-stage) round function. Normally, when designing an execution circuit for a DES calculation flow, one function execution circuit that executes a 16-stage round function is formed and repeatedly operated 16 times.

  The conventional general round function unit has the configuration described with reference to FIG. 2, and as described above, the calculation result of the 16-stage round operation executed in the DES encryption process is two 32-bit registers ( They are stored in the L register 151 and the R register 152) shown in FIG. Each register has a circuit that holds 1-bit data constituting 32 bits, specifically, a D-type flip-flop constituted by, for example, a latch circuit, and holds 32 bits in 32 D-type flip-flops. It is configured.

  FIG. 4 shows a register circuit configuration including a general 1-bit data holding D-type flip-flop applied to a conventional register. The circuit shown in FIG. 4A has a register circuit configuration including a general master-slave D-type flip-flop for holding 1-bit data, which is applied to a conventional register, and includes a latch 1 (master) and a latch 2. (Slave).

  4B is a clock signal generation circuit that generates a clock signal to be input to the register circuit shown in FIG. 4A, and FIG. 4C is a circuit symbol (D) corresponding to the register circuit shown in FIG. Type flip-flop). FIG. 5 shows an operation timing chart of the register circuit shown in FIG.

  The operation of the register circuit shown in FIG. 4A will be described with reference to FIGS. Since the clock signal “ck” is Low and “xck” is High while the input clock “CLK_in” is Low, the transfer gates “TRN1” and “TRN4” in the register circuit shown in FIG. ON, “TRN2” and “TRN3” are turned OFF. At this time, the value of the register input value “D_in” is input to the latch 1 and the value fetched immediately before is held and output to the latch 2. This is the state up to time t1 shown in FIG.

  In this state, at the time t1 shown in FIG. 5, at the moment when the input clock “CLK_in” is switched to High, “ck” is changed to High and “xck” is changed to Low, so that the transfer gates “TRN1” and “TRN4” are changed. Since it is turned OFF and "TRN2" and "TRN3" are turned ON, the value of the input value "D_in" is held in the latch 1, and the value held in this latch 1 passes through the latch 2 and is "Q" And “/ Q”. At this time, if the value of “D_in” is different from the value held in the latch 2, a current flows when driving the latch 2 and the load node ahead. That is, a current flows when data rewrite (1 → 0) or (0 → 1) occurs in a register, and this becomes a minute current that is statistically processed by a DPA attack.

  Next, a register circuit configuration and operation according to the present invention will be described with reference to FIGS. In the cryptographic processing apparatus according to the present invention, when registering the result data of the round operation, the register storage timing of the fetch bits is not uniform, but the processing of storing the timings in a distributed manner is executed. As described above with reference to FIG. 2, in the DES encryption process, 16 round operations are repeatedly executed, and the operation result data of each round is 32 bits for each round, as shown in FIG. , And stored in the R register 152. In the cryptographic processing apparatus of the present invention, in the register storage processing of the result data of the round operation, 32 bits are not stored at the same timing but are stored at different timings. For example, four different timings are set, and 8 bits are stored at four timings. By this timing control, the current generated by the bit change at the time of storing data in the register is diffused, and the resistance against the DPA attack is enhanced.

  The circuit shown in FIG. 6A has a register circuit configuration according to the present invention that executes the above-described processing, and is a register circuit that executes storage of 1-bit data similar to that shown in FIG. As described above, the calculation result of the 16-stage round operation executed in the DES encryption process is stored in two 32-bit registers (L register 151 and R register 152 shown in FIG. 2). Each register has a circuit for holding 32-bit data and has 32 circuits shown in FIG.

  The register circuit shown in FIG. 6A has a master-slave D-type flip-flop as a basic configuration, similar to the circuit configuration described above with reference to FIG. 4A, and includes latch 1 (master) and latch 2 (Slave), but the input clock signal is set differently for the master and slave.

  6B corresponds to the clock signal generation circuit that generates the clock signal to be input to the register circuit shown in FIG. 4A, and FIG. 6C corresponds to the register circuit shown in FIGS. 6A and 6B. Circuit symbols are shown. FIG. 7 shows an operation timing chart of the register circuit shown in FIG.

  The operation of the register circuit shown in FIG. 6A will be described with reference to FIGS. As described above, the register circuit shown in FIG. 6A uses two clocks “CLK1_in” and “CLK2_in” unlike the configuration described with reference to FIG.

  The clock “CLK1_in” is input to the master (latch 1), the clock “CLK2_in” is input to the slave (latch 2), and the respective latch circuits (latch 1 and latch 2) are controlled by the respective clocks. Is made.

  As shown in FIG. 7, the timing of the two clocks “CLK1_in” and “CLK2_in” rises first, followed by a predetermined time, and then “CLK2_in” rises. In the example shown in FIG. 7, the falling is the same timing, but it is not necessary to have the same timing.

  The clock setting condition in this embodiment is that the rising edge of “CLK2_in” input to the slave (latch 2) is later than or the same timing as the rising edge of the clock “CLK1_in” input to the master (latch 1), and “ This means that the falling edge of “CLK2_in” is earlier than or the same as the falling edge of CLK1_in ”. That is, the clock signal generation unit in the cryptographic processing device of the present invention is a clock that is set so that the data input timing from the master to the slave is delayed from the data holding start timing in the master as a set of control clocks for the master and slave of the register. Are generated and input to the master and slave of the register.

  In a period when both of the input clocks “CLK1_in” and “CLK2_in” are Low, for example, t0 to t1, t3 to t4, etc. shown in FIG. Therefore, the transfer gates “TRN1” and “TRN4” shown in FIG. 6A are turned on, “TRN2” and “TRN3” are turned off, and the value of the input value “D_in” is input to the latch 1 and latch 2 Is set to a state in which the value fetched immediately before is held and output.

  For example, the time before time t4 shown in FIG. 7 corresponds to this state, the value [D1] of the input value “D_in” is input to the latch 1, the input value of the latch 1 is [D1], and the latch 2 Is set to a state [Q = D0] in which the value [/ D0] fetched immediately before is held and output.

  In this state, at the moment when the input clock “CLK1_in” switches to High, “ck1” changes to High and “xck1” changes to Low, so that the transfer gate “TRN1” is turned OFF, “TRN2” is turned ON, and the input value “ The value of D_in "is held in the latch 1.

  For example, the time t4 shown in FIG. 7 corresponds to this state, and the value [D1] of the input value “D_in” is set in the latch 1 as the hold value. During the period (t4 to t6) when the input clock “CLK1_in” is High, the hold value of the latch 1 is fixed.

  Next, at the moment when the input clock “CLK2_in” switches to High, “ck2” changes to High and “xck2” changes to Low, so that the transfer gate “TRN4” is turned OFF and “TRN3” is turned ON and held in the latch 1 The value of “D_in” being supplied is supplied to the latch 2 and the value of the latch 2 is changed to “D_in”, and is output to “Q”, “/ Q” and its load.

  For example, the time t5 shown in FIG. 7 corresponds to this state, the value [D1] of “D_in” held in the latch 1 is supplied to the latch 2, and the value of the latch 2 changes to “D_in”. The hold value is output to “Q”, “/ Q” and its load (Q = D1, / Q = / D1).

  At this time, when the value of the input value “D_in” is different from the value held in the latch 2, that is, when the stored bit value becomes (0 → 1) or (1 → 0), statistical processing is performed by the DPA attack. A small current is generated, and calculation of the F function is started at this timing.

  Next, referring to FIG. 8 and FIG. 9, clock signals “CLK1” and “CLK2 comprising two different timing pulses input to the master and slave latches of the register circuit having the master-slave type flip-flop configuration of the present invention. An example of the configuration of the generation circuit will be described. FIG. 8 shows a clock signal generation circuit, and FIG. 9 shows a timing chart corresponding to the clock signal generation circuit shown in FIG.

  In this example, the frequency of the clock in the DES is about half that of the system clock “SYS_CLK” supplied to the DES cryptographic processing apparatus. The other oscillation signal “OSC” supplied to this circuit is a clock signal which is asynchronous with “SYS_CLK” supplied from the internal oscillation circuit and has a frequency several times as shown in FIG.

  With this oscillation signal “OSC”, “SYS_CLK” is subjected to timing change processing by the first D-type flip-flop (DFF1), and outputs a retimed clock signal “CLK”. This is the clock (CLK) shown in FIG.

Further, a signal divided by two is generated in a second D-type flip-flop (DFF2) as a frequency dividing circuit. The "/ Q" output of this frequency divider (DFF2) is shown in FIG.
“NO” of the clock signal “CLK” re-timed with the “Q” output (DFF2: Q shown in FIG. 9) of the frequency divider circuit becomes “CLK2” shown in FIG.

  As shown in FIG. 9, these two clock signals (CLK1, CLK2) are clock signals that satisfy the clock setting conditions in the present embodiment described above with reference to FIG. That is, two clock signals whose rising edge of “CLK2” is later than or the same timing as the rising edge of clock “CLK1” and whose falling edge of “CLK2” is earlier or the same timing than the falling edge of “CLK1” Become. These two clock signals are clock signals input to the master latch and slave latch of the register circuit shown in FIG.

  In the cryptographic processing apparatus of the present invention, as described above, in the register storing process of the round operation result data, 32 bits are not stored at the same timing, but are stored at different timings. For example, four different timings are set, and 8 bits are stored at four timings. Hereinafter, as a specific embodiment, a configuration example in which processing is performed for fetching all four bits of the output of each component (“S1” to “S8”) of the S box in the F function of the DES arithmetic circuit into the register at different timings. Will be described. By this timing control, the current generated by the bit change at the time of storing data in the register is diffused, and the resistance against the DPA attack is enhanced.

A configuration for performing processing for fetching all four bits of the output of each component (“S1” to “S8”) of the S box in the F function of the DES arithmetic circuit into the register at different timings will be described below. As shown in FIG. 10, combinations of clock signals with different timings are generated by supplying signals “OSC1” to “OSC4” from four different frequency oscillation circuits to the same four circuits. That is,
(A) CLK1-1, CLK1-2
(B) CLK2-1 and CLK2-2
(C) CLK3-1, CLK3-2
(D) CLK4-1, CLK4-2
A combination of these four different clock signals is generated and the four bits (a) to (d) of these four clock signals are stored in the 4 bits of the output of each component of the S box ("S1" to "S8"). It is set to supply to the register circuit to be operated, that is, the register circuit having the master-slave type flip-flop configuration shown in FIGS. For example, combinations of clock signals having different rising and falling timings are generated as in the clock signals (a) to (d) shown in FIG.

  As previously described with reference to FIGS. 2 and 3, in the F function 153 in the DES arithmetic circuit shown in FIG. 2, after the non-linear replacement by the S box, the replacement circuit (the replacement shown in FIG. 3) is performed. Unit 172) executes substitution based on the table, which is used as an F function output. After that, as described with reference to FIG. 2, the exclusive OR operation (F) of the F function output and the L register 151 is performed. XOR) is executed in the exclusive OR operation unit 154, and the operation result is stored in the R register 152.

  As the table applied to the replacement process based on the table in the replacement unit 172 illustrated in FIG. 3, the table illustrated in FIG. 12 is applied. The table shown in FIG. 12 is a table for exchanging the bit string order of the 32-bit output of S1 to S8 that outputs 4 bits each. For example, the first bit of S1 in the S box is set to the ninth bit in the 32 bits of the F function output, and the second bit of S1 of the S box is the 17th bit in the 32 bits of the F function output. And the first bit of S2 of the S box is set to the thirteenth bit in the 32 bits of the F function output. After the position of the 32-bit S box output is replaced by this table, an exclusive OR operation (XOR) with the L register 151 is executed in the exclusive OR operation unit 154, and the operation result is stored in the R register 152. The

In the configuration of the present invention, the 32-bit data for the R register is divided into four, and each storage timing is controlled by the combination of the four different clock signals described above. Various combinations can be applied for the setting of this combination, and an example will be described below. For example, the S box output of the table shown in FIG. 12 is an output of 4 bits each of S1 to S8,
(A) 1st bit of S1-S8 (b) 2nd bit of S1-S8 (c) 3rd bit of S1-S8 (d) 4th bit of S1-S8 First, in correspondence with the four clock signal sets (a) to (d) described with reference to FIGS. 10 and 11, these exclusive OR operation results are stored in the R register and output timing is controlled. Apply.

FIG. 13 shows a correspondence table of clock signals to be applied and input bit positions for the R register when these four timing sections are set. The table shown in FIG.
(A) CLK1-1, CLK1-2
Is applied to the 9th, 13th, 24th, 26th, 8th, 4th, 32nd and 5th bit fetch timings stored in the R register,
(B) CLK2-1 and CLK2-2
Is applied to the 17, 28, 16, 20, 14, 29, 12, 27th bit storage timing stored in the R register,
(C) CLK3-1, CLK3-2
Is applied to the 23, 2, 30, 10, 25, 11, 22, and 15th bit storage timings stored in the R register,
(D) CLK4-1, CLK4-2
Is applied to the 31st, 18th, 6th, 1st, 3rd, 19th, 7th and 21st bit storage timings stored in the R register.

That is, the storage timing of 8 bits, which is the first bit of S1 to S8 of the S box output shown in FIG. 12, is (a) CLK1-1, CLK1-2,
The storage timing of the 8th bit which is the second bit is (b) CLK2-1 and CLK2-2,
The storage timing of 8 bits as the third bit is (c) CLK3-1, CLK3-2,
The storage timing of the fourth bit, which is 8 bits, is set to (d) CLK4-1 and CLK4-2.

  FIG. 14 shows a processing circuit configuration example for executing the R register storing process at such four kinds of clock timings. 14A shows an exclusive OR (XOR) operation between the output of the F function unit and the L register stored data. That is, the calculation processing in the exclusive OR calculation unit 154 of the output of the F function unit 153 and the output of the L register 151 in the circuit configuration of FIG. For example, the leftmost operation of (a) XOR operation shown in FIG. 14 is an exclusive OR operation of the first bit in the output of the F function in the F function portion and the first bit of the L register. The output from the F function is switched in the order shown in the table shown in FIG. 12, and the first bit of the S box output is the fourth bit of S4 as understood from the table shown in FIG. is there.

  FIG. 14B shows the first clock signal of the set of four types of clock signals described above, that is, the four types of clock signals input to the master latch described with reference to FIG. FIG. 14C shows an R register, which has a configuration in which 32 master-slave flip-flops described above with reference to FIG. 6A are arranged, and can store 32-bit data. It is a bit register.

  Each exclusive OR operation result calculated in FIG. 14A becomes the input value [D_in] described with reference to FIGS. 6 and 7, and this input value is taken into the 32-bit register. The register has a master-slave type flip-flop configuration as described with reference to FIG. 6, and the data storage and holding timing on the master side is controlled by the clock 1 as described with reference to FIG. The data storage and holding timing on the slave side is controlled by the clock 2.

  First, four different timings CLK1-1 to CLK4-1 shown in FIG. 14B are applied to the input value [D_in] corresponding to the exclusive OR operation result shown in FIG. As described with reference to FIG. 5, the data is separated into 8-bit sets and stored in the R register at four different timings.

  That is, the ninth, thirteenth, twenty-fourth, twenty-sixth, eighth, fourth, thirty-second, and fifth bits are stored according to the control timing defined by CLK1-1, and the seventeenth, twenty-eighth, twenty-eighth, according to the control timing defined by CLK2-1. The 16th, 20th, 14th, 29th, 12th and 27th bits are stored, and the 23rd, 2nd, 30th, 10th, 25th, 11th, 22nd and 15th bits are stored according to the control timing specified by CLK3-1. In accordance with the control timing specified by CLK4-1, the 31st, 18th, 6th, 1st, 3rd, 19th, 7th and 21st bits are stored.

  This capture timing corresponds to the rising timing of CLK1 such as times t1 and t4 shown in FIG. At this time, since CLK1-2 to CLK4-2 are not changed, the latch value of each slave (latch 2) of the register and its output do not change. Accordingly, the result of the round operation does not change during this period. Thereafter, at the rising edge of CLK1-2 to CLK4-2, the value of the master (latch 1) is taken into the slave (latch 2) by the corresponding bit of the R register, and the output of the load changes.

  That is, the change in the value of the slave latch also occurs at different timings by applying four different timings CLK1-2 to CLK4-2 shown in FIG.

  Accordingly, when the bit data of the slave latch is changed, a current corresponding to the bit change flows. At this time, the output bits of the components of the S box ("S1" to "S8") change by 1 bit each at the rising edge of CLK1-2 to CLK4-2. The order of change is not constant because it is determined by the retiming in “OSC1” to “OSC4” described above with reference to FIG. For this reason, since each bit of each S box component changes asynchronously with the input clock in an arbitrary order, it is difficult to align the timing of the change currents of specific bits of the S box component of interest. The DPA attack based on the current analysis at the time of bit fetching to the R register becomes difficult. With these timing controls, the current generated due to the bit change when data is stored in the register is diffused, and the resistance to the DPA attack is enhanced. When the output of the slave of the R register is updated, the calculation of the F function of the next round is executed with the updated value.

  Note that the same processing is applied when data is taken into the L register. As understood from the circuit configuration shown in FIG. 2, the L register stores the value (32-bit data) stored in the R register in the previous round operation as it is.

The same control as the fetch timing for the R register is executed for the fetch timing of these 32-bit data. FIG. 15 shows a correspondence table of clock signals to be applied and input bit positions for the L register when setting the data storage timing division for the L register. The table shown in FIG. 15 has the same configuration as the table shown in FIG.
(A) CLK1-1, CLK1-2
Is applied to the 9th, 13th, 24th, 26th, 8th, 4th, 32nd and 5th bit fetch timings stored in the L register,
(B) CLK2-1 and CLK2-2
Is applied to the 17, 28, 16, 20, 14, 29, 12, 27th bit fetch timing stored in the L register,
(C) CLK3-1, CLK3-2
Is applied to the 23rd, 2nd, 30th, 10th, 25th, 11th, 22nd, and 15th bit fetch timings stored in the L register,
(D) CLK4-1, CLK4-2
Is applied to the 31st, 18th, 6th, 1st, 3rd, 19th, 7th and 21st bit fetch timings stored in the L register.

  FIG. 16 shows a processing circuit configuration example for executing the L register fetching process at such four types of clock timings. (A) is 32-bit data output from the R register, (b) is four types of control clocks CLK1-1 to CLK1-4 input to the master latch of the L register, (c) is the L register, and (d) is , Four types of control clocks CLK2-1 to CLK2-4, (e), which are input to the slave latch of the L register, indicate output bits of the register.

  Similarly to the data storage process for the R register, the data storage process for the L register is executed at different clock timings, and the generated current accompanying the bit change when data is stored in the register is diffused. Increases resistance to attacks.

As described above, in the cryptographic processing device configuration of the present invention, the clock input to the register storing the round operation result is set as different clocks (CLK1, CLK2) for the master and the slave, and these clocks are further set. A set of multiple clock signals having multiple timings by retiming the system clock with the output clock of the oscillator, for example,
(A) CLK1-1, CLK1-2
(B) CLK2-1 and CLK2-2
(C) CLK3-1, CLK3-2
(D) CLK4-1, CLK4-2
Are generated and selectively supplied to a latch as a register configuration circuit to implement bit data capture at different timings. As described above, this configuration can be realized by adding simple logic, thereby realizing a configuration in which the DPA attack is virtually impossible.

  In the case where the cryptographic processing apparatus includes an oscillation circuit for generating random numbers, the output of the oscillation circuit can be applied as the OSC signal described above with reference to FIG. With this setting, it is possible to realize a configuration that makes DPA attack impossible with almost no increase in circuit scale.

  Finally, a configuration example of the IC module 600 as a device that executes the above-described encryption processing will be described with reference to FIG. The above-described processing can be executed in, for example, various information processing apparatuses such as a PC, an IC card, a reader / writer, and the IC module 600 shown in FIG. 6 can be configured in these various devices.

  A CPU (Central processing Unit) 601 shown in FIG. 6 performs encryption processing start and end, data transmission / reception control, data transfer control between each component, switching control of each switch described above, and other various programs. The processor to execute. The memory 602 is a ROM (Read-Only-Memory) that stores a program executed by the CPU 601 or fixed data as an operation parameter, a program executed in the processing of the CPU 601, and a parameter storage area that changes as appropriate in the program processing, It consists of RAM (Random Access Memory) used as a work area. The memory 602 can be used as a storage area for key data and the like necessary for encryption processing. The data storage area is preferably configured as a memory having a tamper resistant structure.

  The cryptographic processing unit 603 is a cryptographic processing unit that executes a cryptographic algorithm including a repetition process of a plurality of round functions such as the DES algorithm described above. The oscillation circuit 604 is an oscillation circuit that generates a plurality of signals having different frequencies described above with reference to FIGS. An oscillation circuit included in the random number generator may be applied.

  The transmission / reception unit 605 is a data communication processing unit that performs data communication with the outside. For example, the data transmission / reception unit 605 performs data communication with an IC module such as a reader / writer, and outputs ciphertext generated in the IC module or an external reader. Data input from devices such as writers is executed.

  The clock signal generation unit 607 generates a plurality of clock signals applied in the register storage processing in the encryption processing unit 603 and supplies the generated clock signals to the round operation result storage register in the encryption processing unit 603.

  The present invention has been described in detail above with reference to specific embodiments. However, it is obvious that those skilled in the art can make modifications and substitutions of the embodiments without departing from the gist of the present invention. In other words, the present invention has been disclosed in the form of exemplification, and should not be interpreted in a limited manner. In order to determine the gist of the present invention, the claims section described at the beginning should be considered.

  Note that the various processes described in the specification are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Further, in this specification, the system is a logical set configuration of a plurality of devices, and the devices of each configuration are not limited to being in the same casing.

  According to the configuration of the present invention, a cryptographic processing device that increases the difficulty of cryptographic analysis by power analysis based on detection of fluctuations in current consumption associated with regular processing of cryptographic processing sequences without complicating the processing algorithm Is realized.

  In the configuration of the present invention, for example, in a cryptographic processing apparatus that executes a cryptographic algorithm including a repetition process of a plurality of round operations such as DES, a clock signal for controlling the data storage timing for a register that stores the result of the round operation is The master and slaves constituting the clock are different clocks (CLK1, CLK2), and further, for example, a plurality of clock signal groups (CLK1-1, CLK1-2) to (timed) by retiming with the output of the oscillator. CLK2-n, CLK2-n) are generated and selectively supplied to a master and a slave as a register configuration circuit, thereby realizing bit data capture at different timings. With this configuration, it is possible to realize a cryptographic processing apparatus that is highly resistant to DPA attacks by statistical processing of current consumption.

It is a figure which shows the basic composition of a DES encryption process. It is a figure which shows the structure of the round function part which comprises each round of a round function part. It is a figure which shows the structure of F function. It is a figure which shows the general register circuit structure in a cryptographic processing apparatus. FIG. 5 is a diagram showing a timing chart in the register circuit shown in FIG. 4. It is a figure which shows the register circuit structure based on one Example of the encryption processing apparatus of this invention. FIG. 7 is a diagram showing a timing chart corresponding to the register circuit shown in FIG. 6. It is a figure explaining the structural example of the clock signal generation circuit which concerns on one Example of the encryption processing apparatus of this invention. FIG. 9 is a diagram illustrating a timing chart corresponding to the clock signal generation circuit illustrated in FIG. 8. It is a figure explaining the structural example of the clock signal generation circuit which concerns on one Example of the encryption processing apparatus of this invention. FIG. 11 is a diagram illustrating a timing chart corresponding to the clock signal generation circuit illustrated in FIG. 10. It is a figure which shows the replacement table applied to the replacement process in F function part. FIG. 4 is a table for setting data storage timing divisions for an R register, and is a diagram showing a correspondence table between clock signals and input bit positions for the registers. It is a figure which shows the example of a processing circuit structure which performs R register storing process in four types of clock timings. FIG. 4 is a table for setting data storage timing divisions for an L register, and is a diagram showing a correspondence table between clock signals and input bit positions for the registers. It is a figure which shows the example of a processing circuit structure which performs the L register storing process in four types of clock timings. It is a figure which shows the structural example of IC module as a cryptographic processing execution device which can apply the structure of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 110 Round function part 111 Initial replacement part 112,113 Conversion part 114 Reverse replacement part 120 Key schedule part 121 Master key (secret key) replacement part 122,123 Key generation part 141 Initial replacement part 142 Reverse replacement part 150 Round function part 151 L Register 152 R Register 153 F Function Unit 154 Exclusive OR Operation (XOR) Unit 171 Expansion Unit 172 Replacement Unit 181 S Box 600 IC Module 601 CPU (Central Processing Unit)
602 Memory 603 Encryption processing unit 604 Oscillation circuit 605 Transmission / reception unit 606 Clock 607 Clock signal generation unit

Claims (7)

A cryptographic processing device that performs cryptographic processing computation including repetition processing of multiple round computations,
A round calculation unit for performing round calculation;
A register for storing the round operation result of each round;
A clock signal generating section for generating a clock signal for controlling data storage timing for the register, and outputting to the register;
The clock signal generator is
A cryptography having a configuration in which a plurality of different clock signals having different timings are generated, and the generated plurality of different clock signals are selectively input to a plurality of bit data storage register circuits constituting the register. Processing equipment. The register is
A configuration having two latches, a master and a slave,
The clock signal generator is
As a set of control clocks for the master and slave of the register,
(CLK1-1, CLK2-1) to (CLK1-n, CLK2-n)
2. The configuration according to claim 1, wherein a set of n clocks is generated and selectively input as control clocks for a master and a slave of a plurality of bit data storage register circuits constituting the register. Cryptographic processing equipment. The clock signal generator is
As a set of control clocks for the master and slave of the register,
3. The configuration according to claim 2, wherein a set of clocks set so that a data input timing from the master to the slave is delayed from a data holding start timing in the master is generated and input to the master and slave of the register. The cryptographic processing device described. The clock signal generator is
As a set of control clocks for the master and slave of the register,
A plurality of bit data constituting the register by generating a set of four types of clocks corresponding to the output 4 bits of each of the components (S1 to S8) as the nonlinear conversion unit of the S box included in the round operation unit 3. The encryption processing apparatus according to claim 2, wherein the encryption processing apparatus is configured to input to a master and a slave of a storage register circuit. The clock signal generator is
2. The cryptographic processing apparatus according to claim 1, wherein the cryptographic processing apparatus is configured to generate a plurality of clock signals having different timings based on a system clock applied in the cryptographic processing apparatus and an output of the oscillation circuit. The round calculation unit has an S box as a nonlinear conversion unit,
The cryptographic processing apparatus according to claim 1, wherein the register is configured to store result data of a round operation process including a non-linear conversion process by the S box. The cryptographic processing device includes:
The cryptographic processing apparatus according to claim 1, wherein the cryptographic processing apparatus is configured to execute a cryptographic processing operation in accordance with a DES (Data Encryption Standard) algorithm.

Images