Search

Establishing a strong link between the paper medium and the data represented on it is an interesting alternative to defeat unauthorised copy and content modification attempts. Many applications would benefit from it, such as show tickets, contracts, banknotes or medical prescripts. In this study, the authors present a low-cost solution that establishes such a link by combining digital signatures, physically unclonable functions and fuzzy extractors. The proposed protocol provides two levels of security that can be used according to the time available for verifying the signature and the trust in the paper holder. In practice, this solution uses ultra-violet fibres that are poured into the paper mixture. Fuzzy extractors are then used to build identifiers for each sheet of paper and a digital signature is applied to the combination of these identifiers and the data to be protected from copy and modification. The authors additionally provide a careful statistical analysis of the robustness and amount of randomness reached by the extractors. The authors conclude that identifiers of 72 bits can be derived, which is assumed to be sufficient for the proposed application. However, more randomness, robustness and unclonability could be obtained at the cost of a more expensive process, keeping exactly the same methodology., Anglais

Every security design involves choosing adequate parameters. When dealing with cryptography, one of the most important choices is the length of the key to be used. Such emphasis comes from Kerckhoffs' principle stating that ``the security must only rely on the key'' while the system should be considered public knowledge. This is indeed the case for our public standards, anyone can access their specifications. However, in those standards, no information is given about how to choose the key length given an application's security requirements. Using overwhelming large keys in order to work on the safe side is not the way to go as it crushes performances, especially for asymmetric schemes. A commonly used solution is to use recommendations from known and famous organizations, like the NIST or ECRYPT. Another option is to use the mathematical model proposed by Lenstra and Verheul to derive a key length corresponding to a desired security margin. Questions related to the appropriate selection of keys are at the basis of the work contained in this dissertation. First, we made the proposal of Lenstra and Verheul available on www.keylength.com, together with other recommendations. Afterwards, we pointed out that Lenstra and Verheul's analysis is based on software data points only. Therefore, we decided to introduce a new data point for hardware in order to compare it with software. For this purpose, we mounted an attack against an elliptic curve discrete logarithm problem using a cluster of low-cost FPGAs. Then, we noted that only mathematical attacks were considered, that is without taking into account any implementation defect of which an attacker could take advantage. Such a defect led to the now largely studied side-channel and fault attacks. We explored the potential threatd fault attacks really represent and dealt with the more pernicious kinds of fault attacks that aim at disturbing the public elements used in discrete logarithm based schemes. Finally, we studied how, (FSA 3) -- UCL, 2009

This paper presents an updated implementation of the advanced encryption standard (AES) on the recent Xilinx Virtex-5 FPGAs. We show how a modified slice structure in these reconfigurable hardware devices results in significant improvement of the design efficiency. In particular, a single substitution box of the AES can fit in 8 FPGA slices. We combine these technological changes with a sound intertwining of the round and key round functionalities in order to produce encryption and decryption architectures that perfectly fit with the digital cinema initiative specifications. More generally, our implementations are convenient for any application requiring Gbps-range throughput., Anglais

Many cryptosystems suffer from fault attacks when implemented in physical devices such as smart cards. Fault attacks on secret key elements have successfully targeted many protocols relying on the elliptic curve discrete logarithm problem (ECDLP), the integer factorization problem (IFP) or the discrete logarithm problem (DLP). More recently, faults attacks have also been designed against the public- key elements of ECDLP and IFP-based schemes. In this paper, we present the first fault attacks on the public key elements of DSA and ElGamal, two DLP-based signature schemes. Our attacks fully recover a 160-bit DSA secret key and a 1024-bit ElGamal secret key with ~ 4-10/sup 7/ and ~ 3-10/sup 6/ faulty signatures respectively. Such figures might suggest that DLP-based schemes are less prone to fault attacks than ECDLP- and IFP-based schemes. However, the integrity of public keys should always be checked in order to thwart such attacks since improvements may reduce the required amount of faulty signatures in the near future., Anglais

Elliptic curve cryptography (ECC) has gained increasing acceptance in the industry and the academic community and has been the subject of several standards. This interest is mainly due to the high level of security with relatively small keys provided by ECC. Indeed, no sub-exponential algorithms are known to solve the underlying hard problem: the elliptic curve discrete logarithm. The aim of this work is to explore the possibilities of dedicated hardware implementing the best known algorithm for generic curves: the parallelized Pollard's rho method. This problem has specific constraints and requires therefore new architectures. Four different strategies were investigated with different FPGA families in order to provide the best area-time product, according to the capabilities of the chosen platforms. The approach yielding the best throughput over hardware cost ratio is then fully described and was implemented in order to estimate the cost of an attack. Such results should help to improve the accuracy of the security level offered by a given key size, especially for the shorter parameters proposed for resource constrained devices., Anglais

Efficient cryptographic implementations are a fundamental factor in the achievement and dissemination of new computerized applications. In some recent environments with (very) limited resources such as smart cards, sensor networks or RFID tags, standard algorithms may not be completely adapted.Consequently, the design of new solutions for low-cost cryptography is sometimes necessary and is at least an interesting research direction. In this context, stream ciphers are usually believed to be an efficient alternative to block ciphers, because of a lower hardware (or even software) implementation cost. The eSTREAM research initiative was consequently established in order to investigate the possibility of building secure and efficient stream ciphers. Among a large number of submitted candidates, the project recently (September 2006) narrowed the “hardware profiled” stream ciphers to four focused candidates, namely Trivium, Grain-128, MICKEY-128 2.0 and Phelix. In this paper, we evaluate the hardware performance of these algorithms in the reconfigurable hardware Xilinx Virtex-II devices. Based on our implementations (that mainly confirm previous results), we discuss the respective interest of the focused candidates and suggest certain guidelines for their comparison.

Elliptic Curve Public Key Cryptosystems (ECPKC) are becoming increasingly popular for use in mobile appliances where bandwidth and chip area are strongly constrained. For the same level of security, ECPKC use much smaller key length than the commonly used RSA. The underlying operation of affine coordinates elliptic curve point multiplication requires modular multiplication, division/inversion and addition/substraction. To avoid the critical division/inversion operation, other coordinate systems may be chosen, but this implies more operations and a strong increase in memory requirements. So, in area and memory constrained devices, affine coordinates should be preferred, especially over GF(p). This paper presents a powerful reconfigurable hardware implementation of the Takagi modular divider algorithm. Resulting 256-bit circuits achieved a ratio throughput/area improved by at least 900% of the only known design in Xilinx Virtex-E technology. Comparison with typical modular multiplication performance is carried out to suggest the use of affine coordinates also for speed reason.

Modular multiplication and inversion/division are the most common primitives in today's public key cryptography. Elliptic curve public key cryptosystems (ECPKC) are becoming increasingly popular for use in mobile appliances where bandwidth and chip area are strongly constrained. For the same level of security, ECPKC use much smaller key length than the commonly used RSA but need modular inversion/division. This paper presents an improved algorithm for prime field Montgomery modular inversion. The first important contribution lies in the reduction of the number of operations needed. Resource sharing is also used to lighten the control part of the algorithm. The second contribution is the minimization of the set of different instructions to enable powerful FPGA implementations. Resulting 256-bit circuit achieves a ratio throughput/area improved by at least 70% compared to the only known Montgomery inverse design in FPGA technology. Though the implementations are first oriented towards FPGA, some improvements are generic. So, they could prove to be also efficient for ASIC designs in terms of area and power consumption., Anglais