EP1034527A2

EP1034527A2 - Method for reducing storage space requirements for a first electronic key and coding/decoding arrangement

Info

Publication number: EP1034527A2
Application number: EP98966766A
Authority: EP
Inventors: Jean Georgiades
Original assignee: Siemens AG
Current assignee: Siemens AG
Priority date: 1997-12-01
Filing date: 1998-11-25
Publication date: 2000-09-13
Also published as: JP2001525624A; WO1999028887A3; CA2312358A1; WO1999028887A2

Abstract

In order to save the storage space required for a secret key, the latter is subdivided into blocks, the blocks are then permutated and a permutation-linked index is stored. The index is significantly shortened in relation to the secret key. On the other hand, the secret key can be recovered from the index by determining the permutation in the index. The secret key is determined by means of the non-secret permutated blocks and the permutation. The invention also relates to an arrangement, i.e. a chip card, for coding and decoding.

Description

description

Method for reducing the storage space requirement for an electronic first key and arrangement for encryption and decryption

The invention relates to a method for reducing the storage space requirement for an electronic first key and an arrangement for encryption and decryption.

A "key" is understood to mean data that are to be kept secret and are to be used in particular in a cryptographic process.

An "attacker" is an unauthorized person with the goal of getting the key.

Numerous cryptographic methods are known, including symmetrical and asymmetrical processes. Especially in a computer network, but increasingly also in portable media, e.g. a cell phone or chip card, it must be ensured that a stored key is not accessible even if an attacker seizes the computer, cell phone or chip card.

In order to ensure sufficient security of cryptographic methods, keys, in particular in the case of asymmetrical methods, are each determined with lengths of several 100 bits. A memory area of a computer or portable medium that is protected from an attack, that is, a memory area that an attacker cannot read, is usually very small. A length of a key of several 100 bits stored in such a protected memory area reduces free memory space within the protected memory area, so that relatively few such keys can be stored together. The object of the invention is to provide a method for reducing the storage space requirement for an electronic key and an arrangement for encryption and decryption, the disadvantage described above being avoided.

This object is achieved in accordance with the features of the independent claims.

A method for reducing the storage space requirement for an electronic first key with a predetermined length is specified, in which the first key contains a number of units corresponding to the predetermined length. Several units are combined into one block. The first key is represented by several blocks, and a publicly accessible identifier is created from the first key by determining a permutation of the blocks and storing an index for this permutation as an electronic second key.

The index identifies the permutation after which the blocks of the first key have been exchanged. For this purpose, a first position in the index can contain a number that describes the position to which the first block of the first key has been moved based on the permutation. Analogously, the second position of the index refers to the position (a block corresponds to a position) of the public identifier which represents the second block of the first key, etc. The result of continuing this process until all blocks have been assigned is one Permutation number (PERM, see Fig. 3) that uniquely references the first key from the publicly accessible identifier.

The index can also be a shortened form of the permutation number. If n denotes the number of blocks, then (if all blocks are different in pairs) n! Possibilities to arrange the blocks. Blocks 1 to n can be arranged in different ways. Sorting the possibilities of the arrangement according to a given scheme (e.g. in a table) by size, whereby each block receives a number according to its position, you can determine the index by looking for the entry of the permutation number and its place within the arrangement (with reproducible order) is saved as an index (see example in Fig. 3 and Table 1).

It should be noted here that to illustrate a

Arrangement is assumed in a table, whereas in practice an arrangement according to a certain scheme

64 is preferable because e.g. with n = 50 the table approx. 3 * 10

Should have entries. An example of an arrangement according to a certain scheme is explained in more detail in the description of the figures.

The reduction in the storage space requirement for the first key results from the fact that only the second key is stored. The second key comprises the index and therefore requires significantly less storage space than the first key. The storage space requirement for the second key is preferably determined by the number of possible permutations. The created identifier can be made publicly accessible, so it does not have to be stored in a protected memory area. An attacker who learns of this identifier, even if he knows the block size, has n! Possibilities (n is the number of blocks) to determine the first key from the identifier. In practice, such an attempt is extremely unlikely to succeed.

A further development consists in the blocks each comprising an equal number of units. It is also a further development that one of the following units is used: a) number; b) alphanumeric character; c) byte; d) bit.

Another development is that the second key is stored in a protected memory area, preferably on a chip card.

It is advantageous that the second key has a significantly reduced length compared to the first key and thus less demands on the storage space within the protected

Storage area provides. The protected memory area ensures that data contained there cannot be easily read by an attacker. Since the available storage space in the protected storage area is generally small, it is a significant advantage if a key to be stored in the protected storage area is reduced in length without having to accept a reduced security of the cryptographic method.

As part of additional training, the

Permutation of the blocks is determined by carrying out the following steps: A permutation is randomly determined from all possible permutations, the permutations being created according to a specific scheme and thus an order of the permutations created can be reproduced. The index then determines a place for the permutation within the sequence of the permutations.

This index thus represents a reproduction of the first key, which is reproducible on the basis of the regulation (= predefined scheme) for forming the permutations. According to the randomly determined permutation, the Blocks swapped and saved as a publicly accessible identifier.

In a development of the invention, a third key is determined on the basis of the second key, this third key being equal to the first key. For this purpose, the public identifier is divided into blocks, each block comprising several units of the identifier. A third key is determined from the identifier and the second key, in that all possible permutations of the blocks, which are reproducibly created in their sequence, and the permutation among the permutations that represents the third key is determined using the second key.

This corresponds essentially to the inverse operation to form the permutation of the blocks, which are reproducible in their order. The index (second key) is used for addressing within the sequence of the permutations, so that the associated permutation with the publicly accessible identifier defines a third key which is the same as the first key.

It is also a further development that the second key is a secret key and is protected

Memory area, e.g. a chip card.

According to the invention, an arrangement for encryption and decryption is also specified with a medium which has a protected memory area and with a

Computing unit which is set up in such a way that a first key is shortened in accordance with the steps of the method described above.

The medium is preferably a portable medium, for example a chip card. The protected memory area can be stored both on the medium and within a computer, which is connected, for example, in a network with other computers. The protected memory area should be sufficiently secure against unauthorized access. This ensures suitable mechanisms, for example reading the protected

Prevent the memory area and, based on internal mechanisms, as perceived by a computer that accesses the protected memory area, only a result of a comparison operation with an entry, in particular a key, of the protected memory area is communicated to the outside.

Further developments of the invention also result from the dependent claims.

Exemplary embodiments of the invention are illustrated and explained below with reference to the drawings.

Show it

1 shows a sketch which represents a method for reducing the storage space requirement for an electronic first key,

2 shows a sketch which represents a method for restoring the first key from the publicly accessible identifier and the second key,

3 shows an example of a method for reducing the storage space requirement for a secret key,

4 shows an arrangement for encryption and decryption,

5 shows a computing unit 1 shows a method for reducing the storage space requirement for an electronic first key. In a step 101, the first key is divided into blocks, the blocks each containing an equal number of units. Such units are preferably numbers, alphanumeric characters, bytes or bits. In a step 102, a permutation is randomly determined from all permutations of the blocks that are reproducible in their order. This random permutation is used as a publicly available identifier. From the order of the blocks corresponding to this permutation, it is extremely unlikely that the first key will be restored if the first key is provided with a suitable number of units. The selected permutation has a certain place within the order of all permutations (order reproducible) (see step 103). In a step 104, the index is stored as a second key. The second key is stored in a protected memory area.

2 shows steps of a method for restoring the first key from the publicly accessible identifier with the second key. For this purpose, in a step 201, reproducible permutations of the blocks of the identifier are determined from the identifier. On the basis of the second key, a permutation among the permutations is determined as a third key (see step 202). The third key is equal to the first key (see step 203). The first key that was mapped in a second key to reduce storage space is thus restored.

The example shown below explains the method of operation for reducing the Storage space requirement for an electronic key. Fig. 3 illustrates the relationships.

The first key Kl "1234567890" comprises several units UNIT "1", "2", "3", "4", "5", "6", "7", "8", "9", "0" which are each represented by an alphanumeric character. In a step 301 the first key K1 is subdivided into blocks BL "1 2", "3 4", "5 6", "7 8", "9 0", each of which comprises two units EINH. A next step 302 determines a random combination of the blocks BL to form an identifier KEN "3478129056", which can be publicly accessible. Depending on the permutation of the first key K1 and the identifier KEN, a step 303 represents a permutation number PERM "24153" which uniquely converts the identifier KEN into the first key K1.

The permutation number PERM maps the identifier KEN to the first key, in that the first digit of the permutation number PERM "2" is the first digit of the identifier KEN "3 4" based on blocks of two units and this block as the second block of the first key Kl identifies. The second digit of the identifier KEN "7 8" is therefore the fourth digit of the first key K1, etc. After complete assignment, the permutation number clearly results in the first key K1 to "1234567890".

A further assignment results in a representation of the first key K1 that is significantly shortened in relation to the length of the permutation number PERM. In a step 304, a place in this order is determined from the permutation number PERM based on the sequence of all permutations that have the same number of digits as the permutation number PERM using table 1. The table includes a section of the total number of options for arranging the blocks BL. n = 5 => n! = 120 options for arranging the blocks

Sorting the possible permutations according to size results in a clear order of all permutations (from 0 to n! -L) (see table 1 as a section of the first 47 options).

TaJelle 1

Using the table LISTE, the entry is determined in a step 305 which references the permutation number PERM in the table LISTE. As can be seen from Table 1, the 37th entry in Table 1 (LIST in Fig. 3) is equal to the permutation number PERM. Accordingly, the 37th entry, ie the character string “037”, is stored as the second key K2. The second key K2 has a significantly reduced length compared to the first key Kl. The second key K2 is preferably protected Storage area filed. The size of the second key K2 is determined by the number of possible permutations. If n is the number of blocks BL into which the first key K1 is divided, the number of possibilities for "n!" Results. Here in the example there are 5 blocks, i.e. 120

Possibilities. The second key K2 is three digits ("000" to "119") in decimal notation, but only 7 bits in binary notation.

If the first key Kl comprises several 100 bits, it is clear that, even when combined into blocks of several bits, there is still a large number of blocks, and the factorial of this number corresponds to the possibilities that the attacker would have to try out to get the first key. The likelihood of such an event is slim.

Table 1 mainly serves to illustrate the basic procedure. In practice, the number of blocks n is usually large, so that the assignment described, indicated by Table 1, is preferably carried out according to a specific scheme. Such a scheme will be explained below.

ASSIGNMENT OF THE PERMUTATION TO THE IDENTIFIER:

The following abbreviations apply:

n number of blocks, PERM permutation,

L List with not yet evaluated blocks of the secret key, initialization with

L = (l, 2,3, ..., n), k: = 0

The rule for assigning the permutation to the identifier is as follows: FOR s = 1 TO n- 1 DO

1. Read s th number of permutation

2. T = position of the read number from list L 3. k = k + (T-l) * (n-s)!

4. Delete the T-th position from list L, subsequent positions advance by one position

5. s = n-1? YES? => End of program

Result: k = identifier

The relationship is illustrated below using an example:

n = 5

PERM = 2,4,1,5,3

L = (1,2,3,4,5) k = 0

1st step: s = 1, n-s = 4, (n-s)! = 24, k = 0, L = (1,2,3,4,5]

1. sth number of permutation: 2

2. T = 2 3. k = 0 + (2-1) * 24 = 24

4. L = (1,3,4,5)

2nd step: s = 2, n-s = 3, (n-s)! = 6, k = 24, L = (1,3,4,5) 1st sth number of permutation: 4

2. T = 3

3. k = 24 + (3-1) * 6 = 36

4. L = (1,3,5)

3rd step: s = 3, ns = 2, (ns)! = 2, k = 36, L = (1,3,5) 1. sth number of permutation: 1 2. T = 1

3. k = 36 + (1-1) * 2 = 36

4. L = (3.5)

4th step: s = 4, n-s = 1, (n-s)! = 1, k = 36, L = (3.5)

1. sth number of permutation: 5

2. T = 2

3. k = 36 + (2-1) * 1 = 37 4. L = (3)

5. s = n-1 = 4? => YES! => End of program

Result: identifier = k = 37.

ASSIGNMENT OF THE IDENTIFIER TO THE PERMUTATION:

The following abbreviations apply:

n number of blocks, k identifier

L List with as yet unidentified positions of the secret key, initialization with L = (1, 2, 3, ..., n).

The rule for assigning the identifier to the permutation is as follows:

FOR s = l TO n-1 DO 1.Divide k / (n-s)!

2. E = integer result of the division in 1.

3. R = rest of division in 1.

4. The s-th block of the permuted key is the block of the secret key located at (E + 1) -th position of the list L 5. the (E + l) th entry in list L is deleted, subsequent entries move forward by one position

6. k takes the value R.

7. s = n-1?

YES? => then the nth block of the permuted key is the block of the secret key that is still left in list L => end of program.

The relationship is illustrated below using an example (according to the above example for Table 1: identifier 37 => permutation 24153):

n = 5 k = 37

1st step: s = 1, k = 37, (n-s)! = (5-1)! = 24, L = (1,2,3,4,5) 1. 37/24 = 1, remainder 13

2. E = 1

3. R = 13

4. the 1st block of the permuted key is the block of the secret key located at the 2nd position in the list L = (1,2,3,4,5)

5. the 2nd entry in list L is deleted, subsequent entries move forward by one position => L = (1,3,4,5) 6. k = 13

Step 2: s = 2, k = 13, (n-s)! = 6, L = (1,3,4,5) 1. 13/6 = 2, remainder 1 2. E = 2

3. R = 1 4. the 2nd block of the permuted key is the block of the secret key 5 located at the 3rd position in the list L = (1,3, 4th, 5). L = (1,3,5)

6. k = 1

3rd step: s = 3, k = 1, (n-s)! = 2, L = (1,3,5) 1. 1/2 = 0, remainder 1

2. E = 0

3. R = 1

4. The 3rd block of the permuted key is the block of the secret key located at the 1st position in the list L = (1,3,5)

5. L = (3.5)

6. k = 1

4th step: s = 4, k = 1, (n-s)! = 1, L = (3.5)

1.1 / 1 = 1, remainder 0

2. E = 1

3rd R = 0 4th 4th block of the permuted key is the 2nd position of the

List L = (3,5.) Located block of the secret

Key 5. L = (3) 6. k = 1

7. s = n-1? => YES! => Then the 5th block of the permuted key is the block of the secret key that is still in the

List L = (3) is left => end of program.

Result: the permutation is: 2,4,1,5,3 3 that the identifier K2 can be determined from the PERM permutation and vice versa the PERM permutation can be determined from the identifier K2. The LIST block ensures an allocation of the location of the PERM permutation within the set of all permutations of the same length, the permutations being sorted according to size.

An arrangement for encryption and decryption is shown in FIG.

A portable medium 401, preferably a chip card, comprises a (conventional) memory area MEM 403 and a protected memory area SEC 402

Interface IFC 404 data is exchanged between the medium 401 and a computer network 406 via a channel 405. The computer network 406 comprises a plurality of computers which are connected to one another and communicate with one another. Data for the operation of the portable medium 401 are preferably available distributed in the computer network RN 406.

The protected memory area 402 is designed to be unreadable. The data of the protected memory area 402 is used on the basis of a computing unit which is accommodated on the portable medium 401 or in the computer network 406. As a result, a comparison operation can indicate whether or not a comparison of an entry with a key in the protected memory area 402 was successful.

A computing unit 501 is shown in FIG. The arithmetic unit 501 comprises a processor CPU 502, a memory 503 and an input / output interface 504, which is used in different ways via an interface 505 led out of the arithmetic unit 501: an output on a monitor 507 is visible via a graphics interface and / or printed out on a printer 508. A Input takes place via a mouse 509 or a keyboard 510. The computing unit 501 also has a bus 506, which ensures the connection of memory 503, processor 502 and input / output interface 504. It is also possible to connect additional components to bus 506: additional memory, hard disk, etc.

Claims

claims

1. Method for reducing the storage space requirement for an electronic first key with a predetermined length on a computer, a) in which the first key contains a number of units corresponding to the predetermined length, b) in which several units are combined to form a block, c) in which the first key is represented by several blocks, d) in which a publicly accessible identifier is created from the first key by a

Permutation for the blocks is determined and an index for this permutation is stored as an electronic second key.

2. The method of claim 1, wherein the blocks each contain an equal number of units.

3. The method of claim 1 or 2, wherein one of the following units is used: a) number, b) alphanumeric character, c) byte, d) bit.

4. The method according to any one of the preceding claims, wherein the second key in a protected

Storage area is saved.

5. The method according to any one of the preceding claims, wherein the permutation of the blocks comprises the following steps: a) a permutation is randomly determined from all possible permutations, the permutations according to be created according to a certain scheme and thus an order of permutations is reproducible; b) the index represents a place of permutation within the order of permutations.

6. A method for determining a third key based on the second key, which was created using the method according to one of claims 1 to 5, a) in which the public identifier is divided into blocks, each block comprising several units of the identifier, b ) in which the third key is determined from the identifier and the second key, in that all possible permutations of the blocks are created and the permutation that corresponds to the third key is determined on the basis of the second key.

7. Arrangement for encryption and decryption, a) in which a medium has a protected memory area, b) with a computing unit which is set up in such a way that a first key is shortened by

(1) the first key contains a number of units corresponding to the predetermined length,

(2) several units are combined to form a block,

(3) the first key is represented by several blocks, (4) a publicly accessible identifier is created from the first key by determining a permutation for the blocks and storing an index for this permutation as an electronic second key.

Arrangement according to Claim 7, in which the computing unit is set up in such a way that a) a permutation is randomly determined from all possible permutations, the permutations being created according to a specific scheme and thus an order of the permutations being reproducible; b) which is represented by the index a place of permutation within the order of the permutations.

9. Arrangement according to claim 7 or 8, in which the computing unit is set up in such a way that a third key is determined on the basis of the second key, which was created using the method according to one of claims 1 to 5, by performing the following steps: a) the public identifier is divided into blocks, each block comprising several units of the identifier, b) the third key is determined from the identifier and the second key by creating all possible permutations of the blocks and determining that permutation on the basis of the second key that corresponds to the third key.

10. Arrangement according to one of claims 7 to 9, wherein the computing unit is provided on the medium.

11. Arrangement according to one of claims 7 to 9, wherein the computing unit is a computer in a network of at least one computer and the medium.

12. Arrangement according to one of claims 7 to 11, wherein the medium is a chip card.