WO2002073878A1

WO2002073878A1 - Electronically-controlled electric wire switching device

Info

Publication number: WO2002073878A1
Application number: PCT/FR2002/000892
Authority: WO
Inventors: Christophe Tymen; Eric Brier
Original assignee: Gemplus
Priority date: 2001-03-13
Filing date: 2002-03-13
Publication date: 2002-09-19
Also published as: FR2822310A1; FR2822310B1

Abstract

The invention relates to electronic devices that switch between n electric wires, n being a power of 2. The switching is electronically controlled by means of a key made up of bits. Said device comprises several switches among other elements. The inventive device comprises two identical sub-blocks, each of which switches half of the wires, and n/2 switches which switch said wires after the application of the two sub-blocks.

Description

ELECTRONICALLY CONTROLLED ELECTRIC WIRE SWITCHING DEVICE

The invention relates to an electronic device for permuting electrical wires between them, this permutation being itself electronically controlled. The realization of the invention requires very few electronic components, and can be used in electronic devices having little computing capacity, or memory volume. The detail of the invention is exposed in a publication entitled “Fast primitives for internai data scrambling in tamper resistant hardware”, to appear in the proceedings of the Ches'2001 conference (Cryptography Hardware and Embedded Systems) to be held in Paris in May 2001. The problem of permuting electrical wires by electronically controlling this permutation is a well-known problem, which has applications in the field of networks in switching theory and also for securing confidential data inside integrity devices. protected like smart cards.

More explicitly, such a device takes n electrical wires as input, and restores them to n wires which are permuted, this permutation being determined by the numerical value of k additional wires corresponding to k bits 0/1 controlling the permutation. This set of k bits is called the device command. The technical criteria desired for such a device are generally:

1. That we can, thanks to the k control bits, generate as many permutations of the n wires as possible.

2. That the device include as few logic gates as possible.

3. That the number of permutations generated be as close as possible to the number of commands that it is possible to choose.

4. That the permutations generated are in a uniform way when one chooses the command with a uniform probability in the set {0, l} ^k .

5. That the crossing time of the associated electronic circuit is very short.

In general, it is difficult to meet all of these criteria. In particular, there is no device of very compact size uniformly generating permutations. The invention fills this gap by proposing an electronic device which makes it possible to generate a large number of permutations, uniformly, or almost uniformly, and with very few logic gates.

The invention is broken down into two devices, which independently have different advantages compared to the criteria set out above.

We now present the details of the two devices. For this, we introduce the description of a basic electronic device, which we call a switch. A switch is an electronic circuit that has two input wires, two output wires, and a key bit. Depending on the value of this key bit, the two output wires are equal to the two input wires, or are equal to the two input wires whose values are exchanged with each other. The electronic description of a switch is shown in Figure 1.

Thereafter, we will use a mathematical description more than a description in terms of electronic devices, which leads us to introduce certain mathematical notations and concepts. However, there is a perfect equivalence between the mathematical language we use in the following, and an electronic description stricto sensu. We denote by S _n the group of permutations of the set with n elements {0,. . . , n - 1}. By definition, key permutation is called an application σ of the set of keys {0, l} ^m in the set S _n , which is symbolized by:

σ: {0 ₍ l} ^m → S _n K ^ → σ _κ . A key permutation is simply the mathematical equivalent of a device permuting electrical wires, this permutation being selected by an electronic control K. A transposition is a element of S _n which exchanges two elements of {0,..., n - 1} We denote (i, j) the transposition which exchanges the symbol i with the symbol j. On the other hand, the product of two permutations r and μ, noted v - τ o μ, or simply v = rμ, is defined by v (ï) - r (μ (i)) for all i in {0,..., n - 1}. a mathematical theorem which indicates that any element of S _n can be written as a product of transpositions. In our context, the key permutation (i, j) ^b , b being a key bit equal to zero or one, corresponds precisely to a switch both of which inputs are the index bits i and j, and whose key bit is bit b. Consequently, the preceding theorem means that one can obtain all the possible configurations of the output wires (ie all the possible permutations) by stacking one after the other of the switches to form the final electronic device. We now present in detail the two devices of the invention. In both cases, they deal with the situation where the number of electric wires concerned is worth a power of two, which makes it possible to define the whole / such that π = 2 '.

The first device is an electronic circuit formed by an assembly of switches, and which verifies the property that the number of possible configurations of the output wires is precisely equal to the number of keys that it is possible to choose for this key permutation. This device is therefore a key permutation, according to the definition given above. This device is described in paragraph 3.4 of the above publication. The description of the device P _n can be done by induction, as follows. This device is constructed from two sub-blocks identical to a _n / _{2 device} - Suppose we have carried out our construction of a key permutation μ _/ <- for π / 2 wires. So, we can use twice μx, with two different keys K _\ and K ₂ , to swap on the one hand the wires numbered from 0 to π / 2 - 1, and on the other hand, the wires numbered from π / 2 to π - 1. Then, we add to this key permutation the transpositions which exchange wire 0 with wire π / 2, wire 1 with wire π / 2 + - 1, and so on, until exchanging π / 2 - 1 wire with π wire. These transpositions are each controlled by a key bit, and the combination of all these key bits forms a key K ₃ . We have thus constructed a key permutation O- _(KI , K _Î , _K3) which permutes the set {0,. . . , π - 1}. It can be proved that this construction has the property of generating n "7 ² different configurations of the output wires, which is precisely equal to the number of different keys which make it possible to control the switches involved in the construction. The proof of this fact is found in the publication cited above. The advantage of this construction also lies in the fact that the number of switches involved in the construction is equal to (π log ₂ ) / 2, which is very little, and therefore leads to a small circuit, with a very short crossing time.

The second device Q _n is also an electronic circuit formed by an assembly of switches, which performs a key permutation. It is constructed from two identical sub-blocks ticks to a device Q „/ ₂ . This second device generates more configurations of the output wires than the first construction, which is desirable. It can also be described by an iterative construction, exposed in what follows. A full description can be found in paragraph 3.5 of the above publication. Essentially, the contruction is very similar to that exposed previously, with the difference that we add several permutations again after adding the transpositions used in the previous construction. Suppose we have constructed a key permutation μ _κ of π / 2 children. We apply the transformations described above to achieve a key permutation <J ₍ κ _x, κ _{, Kz)} - Then, we add π / 4 permutations as follows. We denote c = (0, 2, 1, 3) the permutation of {0, 1, 2, 3} which sends 0 over 2, 2 over 1, 1 over 3 and 3 over 0. We denote c, the permutations obtained for all i such that 0 <i <π / 4 by making substitutions in c

0 ι-, 1 H- + 1, 2 ι → n / 2 + i, 3 ι → π / 2 X i l.

We can now complete our construction, by composing r ₍ κ κ ₂ , κ ₃ ) ^with the permutation C _Q ° o ^• . ^{• •} o cX * Z {. where the 6, are additional key bits, worth 0 or 1. We therefore again obtain a key permutation. We can prove that this construction has the property of generating π ^Qn 2 ^{_ / 3n} , where and β are constants worth = 0, 65 and β = 0, 15. In addition, the key associated with a length of (3 / 4) π log ₂ π bits. In particular, this construction has the property of generating a large number of different permutations, among all the possible permutations. According to the invention, this construction can be generalized, by extending the device, by using the construction of the first device, and by adding permutations consisting of cycles of length greater than two, for example four, but any value greater than two is possible. Furthermore, the device P _n or Q _n , permuting π / 2 wires, is equivalent to the device P _n or Q _n permuting π wires. Finally, said switches each comprise two wires and a key bit, and execute a permutation of these two wires on the condition that the key bit is equal to 1 and leaves these wires unchanged if the key bit is equal to 0.

The present invention will be easier to understand using the attached figures which are: - Figure 1, electronic representation of a switch with logic gates. - Figure 2, electronic representation of the first device of the invention.

- Figure 3, electronic representation of the second device of the invention.

- Figure 4, electronic representation of a cycle of length four.

A possible embodiment of the invention is now described. We place ourselves in the particular non-restrictive case where the number of wires is equal to 8: π = 8. Then, according to the invention, we can manufacture a key permutation which generates 2 ¹² different configurations of wires for the first device. , and 2 ¹⁴ for the second device. The size of the keys is 12 bits and 16 bits respectively. The corresponding circuits are exposed with the following three figures. The first figure, Figure 1, shows an electronic embodiment of a switch, using logic gates "and" and "or", according to a standard graphic symbolism. The inputs are referenced by Inl, In2, and the outputs by Outl, Out2. K represents the key bit determining the state of the switch. In the following two figures, we represent electronic circuits made from switches for each 8 wires numbered from 0 to 7. For the sake of simplification, we represent these circuits in the form of graphs, where the nodes correspond to switches, and where the edges correspond to wires. For the sake of simplicity, the wires which correspond to the key bits which determine the state of the switches are not represented. FIG. 2 represents an embodiment of the first device, in the case where π = 8. To represent an electronic embodiment of the second device, rectangular boxes are also used, to represent the cycles of length four used in the iterative construction of the second device, as shown in Figure 4. Again, the son corresponding to a key are not shown. FIG. 3 represents an embodiment of the second device, in the case where π = 8. FIG. 4 represents an embodiment using multiplexers of a cycle of length 4, controlled by a bit of key b, receiving at input four sons denoted eo, e, e, e ₃ , and producing as output four sons denoted ^s o, S _I , s ₂ , s.

Claims

1. Electronic device P _n which permutes π electrical wires between them, π being a power of 2, the permutation being controlled electronically by means of a key K formed of k bits, comprising inter alia several switches, characterized in that it is constructed from two sub-blocks identical to a device P _n / ₂ , each permuting π / 2 wires respectively numbered from 0 to π / 2— 1 and from π / 2 to π— 1, and that it is comprised in addition π / 2 switches which swap the wires obtained in the order resulting from the application of the two aforementioned sub-blocks by swapping two by two the wires numbered 0 and π / 2, 1 and π / 2 + 1, up to to exchange the wires numbered π / 2 - 1 and π - 1, each of these exchanges being controlled independently by a key bit.

2. Electronic device Q _n which permutes π electrical wires between them, π being a power of 2, the permutation being controlled electronically by means of a key K 'formed of k' bits, comprising inter alia several switches, characterized in that '' it is constructed from two sub-blocks identical to a Q _n / _{2 device} , each permuting π / 2 wires respectively numbered from 0 to π / 2 - 1 and from π / 2 to π - 1, which it includes in addition π / 2 switches which swap the wires obtained in the order resulting from the application of the two aforementioned sub-blocks by swapping two by two the wires numbered 0 and π / 2, 1 and π / 2 + 1, up to to exchange the wires numbered π / 2 - 1 and π - 1, each of these exchanges being controlled independently by a key bit, and that it finally comprises π / 4 key permutations, permuting the wires obtained in the resulting order of the application of the two aforementioned sub-blocks and of the aforementioned π / 2 switches of m year to apply or not for any integer i such that 0 <. <π / 4 - 1 the permutation which sends the wire numbered i on the wire numbered π / 2 + i, the wire numbered π / 2 + i on the wire numbered i X 1, the wire numbered i X 1 on the numbered wire π / 2 + i X 1, the thread numbered π / 2 + i + 1 on the thread numbered i + 1, the choice to apply these permutations or not being determined independently for all integer i by the data of a key bit.

3. Electronic device according to claim 1 characterized in that the device P _n / ₂ permuting π / 2 son is equivalent to the device P _n permuting n son.

4. Electronic device according to claim 2 characterized in that the device Q _n / ₂ permuting π / 2 wires is equivalent to the device Q _n permuting π wires.

5. Electronic device according to claim 1 or 2 characterized in that said switches each comprise two wires and a key bit, and execute a permutation of these two wires on the condition that the key bit is equal to 1, and leave these wires unchanged if the key bit is 0.