WO2007006798A1

WO2007006798A1 - Method and system for authenticating silicon chips

Info

Publication number: WO2007006798A1
Application number: PCT/EP2006/064158
Authority: WO
Inventors: David Pointcheval; Benoit Chevallier-Mames
Original assignee: Gemplus
Priority date: 2005-07-13
Filing date: 2006-07-12
Publication date: 2007-01-18

Abstract

The invention concerns a system for activating a silicon chip (10) of an identification medium (1) comprising a reader (2) adapted to read the chip and a computer device (3) connected to each other and comprising interface means (21, 31), wherein the chip, the reader (2) and the device comprise means (11, 22, 32) for processing all or part of the identification data, supplied for example on the interface means, and for providing evidence of processing in accordance with a specific law, the chip and the device comprise means for transmitting (23, 4) processed data and evidence to the reader (2), and reciprocally, the chip comprises means (11) for reading the processed data and the evidence and for verifying that said data observe a law stored in the chip, the chip further comprising means (11) for activating the chip if said law is observed. The invention also concerns a method implemented by the system.

Description

METHOD AND SYSTEM FOR AUTHENTICATING CHIPS

ELECTRONIC

GENERAL TECHNICAL FIELD

The present invention relates to a method for activating an electronic chip of an identification medium, an identification information being stored in the chip, the chip being able to be read by a reader connected to a computing device, the reader and the device each having interface means allowing a user to provide identification information.

The invention also relates to an activation system using such a method. STATE OF THE ART Transactions and exchanges using an electronic chip of an identification medium, identifying information being stored in the chip (this is the case, for example, of a chip of a smart card) , are more and more widespread. These include, for example, bank payment transactions or the withdrawal of money from ATMs. These transactions require the prior activation of the chip. In the remainder of the present description, the term "activation" means that the chip goes from a state that does not allow transactions - where transactions concerning data stored in the chip are not permitted - to a state where transactions concerning data stored in the chip are allowed. This is the case, for example, of bank transactions with a ticket distributor or a payment terminal. Once activated, the chip can exchange information with external devices and vice versa.

Electronic chip transactions have many advantages, but today there is an ever increasing demand for security. Currently, for the activation of the chip, a user provides the identification information to interface means of a reader of the chip.

Such activation is potentially subject to fraud. It is possible that the drive is corrupted by an attacker of the system. In this case, the reader can generate a copy of the characteristics of the chip and / or store the identification information for fraudulent purposes.

In addition, the reader of the chip is connected to a computer device, which allows in particular to perform processing operations. In the same way as for the reader, the device may be corrupt or have a virus so that it can generate a copy of the chip features and / or store the identification information for fraudulent purposes. PRESENTATION OF THE INVENTION

The invention proposes to increase the security of transactions using a chip.

The invention allows to start the manipulation of the identification information on two different elements. Thus the probability that the two elements are corrupted at the same time is much lower than the probability of corruption of the reader of the prior art. The user of the chip therefore has more confidence in the activation system.

For this purpose, the invention proposes a method of activating an electronic chip of an identification medium, an identification information being stored in the chip, the chip being able to be read by a reader connected to a device. computer device, the reader and the device each comprising interface means enabling a user to provide identification information, characterized in that the method comprises the following steps:

Providing a first portion of the identification information to the interface means of the reader, providing a second portion of the identification information to the interface means of the device,

• Processing by the chip of the identification information, to develop at least a first processed information and at least a first evidence that the development of the first processed information respects a law stored in the chip, and transmission by the chip of said first processed information and said first evidence to said reader,

• Processing by the reader of said first part of the identification information and said first information processed, to develop at least a second processed information and at least a second proof that the development of the second processed information respects a stored law in the reader, and transmission by the reader of said second processed information and said second evidence to said device,

• Processing by the device of said second part of the identification information and said second processed information, to develop at least a third processed information and at least a third proof that the development of the third processed information respects a stored law in the device, and transmission by the device of said third processed information and said third evidence to said reader,

• Processing by the reader of said third information processed, to develop at least a fourth processed information and at least a fourth proof that the development of the fourth piece of information treated respects a law stored in the reader, and transmission by the reader of said fourth processed information and said second, third and fourth evidence to said chip,

• Reading by the chip of said fourth processed information and said second, third and fourth proofs, and verifying that the fourth processed information respects a law stored in the chip to deduce, if said law is respected, that said first part and said second part of the identification information corresponds to the said identification information,

• Activation of the chip if the said law is respected. The invention is advantageously completed by the following features, taken alone or in any of their technically possible combination: said first part and said second part of the identification information correspond to said identification information when the identification information is the sum of the first and second parts of the identification information; said correspondence is verified when the identification information is the concatenation of the first and second parts of the identification information, or the second and first parts of the identification information;

- each proof is elaborated thanks to a protocol of proof of knowledge to disclosure of knowledge null;

the method comprises a step of transmission by the reader of the first information processed and of the first proof to the device;

the method comprises a step of verification by the device of the first and second proofs; the method comprises a verification step by the chip of the second, third and fourth proofs;

the elaboration of the first processed information X * by the chip takes place by taking

X * Xx ^ U ^pw where pw is the identification information and U is an element of a finite group generated by an integer g, g further defining X as X = g ^x where x is an integer ranging from 0 to q-1 with q being an integer defining the order of the group.

the elaboration of the first proof zkpn by the chip is carried out taking zkpr _x = ZKPOK (X *) where ZKPOK is a proof of knowledge protocol with null knowledge disclosure,

the preparation of the second information processed A and B by the reader is carried out by taking

A = (x * / u ^pw ° y °

B = U ^a ° where oco is a random variable between 0 and q-1; and pw ₀ is a first part of the identification information

the preparation of the second proof zkpr ₂ by the reader takes place taking zkpr ₂ = ZKPOK (A, B) - the development of the third processed information Yi and Ki by the device is carried out taking

Y ₁ = g " ¹ and

K ₁ = (AfB * " ¹ )" ¹ where ai is a random variable between 0 and q-1; and pwi is a second part of the identification information

the development of the third proof zkpr ₃ by the device takes place taking zkpr ₃ = ZKPOK (Y ₁₉ K ₁ )

the preparation of the fourth information processed Y and K is carried out by the reader taking

K = K ₁ "where y is a random variable between 0 and q-1

the preparation of the fourth proof zkpr ₄ by the reader takes place taking zkpr ₄ = ZKPOK (Y, K)

the verification of the correspondence of the parts pw ₀ and pwi with pw is carried out in particular by checking that

K = Y ^X

The invention also proposes a system for implementing the method.

The invention has the following numerous advantages. The identification information is never given as a whole to either the reader or the computing device. None of the non-chip devices have identification information as a whole. The identification information is separated into at least two parts, the reader and the device each having access to only one part.

Since the identification information is separated into at least two distinctly provided parts on two separate devices (the reader and the computing device), the user's confidence in the chip activation system is increased. Indeed, the two aforementioned devices are often manufactured by two different organizations and have different hardware and software parts respectively. It is therefore difficult to corrupt the two organizations or to introduce a virus on both devices at the same time to obtain the set of characteristics or all of the identification information of the chip. If one of the two devices is attacked and an attacker gets to know a first part of the identification information of the chip, it is not possible for the attacker, by applying the same method, of learn any information about the second part of the password. Each part of the identification information is provided on a different device. Each apparatus performs calculations from this portion of the identification information to generate processed information. It also generates proof that the calculations are done according to a law stored in the device. The exchanges between the chip and the devices include the information processed and the evidence.

The processing is carried out in particular by generating at least one exponentiation value representing an exponentiation of the parts or all of the identification information. Parts or all of the identifying information are never exchanged under a value that is not an exponentiation. They are always hidden as an exponentiation before being exchanged on a connection between the chip, the reader and the device. It is mathematically difficult to go back to a superscript value in an exponentiation value (this is a problem mathematical known and reputed difficult, called "discrete logarithm problem"). Thus, even if an attacker recovers an exponentiation value, he will have difficulty finding the value of the part or all of the identification information. The generation of the proof is carried out notably by an application of a function which makes it possible to prove the calculations of the values of exponentiation. This function is a proof of knowledge protocol with zero knowledge disclosure. The proof of knowledge protocol with null knowledge disclosure shows, in our case, that the generation of the exponentiation values was carried out according to a calculation pre-established by a law, without showing the details of the calculation. Thus, even if an attacker manages to generate - in one way or another - an exponentiation value consistent with the other exponentiation values, he will have difficulty creating a corresponding proof that will be accepted by the chip, the reader and / or the device. In addition, even if the attacker manages to intercept a piece of evidence, he will not be able to know the part or all of the identification information.

Preferably, each message sent or received by the computing device, or received or sent by the chip, is processed by the reader. Therefore, the critical point of a chip activation system is the reader. The latter sees and can modify all the communications coming or going to the chip or the device. If an attacker manages to corrupt the reader and learn the part of the identification information entered on the interface of the reader, it has been seen that a method according to the invention makes it possible to prevent this attacker from learning the problem. identification information as a whole. In addition, the attacker can not activate the chip without the help of the computing device, unless performing N / 2 attempts on average generating parts of the credentials, where N is the number of possibilities for identification information. However, the chip can be blocked after three erroneous attempts.

In addition, the separation into at least two parts is managed in a very simple way for the user of the support of the chip, and it suffices for example to divide the identification information into two parts such as for example the concatenation of the two parts gives the complete identification information.

PRESENTATION OF FIGURES

Other features, objects and advantages of the invention will emerge from the description which follows, which is purely illustrative and nonlimiting and which should be read with reference to the appended drawings in which:

FIG. 1 diagrammatically represents an activation system of an electronic chip comprising a reader connected to a computing device; and FIG. 2 is a block diagram showing the various possible steps of an activation method according to the invention.

In all the figures, similar elements bear identical reference numerals.

DETAILED DESCRIPTION FIG. 1 schematically represents an activation system of an electronic chip of an identification medium 1.

The identification medium can be of any type. It can be a smart card, a security module, a mobile phone, a personal assistant

(PDA - Personal Digital Assistant), Trusted Platform Module (TPM), Secure Digital Card (SD card), Universal Integrated Circuit (UICC) card

Card) or MMC (Multi Media Card) secured according to the terminologies employed by those skilled in the art.

Identification information pw is stored in the chip 10.

Said information pw may for example be a password (pw or "password" according to the English terminology used by those skilled in the art) activation of the chip. The password may also be for example the personal identification number (PIN).

The chip 10 comprises means 11 capable of performing all the steps described in the following developments, in particular the calculation, processing and activation steps. The means 11 are able to read processed information. Means 11 are also able to verify that this processed information respects a law stored in the chip to deduce from this, if said law is respected, that parts pw ₀ and pwi of the identification information (described in more detail below) correspond to said identification information pw. The means 11 are also able to activate the chip if said law is respected. The system comprises a reader 2 capable of reading the chip 10 of the support 1.

The reader may for example comprise means 20 in which the support 1 can be introduced. Other examples of reading means are possible, for example contactless means of the Radio Frequency Identification (RFID) identification type. The reader 2 comprises interface means 21 enabling a user to provide identification information. The means 21 are for example keyboard type, keypad, magnetic means, biometric or voice or sound recognition.

The reader 2 comprises means 23 allowing the transmission of information from the reader to the chip 10, and vice versa.

The reader 2 further comprises means 22 able to process a first portion pw ₀ of the identification information supplied to the interface 21 of the reader 2 means to develop at least a second and a fourth processed information and develop at least one second and fourth proofs (described in more detail later in this description).

The system also includes a computer device 3, which can be for example a computer or a server.

The device 3 comprises interface means 31 enabling the user to provide identification information. The means 31 are for example keyboard type, keypad, magnetic means, biometric or voice or sound recognition.

The device 3 comprises means 32 able to process a second part pwi of the identification information supplied to the interface means 31 of the device 3 to produce at least a third piece of processed information and at least a third piece of evidence (described in more detail). in the following description). The device 3 is connected to the reader 2 by the means 4 allowing the transmission of information from the reader 2 to the device 3, and vice versa. The means 4 are for example of the wired type and operate according to a TCP / IP (Transmission Contrai Protocol Internet Protocol), or non-wired type and operate according to a Wi-fi protocol (Wireless Fidelity) or IrDA (Infrared Data Association).

The transmission of information between the chip 10 and the device 3 - and vice versa - is carried out via the reader 2, the device or the chip transmitting the information first to the reader who then transmits them to the chip or device. device.

The system of FIG. 1 makes it possible to implement a method for activating a chip according to which, as shown in FIG. 2, the chip establishes, during a step 100, a correspondence between a from the identification information pw and secondly a first part pw ₀ and a second part pwi of the identification information.

The calculations of the invention described in the following developments are carried out in a finite group generated by an integer g. The group is thus the set of g ', for i an integer going from 0 to q-1. We call q the order of the group, q being preferentially first. The group is noted multiplicatively. The operation of the group is noted

"X" (times). An example of such a group is the set formed for g 'modulo p, where p is a large prime and q is a divisor of p-1. The group operation is then the modular multiplication modulo p.

We call U an element of the group. We call Z _q the set of integers between 0 and q-1.

The correspondence is established as follows: the identification information pw is the sum of the first and second parts pw ₀ and pwi of the identification information pw. The sum preferably corresponds to the concatenation of the first and second parts pw ₀ and pwi of the identification information pw.

The establishment of the pair pw ₀ and pwi separating the identification information into two parts can be written as: pw = (pw ₀ -l- pwjmod q where mod indicates the modulo

It should be noted that pw ₀ and pwi are not fixed and can be modified by the user at each activation of the chip. The chip knows the law connecting pw ₀ and pwi corresponding to pw.

In a step 110, the chip 10 selects a random variable x between 0 and q-1. This choice is written mathematically:

Chip 10 then builds a variable X such that: X = g ^x

In a step 111, the chip 10 processes the identification information pw, to develop a first processed information. Such a processing step comprises generating at least one exponentiation value

X * representing an exponentiation of the identification information. Such a generation can be expressed by:

X * ^ Xx U ^pw

(the operator x between X and U ^pw corresponds to the "times" operator mentioned above).

During a step 112, the chip produces a first proof zkpn to prove to the reader 2 and / or the device 3 that the calculation of X * has been carried out correctly, that is to say according to a law stored in the chip .

Advantageously, the function that makes it possible to prove an exponentiation calculation - such as for example X * - is a proof of knowledge protocol with zero knowledge disclosure (ZKPOK "zero knowledge - proof of knowledge" according to the English terminology -saxonne generally used by those skilled in the art). The proof thus elaborated makes it possible to prove that the calculated value was indeed calculated according to a particular law, without giving information on the calculations.

An entity - as for example the reader 2 or the device 3 as will be seen in the remainder of the present description - which obtains the processed information X * and a related proof, knows, thanks to the proof, that the information X * was generated correctly by the chip, without obtaining information on the calculations allowing the generation of the exponentiation value X *. The entity can not therefore go back to the identification information pw. There are several known knowledge proof protocols with zero knowledge disclosure. It is then possible to select any one, provided that the selected protocol is the same on the chip, the reader and the device.

The application of the ZKPOK protocol for the generation of the first proof is written: zkpr _x = ZKPOK (X *)

The first proof zkpn makes it possible to show that the chip knows variables δ and Y such that X * = g ^δ U ^γ , which can be written mathematically by: zkpr _x = ZKPOK (δ, y: X * = g ^δ £ / ^γ) which corresponds to the development of X *.

Said first processed information X * and the first proof zkpn are then transmitted, in a step 113, by the chip 10 to the reader 2, thanks to the means 23. A step 114 is the transmission, by the reader 2, of the first processed information X * and the first proof zkpn to the computing device 3. The transmission is done by the means 4.

During a step referenced 115 in FIG. 2, the user supplies the interface means 21 of the reader 2 with the first part pw ₀ of the identification information pw. In step 115, the user also provides the interface means 31 of the device 3 with the second part pwi of the identification information pw.

During a step 210, the reader 2 selects random variables y and α ₀ between 0 and q-1. This choice is written mathematically: y, a _n <r ^ -Z _a It is understood that step 210 can be performed before or after step 115.

The device 3 chooses, during a step 310, a random variable ai and between 0 and q-1. This choice is written mathematically: (X ₁ <^ - Z _q

It is understood that steps 115, 210, and 310 can be performed in any order and at any time between step 110 and step 211 described below.

During a step 211, subsequent to the step 113 already described, the reader 2 processes said first portion pw ₀ of the identification information to develop at least a second processed information.

The processing comprises generating at least one exponentiation value A representing an exponentiation of the pw _o portion and a second auxiliary processed information B. This generation is written as follows:

A = (x * / u ^pw ° y ° B = U ^a °

During a step 212, the reader prepares a second proof zkpr ₂ to prove to the chip 10 and / or the device 3 that the calculations of A and B have been carried out correctly, that is to say according to a stored law in the player. Advantageously, the function that makes it possible to prove the exponentiation calculations of A and B is a ZKPOK proof protocol.

The application of the ZKPOK protocol for the development of the second proof is written: zkpr ₂ = ZKPOK (A, B)

The second proof zkpr ₂ shows that the reader knows variables α and β such that A = X * ^α U ^β and B = U ^α which can be written mathematically by: zkpr ₂ =

During a step 213, the reader 2 transmits said second processed information A, the second auxiliary processed information B and the second proof zkpr ₂ to the device 3 thanks to the means 4. During a step 311, understood after the step 114 transmitting the first processed information X * and the first proof zkpn by the reader 2, and after the step 310, the computing device 3 generates an exponentiation value Yi such that:

Y = g It is understood that step 114 can take place before or after steps 211 and 212. Step 311 can therefore take place after step 312 described below.

In a step 312, subsequent to the steps 213 and 114, the device 3 verifies the proofs zkpn and zkpr ₂ by the means 32. The verification of the proofs zkpn and zkpr ₂ makes it possible to verify that the first and second information processed have were created correctly in order to mitigate attacks during which the device 3 would reveal information then useful to a corrupted reader 2.

The device 3 knows the processed information X *, A and B, and knows that this information has been created correctly. However, the device 3 knows nothing about the values pw, pw ₀ or pw that were used to create the processed information.

When the step 312 is enabled, the device 3 goes to a step 313. If the step 312 is not validated, namely if one of the two proofs is not good, then the device 3 goes to a step 315 according to which a message may be sent to the user to warn him of a faulty provision of part of the identification information, or of a possible problem of corruption of one of the devices of the system. A message can also be sent to the chip. The chip can then update a counter that counts the number of failures in the verification of evidence after a new supply of the parts of the identification information. The chip can therefore trigger a predefined policy, for example blocking the chip after three failures.

In step 313, the device 3 processes the second part pwi of the identification information to form at least one other exponentiation value Ki such that:

K ₁ = (AfB * " ¹ ) ^{* 1}

Yi and Ki represent third processed information.

During a step 314, the device 3 produces a third proof zkpr ₃ to prove in particular to the chip 10 that the calculations of Yi and Ki were performed correctly, that is to say according to a law stored in the device.

Advantageously, the function that makes it possible to prove the exponentiation calculations of Yi and Ki is a ZKPOK proof protocol.

The application of the ZKPOK protocol for the elaboration of the third proof is written: zkpr ₃ = ZKPOK (Y ₁₅ K ₁ )

The third proof zkpr ₃ helps to show that the device knows the variables α 'and β' such as Ki = A B ^α ^β and Yi = ^g, which can be expressed mathematically as:

In a step 316, said third processed information Yi and Ki and the third proof zkpr ₃ are transmitted to the reader 2 via the means 4. In a step 214, subsequent to the step 316, the reader 2 generates a fourth information processed thanks to the values Yi and Ki, received from the device 3. The development of the fourth information processed is written:

K = K ₁ " During a step 215, the reader 2 elaborates a fourth proof zkpr ₄ advantageously thanks to a protocol ZKPOK which is written: zkpr ₄ = ZKPOK (Y, K)

The fourth proof zkpr ₄ shows that the reader knows variables μ and v such that K = K / and Y = Y / which can be written mathematically by:

zkpr _A

In a step 216, the reader 2 transmits to the chip 10 the fourth processed information Y, K and the proofs zkpr ₂ , zkpr ₃ and zkpr ₄ . In a step 116, subsequent to step 216, the chip performs a verification of the proofs zkpr ₂ , zkpr ₃ , zkpr ₄ by the means 11. The proof verification zkpr ₂ , zkpr ₃ , zkpr ₄ makes it possible to verify that the second, third, and fourth processed information was created correctly, to avoid certain attacks. Thanks to step 116, the chip 10 knows in particular the fourth processed information Y and K, and can validate that this information has been created correctly.

When the step 116 is enabled, the device 3 goes to a step 118. If the step 116 is not validated, namely if at least one of the three proofs is not good, then the chip 10 goes to a step 117, according to which a message may be sent to the user to warn him of an erroneous provision of part of the identification information, or of a possible problem of corruption of one of the apparatuses of the system. The chip can then update a counter that counts the number of failures in the verification of the evidence after a new provision of the credentials parts. The chip can therefore trigger a predefined policy, for example blocking the chip after three failures. During a step 118, the chip verifies that:

K = Y ^X When the verification steps 116 and 118 have been performed and are validated, the chip is assured that the reader and the device are reliable, and that the portions pw ₀ and pwi correspond to the portions of the identification information pw. The chip can therefore be activated during a step 119 and transactions, for example banking, can begin.

If step 118 is not validated, then the card proceeds to step 117 already described.

The foregoing developments advantageously apply to a secure identification medium. It is understood that the support may be a smart card, for example the credit card type of payment or withdrawal of money, but also a security module, a mobile phone, a personal assistant (PDA), a TPM, an SD -card, a UICC card, or a secure MMC card.

The preceding developments advantageously apply to a separation of the identification information into two parts. This information can also be separated into more than two parts on additional devices.

Claims

1. A method for activating an electronic chip (10) of an identification medium (1), an identification information (pw) being stored in the chip, the chip being readable by a reader ( 2) connected to a computer device (3), the reader (2) and the device (3) each comprising interface means (21, 31) enabling a user to provide identification information, characterized in that the method comprises the following steps:

• Providing a first part (pw ₀ ) of the identification information (pw) to the interface means (21) of the reader (2),

• Providing a second part (pw-i) of the identification information (pw) to the interface means (31) of the device (3), • Processing by the chip (10) of the information of identification (pw), to develop at least a first processed information and at least a first evidence that the development of the first processed information respects a law stored in the chip, and transmission by the chip of said first processed information and said first proof to said reader (2),

• Processing by the reader (2) of said first part (pw ₀ ) of the identification information and said first processed information, to develop at least a second processed information and at least a second proof that the development of the second processed information respects a law stored in the reader, and transmission by the reader (2) of said second processed information and said second evidence to said device (3),

• Processing by the device (3) of said second part (pw-i) of the identification information and said second processed information, to develop at least a third processed information and at least a third proof that the development of the third information processed respects a law stored in the device, and transmission by the device of said third processed information and said third evidence to said reader,

• Processing by the reader (2) of said third information processed to develop at least a fourth processed information and at least a fourth proof that the development of the fourth processed information respects a law stored in the reader, and transmission by the reader (2) said fourth processed information and said second, third and fourth evidence to said chip (10),

• Reading by the chip of said fourth processed information and said second, third and fourth proofs, and verifying that the fourth processed information respects a law stored in the chip to deduce, if said law is respected, that said first part (pw ₀ ) and said second part (pw-i) of the identification information corresponds to said identification information (pw), • Activation of the chip if said law is respected.

2. Method according to the preceding claim, wherein said first part (pw ₀ ) and said second part (pw-i) of the identification information correspond to said identification information (pw) when the information of identification is the sum of the first (pw ₀ ) and second (pwi) parts of the identification information (pw).

The method of claim 1, wherein said correspondence is verified when the identifying information is the concatenation of the first (pw ₀ ) and second (pw-i) portions of the identification information (pw), or second (pw-i) and first (pw ₀ ) portions of the identification information (pw).

4. Method according to one of the preceding claims, wherein each proof is developed through a proof of knowledge protocol with zero knowledge disclosure.

5. Method according to one of the preceding claims, comprising a step of transmission by the reader (2) of the first processed information and the first evidence to the device.

6. Method according to the preceding claim, comprising a step of verification by the device (3) of the first and second proofs.

7. Method according to one of the preceding claims, comprising a verification step by the chip (10) of the second, third and fourth proof).

8. Method according to one of the preceding claims, wherein

• The development of the first processed information X * by the chip is carried out by taking X * X ^ x U where ^pw pw is the identification information and U is an element of a finite group generated by an integer g , g further defining X such that X = g ^x with x an integer from 0 to q-1 with q being an integer defining the order of the group.

• The development of the first proof zkpn by the chip is done by taking zkpr _x = ZKPOK (X *) where ZKPOK is a knowledge proof protocol with null knowledge disclosure,

• The preparation of the second information processed A and B by the reader is done by taking

A = (x * / u ^pw ° y °

B = U ^a ° where OC ₀ is a random variable between 0 and q-1; and pw ₀ is a first part of the identification information • The development of the second proof zkpr ₂ by the reader takes place taking zkpr ₂ = ZKPOK (A, B)

• The development of the third processed information Yi and Ki by the device is done by taking

Y ₁ = g " ¹ and

K ₁ = (AfB * " ¹ ) ^{* 1} where ai is a random variable between 0 and q-1, and pwi is a second part of the identification information • The development of the third proof zkpr ₃ by the device is performed taking zkpr ₃ = ZKPOK (Y ₁₉ K ₁ )

• The development of the fourth information processed Y and K is done by the reader taking

κ = κ _λ ^y where y is a random variable between 0 and q-1

• The elaboration of the fourth proof zkpr ₄ by the reader is carried out taking zkpr ₄ = ZKPOK (Y, K) • The verification of the correspondence of the parts pw ₀ and pwi with pw is carried out in particular by checking that

K = Y ^X

9. System for activating an electronic chip (10) of an identification medium (1), identification information (pw) being stored in the chip, the system comprising a reader (2) able to read the chip and a computer device (3), the reader being connected to the device, the reader (2) and the device (3) each comprising interface means (21, 31) enabling a user to provide identification information, characterized in that:

The chip (10) comprises means (11) able to process the identification information (pw), to elaborate at least a first piece of information processed and at least a first proof that the preparation of the first piece of information treated complies with a law stored in the chip, the chip (10) further comprising means (23) able to transmit said first processed information and said first evidence to said reader (2); The reader (2) comprises means (22) able to process a first part (pw ₀ ) of the identification information supplied to the reader interface means (21) of the reader (2) to produce at least a second and a fourth information processed and a second and fourth evidence that the preparation of the second and fourth processed information respects a law stored in the reader, the reader further comprising means (23, 4) able to transmit said processed information and said evidence to said chip (10) and / or said device (3);

The device (3) comprises means (32) able to process a second part (pw-i) of the identification information supplied to the interface means (31) of the device for producing at least a third information processed and a third proof that the development of the third processed information respects a law stored in the device, the device further comprising means (4) able to transmit said third processed information and the third proof to the reader, • the chip further comprises means (11) adapted to read the fourth information processed and the second, third and fourth proofs, and means for verifying that the fourth information processed respects a law stored in the chip to deduce, if said law is respected, that said first part (pw ₀ ) and said second part (pwi) of the identification information correspond to said identification information (pw), the chip com further carrying means (11) for activating the chip if said law is respected.

10. System according to the preceding claim, comprising means for verification by the device (3) of the first and second proofs.

11. System according to one of the two preceding claims, comprising verification means by the chip (10) of the second, third and fourth evidence.

12. System according to one of the three preceding claims, wherein the carrier (1) is a smart card.

13. System according to the preceding claim, wherein the smart card is of the bank card type payment or withdrawal of money and / or SD card and / or a UICC card or and / or a secure card MMC.