It is known practice to chain together various encryption/decryption means in an enciphering/deciphering system. In all of what follows, the expression encryption/decryption will be used to refer to a particular encryption means used in a bigger enciphering/deciphering system.
It has long been sought to optimize the operation of these systems from the triple viewpoint of speed, memory space occupied and security. Speed is understood to mean the time required to decipher the data received.
Encryption/decryption systems with symmetric keys are known. Their inherent security can be gauged as a function of several criteria.
The first criterion is that of physical security, relating to the ease or to the difficulty of a method of investigation by extracting certain components, this being followed by their possible replacement by other components. These replacement components, intended to inform the unauthorized person about the nature and manner of operation of the enciphering/deciphering system, are chosen by him/her in such a way as not to be detected, or to be as undetectable as possible, by the remainder of the system.
A second criterion is that of system security, within the framework of which attacks are not intrusive from the physical viewpoint but call upon analysis of mathematical type. Typically, these attacks will be conducted by computers of high power, which will attempt to break the algorithms and the enciphering codes.
Means of encryption/decryption with symmetric keys are for example the systems referred to as DES (Data Encryption Standard). These relatively old means now merely offer system security and physical security which are entirely relative. It is for this reason in particular that increasingly, DES, the lengths of whose keys are too small to satisfy the conditions of system security, is being replaced by new means of encryption/decryption or with longer keys. Generally, these means having symmetric keys call upon algorithms comprising enciphering rounds.
Other attack strategies are referred to as Simple Power Analysis and Timing Analysis. In Simple Power Analysis, one uses the fact that a microprocessor tasked with encrypting or decrypting data is connected to a voltage source (in general 5 volts). When it is idle, a fixed current of magnitude i flows through it. When it is active, the instantaneous magnitude i is dependent, not only on the incoming data, but also on the encryption algorithm. Simple Power Analysis consists in measuring the current i as a function of time. The type of algorithm, which the microprocessor is performing can be deduced from this.
In the same way, the method of Timing Analysis consists in measuring the duration of computation as a function of a sample presented to the decryption module. Thus, the relationship between the sample presented and the time for computing the result makes it possible to retrieve the decryption module secret parameters such as the key. Such a system is described for example in the document <<Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems>> published by Paul Kocher, Cryptography Research, 870 Market St, Suite 1088, San Francisco, Calif.-USA.
To improve the security of the enciphering system, algorithms having asymmetric keys have been proposed, such as the so-called RSA (Rivest, Shamir and Adleman) systems. These systems comprise the generation of a pair of matched keys, one the so-called public key serving in the enciphering, and the other the so-called private key serving in the deciphering. These algorithms exhibit a high level of security, both system and physical security. They are on the other hand slower than the traditional systems, especially at the enciphering stage.
The most recent attack techniques call upon the so-called DPA concept, standing for Differential Power Analysis. These methods are based on suppositions, verifiable after a large number of trials, about the presence of a 0 or a 1 in a given position of the enciphering key. They are almost non-destructive, thus rendering them largely undetectable, and call upon both a physical intrusion component and a mathematical analysis component. Their manner of operation recalls the techniques for investigating oil fields, where an explosion of known power is generated at the surface and where earphones and probes, placed at likewise known distances from the site of the explosion, enable assumptions to be made about the stratigraphic composition of the subsurface without having to carry out too much digging, by virtue of the reflecting of the shock waves by the boundaries of sedimentary beds in this subsurface. DPA attacks are described in particular in § 2.1. of the document <<A Cautionary Note Regarding Evaluation of AES Candidates on Smart-Cards>>, published on 1st Feb. 1999 by Suresh Chari, Charanjit Jutla, Josyula R. Rao and Pankaj Rohatgi, of IBM T. J. Watson Research Center, Yorktown Heights, N.Y.
The requirement of having to resist DPA attacks forces the use of so-called <<whitening>> jamming systems, either in the input information, or at the output of an enciphering/deciphering algorithm. The technique of whitening is described in § 3.5 of the same aforesaid document.
Moreover, the fact that the computation powers are limited in the decentralized subsystem of a pay-per-view television system creates a problem, which has never yet been satisfactorily solved, for performing the chaining described previously to a sufficient extent.