Upload
erika-heath
View
220
Download
1
Tags:
Embed Size (px)
Citation preview
RSA Data Security, Inc.
Some Perspectives on Smart Card Cryptography
Burt Kaliski, Chief ScientistRSA Laboratories
SCIA IC Card & System Security MeetingNovember 16–17, 1998
© RSA 1998
Introduction
• The emerging world of e-commerce depends on security services:– user authentication– key distribution– data integrity and confidentiality– digital signatures / nonrepudiation
• Smart cards and cryptography are helpful tools for implementing these services
© RSA 1998
Smart Cards and Cryptography
• Smart cards carry the keys, perform cryptographic operations– ideal for “personal” cryptography
• Other tokens also considered in many designs:– PC cards– palmtops
© RSA 1998
Public Key vs. Symmetric
• A classic choice: scalability vs. speed– symmetric cryptography up to 100x faster– but management of public keys much
easier
• Open system or closed?
• Benefits can be combined
© RSA 1998
A Hybrid Approach
• Registration with public-key cryptography:– smart card establishes symmetric key via
server’s public key
• User authentication, key distribution, data protection with symmetric key
• Digital signatures combine public-key cryptography with hashing
© RSA 1998
Public-Key Algorithms
• Three families considered in standards:– discrete logarithm (DL): Diffie-Hellman,
DSA, MQV– elliptic curve (EC): analogs of DL– integer factorization (IF): RSA, RW
• Tradeoffs in key and data size, security, speed
© RSA 1998
Symmetric Algorithms
• Encryption algorithms:– DES, triple-DES, AES– “exportable” alternatives
• Integrity-protection algorithms
• Hash functions
• Tradeoffs primarily in security, speed
© RSA 1998
Protocols
• Many to choose from for each service
• Examples:– time-based vs. challenge-response user
authentication– key transport vs. key agreement
• Tradeoffs in algorithms supported, number of messages
© RSA 1998
Implementation Considerations
• Many kinds of physical attacks to contend with, beyond the cryptography:– timing analysis– power analysis– reverse engineering
• Logical attacks especially of concern in multi-application environments
© RSA 1998
Crypto-Coprocessors
• Cryptographic operations in smart cards are often accelerated with coprocessors– typical: modular exponentiation
• All three families can be accelerated with a modular arithmetic coprocessor– RSA (mod n)
– DL, EC over GF(p) for odd p
• What’s in a coprocessor today may be standard tomorrow
© RSA 1998
RSA Cryptography
• Cryptographic operations based on the RSA algorithm– PKCS #1, IEEE P1363, ANSI X9.31, X9.44
(draft) standards
• Key pair generation, encryption / decryption, signature / verification
• Example times given for several smart card chips– most with 8-bit CPUs, coprocessors
© RSA 1998
Key Length
• Typical RSA key length: 1024 bits
• Security about 280 against best methods– comparable to 160-bit ECC, 80-bit
symmetric in terms of operations– … but RSA-breaking methods require
much more memory
© RSA 1998
Private-Key Operations
• Signature generation and decryption with private key (n,d):
y = xd mod n– with Chinese Remainder Theorem:
yp = xd mod p-1 mod p
yq = xd mod q-1 mod q
y = [(yp-yq)q-1 mod p] q + yq
• Typical: two 512-bit modexps– 100-800ms on example smart cards
© RSA 1998
Public-Key Operations
• Signature verification or encryption with public key (n,e):
y = xe mod n– e = 3, 17, 216+1 common
• Typical: a few 1024-bit modmults– 5-265ms on smart cards with e = 216+1
• except in two cases, 50ms
– coprocessor not needed for small e
© RSA 1998
Key Pair Generation
• Public key (n,e)
• Private key (n,d)– where
n = pq
de 1 mod lcm (p-1, q-1)
• Typical: two 512-bit prime generations– est. 10-100 seconds on examples
© RSA 1998
Key and Data Sizes
• Nominal: about 1024 bits for signature, ciphertext, public key (+ e); 2560 bits for private key
• But many optimizations available:– 100 bits for private key with seed, offsets– 160-320 bits overhead for signatures with
message recovery
© RSA 1998
Example Timings
Manufacturer Device Clock(MHz)
Coproc. Sign(ms)
Verify(ms)
SGS-Thomson ST16CF54B 5 MAP 800 265
ST19CF68 10 MAP 400 150
ST19KF16 10 MAP 110 5
Philips P83W854 / 8 indep. FameX 250 50
P83W8516 / 32 indep. FameX 160 25
Siemens SLE66CX160S 5 ACE 230 24
NEC PD789828 40 SuperMAP 100 7
Source: H. Handschuh and P. Paillier, “Smart Card Crypto-Coprocessors for Public-Key Cryptography,” RSA Laboratories’ CryptoBytes, Summer 1998 (www.rsa.com/rsalabs/pubs/cryptobytes)
© RSA 1998
RSA and ECC Advantages
• ECC advantages– signature generation
/ decryption speed
– key pair generation speed
• key agreement, forward secrecy
– key and data sizes
– GF(2m) option
• RSA advantages– signature
verification / encryption speed
• certificate-based key management
– parameter generation speed (none)
– security analysis
For more reading: M.J. Wiener, “Performance Comparisons of Public-Key Cryptosystems,” RSA Laboratories’ CryptoBytes, Summer 1998(www.rsa.com/rsalabs/pubs/cryptobytes)
© RSA 1998
Interfaces and File Formats
• Interoperability is more than just the same algorithms and protocols
• Other aspects to consider:– physical interface (ISO 7816)– programming interface (PKCS #11)– information formats (PKCS #15)
© RSA 1998
PKCS: The Public-Key Cryptography Standards
• Informal, intervendor specifications
• Coordinated by RSA Laboratories, developed with the cryptography community
• More information:– www.rsa.com/rsalabs/pubs/PKCS
© RSA 1998
PKCS #11 / Cryptoki
• Programming interface for cryptographic tokens
• “Logical token” has objects, operations, access rights, independent of physical implementation
• Currently v2.01, revision in progress
© RSA 1998
PKCS #15: Information Formats
• Common formats for cryptographic objects– file formats in case of smart cards
• Coordination with several groups:– WAP Forum– DC/SC Forum– SEIS (Sweden)
• Draft available for comment