1. Efficient Downloading and Updating Application on Smart Cards Yongsu Park, Junyoung Heo, Yookun Cho School of Computer Science and Engineering Seoul National University

2. Download of applications on Smart Cards  2 types of the smart card  Applications are loaded onto the ROM at the time of fabrication  These cards should be used for some specific purpose.  Applications are downloaded onto the FLASH memory when they are required.  This provides flexibility and wide utilities.  Small communication bandwidth, small size of he card’s RAM => Usually, application is divided into blocks, each of which is downloaded into the smart card.

3. Threats and Security Requirements  Threats for downloading the applications  Downloaded application can be a malicious program.  Downloaded application may be infected by a virus.  Malicious program can illegally modify the files containing e-cash.  Security Requirements  Source authentication of the downloaded blocks  Data integrity of the downloaded blocks  Naive approach – Signing each block  Computationally inefficient  large communication overhead

4. Previous work  CASCADE with hashes  Requires a large amount of FLASH memory and RAM  CASCADE without hashes  Has a long verification delay of each block  OTA (Ordered Tree Authentication)  Requires a large amount of FLASH memory (e.g., If a block size is 256 bytes and SHA-1 is used, OTA requires 15.6 % overhead)

5. Proposed Scheme  Proposed scheme  Based on hash-chaining technique  Parameterized scheme  Provides a trade-off between the required FLASH memory size and the verification delay of updating the application.  Two phases  Authentication information generation phase  Transmission phase Sig(H 1 ) M1M1 M2M2 M3M3 M4M4 H(M 4 ||M 5 ) H 1 H 2 H 3 H 4 H(M 3 ||H 4 )H(M 2 ||H 3 )H(M 1 ||H 2 ) M5M5

6. Downloading the application  Authentication information generation phase 1. An application consists of blocks, M 1, …, M n. 2. A parameter k, k|n. 3. For every n/k chunks, AP computes a hash-chain (without a Sig()). 4. For S 1, …, S k, AP computes a hash chain. H 1 H 4 M1M1 M2M2 M4M4 M5M5 H(M 1 ||H 1 ) H(M 2 ||M 3 )H(M 5 ||M 6 ) H(M 4 ||H 4 ) S 1 S 2 S 3 S 4 M3M3 M6M6 H 7 H 10 M7M7 M8M8 M 10 M 11 H(M 7 ||H 7 ) H(M 8 ||M 9 )H(M 11 ||M 12 ) H(M 11 ||H 11 ) M9M9 M 12 An example (n=12, k=4) Sig AP (I 1 ) S1S1 S2S2 S3S3 S4S4 H(S 3 ||I 4 )H(S 2 ||I 3 )H(S 1 ||I 2 ) I 1 I 2 I 3

7. Downloading the application (Cont’d)  Transmission phase 1. AP transmits Sig AP (I 1 ), I 1, (S 1, I 2 ), (S 2, I 3 ), …, (S k-2, I k-1 ), (S k-1, S k-2 ) 2. The card verifies S i and then stores Sig AP (I 1 ), S 1, S 2, …, S k in the FLASH memory. 3. AP transmits each hash chain that corresponds to S i 4. The card verifies M i and then stores it in the FLASH memory. H 1 H 4 M1M1 M2M2 M4M4 M5M5 H(M 1 ||H 1 ) H(M 2 ||M 3 )H(M 5 ||M 6 ) H(M 4 ||H 4 ) S 1 S 2 S 3 S 4 M3M3 M6M6 H 7 H 10 M7M7 M8M8 M 10 M 11 H(M 7 ||H 7 ) H(M 8 ||M 9 )H(M 11 ||M 12 ) H(M 11 ||H 11 ) M9M9 M 12 Sig AP (I 1 ) S1S1 S2S2 S3S3 S4S4 H(S 3 ||I 4 )H(S 2 ||I 3 )H(S 1 ||I 2 ) I 1 I 2 I 3

8. Updating the application  Consider the case when a single block M t is to be updated.  Authentication information generation phase 1. AP recalculates all the hash-chains.  Transmission phase 1. AP transmits Sig AP (I 1 ), I 1, (S 1, I 2 ), (S 2, I 3 ), …, (S k-2, I k-1 ), (S k-1, S k-2 ) 2. The card verifies S i and then stores Sig AP (I 1 ), S 1, S 2, …, S k in the FLASH memory. 3. AP transmits a single hash chain that corresponds to S i which contains M t. 4. The card verifies data blocks and then stores them in the FLASH memory.

9. Analysis  Amount of required RAM and FLASH memory  Required RAM size: O(1)  FLASH memory overhead: O(k)  Verification Delay  Verification delay of M i : # of hashes to be downloaded for verification after M i is downloaded.  Downloading the application: O(k). By the method in Section 4.2, this can be reduced to O(1).  Updating the application: O(k+n/k)

10. Comparison

11. Conclusion  This paper presents an efficient method for authentication of the application that is to be downloaded/updated into the smart card.  The proposed scheme is based on hash chain technique and provide a trade-off between the FLASH memory requirement (O(k)) and verification delay of updating the application (O(n/k))  Moreover, the the required RAM size and verification delay of downloading the application are O(1).