Description
Elliptic Curve Cryptography (ECC) is believed to be unbreakable in the black box model, where the cryptanalyst has access to inputs and outputs only. However, it is not enough if the cryptosystem is embedded on a device that is physically accessible to potential attackers. In addition to inputs and outputs, the attacker can study the physical behaviour of the device such as the execution time or the power consumption. These attacks are called side-channel attacks.<br/> In this talk we present some attacks we called Same-Values Analysis. The attacks are named after the same principle: they take advantage of same values occurring within an Elliptic Curve Scalar Multiplication (ECSM). They differ from the targeted implementation or from the method used to detect the occurrence of the same values. In the first part of the talk, we analyse the Unified Formulae and the Side-Channel Atomicity countermeasures. These countermeasures permit to protect against one of the first side-channel attack on ECC: the Simple Power Analysis. We show that these coutermeasures bring vulnerabilities since they succumbs to some of our Same-Values Analysis. The attacks are powerful since the attacker does not need to know the input or output point of the ECSM. Moreover, only a single trace is required to recover all bits of the scalar.<br/> In the second part, we focus on another Same-Values Analysis. It exploits the occurrence of particular points. These points verify that, within an elliptic curve operation (e.g. an addition or a doubling), two distinct intermediate variables have the same values. The attacker chooses the suitable base point such that the particular point will occur during the ECSM only if some conditions of the scalar are met.
Prochains exposés
-
Polytopes in the Fiat-Shamir with Aborts Paradigm
Orateur : Hugo Beguinet - ENS Paris / Thales
The Fiat-Shamir with Aborts paradigm (FSwA) uses rejection sampling to remove a secret’s dependency on a given source distribution. Recent results revealed that unlike the uniform distribution in the hypercube, both the continuous Gaussian and the uniform distribution within the hypersphere minimise the rejection rate and the size of the proof of knowledge. However, in practice both these[…]-
Cryptographie
-
Primitive asymétrique
-
Mode et protocole
-
-
Post-quantum Group-based Cryptography
Orateur : Delaram Kahrobaei - The City University of New York