• Abstract and Figures
• Public Full-text

Failure of the Point Blinding Countermeasure Against Fault Attack in Pairing-Based Cryptography Nadia El Mrabet, Emmanuel Fouotsa To cite this version: Nadia El Mrabet, Emmanuel Fouotsa. Failure of the Point Blinding Countermeasure Against Fault Attack in Pairing-Based Cryptography. 2015, 10.1007/978-3-319-18681-8_21. hal-01197148 HAL Id: hal-01197148 https://hal.archives-ouvertes.fr/hal-01197148 Submitted on 11 Sep 2015 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Failure of the Point Blinding Countermeasure against Fault Attack in Pairing-Based Cryptography ? Nadia EL MRABET1 and Emmanuel FOUOTSA2 (1) LIASD − Universit´eParis 8 -France - [email protected] (1) SAS - CMP Gardanne - France - [email protected] (2) Dep of Mathematics, Higher Teacher's Training College, University of Bamenda - Cameroun (2) LMNO − Universit´ede Caen - France - [email protected] Abstract. Pairings are mathematical tools that have been proven to be very useful in the con- struction of many cryptographic protocols. Some of these protocols are suitable for implementation on power constrained devices such as smart cards or smartphone which are subject to side channel attacks. In this paper, we analyse the efficiency of the point blinding countermeasure in pairing based cryptography against side channel attacks. In particular,we show that this countermeasure does not protect Miller's algorithm for pairing computation against fault attack. We then give rec- ommendation for a secure implementation of a pairing based protocol using the Miller algorithm. Key words: Miller's algorithm, Identity Based Cryptography, Side Channel Attacks, Fault Attacks, Countermeasure. 1 Introduction Pairings are bilinear maps defined on the group of rationals points of elliptic or hyper elliptic curves [36]. Nowadays, more and more protocols using pairings are proposed in the literature [10, 21, 6]. Among these protocols, only those constructed on the identity based model involve a se- cret which is one of the argument during the computation of a pairing. The implementation of a pairing based protocol is efficient enough to allow the use of pairing based cryptography on power constrained device such as smart cards and mobile phones [31, 22, 19]. Smart cards are by nature sensitive to side channel attacks. Side channel attacks are powerful attacks that use the implementation of a protocol to obtain information on the secret. They are divided into two families: invasive and non invasive attacks. Invasive attacks are based on the model of fault attacks. The execution of a protocol is disturbed, the result is then a faulty one and the analysis of this faulty result can provide information on the secret. In non invasive attacks, the information can be leaked by the time of execution, the electric consumption or the elec- tromagnetic emission of the device. Several works have investigated the robustness of identity based cryptography to side channel attacks. They are mainly focused on fault attacks [27, 37, 11, 2]. Few works consider differential power analysis attack [27, 13, 5]. As the secret during an identity based protocol can be recovered by side channel attacks, several countermeasures were proposed. Those countermeasures are the same for invasive and non invasive attacks [14]. In [16], Ghosh, Mulhopadhyay and Chowdhury proposed an analysis of countermeasures to fault attack presented in [27]: the new point blinding method and the alliterating point blinding method. They concluded that the countermeasures are not sufficient and proposed new one. However, ? This work was supported in part by the French ANR-12-INSE-0014 SIMPATIC Project. The second author is supported by The Simons Foundations through Pole of Research in Mathematics with applications to Infor- mation Security, Subsaharan Africa their explanations on the non efficiency of the countermeasure are not convincing. Later, Park et al. [28] clearly exposed the weaknesses of the point blinding technique against fault attacks described by Page and Vercauteren [27]. In this article we analyze and extend the work in [16, 28] on the efficiency of the point blinding countermeasure in pairing based cryptography. Especially, we generalize the attack of Park et al. [28] and expose its failure to protect the Miller algorithm, main tool in pairing computation. As the most efficient pairings are constructed on the model of the Tate pairing, we focus on the Miller algorithm, used for the Tate pairing considering Weierstrass elliptic curve. Obviously, this analysis is the same for the (optimal ) Ate, twisted Ate or pairing lattices; and for every model of elliptic curve or coordinates. The rest of this paper is organized as follows: The Section 2 presents brief concepts on pairings that are useful to understand this work. In Section 3 we present side channel attacks with emphasis on fault attacks in pairing based cryptography. In Section 4 we explicitly demonstrate that the point blinding countermeasure fails to protect the Miller algorithm against fault attack. Finally we conclude the work in Section 6. 2 Background on pairings In this section, we briefly recall basics on pairings and on the Miller algorithm [25], main tool for an efficient computation of pairings. Let E be an elliptic curve defined over a finite field Fq, with q a prime number or a power of a prime. The neutral element of the additive group law defined on the set of rational points of E is denoted P1. Let r be a large prime divisor of the group order ]E(Fq) and k the embedding degree of E with respect to r, i.e. the smallest integer k such that k r divides q − 1. The integer k is also the smallest integer such that E Fq [r] ⊂ E(Fqk ), where E Fq [r] = fP 2 E Fq :[r]P = P1g with [r]P = P + P + ::: + P and Fq is the algebraic | {z } r times closure of Fq. In general , the sizes of r, q and k are dependent from the security level and the currently recommendations are at least r > 2160 and qk > 22024 [15]. The recent results for the discrete logarithm problem [20, 3] imply that the number q must be a large prime number. The security recommendations allow the choice of k to be a product of power of 2 and 3. A consequence of the fact that k ≡ 0 mod 2 is the use of a twist representation for the point Q. This representation using a twisted elliptic curve allow the denominator elimination optimization [23]. Definition of a twisted elliptic curve. We explain here the concept of twist of elliptic curve in the context of Weierstrass elliptic curve. This will help us to understand the choice of the coordinates of points in Section 4. The quadratic twist of the elliptic curve E : y2 = x3 + ax + b ~ 1 2 3 over Fpk is the elliptic curve E : ν y = x + ax + b where f1; νg is a basis of Fqk as Fqk=2 vector space. The two curves are isomorphic via ~ : E(F k=2 ) −! E(Fqk ) q p (x; y) 7−! (x; y ν): This isomorphism is particularly useful since it enables to take the point Q 2 E(Fqk ) in 0 0 the following manner Q = (Q ) where Q = (xQ; yQ) with xQ; yQ 2 Fqk=2 . This ensures an efficient computation since many computations will be consequently done instead in the subfield Fqk=2 and more interestingly, it enables to avoid the inversions in the Miller algorithm. This elimination is the denominator elimination [23]. Indeed, if P1(x1; y1) and P2(x2; y2) are two points of the elliptic curve in Weierstrass form 2 3 E : y = x + ax + b then the function hP1;P2 with divisor Div(hP1;P2 ) = (P1) + (P2) − (P1 + P2) − (P1); `P1;P2 is hP1;P2 = where `P1;P2 is the straight line defining P1+P2 and vP1+P2 is the corresponding vP1+P2 vertical line passing through P1 + P2. Explicitly, we have y − λx − α hP1;P2 (x; y) = ; x − x3 2 y2 − y1 3x1 + a where x3 is the first coordinate of P1 + P2 and λ = if P1 6= P2, λ = if x2 − x1 2y1 P1 = P2 and α = y1 − λx1. In the particular case of doubling (P1 = P2), a straightforward computation gives, after X1 Y1 changing to Jacobian coordinates (x1 = 2 , y1 = 3 ) Z1 Z1 3 p 2 2 4 2 p 2Y1Z1 yQ ν − 2Y1 − (3X1 + aZ1 )(xQZ1 − X1) hP1;P1 (Q) = hP1;P2 (xQ; yQ ν) = 3 ; 2Y1Z1 (xQ − x3) We then remark that the denominator of the previous expression is an element of Fqk=2 and consequently will be equal to 1 during the final exponentiation. So the main expression that will be used in the Miller algorithm is: p 3 p 2 2 4 2 hP1;P1 (Q) = hP1;P2 (xQ; yQ ν) = 2Y1Z1 yQ ν − 2Y1 − (3X1 + aZ1 )(xQZ1 − X1) (1) The expression given by equation 1 is used in algorithms 1 and 2 and will be particularly useful in Section 4 to illustrate our attack. The Tate pairing. Consider a point P 2 E(Fq)[r], the principal divisor D = r(P ) − r(P1) and a function fr;P with divisor Div (fr;P ) = D. Let Q 2 E(Fqk )[r]=E(Fq) and µr be the group ∗ of r-th roots of unity in Fqk .

Load more

  14

Copy Link