Date de l'exposé : 25 avril 2014
Same-Values Analysis on Elliptic Curve CryptographyElliptic Curve Cryptography (ECC) is believed to be unbreakable in the black box model, where the cryptanalyst has access to inputs and outputs only. However, it is not enough if the cryptosystem is embedded on a device that is physically accessible to potential attackers. In addition to inputs and outputs, the attacker can study the physical behaviour of the device such as the execution time or the power consumption. These attacks are called side-channel attacks.
In this talk we present some attacks we called Same-Values Analysis. The attacks are named after the same principle: they take advantage of same values occurring within an Elliptic Curve Scalar Multiplication (ECSM). They differ from the targeted implementation or from the method used to detect the occurrence of the same values.
In the first part of the talk, we analyse the Unified Formulae and the Side-Channel Atomicity countermeasures. These countermeasures permit to protect against one of the first side-channel attack on ECC: the Simple Power Analysis. We show that these coutermeasures bring vulnerabilities since they succumbs to some of our Same-Values Analysis. The attacks are powerful since the attacker does not need to know the input or output point of the ECSM. Moreover, only a single trace is required to recover all bits of the scalar.
In the second part, we focus on another Same-Values Analysis. It exploits the occurrence of particular points. These points verify that, within an elliptic curve operation (e.g. an addition or a doubling), two distinct intermediate variables have the same values. The attacker chooses the suitable base point such that the particular point will occur during the ECSM only if some conditions of the scalar are met.