Automatic Generation of HCCA Resistant Scalar Multiplication - - PowerPoint PPT Presentation

▶
automatic generation of hcca resistant scalar
SMART_READER_LITE
LIVE PREVIEW

Automatic Generation of HCCA Resistant Scalar Multiplication - - PowerPoint PPT Presentation

Oct 16, 2022 244 likes •1k views

Automatic Generation of HCCA Resistant Scalar Multiplication Algorithm by Proper Sequencing of Field Multiplier Operands Poulami Das, Debapriya Basu Roy and, Debdeep Mukhopadhyay Indian Institute of Technology Kharagpur 29 / 09 / 2017 Debapriya

slide-1
SLIDE 1

Automatic Generation of HCCA Resistant Scalar Multiplication Algorithm by Proper Sequencing of Field Multiplier Operands

Poulami Das, Debapriya Basu Roy and, Debdeep Mukhopadhyay Indian Institute of Technology Kharagpur

29/09/2017 Debapriya Basu Roy, Proofs-2017 1/22

slide-2
SLIDE 2

Outline

Introduction

29/09/2017 Debapriya Basu Roy, Proofs-2017 2/22

slide-3
SLIDE 3

Outline

Introduction Motivation

29/09/2017 Debapriya Basu Roy, Proofs-2017 2/22

slide-4
SLIDE 4

Outline

Introduction Motivation Horizontal Collision Correlation Analysis (HCCA)

29/09/2017 Debapriya Basu Roy, Proofs-2017 2/22

slide-5
SLIDE 5

Outline

Introduction Motivation Horizontal Collision Correlation Analysis (HCCA) Asymmetric Leakage of Long Integer Field Multiplication

29/09/2017 Debapriya Basu Roy, Proofs-2017 2/22

slide-6
SLIDE 6

Outline

Introduction Motivation Horizontal Collision Correlation Analysis (HCCA) Asymmetric Leakage of Long Integer Field Multiplication Countermeasure Design

29/09/2017 Debapriya Basu Roy, Proofs-2017 2/22

slide-7
SLIDE 7

Outline

Introduction Motivation Horizontal Collision Correlation Analysis (HCCA) Asymmetric Leakage of Long Integer Field Multiplication Countermeasure Design Conclusion

29/09/2017 Debapriya Basu Roy, Proofs-2017 2/22

slide-8
SLIDE 8

Introduction

Cryptography has emerged as the practice or study of securing communications against third parties called adversaries.

29/09/2017 Debapriya Basu Roy, Proofs-2017 3/22

slide-9
SLIDE 9

Introduction

Cryptography has emerged as the practice or study of securing communications against third parties called adversaries. Public Key Cryptography (PKC) was introduced to address key issues

  • f Key Distribution Problem and Digital Signature Verification

problems.

29/09/2017 Debapriya Basu Roy, Proofs-2017 3/22

slide-10
SLIDE 10

Introduction

Cryptography has emerged as the practice or study of securing communications against third parties called adversaries. Public Key Cryptography (PKC) was introduced to address key issues

  • f Key Distribution Problem and Digital Signature Verification

problems. The two most widely used primitives of PKC are RSA and Elliptic Curve Cryptography.

29/09/2017 Debapriya Basu Roy, Proofs-2017 3/22

slide-11
SLIDE 11

Introduction

Cryptography has emerged as the practice or study of securing communications against third parties called adversaries. Public Key Cryptography (PKC) was introduced to address key issues

  • f Key Distribution Problem and Digital Signature Verification

problems. The two most widely used primitives of PKC are RSA and Elliptic Curve Cryptography. Elliptic Curve Cryptography (ECC) has emerged as a strong alternative to RSA due to its property of more security per key bit.

29/09/2017 Debapriya Basu Roy, Proofs-2017 3/22

slide-12
SLIDE 12

Motivation

ECC scalar multiplication algorithm is mathematically secure against the ECDLP problem.

29/09/2017 Debapriya Basu Roy, Proofs-2017 4/22

slide-13
SLIDE 13

Motivation

ECC scalar multiplication algorithm is mathematically secure against the ECDLP problem. However ECC algorithms once implemented, the implementations suffer from side-channel leakage such as power (EM) leakage, timing leakage, acoustic leakage etc.

29/09/2017 Debapriya Basu Roy, Proofs-2017 4/22

slide-14
SLIDE 14

Motivation

ECC scalar multiplication algorithm is mathematically secure against the ECDLP problem. However ECC algorithms once implemented, the implementations suffer from side-channel leakage such as power (EM) leakage, timing leakage, acoustic leakage etc.

29/09/2017 Debapriya Basu Roy, Proofs-2017 4/22

slide-15
SLIDE 15

Motivation

ECC scalar multiplication algorithm is mathematically secure against the ECDLP problem. However ECC algorithms once implemented, the implementations suffer from side-channel leakage such as power (EM) leakage, timing leakage, acoustic leakage etc. Ladder, Unified Algorithm, Atomic formula: Countermeasure against Simple Power Analysis

29/09/2017 Debapriya Basu Roy, Proofs-2017 4/22

slide-16
SLIDE 16

Motivation

ECC scalar multiplication algorithm is mathematically secure against the ECDLP problem. However ECC algorithms once implemented, the implementations suffer from side-channel leakage such as power (EM) leakage, timing leakage, acoustic leakage etc. Ladder, Unified Algorithm, Atomic formula: Countermeasure against Simple Power Analysis Scalar Blinding, Point Coordinate Randomization: Countermeasure against Differential Power Analysis

29/09/2017 Debapriya Basu Roy, Proofs-2017 4/22

slide-17
SLIDE 17

Motivation

Horizontal Attacks are special attacks which threatens a SPA as well as DPA resistant implementation.

29/09/2017 Debapriya Basu Roy, Proofs-2017 5/22

slide-18
SLIDE 18

Motivation

Horizontal Attacks are special attacks which threatens a SPA as well as DPA resistant implementation. It involves few (single) number of traces to break the entire secret key.

29/09/2017 Debapriya Basu Roy, Proofs-2017 5/22

slide-19
SLIDE 19

Motivation

Horizontal Attacks are special attacks which threatens a SPA as well as DPA resistant implementation. It involves few (single) number of traces to break the entire secret key. Thus imposes a serious threat to ECC implementations.

29/09/2017 Debapriya Basu Roy, Proofs-2017 5/22

slide-20
SLIDE 20

Horizontal Collision Correlation Analysis (HCCA)

First seminal work in Horizontal Attacks was Big Mac Attack by Walter et. al.

29/09/2017 Debapriya Basu Roy, Proofs-2017 6/22

slide-21
SLIDE 21

Horizontal Collision Correlation Analysis (HCCA)

First seminal work in Horizontal Attacks was Big Mac Attack by Walter et. al. Big Mac Analysis followed several flavors of Horizontal attacks on the RSA-based exponentiation algorithms.

29/09/2017 Debapriya Basu Roy, Proofs-2017 6/22

slide-22
SLIDE 22

Horizontal Collision Correlation Analysis (HCCA)

First seminal work in Horizontal Attacks was Big Mac Attack by Walter et. al. Big Mac Analysis followed several flavors of Horizontal attacks on the RSA-based exponentiation algorithms. Horizontal Collision Correlation Analysis or HCCA by Bauer et. al. put forward the idea of Horizontal Attacks in case of elliptic curve cryptography.

29/09/2017 Debapriya Basu Roy, Proofs-2017 6/22

slide-23
SLIDE 23

Horizontal Collision Correlation Analysis (HCCA)

First seminal work in Horizontal Attacks was Big Mac Attack by Walter et. al. Big Mac Analysis followed several flavors of Horizontal attacks on the RSA-based exponentiation algorithms. Horizontal Collision Correlation Analysis or HCCA by Bauer et. al. put forward the idea of Horizontal Attacks in case of elliptic curve cryptography. HCCA threatens an atomic scheme ECC algorithm or unified ECC algorithm (Edward curve) with SPA, DPA resistance.

29/09/2017 Debapriya Basu Roy, Proofs-2017 6/22

slide-24
SLIDE 24

Horizontal Collision Correlation Analysis (HCCA)

HCCA is based on underlying field multiplications that constitute ECC point addition and doubling.

29/09/2017 Debapriya Basu Roy, Proofs-2017 7/22

slide-25
SLIDE 25

Horizontal Collision Correlation Analysis (HCCA)

HCCA is based on underlying field multiplications that constitute ECC point addition and doubling. It is based on the following assumption: The adversary can detect when a pair of field multiplications have at least one operand in common

29/09/2017 Debapriya Basu Roy, Proofs-2017 7/22

slide-26
SLIDE 26

Horizontal Collision Correlation Analysis (HCCA)

HCCA is based on underlying field multiplications that constitute ECC point addition and doubling. It is based on the following assumption: The adversary can detect when a pair of field multiplications have at least one operand in common If A, B, C and D be field multiplications considered without loss of generality, then following pairs can be defined

29/09/2017 Debapriya Basu Roy, Proofs-2017 7/22

slide-27
SLIDE 27

Horizontal Collision Correlation Analysis (HCCA)

HCCA is based on underlying field multiplications that constitute ECC point addition and doubling. It is based on the following assumption: The adversary can detect when a pair of field multiplications have at least one operand in common If A, B, C and D be field multiplications considered without loss of generality, then following pairs can be defined (A × B, A × B): sharing both operands

29/09/2017 Debapriya Basu Roy, Proofs-2017 7/22

slide-28
SLIDE 28

Horizontal Collision Correlation Analysis (HCCA)

HCCA is based on underlying field multiplications that constitute ECC point addition and doubling. It is based on the following assumption: The adversary can detect when a pair of field multiplications have at least one operand in common If A, B, C and D be field multiplications considered without loss of generality, then following pairs can be defined (A × B, A × B): sharing both operands (A × B, C × B): sharing one operand

29/09/2017 Debapriya Basu Roy, Proofs-2017 7/22

slide-29
SLIDE 29

Horizontal Collision Correlation Analysis (HCCA)

HCCA is based on underlying field multiplications that constitute ECC point addition and doubling. It is based on the following assumption: The adversary can detect when a pair of field multiplications have at least one operand in common If A, B, C and D be field multiplications considered without loss of generality, then following pairs can be defined (A × B, A × B): sharing both operands (A × B, C × B): sharing one operand (A × B, C × D): sharing no operand

29/09/2017 Debapriya Basu Roy, Proofs-2017 7/22

slide-30
SLIDE 30

Horizontal Collision Correlation Analysis (HCCA)

Following properties have been defined:

29/09/2017 Debapriya Basu Roy, Proofs-2017 8/22

slide-31
SLIDE 31

Horizontal Collision Correlation Analysis (HCCA)

Following properties have been defined: property 1: When a pair of multiplications (mi, mj) share one (two) common operand (s).

29/09/2017 Debapriya Basu Roy, Proofs-2017 8/22

slide-32
SLIDE 32

Horizontal Collision Correlation Analysis (HCCA)

Following properties have been defined: property 1: When a pair of multiplications (mi, mj) share one (two) common operand (s). property 1a: When a pair of multiplications (mi, mj) share one common operand. For example: (A × B, C × B)

29/09/2017 Debapriya Basu Roy, Proofs-2017 8/22

slide-33
SLIDE 33

Horizontal Collision Correlation Analysis (HCCA)

Following properties have been defined: property 1: When a pair of multiplications (mi, mj) share one (two) common operand (s). property 1a: When a pair of multiplications (mi, mj) share one common operand. For example: (A × B, C × B) property 1b: When a pair of multiplications (mi, mj) share two common operands. For example: (A × B, A × B)

29/09/2017 Debapriya Basu Roy, Proofs-2017 8/22

slide-34
SLIDE 34

Horizontal Collision Correlation Analysis (HCCA)

Following properties have been defined: property 1: When a pair of multiplications (mi, mj) share one (two) common operand (s). property 1a: When a pair of multiplications (mi, mj) share one common operand. For example: (A × B, C × B) property 1b: When a pair of multiplications (mi, mj) share two common operands. For example: (A × B, A × B) property 2: When a pair of multiplications (mi, mj) share no common

  • perand among themselves. For example: (A × B, C × D)

29/09/2017 Debapriya Basu Roy, Proofs-2017 8/22

slide-35
SLIDE 35

Horizontal Collision Correlation Analysis (HCCA)

Following properties have been defined: property 1: When a pair of multiplications (mi, mj) share one (two) common operand (s). property 1a: When a pair of multiplications (mi, mj) share one common operand. For example: (A × B, C × B) property 1b: When a pair of multiplications (mi, mj) share two common operands. For example: (A × B, A × B) property 2: When a pair of multiplications (mi, mj) share no common

  • perand among themselves. For example: (A × B, C × D)

property 3: Given a set S of n field multiplications (m1, m2, . . ., mn), if there exists at least one pair (mi, mj), where mi and mj ∈ S, i = j, sharing property 1.

29/09/2017 Debapriya Basu Roy, Proofs-2017 8/22

slide-36
SLIDE 36

Horizontal Collision Correlation Analysis (HCCA)

HCCA can be launched in two scenarios.

29/09/2017 Debapriya Basu Roy, Proofs-2017 9/22

slide-37
SLIDE 37

Horizontal Collision Correlation Analysis (HCCA)

HCCA can be launched in two scenarios. HCCA scenario 1:

29/09/2017 Debapriya Basu Roy, Proofs-2017 9/22

slide-38
SLIDE 38

Horizontal Collision Correlation Analysis (HCCA)

HCCA can be launched in two scenarios. HCCA scenario 1: ECC point doubling can be considered as a set setd of nd underlying field multiplications (d1, d2, . . ., dnd)

29/09/2017 Debapriya Basu Roy, Proofs-2017 9/22

slide-39
SLIDE 39

Horizontal Collision Correlation Analysis (HCCA)

HCCA can be launched in two scenarios. HCCA scenario 1: ECC point doubling can be considered as a set setd of nd underlying field multiplications (d1, d2, . . ., dnd) ECC point addition can be considered as a set seta of na underlying field multiplications (a1, a2, . . ., ana)

29/09/2017 Debapriya Basu Roy, Proofs-2017 9/22

slide-40
SLIDE 40

Horizontal Collision Correlation Analysis (HCCA)

HCCA can be launched in two scenarios. HCCA scenario 1: ECC point doubling can be considered as a set setd of nd underlying field multiplications (d1, d2, . . ., dnd) ECC point addition can be considered as a set seta of na underlying field multiplications (a1, a2, . . ., ana) HCCA scenario 1 is based on condition 1 defined below:

29/09/2017 Debapriya Basu Roy, Proofs-2017 9/22

slide-41
SLIDE 41

Horizontal Collision Correlation Analysis (HCCA)

HCCA can be launched in two scenarios. HCCA scenario 1: ECC point doubling can be considered as a set setd of nd underlying field multiplications (d1, d2, . . ., dnd) ECC point addition can be considered as a set seta of na underlying field multiplications (a1, a2, . . ., ana) HCCA scenario 1 is based on condition 1 defined below: condition 1: Only one of the sets seta and setd satisfies property 3.

29/09/2017 Debapriya Basu Roy, Proofs-2017 9/22

slide-42
SLIDE 42

Horizontal Collision Correlation Analysis (HCCA)

HCCA scenario 1

DBL DBL ADD DBL ADD DBL DBL Correlation is low Correlation is high

10110.........

X1Y2 X2Y1 X1Y1 X1Y1

Figure: HCCA scenario 1

29/09/2017 Debapriya Basu Roy, Proofs-2017 10/22

slide-43
SLIDE 43

Horizontal Collision Correlation Analysis (HCCA)

HCCA scenario 2:

29/09/2017 Debapriya Basu Roy, Proofs-2017 11/22

slide-44
SLIDE 44

Horizontal Collision Correlation Analysis (HCCA)

HCCA scenario 2: Scenario 2 is based on the fact: In point addition operation one of the point parameter is always the base point.

29/09/2017 Debapriya Basu Roy, Proofs-2017 11/22

slide-45
SLIDE 45

Horizontal Collision Correlation Analysis (HCCA)

HCCA scenario 2: Scenario 2 is based on the fact: In point addition operation one of the point parameter is always the base point. It holds irrespective of the curve equation or the unified formula steps involved in the scalar multiplication.

29/09/2017 Debapriya Basu Roy, Proofs-2017 11/22

slide-46
SLIDE 46

Horizontal Collision Correlation Analysis (HCCA)

HCCA scenario 2: Scenario 2 is based on the fact: In point addition operation one of the point parameter is always the base point. It holds irrespective of the curve equation or the unified formula steps involved in the scalar multiplication.

HCCA scenario 2

Correlation is high

10110.............

DBL DBL ADD DBL ADD DBL DBL XpXb XqXb

Figure: HCCA scenario 2

29/09/2017 Debapriya Basu Roy, Proofs-2017 11/22

slide-47
SLIDE 47

Asymmetric Leakage of Field Multiplications

Long Integer Multiplication

Algorithm 1: Long Integer Multiplication algorithm(LIM)

Data: : {X = (X[t], X[t − 1], ...., X[1])2w } , {Y = (Y [t], Y [t − 1], ...., Y [1])2w } Result: : {X.Y } begin for i ← 1 to 2t do R[i] = 0 end for i ← 1 to t do C = 0 ; for j ← 1 to t do (U, V )2w = X[i] × Y [j] ; (U, V )2w = (U, V )2w + C ; (U, V )2w = (U, V )2w + R[i + j − 1] ; R[i + j − 1] = V ; C = U; end R[i + t] = C ; end return R ; end

29/09/2017 Debapriya Basu Roy, Proofs-2017 12/22

slide-48
SLIDE 48

Asymmetric Leakage of Field Multiplications

Let Ci be the operation leaking information at each iteration.

29/09/2017 Debapriya Basu Roy, Proofs-2017 13/22

slide-49
SLIDE 49

Asymmetric Leakage of Field Multiplications

Let Ci be the operation leaking information at each iteration. The output of the calculation Ci is denoted as Oi

29/09/2017 Debapriya Basu Roy, Proofs-2017 13/22

slide-50
SLIDE 50

Asymmetric Leakage of Field Multiplications

Let Ci be the operation leaking information at each iteration. The output of the calculation Ci is denoted as Oi At each iteration output Oi leaks an information l(Oi)

29/09/2017 Debapriya Basu Roy, Proofs-2017 13/22

slide-51
SLIDE 51

Asymmetric Leakage of Field Multiplications

Let Ci be the operation leaking information at each iteration. The output of the calculation Ci is denoted as Oi At each iteration output Oi leaks an information l(Oi) The leakage l(Oi) is approximated by the Hamming Weight power model.

29/09/2017 Debapriya Basu Roy, Proofs-2017 13/22

slide-52
SLIDE 52

Asymmetric Leakage of Field Multiplications

Let Ci be the operation leaking information at each iteration. The output of the calculation Ci is denoted as Oi At each iteration output Oi leaks an information l(Oi) The leakage l(Oi) is approximated by the Hamming Weight power model. A long integer multiplication LIM(A, B) leads to a leakage vector < l(a0b0), l(a0b1), . . ., l(aibj), . . ., l(at−1bt−1) >

29/09/2017 Debapriya Basu Roy, Proofs-2017 13/22

slide-53
SLIDE 53

Asymmetric Leakage of Field Multiplications

ρ1 = Corr(LIM(A, B), LIM(C, B))

29/09/2017 Debapriya Basu Roy, Proofs-2017 14/22

slide-54
SLIDE 54

Asymmetric Leakage of Field Multiplications

ρ1 = Corr(LIM(A, B), LIM(C, B)) ρ2 = Corr(LIM(A, B), LIM(B, C))

29/09/2017 Debapriya Basu Roy, Proofs-2017 14/22

slide-55
SLIDE 55

Asymmetric Leakage of Field Multiplications

ρ1 = Corr(LIM(A, B), LIM(C, B)) ρ2 = Corr(LIM(A, B), LIM(B, C)) ρ3 = Corr(LIM(A, B), LIM(C, D))

29/09/2017 Debapriya Basu Roy, Proofs-2017 14/22

slide-56
SLIDE 56

Asymmetric Leakage of Field Multiplications

ρ1 = Corr(LIM(A, B), LIM(C, B)) ρ2 = Corr(LIM(A, B), LIM(B, C)) ρ3 = Corr(LIM(A, B), LIM(C, D)) Lemma 1: std(LIM(A, B)) = std(LIM(B, A))

29/09/2017 Debapriya Basu Roy, Proofs-2017 14/22

slide-57
SLIDE 57

Asymmetric Leakage of Field Multiplications

ρ1 = Corr(LIM(A, B), LIM(C, B)) ρ2 = Corr(LIM(A, B), LIM(B, C)) ρ3 = Corr(LIM(A, B), LIM(C, D)) Lemma 1: std(LIM(A, B)) = std(LIM(B, A)) Lemma 2: cov(LIM(A, B), cov(LIM(C, B)) = cov(LIM(A, B), LIM(B, C)).

29/09/2017 Debapriya Basu Roy, Proofs-2017 14/22

slide-58
SLIDE 58

Asymmetric Leakage of Field Multiplications

With the help of the Lemmas following observations are made:

29/09/2017 Debapriya Basu Roy, Proofs-2017 15/22

slide-59
SLIDE 59

Asymmetric Leakage of Field Multiplications

With the help of the Lemmas following observations are made: Observation 1: ρ1 = ρ2

29/09/2017 Debapriya Basu Roy, Proofs-2017 15/22

slide-60
SLIDE 60

Asymmetric Leakage of Field Multiplications

With the help of the Lemmas following observations are made: Observation 1: ρ1 = ρ2 Observation 2: ρ2 ≈ ρ3

29/09/2017 Debapriya Basu Roy, Proofs-2017 15/22

slide-61
SLIDE 61

Asymmetric Leakage of Field Multiplications

With the help of the Lemmas following observations are made: Observation 1: ρ1 = ρ2 Observation 2: ρ2 ≈ ρ3 Observation 3: ρ1 > ρ2, when C=A (i.e. both the operands are shared).

29/09/2017 Debapriya Basu Roy, Proofs-2017 15/22

slide-62
SLIDE 62

Countermeasure Design: Safe Sequence

Safe sequence formation for Edward curve formula

T1T3 S1 = X1 × Y2 S2 = X1 × X2 S3 = Y1 × Y2 S4 = X2 × Y1 T1 = Z1 × Z2 S5 = T1 × T1 S6 = T1 × T2 = T1 × (S1 + S4) (S5 − dT4) × S6 = T5 × T6 (S5 + dT4) × S7 = T7 × T8 (S5 − dT4) × (S5 + dT4) = T5 × T7 X1Y2 Y1Y2 X2Y1 X1X2 T1T2 T1T1 T5T7 T7T8 T5T6 T1T1 T1T3 T1T2 X1Y1 Y1Y1 X1Y1 X1X1 T5T6 T5T8 T7T8 T7T8 T5T7 T5T6 X1X1 Y1X1 Y1Y1 T1T1 T1T3 T1T2 X1Y1 S7 = T1 × T3 = T1 × (S3 − S2) T4 = S2 × S3

Figure: Safe sequence transformation of Edward unified formula

29/09/2017 Debapriya Basu Roy, Proofs-2017 16/22

slide-63
SLIDE 63

Countermeasure Design: Safe Sequence

Safe sequence formation for Brier-Joye unified formula

Z1X1 X1Z1 Z1Z1 FM ZM Y1Z1 Z1Y1 X1Z2 Y1Z2 Z1Z2 Y1Z1 X2Z1 ZM FM Y1Z1 X1Z1 X1Z1 Y1Z1 Z1Z1 FM ZM

Figure: Safe sequence transformation of Brier-Joye unified formula

29/09/2017 Debapriya Basu Roy, Proofs-2017 17/22

slide-64
SLIDE 64

Results

Equipments:

29/09/2017 Debapriya Basu Roy, Proofs-2017 18/22

slide-65
SLIDE 65

Results

Equipments:

SASEBO GII Board

29/09/2017 Debapriya Basu Roy, Proofs-2017 18/22

slide-66
SLIDE 66

Results

Equipments:

SASEBO GII Board Oscilloscope (DPO4034B)

29/09/2017 Debapriya Basu Roy, Proofs-2017 18/22

slide-67
SLIDE 67

Results

Equipments:

SASEBO GII Board Oscilloscope (DPO4034B) JTAG Cable

29/09/2017 Debapriya Basu Roy, Proofs-2017 18/22

slide-68
SLIDE 68

Results

Equipments:

SASEBO GII Board Oscilloscope (DPO4034B) JTAG Cable EM Probe

29/09/2017 Debapriya Basu Roy, Proofs-2017 18/22

slide-69
SLIDE 69

Results

Scalar Multiplication Number

100 200 300 400 500 600

Correlation Coefficient

0.75 0.8 0.85 0.9 0.95 1

Doubling(Both Operands Are Shared) Addition(No Operands are Shared)

(a) Evaluation of HCCA on

Edwards Curve Scalar Mul- tiplier

Scalar Multiplication Number

100 200 300 400 500 600

Correlation coefficient

0.75 0.8 0.85 0.9 0.95 1 Doubling(Both Operands Are Shared but Sequence is Swapped) Addition(No Operands are Shared)

(b)

Evaluation

  • f

pro- posed countermeasure on Edwards Curve Scalar Mul- tiplier

29/09/2017 Debapriya Basu Roy, Proofs-2017 19/22

slide-70
SLIDE 70

HCCA Scenario 2 and Other Collision Attacks

HCCA scenario 2: Same input point is used in all addition steps Re-randomization: Use randomize input point at each stage of addition steps After the end of scalar multiplication loop, de-randomize the results1. Similar re-randomization can be used to mitigate other single trace collision attacks 2.

1Poulami Das, Debapriya Basu Roy, Debdeep Mukhopadhyay: Exploiting the Order of

Multiplier Operands: A Low Cost Approach for HCCA Resistance. IACR Cryptology ePrint Archive 2015: 925 (2015)

  • 2N. Hanley, H. Kim, and M. Tunstall, Exploiting collisions in addition chain-based

exponentiation algorithm using a single trace, Cryptography ePrint Archive: Report 2012/485.

29/09/2017 Debapriya Basu Roy, Proofs-2017 20/22

slide-71
SLIDE 71

Conclusion

We have shown how the property of asymmetric leakage of field multipliers can be utilized to construct a low-cost countermeasure which is able to defeat the powerful HCCA.

29/09/2017 Debapriya Basu Roy, Proofs-2017 21/22

slide-72
SLIDE 72

Conclusion

We have shown how the property of asymmetric leakage of field multipliers can be utilized to construct a low-cost countermeasure which is able to defeat the powerful HCCA. We show how a unified addition (doubling) formula can be converted into a safe sequence where, the information leakage from sharing of

  • perands among field multipliers have been hidden. Once the

sequence have been determined through Algorithm 1 there is no runtime overhead requirement for the step 1 of our countermeasure.

29/09/2017 Debapriya Basu Roy, Proofs-2017 21/22

slide-73
SLIDE 73

Conclusion

We have shown how the property of asymmetric leakage of field multipliers can be utilized to construct a low-cost countermeasure which is able to defeat the powerful HCCA. We show how a unified addition (doubling) formula can be converted into a safe sequence where, the information leakage from sharing of

  • perands among field multipliers have been hidden. Once the

sequence have been determined through Algorithm 1 there is no runtime overhead requirement for the step 1 of our countermeasure. We have validated HCCA and our proposed countermeasure scheme

  • n a SASEBO platform.

29/09/2017 Debapriya Basu Roy, Proofs-2017 21/22

slide-74
SLIDE 74

Thank You

29/09/2017 Debapriya Basu Roy, Proofs-2017 22/22