Loop-abort faults on supersingular isogeny cryptosystems Alexandre - - PowerPoint PPT Presentation

▶
loop abort faults on supersingular isogeny cryptosystems
SMART_READER_LITE
LIVE PREVIEW

Loop-abort faults on supersingular isogeny cryptosystems Alexandre - - PowerPoint PPT Presentation

Feb 25, 2024 368 likes •955 views

Loop-abort faults on supersingular isogeny cryptosystems Alexandre Glin Benjamin Wesolowski Laboratoire dInformatique de Paris 6 Sorbonne Universits UPMC, France cole Polytechnique Fdrale de Lausanne, EPFL IC LACAL, Switzerland

slide-1
SLIDE 1

Loop-abort faults on supersingular isogeny cryptosystems

Alexandre Gélin Benjamin Wesolowski

Laboratoire d’Informatique de Paris 6 – Sorbonne Universités UPMC, France École Polytechnique Fédérale de Lausanne, EPFL IC LACAL, Switzerland

PQCrypto 2017 – Utrecht 2017/06/26

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-2
SLIDE 2

Supersingular-Isogeny Public-key Cryptography

Introduced by Jao, De Feo, and Plût in 2011

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-3
SLIDE 3

Supersingular-Isogeny Public-key Cryptography

Introduced by Jao, De Feo, and Plût in 2011 Based on the same problem as the hash function of [CLG06]

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-4
SLIDE 4

Supersingular-Isogeny Public-key Cryptography

Introduced by Jao, De Feo, and Plût in 2011 Based on the same problem as the hash function of [CLG06] The isogeny graph of a supersingular elliptic curve:

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-5
SLIDE 5

Supersingular-Isogeny Public-key Cryptography

Introduced by Jao, De Feo, and Plût in 2011 Based on the same problem as the hash function of [CLG06] The isogeny graph of a supersingular elliptic curve:

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-6
SLIDE 6

Supersingular elliptic curves

Definition A supersingular elliptic curve is a curve E defined over Fpk such that

#E

  • Fpk
  • = 1 mod p.

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-7
SLIDE 7

Supersingular elliptic curves

Definition A supersingular elliptic curve is a curve E defined over Fpk such that

#E

  • Fpk
  • = 1 mod p.

Interesting properties: All supersingular elliptic curves can be defined over Fp2 About

p 12 supersingular elliptic curves, up to isomorphism

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-8
SLIDE 8

Isogenies

Definition An isogeny φ between two elliptic curves E1 and E2 is a surjective group homomorphism with a finite kernel. The degree is defined by

degφ = #Ker φ.

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-9
SLIDE 9

Isogenies

Definition An isogeny φ between two elliptic curves E1 and E2 is a surjective group homomorphism with a finite kernel. The degree is defined by

degφ = #Ker φ.

Interesting properties:

G ⊂ E1 = ⇒ a unique E2 and φ such that φ : E1 → E2

and Ker φ = G

E2 = E/G is obtained in O

  • degφ
  • Alexandre Gélin, Benjamin Wesolowski

Loop-abort faults on supersingular isogeny cryptosystems

slide-10
SLIDE 10

Key-Exchange Protocol

A prime p such that p+1 = ℓn

Aℓm B

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-11
SLIDE 11

Key-Exchange Protocol

A prime p such that p+1 = ℓn

Aℓm B

A supersingular elliptic curve E with ℓn

Aℓm B points

E

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-12
SLIDE 12

Key-Exchange Protocol

A prime p such that p+1 = ℓn

Aℓm B

A supersingular elliptic curve E with ℓn

Aℓm B points

A point RA chosen randomly in E

  • ℓn

A

  • E

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-13
SLIDE 13

Key-Exchange Protocol

A prime p such that p+1 = ℓn

Aℓm B

A supersingular elliptic curve E with ℓn

Aℓm B points

A point RA chosen randomly in E

  • ℓn

A

  • −

→ (mA,nA) ∈ {1,...,ℓn

A}2 random,

RA = mAPA +nAQA for 〈PA,QA〉 = E

  • ℓn

A

  • E

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-14
SLIDE 14

Key-Exchange Protocol

A prime p such that p+1 = ℓn

Aℓm B

A supersingular elliptic curve E with ℓn

Aℓm B points

A point RA chosen randomly in E

  • ℓn

A

  • −

→ (mA,nA) ∈ {1,...,ℓn

A}2 random,

RA = mAPA +nAQA for 〈PA,QA〉 = E

  • ℓn

A

  • =

⇒ the curve EA = E/〈RA〉 and φA : E → EA E EA φA

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-15
SLIDE 15

Key-Exchange Protocol

A prime p such that p+1 = ℓn

Aℓm B

A supersingular elliptic curve E with ℓn

Aℓm B points

A point RA chosen randomly in E

  • ℓn

A

  • −

→ (mA,nA) ∈ {1,...,ℓn

A}2 random,

RA = mAPA +nAQA for 〈PA,QA〉 = E

  • ℓn

A

  • =

⇒ the curve EA = E/〈RA〉 and φA : E → EA

A point RB = mBPB +nBQB random in E

  • ℓm

B

  • = 〈PB,QB〉,

the curve EB = E/〈RB〉 and φB : E → EB

E EA EB φA φB

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-16
SLIDE 16

Key-Exchange Protocol

Bob sends

  • EB,φB(PA),φB(QA)
  • where 〈φB(PA),φB(QA)〉 = EB[ℓn

A]

E EA EB φA φB

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-17
SLIDE 17

Key-Exchange Protocol

Bob sends

  • EB,φB(PA),φB(QA)
  • where 〈φB(PA),φB(QA)〉 = EB[ℓn

A]

Alice computes EAB = EB/〈mAφB(PA)+nAφB(QA)〉

E EA EB EAB φA φB

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-18
SLIDE 18

Key-Exchange Protocol

Bob sends

  • EB,φB(PA),φB(QA)
  • where 〈φB(PA),φB(QA)〉 = EB[ℓn

A]

Alice computes EAB = EB/〈mAφB(PA)+nAφB(QA)〉 Bob computes EBA = EA/〈mBφA(PB)+nBφA(QB)〉

E EA EB EAB φA φB

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-19
SLIDE 19

Key-Exchange Protocol

Bob sends

  • EB,φB(PA),φB(QA)
  • where 〈φB(PA),φB(QA)〉 = EB[ℓn

A]

Alice computes EAB = EB/〈mAφB(PA)+nAφB(QA)〉 Bob computes EBA = EA/〈mBφA(PB)+nBφA(QB)〉

EAB ≃ E/〈RA,RB〉 ≃ EBA so j(EAB) = j(EBA) E EA EB EAB φA φB

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-20
SLIDE 20

Key-Exchange Protocol

Bob sends

  • EB,φB(PA),φB(QA)
  • where 〈φB(PA),φB(QA)〉 = EB[ℓn

A]

Alice computes EAB = EB/〈mAφB(PA)+nAφB(QA)〉 Bob computes EBA = EA/〈mBφA(PB)+nBφA(QB)〉

EAB ≃ E/〈RA,RB〉 ≃ EBA so j(EAB) = j(EBA) = ⇒ j(EAB) secret shared by Alice and Bob

  • E

EA EB EAB φA φB

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-21
SLIDE 21

Position of the problem

Path-finding problem Given two isogenous curves E1 and E2, find an isogeny between them of degree ℓn

A.

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-22
SLIDE 22

Position of the problem

Path-finding problem Given two isogenous curves E1 and E2, find an isogeny between them of degree ℓn

A.

Equivalent to find a path of fixed length in the isogeny graph

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-23
SLIDE 23

Position of the problem

Path-finding problem Given two isogenous curves E1 and E2, find an isogeny between them of degree ℓn

A.

Equivalent to find a path of fixed length in the isogeny graph Brute-force attack in O

  • ℓn

A

  • ≈ O

p

  • Alexandre Gélin, Benjamin Wesolowski

Loop-abort faults on supersingular isogeny cryptosystems

slide-24
SLIDE 24

Position of the problem

Path-finding problem Given two isogenous curves E1 and E2, find an isogeny between them of degree ℓn

A.

Equivalent to find a path of fixed length in the isogeny graph Brute-force attack in O

  • ℓn

A

  • ≈ O

p

  • Claw finding: Find a collision in O
  • ℓ

n 2

A

  • ≈ O
  • 4

p

  • Alexandre Gélin, Benjamin Wesolowski

Loop-abort faults on supersingular isogeny cryptosystems

slide-25
SLIDE 25

Attack framework

Alice uses a static private key (mA,nA)

E EA EB EAB φA φB

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-26
SLIDE 26

Attack framework

Alice uses a static private key (mA,nA)

= ⇒ EA and φA can be precomputed E EA EB EAB φA φB

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-27
SLIDE 27

Attack framework

Alice uses a static private key (mA,nA)

= ⇒ EA and φA can be precomputed

The attacker plays the role of Bob

E EA EB EAB φA φB

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-28
SLIDE 28

Attack framework

Alice uses a static private key (mA,nA)

= ⇒ EA and φA can be precomputed

The attacker plays the role of Bob Focus on the isogeny from EB to EB/〈mAP′

A +nAQ′ A〉,

where P′

A = φB(PA) and Q′ A = φB(QA)

E EA EB EAB φA φB

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-29
SLIDE 29

Attack framework

Alice uses a static private key (mA,nA)

= ⇒ EA and φA can be precomputed

The attacker plays the role of Bob Focus on the isogeny from EB to EB/〈mAP′

A +nAQ′ A〉,

where P′

A = φB(PA) and Q′ A = φB(QA)

Previous active attack [GPST16]:

Idea: Provide dishonest points (

PA, QA) instead of (P′

A,Q′ A)

E EA EB EAB φA φB

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-30
SLIDE 30

Attack framework

Alice uses a static private key (mA,nA)

= ⇒ EA and φA can be precomputed

The attacker plays the role of Bob Focus on the isogeny from EB to EB/〈mAP′

A +nAQ′ A〉,

where P′

A = φB(PA) and Q′ A = φB(QA)

Previous active attack [GPST16]:

Idea: Provide dishonest points (

PA, QA) instead of (P′

A,Q′ A)

Countermeasure: Validation method verifies the correctness

  • f the inputs (Fujisaki-Okamoto transform)

E EA EB EAB φA φB

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-31
SLIDE 31

How is computed the isogeny ?

Degree ℓn

A: Vélu’s formulae ⇒ O

  • ℓn

A

  • Alexandre Gélin, Benjamin Wesolowski

Loop-abort faults on supersingular isogeny cryptosystems

slide-32
SLIDE 32

How is computed the isogeny ?

Degree ℓn

A: Vélu’s formulae ⇒ O

  • ℓn

A

  • Decompose and iterate ⇒ n·O(ℓA)
  • EB

= E0 → E1 → ··· → En−1 → En = EAB

where each → is a degree-ℓA isogeny

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-33
SLIDE 33

How is computed the isogeny ?

Degree ℓn

A: Vélu’s formulae ⇒ O

  • ℓn

A

  • Decompose and iterate ⇒ n·O(ℓA)
  • EB

= E0 → E1 → ··· → En−1 → En = EAB

where each → is a degree-ℓA isogeny

R0 = mAP′

A +nAQ′ A and for 1 ≤ k ≤ n−1,

Ek+1 = Ek/〈ℓn−k−1

A

Rk〉 φk+1 : Ek → Ek+1 Rk+1 = φk+1(Rk)

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-34
SLIDE 34

How is computed the isogeny ?

Degree ℓn

A: Vélu’s formulae ⇒ O

  • ℓn

A

  • Decompose and iterate ⇒ n·O(ℓA)
  • EB

= E0 → E1 → ··· → En−1 → En = EAB

where each → is a degree-ℓA isogeny

R0 = mAP′

A +nAQ′ A and for 1 ≤ k ≤ n−1,

Ek+1 = Ek/〈ℓn−k−1

A

Rk〉 φk+1 : Ek → Ek+1 Rk+1 = φk+1(Rk) En = EAB = EB/〈R0〉 and φ = φn ◦···◦φ1

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-35
SLIDE 35

Loop-abort fault attacks

Introduced for pairing-based cryptography Used recently in the context of lattice-based signature schemes

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-36
SLIDE 36

Loop-abort fault attacks

Introduced for pairing-based cryptography Used recently in the context of lattice-based signature schemes Inject a fault that induces an early-abort in the loop

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-37
SLIDE 37

Loop-abort fault attacks

Introduced for pairing-based cryptography Used recently in the context of lattice-based signature schemes Inject a fault that induces an early-abort in the loop Proven feasible in practice [Blömer et al.]

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-38
SLIDE 38

Loop-abort fault attacks

Introduced for pairing-based cryptography Used recently in the context of lattice-based signature schemes Inject a fault that induces an early-abort in the loop Proven feasible in practice [Blömer et al.] Implementations of SIDH on embedded devices already exist

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-39
SLIDE 39

The attack

ℓA = 2

Need an oracle to compare Alice’s outputs with what the attacker computes

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-40
SLIDE 40

The attack

ℓA = 2

Need an oracle to compare Alice’s outputs with what the attacker computes After k iterations, Alice has computed the intermediate curve

Ek = EB/〈2n−k(mAP′

A +nAQ′ A)〉

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-41
SLIDE 41

The attack

ℓA = 2

Need an oracle to compare Alice’s outputs with what the attacker computes After k iterations, Alice has computed the intermediate curve

Ek = EB/〈2n−k(mAP′

A +nAQ′ A)〉

Guess strategy: first step, k = 1

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-42
SLIDE 42

The attack

ℓA = 2

Need an oracle to compare Alice’s outputs with what the attacker computes After k iterations, Alice has computed the intermediate curve

Ek = EB/〈2n−k(mAP′

A +nAQ′ A)〉

Guess strategy: first step, k = 1

if ma is even, then Ker φ1 = 〈2n−1Q′

A〉

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-43
SLIDE 43

The attack

ℓA = 2

Need an oracle to compare Alice’s outputs with what the attacker computes After k iterations, Alice has computed the intermediate curve

Ek = EB/〈2n−k(mAP′

A +nAQ′ A)〉

Guess strategy: first step, k = 1

if ma is even, then Ker φ1 = 〈2n−1Q′

A〉

if na is even, then Ker φ1 = 〈2n−1P′

A〉

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-44
SLIDE 44

The attack

ℓA = 2

Need an oracle to compare Alice’s outputs with what the attacker computes After k iterations, Alice has computed the intermediate curve

Ek = EB/〈2n−k(mAP′

A +nAQ′ A)〉

Guess strategy: first step, k = 1

if ma is even, then Ker φ1 = 〈2n−1Q′

A〉

if na is even, then Ker φ1 = 〈2n−1P′

A〉

if both are odd, then Ker φ1 = 〈2n−1(P′

A +Q′ A)〉

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-45
SLIDE 45

The attack

ℓA = 2

Need an oracle to compare Alice’s outputs with what the attacker computes After k iterations, Alice has computed the intermediate curve

Ek = EB/〈2n−k(mAP′

A +nAQ′ A)〉

Guess strategy: first step, k = 1

if ma is even, then Ker φ1 = 〈2n−1Q′

A〉

= ⇒ (mA,nA) equivalent to (a,1) for a = mA

nA and a even

if na is even, then Ker φ1 = 〈2n−1P′

A〉

if both are odd, then Ker φ1 = 〈2n−1(P′

A +Q′ A)〉

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-46
SLIDE 46

The attack

ℓA = 2

Need an oracle to compare Alice’s outputs with what the attacker computes After k iterations, Alice has computed the intermediate curve

Ek = EB/〈2n−k(mAP′

A +nAQ′ A)〉

Guess strategy: first step, k = 1

if ma is even, then Ker φ1 = 〈2n−1Q′

A〉

= ⇒ (mA,nA) equivalent to (a,1) for a = mA

nA and a even

if na is even, then Ker φ1 = 〈2n−1P′

A〉

= ⇒ (mA,nA) equivalent to (1,a) for a = nA

mA and a even

if both are odd, then Ker φ1 = 〈2n−1(P′

A +Q′ A)〉

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-47
SLIDE 47

The attack

ℓA = 2

Need an oracle to compare Alice’s outputs with what the attacker computes After k iterations, Alice has computed the intermediate curve

Ek = EB/〈2n−k(mAP′

A +nAQ′ A)〉

Guess strategy: first step, k = 1

if ma is even, then Ker φ1 = 〈2n−1Q′

A〉

= ⇒ (mA,nA) equivalent to (a,1) for a = mA

nA and a even

if na is even, then Ker φ1 = 〈2n−1P′

A〉

= ⇒ (mA,nA) equivalent to (1,a) for a = nA

mA and a even

if both are odd, then Ker φ1 = 〈2n−1(P′

A +Q′ A)〉

= ⇒ (mA,nA) equivalent to (1,a) for a = nA

mA and a odd

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-48
SLIDE 48

The attack

ℓA = 2

Subsequent steps: we assume the key of the form (1,a)

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-49
SLIDE 49

The attack

ℓA = 2

Subsequent steps: we assume the key of the form (1,a) We know the k −1 least significant bits

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-50
SLIDE 50

The attack

ℓA = 2

Subsequent steps: we assume the key of the form (1,a) We know the k −1 least significant bits The k-th bit is either 0 or 1, i.e.,

Ek = EB

  • 2n−k

P′

A +(a mod 2k−1)Q′ A

  • r

Ek = EB

  • 2n−k

P′

A +(a mod 2k−1 +2k−1)Q′ A

  • Alexandre Gélin, Benjamin Wesolowski

Loop-abort faults on supersingular isogeny cryptosystems

slide-51
SLIDE 51

The attack

ℓA = 2

Subsequent steps: we assume the key of the form (1,a) We know the k −1 least significant bits The k-th bit is either 0 or 1, i.e.,

Ek = EB

  • 2n−k

P′

A +(a mod 2k−1)Q′ A

  • r

Ek = EB

  • 2n−k

P′

A +(a mod 2k−1 +2k−1)Q′ A

  • Make a guess and recover the k-th bit of a

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-52
SLIDE 52

The attack

ℓA = 2

Subsequent steps: we assume the key of the form (1,a) We know the k −1 least significant bits The k-th bit is either 0 or 1, i.e.,

Ek = EB

  • 2n−k

P′

A +(a mod 2k−1)Q′ A

  • r

Ek = EB

  • 2n−k

P′

A +(a mod 2k−1 +2k−1)Q′ A

  • Make a guess and recover the k-th bit of a

Conclusion: full-key recovery by iterating this process

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-53
SLIDE 53

Analysis

n bits recovered in n interactions with the victim = ⇒ n faults injected

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-54
SLIDE 54

Analysis

n bits recovered in n interactions with the victim = ⇒ n faults injected

if the success probability µ of the fault injection is not 1,

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-55
SLIDE 55

Analysis

n bits recovered in n interactions with the victim = ⇒ n faults injected

if the success probability µ of the fault injection is not 1,

about n

µ faults injected if the success can be detected

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-56
SLIDE 56

Analysis

n bits recovered in n interactions with the victim = ⇒ n faults injected

if the success probability µ of the fault injection is not 1,

about n

µ faults injected if the success can be detected

about 2n

µ otherwise

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-57
SLIDE 57

Analysis

n bits recovered in n interactions with the victim = ⇒ n faults injected

if the success probability µ of the fault injection is not 1,

about n

µ faults injected if the success can be detected

about 2n

µ otherwise

Alternative with less faults assuming a stronger oracle

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

slide-58
SLIDE 58

Thanks

Bedankt

Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems