Elliptic Curve Scalar Multiplication Algorithm Research Articles

Online Template Attacks: Revisited

An online template attack (OTA) is a powerful technique previously used to attack elliptic curve scalar multiplication algorithms. This attack has only been analyzed in the realm of power consumption and EM side channels, where the signals leak related to the value being processed. However, microarchitecture signals have no such feature, invalidating some assumptions from previous OTA works.In this paper, we revisit previous OTA descriptions, proposing a generic framework and evaluation metrics for any side-channel signal. Our analysis reveals OTA features not previously considered, increasing its application scenarios and requiring a fresh countermeasure analysis to prevent it.In this regard, we demonstrate that OTAs can work in the backward direction, allowing to mount an augmented projective coordinates attack with respect to the proposal by Naccache, Smart and Stern (Eurocrypt 2004). This demonstrates that randomizing the initial targeted algorithm state does not prevent the attack as believed in previous works.We analyze three libraries libgcrypt, mbedTLS, and wolfSSL using two microarchitecture side channels. For the libgcrypt case, we target its EdDSA implementation using Curve25519 twist curve. We obtain similar results for mbedTLS and wolfSSL with curve secp256r1. For each library, we execute extensive attack instances that are able to recover the complete scalar in all cases using a single trace.This work demonstrates that microarchitecture online template attacks are also very powerful in this scenario, recovering secret information without knowing a leakage model. This highlights the importance of developing secure-by-default implementations, instead of fix-on-demand ones.

Novel Elliptic Curve Scalar Multiplication Algorithms for Faster and Safer Public-Key Cryptosystems

Novel Elliptic Curve Scalar Multiplication Algorithms for Faster and Safer Public-Key Cryptosystems

Division polynomial‐based elliptic curve scalar multiplication revisited

Here, the authors provide a derivation of an improvement to Kanayama's elliptic curve scalar multiplication algorithm using division polynomials. In addition, they also provide experimental results and show that the improvement is useful when the elliptic curve under consideration is defined over large prime fields.

Fast elliptic curve algorithm using deformed Fibonacci-type series

The efficient and secure scalar multiplication can be constructed by combining the addition chain and elliptic curve. In this paper, we propose an explicit algorithm which is a kind of 'double-addition' addition chain based on the Fibonacci-type sequence. The 'double-addition' sequence of arbitrary integer k is calculated by using Fibonacci and golden ratio addition chain method. In addition, each cycle of this method is fixed to perform double point and a point add operations based on the 'double-addition' of the elliptic curve scalar multiplication algorithm, so as to be able to resist the simple power attack. At the same time, the length of the chain is greatly shortened by using the double point operation compared with the chain of the Fibonacci. Experimental results showed that the average chain length has attained 38% to 55% reduction compared to other doubling-free addition chain methods.

Fast elliptic curve algorithm using deformed Fibonacci-type series

The efficient and secure scalar multiplication can be constructed by combining the addition chain and elliptic curve. In this paper, we propose an explicit algorithm which is a kind of 'double-addition' addition chain based on the Fibonacci-type sequence. The 'double-addition' sequence of arbitrary integer k is calculated by using Fibonacci and golden ratio addition chain method. In addition, each cycle of this method is fixed to perform double point and a point add operations based on the 'double-addition' of the elliptic curve scalar multiplication algorithm, so as to be able to resist the simple power attack. At the same time, the length of the chain is greatly shortened by using the double point operation compared with the chain of the Fibonacci. Experimental results showed that the average chain length has attained 38% to 55% reduction compared to other doubling-free addition chain methods.

Using modular extension to provably protect Edwards curves against fault attacks

Fault injection attacks are a real-world threat to cryptosystems, in particular, asymmetric cryptography. In this paper, we focus on countermeasures which guarantee the integrity of the computation result, hence covering most existing and future fault attacks. Namely, we study the modular extension protection scheme in previously existing and newly contributed variants of the countermeasure on elliptic curve scalar multiplication (ECSM) algorithms. We find that an existing countermeasure is incorrect and we propose new “test-free” variant of the modular extension scheme that fixes it. We then formally prove the correctness and security of modular extension: specifically, the fault non-detection probability is inversely proportional to the security parameter. Finally, we implement an ECSM protected with test-free modular extension during the elliptic curve operation to evaluate the efficient of this method on Edwards and twisted Edwards curves.

ECDSA Passive Attacks, Leakage Sources, and Common Design Mistakes

Elliptic Curves Cryptography (ECC) tends to replace RSA for public key cryptographic services. ECC is involved in many secure schemes such as Elliptic Curve Diffie-Hellman (ECDH) key agreement, Elliptic Curve Integrated Encryption Scheme (ECIES), and Elliptic Curve Digital Signature Algorithm (ECDSA). As for every cryptosystem, implementation of such schemes may jeopardize the inherent security provided by the mathematical properties of the ECC. Unfortunate implementation or algorithm choices may create serious vulnerabilities. The elliptic curve scalar operation is particularly sensitive among these schemes. This article surveys passive attacks against well-spread elliptic curve scalar multiplication algorithms highlighting leakage sources and common mistakes that can be used to attack the ECDSA scheme. Experimental results are provided to illustrate and demonstrate the effectiveness of each vulnerability. Finally, the article describes the link between partial leakage and lattice attack in order to understand and demonstrate the impact of small leakages on the security of ECDSA. An example of side channel and lattice attack combination on NIST P-256 is provided in the case where the elliptic curve scalar multiplication is not protected against DPA/CPA and a controllable device is not accessible.

Fast elliptic curve scalar multiplication for resisting against SPA

This paper analyses the computation of symbolic ternary form (STF) elliptic curve scalar multiplication algorithm and binary scalar multiplication algorithm. Compared with binary scalar multiplication algorithm, the efficiency of STF scalar multiplication algorithm is increased by 5.9% on average and has a corresponding advantage. For this reason, we improve the structure of STF scalar multiplication algorithm and make the performance more 'smooth' by constructing indistinguishable operation between points addition (A) and triple point (T) and thus to resist against the simple power analysis attacks. At the same time, we propose highest-weight symbolic ternary form (HSTF), which makes a scalar k transform into the highest-weight form. Thus, every cycle has a fixed pattern to resist against SPA attack. With respect to binary scalar multiplication algorithm with anti-SPA, the average efficiency in enhanced by 17.7%.

A Novel Elliptic Curve Scalar Multiplication Algorithm against Power Analysis

Nowadays, power analysis attacks are becoming more and more sophisticated. Through power analysis attacks, an attacker can obtain sensitive data stored in smart cards or other embedded devices more efficiently than with any other kind of physical attacks. Among power analysis, simple power analysis (SPA) is probably the most effective against elliptic curve cryptosystem, because an attacker can easily distinguish between point addition and point doubling in a single execution of scalar multiplication. To make elliptic curve scalar multiplication secure against SPA attacks, many methods have been proposed using special point representations. In this paper, a simple but efficient SPA-resistant multiscalar multiplication is proposed. The method is to convert the scalar into a nonadjacent form (NAF) representation at first and then constitute it in a new signed digit representation. This new representation is undertaken at a small precomputation cost, as each representation needs just one doubling and 1/2 additions for each bit. In addition, when combined with randomization techniques, the proposed method can also guard against differential power analysis (DPA) attack.

Co- $$Z$$ ECC scalar multiplications for hardware, software and hardware–software co-design on embedded systems

Recent elliptic curve scalar multiplication algorithms are based on efficient co- $$Z$$ arithmetics. These arithmetics were initially introduced by Meloni in 2007 where addition of projective points share the same $$Z$$ -coordinate. The co- $$Z$$ version algorithms are sufficiently fast and secure against a large variety of implementation attacks. This paper analyses the performance of these algorithms in hardware and then compares them against software and hardware–software co-design environments on FPGA, in terms of speed, memory, power and energy consumption. Specifically, this paper presents a survey and performance comparison of implementations of co- $$Z$$ versions of the Montgomery ladder and the Joye’s double-add algorithm in an embedded system environment.

Novel Elliptic Curve Scalar Multiplication Algorithms for Faster and Safer Public-Key Cryptosystems

Novel Elliptic Curve Scalar Multiplication Algorithms for Faster and Safer Public-Key Cryptosystems

Algorithm-level error detection for Montgomery ladder-based ECSM

For security reasons, especially to provide resistance against fault-based attacks, it is very important to verify the correctness of computations in elliptic curve cryptographic applications. In this article, we deal with protections to fault attacks against elliptic curve scalar multiplication (ECSM) at algorithm level. To this end, we use the concepts of point verification (PV) and coherency check (CC). We investigate the error detection coverage of PV and CC for the Montgomery ladder ECSM algorithm. Additionally, we consider the case where an attacker can mount a double-fault attack. We show that even with this stronger fault model, it is possible to avoid such attacks utilizing the concept of point blinding.

An Improved Secure Elliptic Curve Scalar Multiplication Algorithm over Prime Fields

An Improved Secure Elliptic Curve Scalar Multiplication Algorithm over Prime Fields

Fault-Based Attack on Montgomery’s Ladder Algorithm

In this paper we present invalid-curve attacks that apply to the Montgomery ladder elliptic curve scalar multiplication (ECSM) algorithm. An elliptic curve over the binary field is defined using two parameters, a and b. We show that with a different “value” for curve parameter a, there exists a cryptographically weaker group in nine of the ten NIST-recommended elliptic curves over $\mathbb{F}_{2^{m}}$. Thereafter, we present two attacks that are based on the observation that parameter a is not utilized for the Montgomery ladder algorithms proposed by Lopez and Dahab (CHES 1999: Cryptographic Hardware and Embedded Systems, LNCS, vol. 1717, pp. 316–327, Springer, Berlin, 1999). We also present the probability of success of such attacks for general and NIST-recommended elliptic curves. In addition we give some countermeasures to resist these attacks.

Fast and secure elliptic curve scalar multiplication algorithm based on side channel atomicity

Simple power analysis is the most devastating attack on the security of elliptic curve scalar multiplication and can retrieve the secret key in some degree. A fast and secure side channel atomic elliptic curve scalar multiplication algorithm was put forward using the side channel atomic block S-A-N-A-M-N-A. In Jacobian coordination,the new algorithm used only 5M+5S+15A for doubling and 6M+6S+18A for mixed addition. In modified Jacobian coordination,the new algorithm used only 4M+4S+12A for doubling and 7M+7S+21A for mixed addition. Compared with the previous methods,the new method can improve the speed by about 7.8%~10% if S/M=0.8 or 18%~20% if S/M=0.6 for 192 bit scalar using NAF recoding.

A FAST AND SECURE ELLIPTIC CURVE SCALAR MULTIPLICATION ALGORITHM OVER GF(pm)

ABSTRACT This paper presents an innovative method for accelerating the elliptic curve scalar multiplication algorithm over GF(pm). The technique uses the substitution of multiplication with squaring and other cheaper operations by exploiting the fact that field squaring is generally less costly than multiplication. Applying this substitution to the traditional formulae, we obtain faster scalar multiplication in unprotected sequential implementations. We also show the significant impact our method has in protecting against simple side channel attacks(SSCA). We modify the ECC scalar multiplication to achieve a faster atomic structure when applying side channel atomicity protection. In contrast to previous atomic operations that assume squarings are indistinguishable from multiplications, our new atomic structure offers true SSCA-protection because it includes squaring in its formulation. In the scalar multiplication using NAF, our atomic blocks speed-up computation up to 30% in contrast to previous atomic implementations.

Fast simultaneous scalar multiplication

Scalar multiplication is a very expensive operation in elliptic curve based cryptographic protocol. In this paper, we propose a modified simultaneous elliptic curve scalar multiplication algorithm using complementary recoding. The signed binary representation of an integer is obtained by simple arithmetic operations such as complement and bitwise subtraction. This is an efficient method to obtain the signed binary representation of scalar when compared to other standard methods such as NAF, MOF and JSF.

Elliptic curve scalar multiplication algorithm using complementary recoding

Elliptic curve based cryptosystem is an efficient public key cryptosystem, which is more suitable for limited environments. The very expensive operation in elliptic curve based cryptographic protocol is the scalar multiplication. In this paper, scalar multiplication using complementary recoding method is proposed. The intermediate operations carried out in conversion are less than the other existing scalar multiplication algorithm. The efficiency of our proposed method is tested and found that our method is an efficient than the other methods.

Efficient elliptic curve scalar multiplication algorithms resistant to power analysis

This paper presents four algorithms for securing elliptic curve scalar multiplication against power analysis. The highest-weight binary form (HBF) of scalars and randomization are applied to resist power analysis. By using a special method to recode the scalars, the proposed algorithms do not suffer from simple power analysis (SPA). With the randomization of the secret scalar or base point, three of the four algorithms are secure against differential power analysis (DPA), refined power analysis (RPA) and zero-value point attacks (ZPA). The countermeasures are also immune to the doubling attack. Fast Shamir’s method is used in order to improve the efficiency of parallel scalar multiplication. Compared with previous countermeasures, the new countermeasures achieve higher security and do not impact overall performance.

An efficient method against side-channel attacks on ECC

Side-channel attacks (SCA) may exploit leakage information to break cryptosystems. In this paper we present a new SCA resistant Elliptic Curve scalar multiplication algorithm. The proposed algorithm, builds a sequence of bit-strings representing the scalar k, characterized by the fact that all bit-strings are different from zero; this property will ensure a uniform computation behavior for the algorithm, and thus will make it secure against simple power analysis attacks (SPA). With other randomization techniques, the proposed countermeasures do not penalize the computation time. The proposed scheme is more efficient than MOller's one, its cost being about 5% to 10% smaller than MOller's one.