Fault attacks against the Miller algorithm in Edwards Coordinates - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2010

Fault attacks against the Miller algorithm in Edwards Coordinates

Résumé

Initially, the use of pairings did not involve any secret entry. However in an Identity Based Cryptographic protocol, one of the two entries of the pairing is secret, so fault attack can be applied to Pairing Based Cryptography to nd it. In [18], the author shows that Pairing Based Cryptography in Weierstrass coordinates is vulnerable to a fault attack. The addition law in Edwards coordinates is such that the expo-nentiation in Edwards coordinates is naturally protected to Side Channel attacks. We study here if this property protects Pairing Based cryptog-raphy in Edwards coordinates against fault attacks. Originally, pairings were used in a destructive way. Pairings convert the discrete logarithm problem from an elliptic curve subgroup to the discrete logarithm problem in a nite eld. This property was used in the MOV [29] and Frey Ruck attack [19] . This pairing property permits the construction of new protocols. The rst constructive use of pairings was the tripartite key exchange of A. Joux [22]. It was followed by original protocols like Identity Based Cryptography (IBC), which was introduced by D. Boneh and M. Franklin in 2001 [10], or short signature schemes [20]. The use of pairings in IBC involves a secret entry during the pairing calculation. Several pairing implementations exist, for example [32] and [5]. Side Channel Attacks (SCA) against pairing based cryptography were rst developed three years ago ([30], [33] and [24]). In [30], D. Page and F. Vercauteren introduce a fault attack against the particular case of the Duursma and Lee algorithm. The fault attack consists in modifying the number of iterations of the algorithm. This idea was complete in [18] in application to the Miller algorithm in Weierstrass coordinates. In [33] the authors conclude that if the secret is used as the rst argument of the pairing computation, then it can not be found. This countermeasure is not one, as concluded in [18]. This three articles consider the case of Weierstrass coordinates. Recently, Edwards coordinates were introduced for computing pairings [6, 8, 23, 3].
Fichier principal
Vignette du fichier
ACTI-ELMRABET-2010-1.pdf (275.4 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01083374 , version 1 (17-11-2014)

Identifiants

Citer

Nadia El Mrabet. Fault attacks against the Miller algorithm in Edwards Coordinates. 4th International Conference on Information Security and Assurance, ISA 2010, Jun 2010, Miyazaki, Japan. pp.72-85, ⟨10.1007/978-3-642-13365-7_8⟩. ⟨hal-01083374⟩
95 Consultations
102 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More