238 5. Implementation Issues

Table 5.9 shows the number of squarings and multiplications needed to compute inverses in the NIST binary fields F2163 , F2233 , F2283 , F2409 and F2571 using Algorithm 5.6. The last squaring of A in step 2.2 is not required, and therefore is not included in the operation counts.

Table 5.9. Operation counts for inversion in the binary fields F2163 , F2233 , F2283 , F2409 and F2571 using Algorithm 5.6.

5.3Secure implementation

When assessing the security of a cryptographic protocol, one usually assumes that the adversary has a complete description of the protocol, is in possession of all public keys, and is only lacking knowledge of the secret keys. In addition, the adversary may have intercepted some data exchanged between the legitimate participants, and may even have some control over the nature of this data (e.g., by selecting the messages in a chosen-message attack on a signature scheme, or by selecting the ciphertext in a chosen-ciphertext attack on a public-key encryption scheme). The adversary then attempts to compromise the protocol goals by either solving an underlying problem assumed to be intractable, or by exploiting some design flaw in the protocol.

The attacks considered in this traditional security model exploit the mathematical specification of the protocol. In recent years, researchers have become increasingly aware of the possibility of attacks that exploit specific properties of the implementation and operating environment. Such side-channel attacks utilize information leaked during the protocol’s execution and are not considered in traditional security models. For example, the adversary may be able to monitor the power consumed or the electromagnetic radiation emitted by a smart card while it performs private-key operations such as decryption and signature generation. The adversary may also be able to measure the time it takes to perform a cryptographic operation, or analyze how a cryptographic device behaves when certain errors are encountered. Side-channel information may be easy to gather in practice, and therefore it is essential that the threat of side-channel attacks be quantified when assessing the overall security of a system.

It should be emphasized that a particular side-channel attack may not be a realistic threat in some environments. For example, attacks that measure power consumption of a cryptographic device can be considered very plausible if the device is a smart card that draws power from an external, untrusted source. On the other hand, if the device

is a workstation located in a secure office, then power consumption attacks are not a significant threat.

The objective of this section is to provide an introduction to side-channel attacks and their countermeasures. We consider power analysis attacks, electromagnetic analysis attacks, error message analysis, fault analysis, and timing attacks in §5.3.1, §5.3.2, §5.3.3, §5.3.4, and §5.3.5, respectively. The countermeasures that have been proposed are algorithmic, software-based, hardware-based, or combinations thereof. None of these countermeasures are guaranteed to defeat all side-channel attacks. Furthermore, they may slow cryptographic computations and have expensive memory or hardware requirements. The efficient and secure implementation of cryptographic protocols on devices such as smart cards is an ongoing and challenging research problem that demands the attention of both cryptographers and engineers.

5.3.1Power analysis attacks

CMOS (Complementary Metal-Oxide Semiconductor) logic is the dominant semiconductor technology for microprocessors, memories, and application specific integrated circuits (ASICs). The basic building unit in CMOS logic is the inverter, or NOT gate, depicted in Figure 5.12. It consists of two transistors, one P-type and one N-type, that

Supply Voltage

P-type transistor

capacitive

load

N-type transistor

Ground

Figure 5.12. CMOS logic inverter.

serve as voltage-controlled switches. A high voltage signal is interpreted as a logical ‘1’, while a low voltage signal is interpreted as a logical ‘0’. If the input voltage Vin is low, then the P-type transistor is conducting (i.e., the switch is closed) while the N- type transistor is non-conducting; in this case, there is a path from the supply voltage to the output and therefore Vout is high. Conversely, if Vin is high, then the P-type transistor is non-conducting while the N-type transistor is conducting; in this case, there is a path from the output to the ground and therefore Vout is low. When the inverter switches state, there is a short period of time during which both transistors conduct

242 5. Implementation Issues

None of the countermeasures that have been proposed are guaranteed to provide adequate protection. It is also important to note that resistance to SPA attacks does not guarantee resistance to other side-channel attacks such as differential power analysis and electromagnetic analysis attacks. It is therefore impossible at present to provide general recommendations for the best countermeasures to SPA attacks. Instead we just give one example and list other methods in the Notes section starting on page 254.

Algorithm 5.7 is a modification of the left-to-right binary point multiplication method to provide enhanced resistance to SPA attacks. Dummy operations are included in the main loop so that the same basic elliptic curve operations (one double and one addition) are performed in each iteration. Thus the sequence of double and additions deduced from the power trace does not reveal any information about the bits of k. As with most algorithmic countermeasures, the increased security comes at the expense of slower performance.

Algorithm 5.7 SPA-resistant left-to-right binary point multiplication

INPUT: k = (kt−1, . . . , k1, k0)2, P E(Fq ).

OUTPUT: k P.

1.Q0 ← ∞.

2.For i from t − 1 downto 0 do

2.1Q0 ← 2Q0.

2.2Q1 ← Q0 + P.

2.3Q0 ← Qki .

3.Return(Q0).

Differential power analysis

Differential power analysis (DPA) attacks exploit variations in power consumption that are correlated to the data values being manipulated. These variations are typically much smaller than those associated with different instruction sequences, and may be obfuscated by noise and measurement errors. Statistical methods are used on a collection of power traces in order reduce the noice and strengthen the differential signals.

To launch a DPA attack, an adversary first selects an internal variable V that is encountered during the execution of the cryptographic operation and has the property that knowledge of the input message m and a portion k of the unknown secret key determines the value of V . The determining function V = f (k , m) is called the selection function. Let us assume for simplicity that V is a single bit. The adversary collects a number of power traces (e.g., a few thousand) from the device that performs the cryptographic operation. She then makes a guess for k , and partitions the power traces into two groups according to the predicted value of the bit V . The power traces in each group are averaged, and the difference of the averages, called the differential trace, is plotted. The idea is that the value of V will have some (possibly very small) influence

on the power trace. Thus, if the guess for k is incorrect, then the partition of power traces was essentially done randomly, and so one would expect the differential trace to be flat. On the other hand, if the guess for k is correct then the two averaged power traces will have some noticeable differences; one would expect the plot of the differential trace to be flat with spikes in regions influenced by V . This process is repeated (using the same collection of power traces) until k is determined.

These ideas are illustrated in the following DPA attack on the SPA-resistant point multiplication method of Algorithm 5.7. The attack demonstrates that SPA countermeasures do not necessarily resist DPA attacks.

DPA attacks are generally not applicable to point multiplication in the signature generation procedure for elliptic curve signature schemes such as ECDSA (Algorithm 4.29) since the secret key k is different for each signature while the base point P is fixed. However, the attacks can be mounted on point multiplication in elliptic curve encryption and key agreement schemes. For example, for the point multiplication in the ECIES decryption procedure (Algorithm 4.43), the multiplier is k = hd where d is the long-term private key and h is the cofactor, and the base point is P = R where R is the point included in the ciphertext.

Suppose now that an adversary has collected the power traces as a cryptographic device computed k P1, k P2, . . . , k Pr using Algorithm 5.7. The adversary knows P1, P2, . . . , Pr and wishes to determine k. If Q0 = ∞ then the doubling operation in step 2.1 is trivial and therefore can likely be distinguished from a non-trivial doubling operation by examination of a single power trace. Thus, the attacker can easily determine the leftmost bit of k that is 1. Let us suppose that kt−1 = 1. The following assignments are made in the first iteration of step 2 (with i = t − 1): Q0 ← ∞, Q1 ← P, Q0 ← P. In the second iteration of step 2 (with i = t − 2) the assignments are Q0 ← 2P, Q1 ← 3P, and either Q0 ← 2P (if kt−2 = 0) or Q0 ← 3P (if kt−2 = 1). It follows that the point 4P is computed in a subsequent iteration if and only if kt−2 = 0. A position in the binary representation of a point is selected, and the power traces are divided into two groups depending on whether the selected bit of 4Pi is 0 or 1. In the notation of the generic description of DPA attacks, the key portion is k = kt−2, m = Pi , and the selection function f computes the selected bit of 4Pi . If the differential trace has some noticeable spikes, then the adversary concludes that kt−2 = 0; otherwise kt−2 = 1. Once kt−2 has been determined, the adversary can similarly infer kt−3 and so on.

Countermeasures As is the case with SPA attacks, numerous techniques for resisting DPA attacks have been proposed. Again, none of them are guaranteed to be sufficient and their effectiveness must be evaluated on a case-by-case basis. These countermeasures are surveyed in the Notes section starting on page 254. Here we only present one countermeasure that provides resistance to the particular DPA attack described above for point multiplication.

Suppose that the field Fq had characteristic > 3, and suppose that mixed Jacobianaffine coordinates (see §3.2.2) are used in Algorithm 5.7. Thus, the point P is stored in affine coordinates, while the points Q0 and Q1 are stored in Jacobian coordinates.