Patent Application
20150092940
1. Technical Fields
The invention relates to the safety technology field. Particularly, the present invention relates to atomic blocks for cryptosystems based on elliptic curves over finite fields of prime characteristic known as ECC-systems.
2. Background
Elliptic Curves Cryptography (ECC) is a public-key cryptosystem proposed by Neal Koblitz [Koblitz87] and Victor Miller [Miller86] in 1985 which provides significant advantages in several situations, including implementations on specialized microprocessors. For example, some industry standards require 1024-bits for the size of integers in the RSA system, whereas the equivalent requirement for ECC is to work with finite fields of 160-bits. Given the restrictions on embedded microprocessors (used in mobile devices), the ECC system is an interesting option to obtain the required security.
Side-channel attacks exploit physical leakages of a cryptographic process on a device (using timing [Kocher96], power consumption [Kocher99] and electromagnetic radiation [Quisquater01, Gandolfi01]). These attacks present a realistic threat to cryptographic applications, and have been demonstrated to be very effective against smart cards without proper countermeasures. There are two general strategies with regard to these attacks: Simple Side-channel Analysis (SSCA) [Kocher96] which analyses the measurements of a single scalar multiplication, observing the differences in the behavior of the scalar multiplication depending on the value of the secret key; and Different Side-channel Analysis (DSCA) [Kocher99], which uses statistical techniques to retrieve information about the secret key based on the measurements from several scalar multiplications. This work will be focused on SSCA.
Several proposals have been made to protect scalar multiplication against these attacks. For example, the double-and-add-always algorithm of Coron [Coron99] ensures that the sequence of operations to compute a scalar multiplication is independent of the value of the secret scalar by inserting a dummy point addition between consecutive doublings (when the bit of the scalar is 0). A second countermeasure is to use unified formulae which use similar sets of field operations for both the general group additions and doublings. Such formulae exist for Edwards curves [Edwards07], inverted Edwards curves [Bernstein07], curves in the Huff model [Joye10], Hessian curves [Smart01], Jacobi curves [Liardet01, Billet02], Weierstrass elliptic curves [Brier02] (more details can be found in the database of special elliptic curves [Bernstein-Lange]). Another possible countermeasure is the Montgomery ladder [Montgomery97] designed for a special type of curve in large characteristic. As for the double-and-add-always algorithm, it makes sure that every bit of the scalar corresponds to both a doubling and an addition, but with the supplementary condition that both operations have an impact on the final output of the scalar multiplication. This was later generalized to all elliptic curves [López99, Brier02, Goundar11], and right-to-left scalar multiplication Double-add of Joye's [Joye03] and zeroless signed-digit algorithm [Goundar11]. A fifth approach consists in using “regular” representations of the scalar [Moeller01, Theriault05, Joye07], with the same fixed sequence of group operations for all scalars. Finally, Side-Channel Atomicity (first proposed by Chevallier-Mames et al. [Chevallier04]) splits point operations into small homogeneous blocks of basic field operations. If it is carefully implemented, it becomes impossible to distinguish between atomic blocks coming from doublings or additions. Atomic blocks are potentially the most efficient SSCA countermeasure.
A number of refinements have been provided to the atomic blocks structure since the paper published by Chevallier-Mames et al. An early assumption in atomic blocks design was that field multiplication and squaring are indistinguishable to side-channel analysis [Chevallier04, Chen09, Elmegaaed09, Giraud10], but it was later showed that the two operations can be distinguished even when they are equally treated by the processor [Amiel09, Hanley11].
As a result, an efficient and secure atomic block should consider distinct squarings and multiplications in its structure. Applying such atomic blocks to existing formulae can be rather inefficient since several dummy operations have to be introduced. Both Longa and Miri [Longa08] and Bernstein and Lange [Bernstein07] presented a flexible methodology to modify group operations formulae to fit it better in atomic blocks that could distinguish between the two field operations, by turning some multiplications into squarings [Longa08].
However, one problem has usually not been addressed in previous works on atomic blocks. If a group or field operation is introduced to provide side-channel uniformity but these operations do not affect the final output, then these “dummy” operations open the way to C-safe fault attacks [Yen00]. These attacks consist in introducing a fault in the scalar multiplication at a point corresponding to a suspected dummy operation, e.g. guessing what the next (non-dummy) group operation should be. If the final output is still valid, the guess was correct, whereas if the fault produces an error in the final output, then the guess was incorrect. Through this process, an attacker can obtain the secret scalar through observation of a few observations of the scalar multiplication.
As a result, it is recommended to avoid using dummy operations in the formulae [Avanzi05]. These attacks can be considered more closely related to DSCA than SSCA (although they are mathematically simpler than other DSCA), but they require far fewer observations than most other DSCA.
The Jacobian coordinates formulae of Abarziúa and Thériault [Abarzua12] for left-to-right scalar multiplication can be considered the current best in atomic blocks formulae countermeasure for Simple-side channel attacks and C-safe-fault.
The object matter of this invention is securing the atomic blocks formulae against Simple side-channel attacks and C-safe fault attacks for: General addition, modified Jacobian coordinates and Mixture Jacobian and Chudnovsky-Jacobian, using for the right-to-left algorithm improving the results [Elmegaaed09] and [Giraud10].
For a detailed description of elliptic curves, see [Avanzi05, Washington08]. An elliptic curve E defined over a large prime field is GF(p) given by an equation of the form y2=x3+ax+b, with 4a3+27b2 00. The group used for cryptography consists of the (affine) point (x,y) on the curve and the point at infinity “0” (the neutral element), with the “chord-and-tangent” addition. The group operation for (p, q)+(r, s) is given by
(x,y)=(λ2−p−r,λ(p−x)−q)
where λ=(q−s)/(p−r) if p≠r (addition formula) and λ=(3p2+a)/(2q) if (p, q)=(r, s) (doubling formula) and (p, q)+(p, −q)=0
Jacobian coordinates are a projective representation of the points consisting of equivalence classes of the form:
(X:Y:Z)=(λ2X,λ3Y,λZ):λεGF(p) (1)
A Jacobian point (X:Y:Z) with Z≠0 corresponds to the affine point (x, y)=(X/Z2, Y/Z3).
The “rescaling” methodology presented by Longa and Miri [Longa08] and Bernstein and Lange [Bernstein07] takes advantage of the projective form of the point coordinates.
The principal idea consists in taking a field multiplication αβ, and replacing it with a number of field squarings, additions and negation
2αβ=(α+β)2−α2−β2 (2)
If λ=2 in the class description (1), it can be easily seen how factors of 2 can be incorporated into all of the coordinates (in the invention, from the output of the computation). It can then be used to replace the computation of some multiplications by equation (2) adjusting the remaining computations accordingly.
The technique presented in [Longa08, Bernstein07] can be summarized in two steps:
In this section, a more detailed description of previous works on block-atomicity for elliptic curves for use in left-to-right and right-to-left scalar multiplication is presented.
Atomic blocks formulae are a very promising method to secure scalar multiplication against SSCA. The idea was first introduced by Chevallier-Manes et al. [Chevallier04] and consists in partitioning point operations into small homogeneous atomic blocks, which cannot be distinguished from each other through SSCA, thus making it impossible for the attacker to know which block is part of a group doubling or addition. Any field operation of an atomic block that is not used by the formula would be filled with dummy operations so that no missing operation would be identified by a SSCA. By staying “as close as possible” to the optimized formula, an atomic block formula can then provide the desired security at a much lower price than other SSCA countermeasures.
Chen et al. in [Chen09], presented an experimental attack on a smart card using an implementation of the atomic blocks proposed by Chevallier-Mames et al. [Chevallier04]. This experimental attacks utilizes the different number atomic blocks for group doublings and additions—for total operation times of 3.16 ms and 3.61 ms respectively—and a delay of 1.12 ms for breaks between group operations. This experimental attack could be applied because the implementation did not avoid irregular breaks between atomic blocks within the same group operation and distinct group operations. Chen et al. proposed to balance the point doubling with respect to a group addition. A preferred option is to require a better management of the delays between atomic blocks, thus allowing for formulae with different numbers of blocks.
The original atomic block of Chevallier-Mames et al. had a structure of (M, A, N, A) Multiplication-Addition-Negation-Addition operations over the prime field. This atomic block made one important assumption: that multiplication and squaring are indistinguishable from a side-channel perspective. This was disproved by Amiel et al. [Amiel09] and Hanley et al. [Hanley11]. Since the Hamming weight for the results of a field multiplication and squaring have different distributions, and the Hamming weight affects the side-channel traces, it is possible to use this difference to distinguish between blocks containing a general multiplication and those containing a squaring operation, re-opening the way to SSCA. As a consequence, atomic blocks should consider distinct squaring and multiplication in their structure.
This distinction can also have some efficiency benefits when considering that specialized squarings are less expensive than multiplication (at a ratio close to 0.8 in practice [Giraud10]). In order to adapt the existing formulae to various atomic block structures, the flexible methodology introduced by Longa and Miri [Longa08], and Bernstein and Lange [Bernstein07] can prove very useful. It permits the modification of point operations formulae to balance the number of squarings and multiplication, thus facilitating the introduction of squarings into atomic blocks.
Elmegaaed, in [Elmegaaed09], presented atomic blocks with structure (M, A, N, A) a mixture of Chudnovsky-Jacobian and Jacobian coordinates wherein if the I/M ratio is 60 or more, are used during scalar multiplication for right-to-left algorithm. Unfortunately these blocks make use of dummy operations and squarings and multiplications were considered to be side-channel equivalent.
Longa and Miri presented a new atomic block structure based on the sequence Squaring-Negation Addition-Multiplication-Negation Addition-Addition of field operations or (S, N, A, M, N, A, A). They applied their atomic block structure to doubling, tripling and mixed addition for elliptic curves in Jacobian coordinates over prime fields. It should be noted that these atomic blocks formulae make use of dummy operations at one point or another at the very least to fill up some of the additions and/or negations.
Giraud et al. in [Giraud10], presented new atomic blocks for Jacobian Addition and Modified Jacobian Doubling. In particular Giraud presented atomic blocks with structure (S, A, M, A, M, A, M, A, A, S, M, A, N, A, M, N, A, N, A, M, N, A) to obtain efficient scalar multiplication for the right-to-left algorithm introduced by Joye in [Joye08]. It should be noted that atomic blocks presented in [Giraud10] make use of dummy operations and consider that a multiplication and square side-channel equivalent.
As stated above, previously published atomic blocks formulae for elliptic curves defined over prime fields are open to C-safe fault attacks [Yen00]. Although most balanced formulae do fill out all the multiplications and squarings with non-dummy operations, no such consideration is applied to field additions and negations.
Experimental data on various smart cards [Giraud10] provide an addition-to-multiplication ratio close to 0.2 and a negation-to-multiplication ratio of 0.1. Even though the timing for these operations is much less than for multiplications and squarings (the squaring-to-multiplication ratio is usually close to 0.8), it would still be reasonable to mount a C-safe fault attack on dummy field additions and negations.
The only way to really avoid C-safe fault attacks is to ensure that every field operation of every atomic block is used in the computation of the final result. Note that it would not be sufficient to repeat the same operation more than once in the formula (using each result at least once), since the repeated operations would leave an essentially identical side-channel signature, thus re-opening the way to SSCA. Due to the aforementioned, all field operations of every atomic block must be filled but always with different operands.
Abarziúa and Thériault in [Abarzua12] presented the Jacobian coordinates formulae of left-to-right scalar multiplication which can be considered the current best in atomic blocks formulae that protect against simple side-channel attacks and C-safe faults attacks for the case left-to-right algorithm using the following operations: doubling, mixed addition, tripling, and quintupling. In the right-to-left case, they also provide formulae for Doubling in Modified Jacobian Coordinates and General Jacobian Addition.
The demand for wireless technology (cell phones, smart card) has significantly increased in recent years. Most of these devices rely on embedded microprocessors to secure the data being transmitted. Providing efficient cryptographic algorithms is a fundamental issue for the development of secure wireless devices.
One of the tools being investigated as a possible method to improve the security of these devices consists of public key cryptosystems, particularly cryptographic systems based on elliptic curves.
The present invention describes a method which improves the safety aspects of the previously published atomic blocks for the right-to-left case. This method builds new sets of atomic blocks designed to protect against both simple side-channel attacks and C-safe fault attacks for scalar multiplication for elliptic curves over prime fields. These atomic blocks are structured with the sequence of field operations (S, N, A, A, M, A), Squaring, Negation, Addition, Addition, Multiplication, Addition. These atomic blocks are applied to various operations in Jacobian coordinates: General addition, Doubling Jacobian modified, Mixture Jacobian and Chudnovsky-Jacobian for use in right-to-left scalar multiplication.
As in previous atomic blocks formulae, the group operations of this invention provide protection against simple side channel attacks by dividing the group operations into smaller sequences of field operations. One of the main differences with other formulae resides in their security against C-safe fault attacks. Unlike previous works, the formulae of this method are designed to completely fill the atomic blocks with field operations that affect the final output (i.e. to avoid “dummy” operations) and are all distinct (none of the operations are repeated). They also have the added bonus of being slightly more “compact” than most previous atomic blocks, having fewer additions/negations for each multiplication/squaring, potentially providing a performance gain.
In this invention, atomic blocks formulae are presented for doubling in Modified Jacobian Coordinates, General Jacobian Coordinates Addition and Mixted Jacobian and Chudnovsky-Jacobian Coordinates Addition, to be used in right-to-left algorithms, improving on the results of [Elmegaaed09] and [Giraud10].
In the following subsections, the resulting atomic blocks are described, providing protection against both simple side-channel attacks and C-safe fault attacks for use in right-to-left scalar multiplication.
A compact and efficient solution is described that protects the scalar multiplication ([d]P) algorithm used in cryptosystems based on elliptic curves (ECC) from simple side-channel attacks [Kocher96, Kocher99] and C-Safe fault attacks [Yen00]. The described method has a more compact structure in comparison to the existing solutions and specifically corresponds to the atomic structure: Squaring, Negation, Addition, Addition, Multiplication, Addition (S, N, A, A, M, A). If the cryptographic algorithm used to calculate the scalar multiplication reads the scalar in a right-to-left direction, the formulae present atomic blocks for General Addition, Modified Jacobian doubling and Mixture Jacobian and Chudnovsky Jacobian. Particularly, this invention is for elliptic curves defined over a prime field. The technique presented by Longa in [Longa08] and Bernstein-Lange [Bernstein07] is applied to balance multiplications and squarings in the previously indicated formulae in addition to the use of algebraic identities to eliminate “dummy” operations, which is a vulnerability present in all atomic blocks previously presented by the scientific community [Chevaliar04, Longa08, Chen09, Elmegaaed09, Giraud10], wherein this vulnerability is used to apply C-safe fault attacks [Yen00]. Moreover, these blocks have a more compact structure than the existing atomic blocks, which results in a better computing performance.
A more detailed explanation of the invention is provided in the following detailed descriptions and appended claims taken in conjunction with the accompanying drawings.
The following is a detailed description and explanation of the preferred embodiments of the invention and best modes for practicing the invention.
The following methodology is used for generating the new atomic blocks of this invention.
The methodology is based on atomic blocks protecting against simple side-channel attacks (SSCA) and C-Safe fault attacks, eliminating the use of dummy operations in the scalar multiplication ([d]P), for cryptosystems based on elliptic curves defined over fields of prime characteristic.
In order to eliminate the dummy operations which can be subject to C-safe fault attacks, algebraic substitutions are used to write formulae for: General Addition, Modified Jacobian doubling and Mixted Jacobian and Chudnovsky Jacobian Addition, when the scalar multiplication is implemented with right-to-left algorithms. These atomic blocks have a compact and efficient atomic structure (S, N, A, A, M, A).
First of all, in order to build atomic blocks it is necessary to balance the number of multiplications and squarings using the method presented in [Longa08] and [Bernstein07]. Besides which, the new algebraic substitutions are employed to eliminate the use of “dummy” operations. From the balanced formulae in relation to the number of squarings (S) and multiplications (M), a graph of algebraic operations is generated (one for each of the previous algorithms: General Addition, Modified Jacobian doubling and Mixed Jacobian and Chudnovsky Jacobian Addition) wherein said graph indicates the flow that must be executed for creating each one of the previous algorithms. This shows the dependencies of multiplications, squarings, additions and negations on the defining field of the elliptic curve to perform the calculation of algorithms.
As a result of the analysis of this directed graph containing dependency operations, ordered pairs (Si,Mi) are created (a squaring followed by a multiplication per each atomic block). The minimum quantity of additions and negations required for each formula is enumerated, and each position thereof is determined by observing the directed graph containing the data dependency operations. A special case takes place in relation to the first and last atomic blocks considering they have less flexibility in the formulae or algorithms that will be presented in this invention.
Based on the minimum number of operations, the most efficient and compact structure possible is the structure (S, N, A, A, M, A) for all previously mentioned algorithms. This results in a more compact structure than previously published formulae, enhancing the safety aspects of all previously presented atomic blocks.
After determining the most efficient structure for these atomic blocks when using right-to-left algorithms for the scalar multiplication ([d]P), formulae and atomic blocks are written for the Modified Jacobian Doubling case ([2]P), as shown in Table 1.
This representation, introduced by Cohen et al. in [Cohen98] is based on Jacobian coordinates. In this representation of a point P, the quadruple (X1:Y1:Z1:a Z1), called Modified Jacobian representation, is used to reduce the computation cost of doubling a point.
Let P=(X1:Y1:Z1:aZ1) be a point in Modified Jacobian representation, on the elliptic curve E. The most efficient doubling formula (with the output also in Jacobian coordinates) requires 4M+4S+12A+3N. In terms of multiplication (M), squaring (S), addition (A), and negation (N), there is little change from previous formulae, however additions and negations were re-organized to fill the operations in the atomic blocks.
A=3X12+W1,
−C=2B(−X1), B=2Y12,
X
2
=A
2−2C −D=2(−B2),
Z
2=(2Y1)Z1 R=X2−C,
W
2=(−2D)(−W1), Y2=(−A)R−D,
The resulting atomic blocks can be found in Table 1, taking as input X1→R1, Y1→R2 and Z1→R3, and returning as output X2→R1, Y2→R2, Z2→R3 and
← R12
← R22
← R7R
indicates data missing or illegible when filed
In table 1, it is possible to observe the operations being performed by each atomic block and their respective registers Ri. In this case, 8 registers are used. In addition, in order to eliminate “dummy” operations, the general algebraic substitution 3a=2a+a is used.
Given the points P=(X1,Y1,Z1) and Q=(X2,Y2,Z2) in Jacobian coordinates, both on the elliptic curve E. To obtain a practical formula for block atomicity formula for the addition P+Q=(X3,Y3,Z3), two multiplications must be replaced with squarings, four of which are new, to get 9M+9S:
−A=X1(−Z22),
B=X
2
Z
1
2,
E=B−A,
2D=Y2[(Z12+Z1)2−(Z12)2−Z12],
−2C=−Y1[(Z22+Z2)2−(Z22)2−Z22],
2F=2D−2C,
X
3=(2F)2−(2E2)(2E)+8(−AE2),
Y
3=−2F[(2F)2−(2E2)(2E)+12(−AE2)]−2C(2E2)(2E),
Z
3
=E[(Z1+Z2)2−Z12−Z22].
The resulting atomic blocks can be found in Table 2 with inputs X1→R1, Y1→R2, Z1→R3, X2→R4, Y2→R5 and Z2→R6 and returning as output X3→R1, Y3→R2, and Z3→R3.
← R7 + R3
← R3 + R6
R12
]
← R
+ R12
← −R
]
← R3 + R12
← R
+ R
← R
+ R
+ Z2)2 − Z24 − Z2
]
+ R1
R14
)]
← R12 + R10
+ R1
AE2]
← R
← R42
← −R14
← −R
← −R13
← R
+ R10
+ R
← R
+ R
← R
+ R
− 8AE2]
← R5R14
R
← R
+ R3
← R
+ R14
← R14 + R7
− 12AE2]
]
indicates data missing or illegible when filed
In the case of General Addition in Jacobian Coordinates (P+Q), the formulae and atomic blocks are shown in table 2, wherein 16 registers are used and the algebraic substitutions applied to eliminate the use of dummy operations are 2b3=(b2+b)2−(b4+b2). This last formula is correct when calculating the square of a Binomial on the right side of the equality, and it will be observed that this is the same with respect to the left side after eliminating some of the expressions having opposite signs. In addition, the expression 4AE2−X3 is calculated as
4AE2−X3=[(2E)2−(2E2)(2E)−12(AE2)].
Finally, an expression of the type c=2a+b is replaced with c=(a+b)+a.
Mixture Jacobian and Chudnovsky-Jacobian coordinates
Elmeggaed in [Elmegaaed09] presented a new atomic blocks for Mixted Jacobian and Chudnovsky-Jacobian coordinates.
Let P=(X1,Y1,Z1) in Jacobian coordinates and Q=(X2,Y2,Z2,E2,F2) in Chudnovsky-Jacobian coordinate, with E2=Z22 and F2=Z23. To obtain a practical formula for block atomicity formula for the addition P+Q=(X3, Y3, Z3) 8M+8S+24A+8N are required:
U
1
=X
1
E
2,
U
2
=X
2
Z
1
2,
S
1=(−Y1)F2,
S
2=(2Y2)(X13),
H=U
1
−U
2,
−R=S2−S1,
G=[2(H2+H)2−2(H2)−2(H2)2],
−V=[(H2)2−(2U1+H2)2]+(2U1)2,
G−2V=[G+2[(H2)2−(2U1+H2)2]]+2(2U1)2,
X
3
=[G−2v]+R2,
Y
3
=−GS
1
−R(X3−V),
Z
3=[(Z1+Z2)2−(Z12+E2)]H.
The resulting atomic blocks can be found in Table 3, taking as input X1→R1, Y1→R2, Z1→R2, X2→R4, Y2→R5, Z2→R6, E2→R6 and F2→R8 and returning as output X3→R1, Y3→R2, and Z3→R3.
In the case of Mixture Jacobian and Chudnovsky-Jacobian coordinates, formulae and atomic blocks are presented in Table 3, wherein 12 registers are used. In addition to some of the previously exposed algebraic identities, two new algebraic identities are also applied to eliminate the use of dummy operations:
4H3=2(H2+H)2−2(H2)−2(H2)2,
−4U1H2=[(H2)2−(2U1+H2)2]+(2U1)2.
G−2V=G+2[(H2)2−(2U1+H2)2]+2(2U1)2.
← R102
← −R6
← R
+ R
+ R6
← R2 + R2
+ R
← R
+ R
)]
← R10R9
R9
← R1 + R
← R
← R
2
← −R6
← −R7
]
← R11 + R10
← R4 + R
← R7 + R7
← R9 + R9
← R2R6
+ R9
indicates data missing or illegible when filed
The system and the atomic blocks that must be used for a cryptosystem implemented by means of right-to-left algorithms.
The following table compares the cost of the atomic blocks presented in [Giraud10] and [Elmegaaed09] to those we obtained.
It should be noticed that as well as giving protection against C-safe fault attacks.
Assuming experimental average ratios to multiplications of S/M≈0.8, A/M≈0.2 and N/M≈0.1 in [Giraud10], in the case Modified Jacobian Projective there is no performance loss. For the case of Mixted Jacobian and Chudnovsky Jacobian Addition there is a performance improvement of 4.7%. For the case of General Addition there is a performance loss of 12.5%.
The formulae presented in the current invention were implemented in the Magma software for verifying its proper performance. Its mathematical performance was analyzed in comparison to the other atomic blocks countermeasures and it was obtained a more efficient solution with respect to what exists in the state of the art for the case of using right-to-left algorithms in the scalar multiplication of a cryptosystem based on elliptic curves.
Although embodiments of the invention have been shown and described, it is to be understood that various modifications, substitutions, and rearrangements of parts, components, and/or process (method) steps, as well as other uses, shapes, construction, and design of the Method for Complete Atomic Blocks for Elliptic Curves in Jacobian Coordinates over Prime Fields Countermeasure for Simple-Side Channel Attacks and C-Safe-Fault Attacks for Right-to-Left Algorithms can be made by those skilled in the art without departing from the novel spirit and scope of this invention.
