Fault Attack on elliptic curve with Montgomery ladder implementation

Pierre-Alain Fouque (1, 2, 3) , Reynald Lercier (4) , Denis Réal (5) , Frédéric Valette (5)

1 ENS-PSL - École normale supérieure - Paris
2 LIENS - Laboratoire d'informatique de l'école normale supérieure
3 CASCADE - Construction and Analysis of Systems for Confidentiality and Authenticity of Data and Entities
4 IRMAR - Institut de Recherche Mathématique de Rennes
5 DGA.MI - DGA Maîtrise de l'information

In this paper, we present a new fault attack on elliptic curve scalar product algorithms. This attack is tailored to work on the classical Montgomery ladder method when the $y$-coordinate is not used. No weakness has been reported so far on such implementations, which are very efficient and were promoted by several authors. But taking into account the twist of the elliptic curves, we show how, with few faults (around one or two faults), we can retrieve the full secret exponent even if classical countermeasures are employed to prevent fault attacks. It turns out that this attack has not been anticipated as the security of the elliptic curve parameters in most standards can be strongly reduced. Especially, the attack is meaningful on some NIST or SECG parameters.

Domaines: Géométrie algébrique [math.AG]

Pierre-Alain Fouque, Reynald Lercier, Denis Réal, Frédéric Valette. Fault Attack on elliptic curve with Montgomery ladder implementation. 5th Workshop on Fault Diagnosis and Tolerance in Cryptography : FDTC 2008, Aug 2008, Washington DC, United States. pp.92-98, ⟨10.1109/FDTC.2008.15⟩. ⟨hal-00373562⟩