Fault Attacks on Projective-to-Affine Coordinates Conversion

Diana Maimut , Cedric Murdica (1) , David Naccache (2) , Mehdi Tibouchi (3)

1 Télécom ParisTech
2 LIENS - Laboratoire d'informatique de l'école normale supérieure
3 NTT Secure Platform Laboratories [Tokyo]

At EUROCRYPT 2004, Naccache {\sl et alii} showed that when the result of an elliptic curve scalar multiplication [k] P (computed using a fixed scalar multiplication algorithm, such as double-and-add) is given in projective coordinates, an attacker can recover information on k. The attack is somewhat theoretical, because elliptic curve cryptosystems implementations usually convert scalar multiplication's result back to affine coordinates before outputting [k]P. This paper explains how injecting faults in the final projective-to-affine coordinate conversion enables an attacker to retrieve the projective coordinates of [k]P, making Naccache et alii's attack also applicable to implementations that output points in affine coordinates. As a result, such faults allow the recovery of information about k.

Domaines: Réseaux et télécommunications [cs.NI]

Diana Maimut, Cedric Murdica, David Naccache, Mehdi Tibouchi. Fault Attacks on Projective-to-Affine Coordinates Conversion. COSADE'13, Mar 2013, France. LNCS, volume 7864, p. 46-61. ⟨hal-00857190⟩