ECDSA Passive Attacks, Leakage Sources, and Common Design Mistakes

Dubeuf Jérémy (1) , David Hely (1, 2) , Vincent Beroulle (2)

1 CTSYS - Conception et Test de SYStèmes embarqués
2 LCIS - Laboratoire de Conception et d'Intégration des Systèmes

Elliptic Curves Cryptography (ECC) tends to replace RSA for public key cryptographic services. ECC is involved in many secure schemes such as Elliptic Curve Diffie-Hellman (ECDH) key agreement, Elliptic Curve Integrated Encryption Scheme (ECIES), and Elliptic Curve Digital Signature Algorithm (ECDSA). As for every cryptosystem, implementation of such schemes may jeopardize the inherent security provided by the mathematical properties of the ECC. Unfortunate implementation or algorithm choices may create serious vulnerabilities. The elliptic curve scalar operation is particularly sensitive among these schemes. This article surveys passive attacks against well-spread elliptic curve scalar multiplication algorithms highlighting leakage sources and common mistakes that can be used to attack the ECDSA scheme. Experimental results are provided to illustrate and demonstrate the effectiveness of each vulnerability. Finally, the article describes the link between partial leakage and lattice attack in order to understand and demonstrate the impact of small leakages on the security of ECDSA. An example of side channel and lattice attack combination on NIST P-256 is provided in the case where the elliptic curve scalar multiplication is not protected against DPA/CPA and a controllable device is not accessible.

Mots clés: side channel analysis; hardware security; cryptography; Elliptic Curve Cryptography

Domaines: Micro et nanotechnologies/Microélectronique; Architectures Matérielles [cs.AR]; Cryptographie et sécurité [cs.CR]

Dubeuf Jérémy, David Hely, Vincent Beroulle. ECDSA Passive Attacks, Leakage Sources, and Common Design Mistakes . ACM Transactions on Design Automation of Electronic Systems, 2016, ⟨10.1145/2820611⟩. ⟨hal-01398724⟩