Improved countermeasure against address-bit DPA for ECC scalar multiplication

Authors:
Masami Izumi;Jun Ikegami;Kazuo Sakiyama;Kazuo Ohta
Affiliations:
The University of Electro-Communications, Chofugaoka, Chofu, Tokyo, Japan;The University of Electro-Communications, Chofugaoka, Chofu, Tokyo, Japan;The University of Electro-Communications, Chofugaoka, Chofu, Tokyo, Japan;The University of Electro-Communications, Chofugaoka, Chofu, Tokyo, Japan
Venue:
Proceedings of the Conference on Design, Automation and Test in Europe
Year:
2010

Citing 5
Cited 1

Checking Before Output May Not Be Enough Against Fault-Based Cryptanalysis

IEEE Transactions on Computers
Differential Power Analysis

CRYPTO '99 Proceedings of the 19th Annual International Cryptology Conference on Advances in Cryptology
Resistance against Differential Power Analysis for Elliptic Curve Cryptosystems

CHES '99 Proceedings of the First International Workshop on Cryptographic Hardware and Embedded Systems
Fast Multiplication on Elliptic Curves over GF(2m) without Precomputation

CHES '99 Proceedings of the First International Workshop on Cryptographic Hardware and Embedded Systems
Investigations of power analysis attacks on smartcards

WOST'99 Proceedings of the USENIX Workshop on Smartcard Technology on USENIX Workshop on Smartcard Technology

An updated survey on secure ECC implementations: attacks, countermeasures and cost

Cryptography and Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

Messerges, Dabbish and Sloan proposed a DPA attack which analyzes the address values of registers [1]. This attack is called the Address-bit DPA (ADPA) attack. As countermeasures against ADPA, Itoh, Izu and Takenaka proposed algorithms that randomizes address bits [2]. In this paper, we point out that one of their countermeasures has vulnerability even if the address bits are uniformly randomized. When a register is overwritten by the same data as one stored in the register during a data move process, the power consumption is lower than the case of being overwritten by the different data. This fact enables us to separate the power traces. As a result, in the case of the algorithm proposed in [2], we could invalidate the randomness of the random bits and perform ADPA to retrieve a secret key. Moreover, for the purpose of overcoming the vulnerability, we propose a new countermeasure algorithm.