Efficient Countermeasures against RPA, DPA, and SPA

Abstract

In the execution on a smart card, side channel attacks such as simple power analysis (SPA) and the differential power analysis (DPA) have become serious threat [15]. Side channel attacks monitor power consumption and even exploit the leakage information related to power consumption to reveal bits of a secret key d although d is hidden inside a smart card. Almost public key cryptosystems including RSA, DLP-based cryptosystems, and elliptic curve cryptosystems execute an exponentiation algorithm with a secret-key exponent, and they thus suffer from both SPA and DPA. Recently, in the case of elliptic curve cryptosystems, DPA is improved to the Refined Power Analysis (RPA), which exploits a special point with a zero value and reveals a secret key [10]. RPA is further generalized to Zero-value Point Attack (ZPA) [2]. Both RPA and ZPA utilizes a special feature of elliptic curves that happens to have a special point or a register used in addition and doubling formulae with a zero value and that the power consumption of 0 is distinguishable from that of an non-zero element. To make the matters worse, some previous efficient countermeasures are neither resistant against RPA nor ZPA. Although a countermeasure to RPA is proposed, this is not universal countermeasure, gives each different method to each type of elliptic curves, and is still vulnerable against ZPA [30]. The possible countermeasures are ES [3] and the improved version [4]. This paper focuses on countermeasures against RPA, ZPA, DPA and SPA. We show a novel countermeasure resistant against RPA, ZPA, SPA and DPA without any pre-computed table. We also generalize the countermeasure to present more efficient algorithm with a pre-computed table.

Exploiting Collisions in Addition Chain-Based Exponentiation Algorithms Using a Single Trace

“…Walter [7] observed that one could potentially derive the bits of an exponent by comparing two parts of a consumption trace corresponding to two operations in a group exponentiation and described some simulations. Amiel and Feix [8], and Kim et al [9] describe some attacks and implementations of this strategy applied to the BRIP exponentiation algorithm [10]. A similar attack has been described by Witteman et al [11] applicable to Coron's double-and-add-always exponentiation algorithm, and Kim et al [9] also describe how one could apply such an attack to the Montgomery ladder [12,13].…”

“…One feature of all these attacks is that an adversary will attempt to determine whether the input to two group operations is the same [8][9][10][11]14]. In this paper we extend this to consider an adversary who is able to determine whether the output of one operation is used as the input to another operation.…”

Enhanced Doubling Attacks on Signed-All-Bits Set Recoding

“…Various countermeasures using random point are introduced so far. Among them, BRIP [13] proposed by Mamiya et al can be applied to our attacks efficiently.…”

How to Avoid the N-1 Attack Without Costly Implementations

“…Though they explained the theoretical form of their attack against the left-to-right SaMA and BRIP algorithms [16], Miyamoto et al demonstrated the effectiveness of an 1 − N attack in practice [17].…”