Experimenting with Faults, Lattices and the DSA

Naccache, David; Nguyêñ, Phong Q.; Tunstall, Michael; Whelan, Claire

doi:10.1007/978-3-540-30580-4_3

Cited by 61 publications

(45 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The lattice-based fault attack was also presented by Naccache et al [17]. Their attack is based on faults inducted into random integer k in order to force a number of the least significant bytes (LSBs) of k to flip to 0.…”

Section: Related Workmentioning

confidence: 99%

“…Afterwards the attacker applies lattice attack on the ElGamal-like signature which can recover private key, given sufficiently many signatures such that a few bits of corresponding k are zeroed. As presented in [17], when one LSB of each k is zeroed, then 27 signatures are sufficient to disclose the private key. In their paper Naccache et al presented theory and methodology of the attack as well as possible countermeasures (e.g.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

DSA Signature Scheme Immune to the Fault Cryptanalysis

Nikodem

2008

Smart Card Research and Advanced Applications

View full text Add to dashboard Cite

Abstract. In this paper we analyse the Digital Signature Algorithm (DSA) and its immunity to the fault cryptanalysis that takes advantage of errors inducted into the private key a. The focus of our attention is on the DSA scheme as it is a widely adopted by the research community, it is known to be vulnerable to this type of attack, but neither sound nor effective modifications to improve its immunity have been proposed. In our paper we consider a new way of implementing the DSA that enhances its immunity in the presence of faults. Our proposal ensures that inducting errors into the private key has no benefits since the attacker cannot deduce any information about the private key given erroneous signatures. The overhead of our proposal is similar to the overhead of obvious countermeasure based on signature verification. However, our modification generates fewer security issues.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

DSA Signature Scheme Immune to the Fault Cryptanalysis

Nikodem

2008

Smart Card Research and Advanced Applications

View full text Add to dashboard Cite

show abstract

“…Random Order: If all the functions are conducted in a random order it will not be possible to determine any relationship between a cache hit/miss and the actual values being manipulated, which can either be implemented in hardware [13] or software [9].…”

Section: Countermeasuresmentioning

confidence: 99%

“…An example of this is given in [9] for copying 256 bytes from buffer A to buffer B and is detailed in Algorithm 4. The same principle can be applied to the loop in the ByteSub and MixColumn function so that an attacker does not know which of the 16!…”

Section: Countermeasuresmentioning

confidence: 99%

Cache Based Power Analysis Attacks on AES

Fournier

Tunstall

2006

Information Security and Privacy

Self Cite

View full text Add to dashboard Cite

Abstract. This paper describes possible attacks against software implementations of AES running on processors with cache mechanisms, particularly in the case of smart cards. These attacks are based on sidechannel information gained by observing cache hits and misses in the current drawn by the smart card. Two different attacks are described. The first is a combination of ideas proposed in [2] and [11] to produce an attack that only requires the manipulation of the plain text and the observation of the current. The second is an attack based on specific implementations of the xtime function [10]. These attacks are shown to also work against algorithms using Boolean data masking techniques as a DPA countermeasure.

show abstract

“…At PKC 2005, Naccache et al [21] employed glitch attacks to ensure that the least significant bytes of the nonces were flipped to zero, allowing the authors to apply the same lattice techniques to recover keys from real smart cards. Recently, Liu and Nguyen [19] developed a new algorithm which allowed them to recover 160-bit keys with only 2 leaked nonce bits.…”

Section: Introductionmentioning

confidence: 99%

Using Bleichenbacher”s Solution to the Hidden Number Problem to Attack Nonce Leaks in 384-Bit ECDSA

Mulder¹,

Hutter

Marson³

et al. 2013

Cryptographic Hardware and Embedded Systems - CHES 2013

View full text Add to dashboard Cite

Abstract. In this paper we describe an attack against nonce leaks in 384-bit ECDSA using an FFT-based attack due to Bleichenbacher. The signatures were computed by a modern smart card. We extracted the low-order bits of each nonce using a template-based power analysis attack against the modular inversion of the nonce. We also developed a BKZ-based method for the range reduction phase of the attack, as it was impractical to collect enough signatures for the collision searches originally used by Bleichenbacher. We confirmed our attack by extracting the entire signing key using a 5-bit nonce leak from 4 000 signatures.

show abstract

Experimenting with Faults, Lattices and the DSA

Cited by 61 publications

References 16 publications

DSA Signature Scheme Immune to the Fault Cryptanalysis

DSA Signature Scheme Immune to the Fault Cryptanalysis

Cache Based Power Analysis Attacks on AES

Using Bleichenbacher”s Solution to the Hidden Number Problem to Attack Nonce Leaks in 384-Bit ECDSA

Contact Info

Product

Resources

About