Improving the Big Mac Attack on Elliptic Curve Cryptography

Abstract

At CHES 2001, Walter introduced the Big Mac attack against an implementation of rsa. It is an horizontal collision attack, based on the detection of common operands in two multiplications. The attack is very powerful since one single power trace of an exponentiation permits to recover all bits of the secret exponent. Moreover, the attack works with unknown or blinded input. The technique was later studied and improved by Clavier et alii and presented at INDOCRYPT 2012. At SAC 2013, Bauer et alii presented the first attack based on the Big Mac principle on implementations based on elliptic curves with simulation results.In this work, we improve the attack presented by Bauer et alii to considerably increase the success rate. Instead of comparing only two multiplications, the targeted implementation permits to compare many multiplications. We give experiment results with traces taken from a real target to prove the soundness of our attack. In fact, the experimental results show that the original Big Mac technique given by Walter was better that the technique given by Clavier et alii. With our experiments on a real target, we show that the theoretical improvements are not necessarily the more suitable methods depending on the targeted implementations.

Improved Atomicity to Prevent HCCA on NIST Curves

“…However the authors do not comment on any atomicity algorithm in [6]. In the following section, we recall a methodology mentioned in [7] that proposes an improvisation of the HCCA for the atomicity algorithms.…”

“…In this paper we show how the countermeasure idea can be applied in case of the well-known atomicity algorithms by introducing minimal overhead, such that the final transformation is resistant against the advanced horizontal attacks. In [7] HCCA attack has been improvised in the light of Big Mac attack by observing the operand sharing property from multiple pairs of field multiplication instead of looking into a single pair. We note here that the countermeasure design can transform the atomicity algorithm into a safe form which is resistant against even the improved attack by [7].…”

“…In [7] HCCA attack has been improvised in the light of Big Mac attack by observing the operand sharing property from multiple pairs of field multiplication instead of looking into a single pair. We note here that the countermeasure design can transform the atomicity algorithm into a safe form which is resistant against even the improved attack by [7].…”

Single-Trace Side-Channel Attacks on Scalar Multiplications with Precomputations

“…In 2013, Bauer et al [4] (see [5] for an extended version) combined the ideas of [11] with Moradi et al 's collision correlation analysis [42] and obtained a very powerful single-trace attack which thwarts many of the state-of-the-art countermeasures. Recently, further works have built on the ideas of improving Big Mac [15] and collision correlations [29]. Another trend of attacks uses clustering algorithms to launch a single-trace attack on ECC.…”

“…-We extend existing correlation-based single-trace attacks (in particular, [4,5,15,29,52]) to scalar multiplications with precomputations. While this type of correlation attacks have been conjectured to form a serious threat to scalar multiplication algorithms with precomputations already before, we are not aware of any works that would have studied this in depth before this paper.…”