Lattice Attacks Against Elliptic-Curve Signatures with Blinded Scalar Multiplication

Abstract

Elliptic curve cryptography is today the prevailing approach to get efficient public-key cryptosystems and digital signatures. Most of elliptic curve signature schemes use a nonce in the computation of each signature and the knowledge of this nonce is sufficient to fully recover the secret key of the scheme. Even a few bits of the nonce over several signatures allow a complete break of the scheme by lattice-based attacks. Several works have investigated how to efficiently apply such attacks when partial information on the nonce can be recovered through side-channel attacks. However, these attacks usually target unprotected implementation and/or make ideal assumptions on the recovered information, and it is not clear how they would perform in a scenario where common countermeasures are included and where only noisy information leaks via side channels. In this paper, we close this gap by applying such attack techniques against elliptic-curve signature implementations based on a blinded scalar multiplication. Specifically, we extend the famous Howgrave-Graham and Smart lattice attack when the nonces are blinded by the addition of a random multiple of the elliptic-curve group order or by a random Euclidean splitting. We then assume that noisy information on the blinded nonce can be obtained through a template attack targeting the underlying scalar multiplication and we show how to characterize the obtained likelihood scores under a realistic leakage assumption. To deal with this scenario, we introduce a filtering method which given a set of signatures and associated likelihood scores maximizes the success probability of the lattice attack. Our approach is backed up with attack simulation results for several signal-to-noise ratio of the exploited leakage.

Minerva: The curse of ECDSA nonces

“…Since then, the HNP was used in many attacks against biased or leaked nonces in (EC)DSA, often utilizing side channels such as timing [ABuH Other attacks utilizing the HNP include using information about nonce distribution [BH19] or fault injection in the case of the SM2 signature algorithm [LCL13]. There have also been some theoretical extensions [FGR12;GRV16;HR06]. Finally, a very different approach was taken by Mulder et al [MHM + 13], where lattice reduction is used just as a processing step, and the core of the method lies in the Fast Fourier Transform.…”

Lattice attacks on pairing-based signatures

“…In [13], Coron proposed notably to randomize the exponent and the projective coordinates of the base point. It is an interesting question to extend our attacks in such setting (as it was done recently for ECDSA in [15]). It is also interesting to study the security against side-channel attacks of the pairing-based signatures whose design does not rely on the exponent inversion framework (i.e.…”

High Order Side-Channel Security for Elliptic-Curve Implementations

“…In such a context, the adversary has no choice but to rely on single-trace attacks which exploit a single leakage trace to infer significant information on the (randomized) scalar. Note that partial information on randomized scalars might still be exploitable, either in the fixed scalar case [SI11,RIL19] or in the nonce scalar case [GRV16], but this partial information must still be significant to retrieve the original scalar (or to break the underlying scheme in the nonce scenario). Several attack techniques exist which aim at making the most of a single leakage trace to fully recover the (randomized) scalar, or at least a significant part of it.…”