Novel Key Recovery Attack on Secure ECDSA Implementation by Exploiting Collisions between Unknown Entries

Abstract

In this paper, we propose a novel key recovery attack against secure ECDSA signature generation employing regular table-based scalar multiplication. Our attack exploits novel leakage, denoted by collision information, which can be constructed by iteratively determining whether two entries loaded from the table are the same or not through side-channel collision analysis. Without knowing the actual value of the table entries, an adversary can recover the private key of ECDSA by finding the condition for which several nonces are linearly dependent by exploiting only the collision information. We show that this condition can be satisfied practically with a reasonable number of digital signatures and corresponding traces. Furthermore, we also show that all entries in the pre-computation table can be recovered using the recovered private key and a sufficient number of digital signatures based on the collision information. As case studies, we find that fixed-base comb and T_SM scalar multiplication are vulnerable to our attack. Finally, we verify that our attack is a real threat by conducting an experiment with power consumption traces acquired during T_SM scalar multiplication operations on an ARM Cortex-M based microcontroller. We also provide the details for validation process.

Enhanced Side-Channel Analysis on ECDSA Employing Fixed-Base Comb Method

“…See Figure 2 for our setup. We collected 50 traces even though our method requires at most 27 (=8+16+2+1) traces 4 , which is one more than the sum of the possible entry number in the first iteration, the remaining iterations, and the final point addition. We apply an additional 5 MHz low-pass filter to all measured traces for noise reduction.…”

“…It thus may be difficult to succeed with a single trace attack against table-based scalar multiplication. Another form of key recovery attack against ECDSA employing table-based scalar multiplication by exploiting collisions between unknown entries has been introduced [4]. In the next section, we introduce this attack in order to better understand the approach proposed in the present paper.…”

“…Jin et al proposed a novel key recovery attack against ECDSA signature generation employing regular table-based scalar multiplication [4]. For convenience, we refer to this as a key recovery attack through the linear combination of entry collision information (LCECI) from now.…”

“…Because the target leakages in our method are similar to those in jin et al's original attack, we perform a similar process for identifying and extracting subtraces in this experiment [4]. We investigate traces to identify target operations and extract subtraces corresponding to these operations.…”

“…FBC scalar multiplication also offers some practical security features against side-channel analysis, including allowing fewer exploitable leakages of word multiplications for horizontal correlation attacks and the complexity of guessing entries for collision attacks is not neglectable. However, a novel key recovery attack against ECDSA signature generation that employs regular table-based scalar multiplication, including the FBC method, was recently introduced at CHES 2021 [4]. This attack finds the secret key using a linear combination of collisions between the leakages that provide information on whether table entries are the same or not.…”