Randomized Mixed-Radix Scalar Multiplication

Abstract

A set of congruence relations is a Z-covering if each integer belongs to at least one congruence class from that set. In this paper, we first show that most existing scalar multiplication algorithms can be formulated in terms of covering systems of congruences. Then, using a special form of covering systems called exact n-covers, we present a novel uniformly randomized scalar multiplication algorithm with built-in protections against most passive side-channel attacks. Our algorithm randomizes the addition chain using a mixed-radix representation of the scalar. Its reduced overhead and purposeful robustness could make it a sound replacement to several conventional countermeasures. In particular, it is significantly faster than Coron's scalar blinding technique for elliptic curves when the choice of a particular finite field tailored for speed compels to double the size of the scalar, hence the cost of the scalar multiplication.

Improving the Performance of {0,1,3}-NAF Recoding Algorithm for Elliptic Curve Scalar Multiplication

“…Selection of radix or digit set for a scalar must also satisfy the characteristics of the scalar multiplication algorithm or implementation technology. According to [21], proper selection of radix and digit set for the scalar can promote an increase of the frequency of useful digits such as zero and a reduction in the total number of nonzero digits to represent a number.…”

Breaking Randomized Mixed-Radix Scalar Multiplication Algorithms

“…In [7], Guerrini et al use covering systems of congruences to randomize the scalar multiplication algorithm. A covering system of congruences (CSC) is defined as a set S = {(r 1 , m 1 ), .…”

“…, (r i , m i )) is then a random decomposition of the scalar k in the covering system S, and computing Although the algorithm does not run in constant-time and uses non-uniform curve operations (i.e. doublings and additions reveal different patterns in an execution trace), the authors of [7] claimed that their randomization is robust against both simple and more advanced attacks.…”

“…In the sequences of curve operations proposed by the authors in [7,Table 4], one can see that some sequences of operations are specific to only a few congruence classes. Indeed, even if the function µ : S → {A, D} * , which maps each congruence class (r i , m i ) to the corresponding sequence of curve operations is not injective, this is not enough: as soon as µ maps a subset (and only this subset) S of S to some patterns of operations, then it becomes possible to determine whether or not congruences in S were used in a given decomposition R just by checking if these patterns appear in the corresponding trace.…”

“…The first contribution of this paper is a novel attack on a recently proposed approach based on covering systems on congruences (CSC) [7]. The threat model that we consider simply assumes that the attacker can distinguish point doublings from point additions in an execution trace.…”