Resistance of Isogeny-Based Cryptographic Implementations to a Fault Attack

Abstract

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Faulty isogenies: a new kind of leakage

“…In [24], Tasso et al implemented Ti's attack and additionally proposed a countermeasure to it. Essentially, they propose to check whether the reconstructed A-coefficient from the computed public key pk 2 = (P , Q , R) equals the last A-coefficient in keygen (output of line 15 of 1).…”

“…In [24] the authors report that electromagnetic injection is considerably difficult to synchronize with the execution of SIKE. Because of this difficulty, the real-scenario attack implemented by the authors achieved a rather modest experimental success rate of just 0.62%, which is relatively inefficient compared with the expected theoretical 50% success rate attributed to Ti's attack [24,Remark 7].…”

“…In 2017, Ti [25] proposed a fault attack that allows to recover Alice's secret isogeny φ A exploiting the fact that if the image of a random point S ∈ E[p + 1] under φ A is revealed, then with high probability, the attack is successful [24,Remark 3]. To accomplish this, the attacker must succeed injecting a fault before Alice starts computing her public key.…”

“…The attacker's goal is to try to perturb any of these points by injecting a fault in a timely manner. Recently, the authors of [24] reported a real implementation of Ti's attack that obtained a small effectiveness (mainly due to the difficulty of producing electromagnetic injections at the right moment). Since Ti's attack only deals with injecting a fault in the key generation procedure, it works equally well for SIDH and SIKE.…”

“…Hence, the recovered secret key can only be useful if the key generation procedure commits the sin of using the same private key, something that should not happen in any proper implementation of SIDH or SIKE. 5 Further, there exist a simple and inexpensive countermeasure to prevent Ti's attack, which is checking the order or correctness of the auxiliary points before to their publication [25,24,4].…”