Side Channel Analysis of Practical Pairing Implementations: Which Path Is More Secure?

Abstract

We present an investigation into the security of three practical pairing algorithms; the Tate, Eta and Ate pairing, in terms of side channel vulnerability. These three algorithms have recently shown to be efficiently computable on the resource constrained smart card, yet no in depth side channel analysis has yet appeared in the literature. Since the secret parameter input to the pairing can potentially be entered in either of the two possible positions, there exist two avenues of attack, i.e. e(P, Q) or e(Q, P) where P is public and Q is private. We analyse the core operations fundamental to pairings and not only highlight how each implementation may potentially succumb to a side channel attack, but also show how one path is more susceptible than the other in Tate and Ate. For those who wish to deploy pairing based systems we make a simple suggestion to improve resistance to SCA.

Improved Side Channel Attacks on Pairing Based Cryptography

“…Regarding non-invasive attacks, i.e., attacks that exploit timings, power consumption, or electro-magnetic radiance, in [KTH + 06] the authors have investigated attacks for implementations of the eta pairing on supersingular curves in characteristic 2. In [WS06], differential power analysis (DPA) based attacks on the Tate pairing were analyzed. The authors showed how to attack implementations of the Tate pairing if the second argument represents the secret.…”

An Efficient Countermeasure against Side Channel Attacks for Pairing Computation

“…Whelan et al [25] explained that a multiplication of secret data by public data, and squaring and square-root computations of secret data became subjects of SCAs if we use the pairing over finite fields of characteristic two. Moreover, they discuss that one input point Q of pairing e(P, Q) is fixed (never changed) during computation of the BKLS algorithm.…”

“…Countermeasures for pairing devices have recently been investigated [21,19,25,13,26]. Let e(P, Q) be a pairing for two points P = (x p , y p ), Q = (x q , y q ) on the underlying elliptic curve.…”

“…In this method, settings X p ← λx p , Y p ← λy p , and Z p ← λ are performed, and its overhead is 3nM for the η T pairing over F 3 n . Whelan et al also considered SCAs against pairings [25,26]. They concluded that pairings using the BKLS algorithm (such as Ate pairing) might not be vulnerable against SCAs by setting the secret point P to the first parameter of e(P, Q).…”

“…However, side channel attacks (SCAs) are serious attacks on hardware implementations. Whelan et al pointed out that pairings except the η T pairing might not be vulnerable against SCAs by setting the secret point to the first parameter [25]. This paper deals with SCAs for the η T pairing over F 3 n .…”