The Importance of the Final Exponentiation in Pairings When Considering Fault Attacks

Whelan, Claire; Scott, Michael

doi:10.1007/978-3-540-73489-5_12

Cited by 27 publications

(57 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…But when it comes to PBC the effort that has been spent on the analysis of SCAs is much smaller than in the case of standart ECC. Nevertheless, there are some results that analyze the vulnerability of pairings to passive attacks as well as to active attacks [PV04, KTH + 06, WS06, WS07,PV06].…”

Section: Introductionmentioning

confidence: 99%

“…The authors attacked two algorithms for the Tate pairing. Later, the vulnerability of several algorithms for the Weil, Tate and eta pairings in presence of fault attacks was studied in [WS07]. The authors of [Mra09] analyze the vulnerability of Miller's algorithm against the same fault type as used in [PV06].…”

Section: Introductionmentioning

confidence: 99%

“…The authors of [Mra09] analyze the vulnerability of Miller's algorithm against the same fault type as used in [PV06]. To apply these results to conrete pairing algorithms that are based on Miller's algorithm, stronger assumptions about the involved faults are necessary than in [PV06] and [WS07].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Improved Side Channel Attacks on Pairing Based Cryptography

Blömer

Gunther

Liske

2013

Constructive Side-Channel Analysis and Secure Design

View full text Add to dashboard Cite

Techniques from pairing based cryptography (PBC) are used in an increasing number of cryptographic schemes. With progress regarding efficient implementations, pairings also become interesting for applications on smart cards. With these applications the question of the vulnerability to side channel attacks (SCAs) arises. Several known invasive and noninvasive attacks against pairing algorithms only work if the second but not if the first argument of the pairing is the secret. In this paper we extend some of these attacks also to the case where the first argument is the secret. Hence we may conclude that positioning the secret as the first argument of the pairing does not improve the security against SCAs, as it sometimes has been suggested.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Improved Side Channel Attacks on Pairing Based Cryptography

Blömer

Gunther

Liske

2013

Constructive Side-Channel Analysis and Secure Design

View full text Add to dashboard Cite

show abstract

“…Countermeasures for pairing devices have recently been investigated [21,19,25,13,26]. Let e(P, Q) be a pairing for two points P = (x p , y p ), Q = (x q , y q ) on the underlying elliptic curve.…”

Section: Introductionmentioning

confidence: 99%

“…In this method, settings X p ← λx p , Y p ← λy p , and Z p ← λ are performed, and its overhead is 3nM for the η T pairing over F 3 n . Whelan et al also considered SCAs against pairings [25,26]. They concluded that pairings using the BKLS algorithm (such as Ate pairing) might not be vulnerable against SCAs by setting the secret point P to the first parameter of e(P, Q).…”

Section: Introductionmentioning

confidence: 99%

An Efficient Countermeasure against Side Channel Attacks for Pairing Computation

Shirase

Takagi

Okamoto

Information Security Practice and Experience

View full text Add to dashboard Cite

Abstract. Pairing-based cryptosystems have been widely researched, and several efficient hardware implementations of pairings have also been proposed. However, side channel attacks (SCAs) are serious attacks on hardware implementations. Whelan et al. pointed out that pairings except the η T pairing might not be vulnerable against SCAs by setting the secret point to the first parameter [25]. This paper deals with SCAs for the η T pairing over F 3 n . To our knowledge, the randomized-projectivecoordinate method has the smallest overhead among all countermeasures against SCAs for the η T pairing. The cost of that overhead is 3nM , where M is the cost of a multiplication in F 3 n . In this paper, we propose another countermeasure based on random value additions (xp + λ) and (y p + λ), where P = (x p , y p ) is the input point, and λ is a random value in F3n . The countermeasure using the random value addition was relatively slow in the case of the scalar multiplication of elliptic curve cryptosystems. However, in the case of the η T pairing, we can construct an efficient countermeasure due to the form of the function g P (x, y) = y 3 p y − (x 3 p + x − 1) 2 for a point P = (x p , y p ). The overhead of our proposed scheme is just 0.5nM , which is a reduction of more than 75% compared with the randomized-projective-coordinate method.

show abstract