Trouble at the CSIDH: Protecting CSIDH with Dummy-Operations Against Fault Injection Attacks

Abstract

The isogeny-based scheme CSIDH is a promising candidate for quantum-resistant static-static key exchanges with very small public keys, but is inherently difficult to implement in constant time. In the current literature, there are two directions for constant-time implementations: algorithms containing dummy computations and dummy-free algorithms. While the dummy-free implementations come with a 2x slowdown, they offer by design more resistance against fault attacks. In this work, we evaluate how practical fault injection attacks are on the constant-time implementations containing dummy calculations. We present three different fault attacker models. We evaluate our fault models both in simulations and in practical attacks. We then present novel countermeasures to protect the dummy isogeny computations against fault injections. The implemented countermeasures result in an overhead of 7% on the Cortex-M4 target, falling well short of the 2x slowdown for dummy-less variants.

Disorientation Faults in CSIDH

“…Prior works investigating fault attacks on isogeny-based cryptography mostly target specific variants or implementations of schemes and are different from our approach. Loop-abort faults on the SIDH cryptosystem [25], discussed for CSIDH in [10], lead to leakage of an intermediate value of the computation rather than the final result. Replacing torsion points with other points in SIDH [36,37] can be used to recover the secret keys; faulting intermediate curves in SIDH [2] to learn if secret isogeny paths lead over subfield curves can also leak information on secret keys.…”

“…One can modify memory locations and observe if this changes the resulting shared secret [11]. A different attack avenue is to target fault injections against dummy computations in CSIDH [10,28]. We emphasize that these are attacks against specific implementations and variants of CSIDH.…”

Faster Key Generation of Supersingular Isogeny Diffie-Hellman

“…Further, to defend the attacker who performs one fault injection, we can simply compute the above points twice and check whether the two results are the same. This countermeasure is also adapted in the CSIDH with dummy-operations against fault injection attacks [22].…”

CTIDH: faster constant-time CSIDH

“…Fault-injection attacks on constant-time CSIDH implementations are discussed in [11,8]. Dummy operations are dangerous in this context: a "safe-error attack" faults an operation and, if the output is unchanged, concludes that the operation was a dummy operation.…”

“…For example, the constant-time differential addition chains in our software involve dummy differential additions; it should be possible to avoid these by precomputing chains of the same length for all of the primes in a batch. As another example, the Matryoshka-doll structure involves dummy operations, and it would be interesting to explore adaptations of the countermeasures of [8] to this context.…”