Evitando ataques Side-Channel mediante el cálculo de curvas isógenas e isomorfas

Transcription

1 1 / 24 Evitando ataques Side-Channel mediante el cálculo de curvas isógenas e isomorfas R. Abarzúa 1 S. Martínez 2 J. Miret 2 R. Tomàs 2 J. Valera 2 1 Universidad de Santiago de Chile (Chile). rodrigo.abarzua@usach.cl 2 Universitat de Lleida (Spain). {santi,miret,rosana}@matematica.udl.cat, javier.valera@udl.cat October 30, 2013

2 2 / 24 Table of Contents

3 3 / 24 Table of Contents Context Smart cards attacks 1 Context Smart cards attacks

4 Context Context Smart cards attacks Smart cards They have different uses: Data storage: Health care, loyalty and stored value,... Security: ID verification, Access control,... Communications: Payphones, Mobile communications,... Banking and Retail: Electronic purse, e-commerce,... Smart cards have constrains (computational, technical and hardware resources and memory are limited), but a good security is necessary: ECDLP: it is simple, efficient and reduces memory requirements 4 / 24

5 5 / 24 Attacks against smart cards Context Smart cards attacks Smart cards leak information through side channels such as voltage fluctuations, timing and electromagnetic signals (SCA) Simple Power Analysis (SPA) Differential Power Analysis (DPA) Timing Attacks Electromagnetic Attacks (EMA) Specific to ECDLP: Special Points Zero-Value Point Attacks (ZVP) Same Values Analysis (SVA)

6 6 / 24 Table of Contents Elliptic curves Isogenies l-volcanoes 1 2 Elliptic curves Isogenies l-volcanoes 3 4 5

7 7 / 24 Elliptic curves Elliptic curves Isogenies l-volcanoes An elliptic curve E over a finite field F p can be given by a Weierstraß s equation: y 2 = x 3 + ax + b a, b F p j(e) = 1728(4a) 3 /( 16(4a b 2 )) The set E(F p ) consists of all (x, y) F p F p, which satisfy this equation, together with the point at infinity, O E E is ordinary #E(F p ) p + 1 A point addition can be defined over E(F p ) so that (E(F p ), +) is an abelian group

8 8 / 24 Isogenies of degree l Elliptic curves Isogenies l-volcanoes An isogeny between two elliptic curves E/F p and E /F p is a rational map I : E/F p E /F p such that I(O E ) = O E ker I = {P E(F p ) I(P) = O E } deg I = # ker I If deg I = l, being l a prime, then I and E are, respectively, a l-isogeny and a l-isogenous curve of E E/F p and E /F p have the same group order. E and E are l-isogenous over F p Φ l (j(e), j(e )) = 0, with Φ l (X, Y ) the modular polynomial associated to l

9 9 / 24 l-volcano graph Elliptic curves Isogenies l-volcanoes Description Nodes: Represent isomorphism classes of elliptic curves Edges: Represent l-isogenies between two isomorphism classes of elliptic curves

10 9 / 24 l-volcano graph Elliptic curves Isogenies l-volcanoes Description Nodes: Represent isomorphism classes of elliptic curves Edges: Represent l-isogenies between two isomorphism classes of elliptic curves

11 10 / 24 Table of Contents Attacks specific to ECDLP Conditions to avoid Attacks specific to ECDLP Conditions to avoid 4 5

12 General idea Attacks specific to ECDLP Conditions to avoid Use dependencies that exist between secret key and algorithm SCA SPA: Observe the power consumption of devices in a single computation and detect the secret key DPA: Observe many power consumptions and analyze this information together with statistic tools Countermeasures Hiding: Break relation between processed value and power consumption. Masking/Blinding: Break relation between algorithmic value and processed value. 11 / 24

13 12 / 24 Attacks specific to ECDLP Conditions to avoid Specific attacks for elliptic curve cryptography (1/2) Special Points attacks Goubin proposed a variant of DPA using points with zero-valued coordinates ((0, y) or (x, 0)) Smart proposed a countermeasure using isogenies to resist Goubin s attack Zero-Value Point attacks Akishita and Takagi noticed that other intermediate registers gave information if they had value zero They also used isogenies to search for a resistant curve

14 13 / 24 Attacks specific to ECDLP Conditions to avoid Specific attacks for elliptic curve cryptography (2/2) Same Values Analysis attacks Murdica et al. found that the occurrence of identical values during computations could give information The proposed solution is using an isomorphic curve

15 14 / 24 Attacks specific to ECDLP Conditions to avoid ZVP (and Special Points) conditions Doubling 3x 2 + a = 0 5x 4 + 2ax 2 4bx + a 2 = 0 P is of order 3 the cardinality of the curve is divisible by 3 x(p) = 0 or x(2p) = 0 b is a quadratic residue y(p) = 0 or y(2p) = 0 there are points of order 2 (i.e. the cardinality of the curve is even) where P = (x, y) can be any point on the curve

16 15 / 24 SVA conditions (Murdica et al.) Attacks specific to ECDLP Conditions to avoid Doubling x = 1 x 2 = y 2y = 3x 2 + a where P = (x, y) can be any point on the curve

17 16 / 24 Table of Contents Previous methods Proposed method Results Previous methods Proposed method Results 5

18 17 / 24 Previous methods Proposed method Results Smart and Akishita-Takagi s method Idea Given a curve E and a list of prime numbers l 1 <... < l n, such that there exists, at least, an l i -isogeny of E, 1 i n: If E does not satisfy the conditions, its l 1 -isogenies will be computed If these new curves neither satisfy the conditions, then, the l 2 -isogenies of E will be computed Previous step will be repeated increasing the l i until finding a resistant curve Disadvantage: the computational cost of calculating an l-isogeny over F p is O(l 2 (ln p))

19 18 / 24 Proposed method Previous methods Proposed method Results For a give curve, first we compute the curves of its l-volcano with l the smallest one If any of them is resistant, we jump to another l-volcano with an l -isogeny, l > l

20 19 / 24 Execution test Previous methods Proposed method Results Algorithm has been implemented in Magma and executed with the curves of the Standards for Efficient Cryptography Group Execution with SECG curves Curve Necessary isogenies secp192r1 16 with l = 5, 16 with l = 11, 18 with l = 13 secp224r1 4 with l = 3 secp256r1 1 with l = 3 secp384r1 30 with l = 19 secp521r1 1 with l = 5

21 20 / 24 Previous methods Proposed method Results Minimum isogeny versus path of isogenies Smart and Akishita-Takagi s strategy searches the minimum isogeny to reach a resistant curve in one step The new proposal searches a path that minimizes individual isogenies Paths leading to a resistant curve Curve Minimum l-isogeny l-isogeny path secp192r1 l = 23 2 with l = 13 secp224r1 l = 3 l = 3 secp256r1 l = 3 l = 3 secp384r1 l = 31 8 with l = 19 secp521r1 l = 5 l = 5

22 Table of Contents 21 /

23 22 / 24 If we increase the value l, the computational cost increases considerably A path with smaller l s has less cost than computing l-isogenies with high values of l This low cost makes possible to treat more conditions without increasing the cost very much

24 23 / 24 Evitando ataques Side-Channel mediante el cálculo de curvas isógenas e isomorfas R. Abarzúa 1 S. Martínez 2 J. Miret 2 R. Tomàs 2 J. Valera 2 1 Universidad de Santiago de Chile (Chile). rodrigo.abarzua@usach.cl 2 Universitat de Lleida (Spain). {santi,miret,rosana}@matematica.udl.cat, javier.valera@udl.cat October 30, 2013