Paper 2003/028

Elliptic Curve Cryptosystems in the Presence of Permanent and Transient Faults

Mathieu Ciet and Marc Joye

Abstract

Elliptic curve cryptosystems in the presence of faults were studied by Biehl, Meyer and Mueller (2000). The first fault model they consider requires that the input point P in the computation of dP is chosen by the adversary. Their second and third fault models only require the knowledge of P. But these two latter models are less `practical' in the sense that they assume that only a few bits of error are inserted (typically exactly one bit is supposed to be disturbed) either into P just prior to the point multiplication or during the course of the computation in a chosen location. This report relaxes these assumptions and shows how random (and thus unknown) errors in either coordinates of point P, in the elliptic curve parameters or in the field representation enable the (partial) recovery of multiplier d. Then, from multiple point multiplications, we explain how this can be turned into a total key recovery. Simple precautions to prevent the leakage of secrets are also discussed.

Metadata
Available format(s)
PDF PS
Category
Implementation
Publication info
Published elsewhere. Unknown where it was published
Keywords
Elliptic curve cryptographyfault analysisfault attacksphysical securityinformation leakage.
Contact author(s)
marc joye @ gemplus com
History
2003-02-11: received
Short URL
https://ia.cr/2003/028
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2003/028,
      author = {Mathieu Ciet and Marc Joye},
      title = {Elliptic Curve Cryptosystems in the Presence of Permanent and Transient Faults},
      howpublished = {Cryptology ePrint Archive, Paper 2003/028},
      year = {2003},
      note = {\url{https://eprint.iacr.org/2003/028}},
      url = {https://eprint.iacr.org/2003/028}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.