A Hole in the Ladder : Interleaved Variables in Iterative Conditional Branching

Abstract

The modular exponentiation is crucial to the RSA cryptographic protocol, and variants inspired by the Montgomery ladder have been studied to provide more secure algorithms. In this paper, we abstract away the iterative conditional branching used in the Montgomery ladder, and formalize systems of equations necessary to obtain what we call the semi-interleaved and fully-interleaved ladder properties. In particular, we design fault-injection attacks able to obtain bits of the secret against semi-interleaved ladders, including the Montgomery ladder, but not against fully-interleaved ladders that are more secure. We also apply these equations to extend the Montgomery ladder for both the semi-and fully-interleaved cases, thus proposing novel and more secure algorithms to compute the modular exponentiation.

The TeamPlay Project: Analysing and Optimising Time, Energy, and Security for Cyber-Physical Systems

“…The EnergyAnalyser tool [7] uses robust and accurate energy models [8], [9] for the target hardware platforms to predict the energy consumed by each task. The SecurityAnalyser quantifies the security protection level against timing and power side-channel attacks with novel metrics [10], and the SecurityOptimiser transforms the code, if required, to increase protection against these side-channel attacks [11], [12].…”

Semi-automatic ladderisation: improving code security through rewriting and dependent types

“…Marquer and Richmond [28] showed that the algorithm in Listing 1 can be rewritten as the common left-to-right exponentiation in Listing 6. More generally, they studied programs with iterative conditional branching, e.g.…”

“…Joye [18,19] introduces highly regular right-to-left variants and left-to-right/right-to-left variants respectively, and Walter [39] demonstrates their duality. Marquer and Richmond [28] abstract away the algorithmic strength of the Montgomery ladder against SCAs, by defining semi-and fully-ladderisable programs. Brown et al [11] propose a Contract Specification Language (CSL), to allow the developer to capture non-functional properties (NFPs) about their program (including time and energy).…”

“…In this paper, we introduce a new tool-supported technique that semi-automatically transforms portions of the code using refactoring and dependent types, resulting in a ladderised equivalent, with an increased security profile. Our technique is aimed at the non-specialised developer, where we provide high-level refactorings that transform the source code in a functionally (and even algorithmically [27]) equivalent way, introducing a semi-interleaved ladder [28]. This refactoring process is aided by an underlying automated rewrite system, which uses dependent types to model a small arithmetic expression language.…”

“…The else branch in Listing 3 is identical to the then branch, except that 𝑥 and 𝑦 are swapped, which also provides protection against timing and power leakage. Moreover, the variable dependency makes these variables interleaved, so this exponentiation is algorithmically (but only partially [28]) protected against safe-error attacks. As opposed to squareand-multiply-always in Listing 2, the code in the else branch is not dead, so will not be removed by compiler optimisations.…”