Defeating Simple Power Analysis on Koblitz Curves

Abstract

Koblitz curves belong to a special class of binary curves on which the scalar multiplication can be computed very efficiently. For this reason, they are suitable candidates for implementations on low-end processors. However, such devices are often vulnerable to side channel attacks. In this paper, we propose a new countermeasure against side channel attacks on Koblitz curves, which utilizes a fixed-pattern recoding to defeat simple power analysis. We show that in practical cases, the recoding can be performed from left to right, and can be easily stored or even randomly generated.

A New Approach for Implementing the MPL Method toward Higher SPA Resistance

“…ρ ideal X,Y = 1. The MPL method is considered as one of the SPAresistant algorithms in many papers [10,11,12]. However, a naïve hardware implementation of the algorithm becomes vulnerable to SPA attacks.…”

“…2, the secret key cannot be identified by power trace easily. This is why much previous work report the MPL method is secure against SPA attacks [10,11,12]. However, the power trace still shows irregular shapes depending on the key bit.…”

Smart Card Research and Advanced Applications

“…Signed bits are allowed for B for two reasons: (a) Koblitz curve cryptosystems are typically implemented by using the τ NAF) representation [24] or some other representation with signed bits (e.g., [22,27]) and (b) this allows computing subtractions with the same algorithm. Adding the two expansions gives the following expansion:…”

“…Figure 3 presents an architecture that implements Algorithm 1 for μ = 1. Because B i ∈ {−1, 0, 1}, it can be used for K given using signed-bit representations (e.g., [22,24,27]). Because t 0 ∈ [−3, 3] and A i + B i ∈ [−1, 2], r ∈ [−4, 5] and we need 4 bits to represent it.…”

“…Ensuring this property (ideally) guarantees that the smallest key-dependent statistical moment in the leakage distribution is d + 1. It has been shown (in different, more or less specialized settings [6,10,21,27]) that the data complexity of side-channel attacks against such implementations increases exponentially with the number of shares. More precisely, in the usual context of (close to) Gaussian noise, this data complexity is proportional to (σ 2 n ) d , with σ 2 n the noise variance.…”