Efficient pairing computation on supersingular Abelian varieties

Barreto, Paulo S. L. M.; Galbraith, Steven D.; hÉigeartaigh, Colm Ó; Scott, Michael

doi:10.1007/s10623-006-9033-6

Cited by 330 publications

(365 citation statements)

References 26 publications

Supporting

Mentioning

348

Contrasting

Unclassified

Order By: Relevance

“…The eta pairing can be regarded as an optimized version of the reduced Tate pairing [19,176]. The optimization consists in a shortened Miller loop.…”

Section: The Eta Pairingmentioning

confidence: 99%

Why Cryptography Should Not Rely on Physical Attack Complexity

Krämer

2015

T-Labs Series in Telecommunication Services

View full text Add to dashboard Cite

Ich versichere an Eides statt, dass ich diese Dissertation selbständig verfasst und nur die angegebenen Quellen und Hilfsmittel verwendet habe. Datum Für meine Eltern AbstractEver since the first side channel attacks and fault attacks on cryptographic devices were introduced in the mid-nineties, new possibilities of physical attacks have been consistently explored. The risk that these attacks pose is reduced by reacting to known attacks and by developing and implementing countermeasures against them. For physical attacks whose theory is known but which have not been conducted yet, however, the situation is different. Attacks whose physical realization is assumed to be very complex are taken less seriously. The trust that these attacks will not be realized due to their physical complexity means that no countermeasures are developed at all. This leads to unprotected devices once the assessment of the complexity turns out to be wrong.This thesis presents two practical physical attacks whose theory is known for several years. Since neither attack has previously been successfully implemented in practice, however, they were not considered a serious threat. Their physical attack complexity has been overestimated and the implied security threat has been underestimated. First, we introduce the photonic side channel, which offers not only temporal resolution, but also the highest possible spatial resolution. Due to the high cost of its first realization, it has not been taken seriously. We show both simple and differential photonic side channel analyses. Then, we present a fault attack against pairing-based cryptography. Due to the need for at least two independent precise faults in a single pairing computation, it has also not been taken seriously. We show how attackers can reveal the secret key of symmetric as well as asymmetric cryptographic algorithms based on these physical attacks. We present countermeasures on the software and the hardware level, which help to prevent these attacks in the future.Based on these two presented attacks, this thesis shows that the assessment of physical attack complexity is error-prone. Hence, cryptography should not rely on it. Cryptographic technologies have to be protected against all physical attacks, have they already been realized or not. The development of countermeasures does not require the successful execution of an attack but can already be carried out as soon as the principle of a side channel or a fault attack is understood.

show abstract

“…The eta pairing can be regarded as an optimized version of the reduced Tate pairing [19,176]. The optimization consists in a shortened Miller loop.…”

Section: The Eta Pairingmentioning

confidence: 99%

Why Cryptography Should Not Rely on Physical Attack Complexity

Krämer

2015

T-Labs Series in Telecommunication Services

View full text Add to dashboard Cite

show abstract

“…Tate pairing can be computed using Miller's algorithm [33] or modified Miller's algorithms [5,7,26]. These algorithms are usually developed by mathematicians in number theory.…”

Section: Algorithm For Tate Pairingmentioning

confidence: 99%

“…Later it was used for pairing based cryptosystems. It can be computed using either Miller algorithm [33] or modified Miller's algorithms [6,7,26]. …”

mentioning

confidence: 99%

FPGA implementations of elliptic curve cryptography and Tate pairing over a binary field

Huang

Sweany

et al. 2008

Journal of Systems Architecture

View full text Add to dashboard Cite

Elliptic curve cryptography (ECC) is an alternative to traditional techniques for public key cryptography. It offers smaller key size without sacrificing security level. Tate pairing is a bilinear map used in identity based cryptography schemes. In a typical elliptic curve cryptosystem, elliptic curve point multiplication is the most computationally expensive component. Similarly, Tate pairing is also quite computationally expensive. Therefore, it is more attractive to implement the ECC and Tate pairing using hardware than using software. The Cryptography is the most standard and efficient way to protect the security of web transactions. It can be used to protect the confidentiality, integrity, authentication, and non-reputation of the web transactions. There are two major categories of cryptography 1 schemes, i.e., public-key cryptography and symmetric-key cryptography. In public-key cryptography, the receiver and sender have their own private key and share a common public key. In symmetric-key cryptography, the receiver and sender must have the same private key, which makes it difficult to manage the private key. Public-key cryptography is easy for key distribution and key management. But it is not as efficient as symmetric-key cryptography [19,39]. Thus, it is interesting to use dedicated hardware for public-key cryptography to improve the performance.A well-known public-key cryptography algorithm is RSA, which was first proposed by and it is projected that its size will increase to 2048 bits after 2010. The performance issues of RSA with such a large key size will then become a dominant force, which can severely affect the performance of RSA. So, we would like to use 283-bit ECC in place of the 2048-bit RSA since it can significantly reduce the key length and still provides the same security level.Despite ECC's advantages over RSA, software based ECC implementations usually require long computation time, hence makes it difficult to be effectively utilized in real-time 2 The main contribution of our FPGA based design is the resources sharing and parallel processing optimization. The simulation results show that our implementation is significantly faster than the software implementation as well as previous FPGA implementations with the same security level [12, 27]. Tate PairingIdentity based cryptography schemes have opened a new territory for public key cryptography [8,38,42]. Using identity based cryptography schemes, a sender can derive the public key of a receiver without receiving the certificate of the receiver issued by a certificate authority (CA). The public key can be derived from the identity of the receiver such as the email or IP address. Pairing over elliptic curve can be used to construct the identity based cryptography schemes. It is a map from two points on the elliptic curve to another multiplicative group. It has special properties of bilinearity. Currently, the most commonly used pairing methods are Tate pairing [13] and Weil pairing [31]. Originally, Weil pairing was used to attack publi...

show abstract

“…The eta pairing [1] is a generalisation of the Duursma-Lee [4] method for computing pairings. It greatly simplifies pairing computation for supersingular curves over fields of small characteristic with even embedding degree.…”

Section: Computing Eta Pairings Without a Final Exponentiationmentioning

confidence: 99%

“…It is shown in [1] how to compute the eta pairing efficiently, for example using denominator elimination. Furthermore, a loop shortening method is given which reduces the computation to just (m + 1)/2 iterations.…”

Section: The Characteristic Two Casementioning

confidence: 99%

Simplified pairing computation and security implications

Galbraith¹,

hÉigeartaigh²,

Sheedy³

2007

Journal of Mathematical Cryptology

Self Cite

View full text Add to dashboard Cite

Abstract. Recent progress on pairing implementation has made certain pairings extremely simple and fast to compute. Hence, it is natural to examine if there are consequences for the security of pairing-based cryptography. This paper gives a method to compute eta pairings in a way which avoids the requirement for a final exponentiation. The method does not lead to any improvement in the speed of pairing implementation. However, it seems appropriate to re-evaluate the security of pairing based cryptography in light of these new ideas. A multivariate attack on the pairing inversion problem is proposed and analysed. Our findings support the belief that pairing inversion is a hard computational problem.

show abstract

Efficient pairing computation on supersingular Abelian varieties

Cited by 330 publications

References 26 publications

Why Cryptography Should Not Rely on Physical Attack Complexity

Why Cryptography Should Not Rely on Physical Attack Complexity

FPGA implementations of elliptic curve cryptography and Tate pairing over a binary field

Simplified pairing computation and security implications

Contact Info

Product

Resources

About