Methods for Increasing the Resistance of Cryptographic Designs Against Horizontal DPA Attacks

Abstract

Side channel analysis attacks, especially horizontal DPA and DEMA attacks, are significant threats for cryptographic designs. In this paper we investigate to which extend different multiplication formulae and randomization of the field multiplier increase the resistance of an ECC design against horizontal attacks. We implemented a randomized sequence of the calculation of partial products for the field multiplication in order to increase the security features of the field multiplier. Additionally, we use the partial polynomial multiplier itself as a kind of countermeasure against DPA attacks. We demonstrate that the implemented classical multiplication formula can increase the inherent resistance of the whole ECC design. We also investigate the impact of the combination of these two approaches. For the evaluation we synthesized all these designs for a 250 nm gate library technologies, and analysed the simulated power traces. All investigated protection means help to decrease the success rate of attacks significantly: the correctness of the revealed key was decreased from 99% to 69%.

On the Complexity of Attacking Commercial Authentication Products

“…A vertical address bit DPA was reported in 2002 in [11]. A well-known fact is that traditional countermeasures against vertical attacks such as scalar randomization as well as the randomization of the EC point coordinates are not effective against vertical address bit DPA attacks [12]. We revealed the scalar k successfully performing a horizontal, i.e.…”

“…Additionally, the always active field multiplier is a kind of SCA protection due to the high fluctuation of its power consumption [9]. Traditional countermeasures against vertical data bit differential attacks [24] were not implemented in our design due to the fact, that the success of the horizontal address bit differential attacks does not depend on the:  EC point P processed in the analysed kP calculation [12] i.e. EC point blinding and randomization are not effective against horizontal (single trace) attacks  scalar k processed in the kP calculation [12].…”

“…Traditional countermeasures against vertical data bit differential attacks [24] were not implemented in our design due to the fact, that the success of the horizontal address bit differential attacks does not depend on the:  EC point P processed in the analysed kP calculation [12] i.e. EC point blinding and randomization are not effective against horizontal (single trace) attacks  scalar k processed in the kP calculation [12]. If the scalar, randomized corresponding to the key randomization approaches [24], will be successfully revealed, the attacker can use the revealed randomized scalar instead of the original scalar k.…”

Unified field multiplier for ECC: Inherent resistance against horizontal SCA attacks

“…We implemented the field multiplier without any countermeasures against SCA, i.e. the sequence of the multiplication was not randomized as for example in [11], and multiplications are not masked. The investigated multiplier is inherently resistant against the performed attacks.…”

Atomicity and Regularity Principles Do Not Ensure Full Resistance of ECC Designs against Single-Trace Attacks

“…Well-known randomization techniques such as secret scalar randomization, randomization of the projective EC point coordinates or EC point blinding [24] are effective against vertical attacks, i.e., if key-dependent data processing is exploited to extract the key. However, they are not effective [25,26] against attacks exploiting the key-dependent addressing of the design blocks, i.e., their application when using atomic patterns does not prevent horizontal attacks that exploit the addressing from being successful. In other words, they do not prevent simple SCA attacks that are looking for highly fine-grained differences in the trace.…”