Refine
Document Type
- Doctoral thesis (2)
- Master thesis (1)
- Report (1)
Has Fulltext
- yes (4)
Is part of the Bibliography
- no (4)
Keywords
- Elliptic curve cryptography (4) (remove)
Institute
In this work we investigated the resistance of different kP implementations based on the Montgomery ladder against horizontal, i.e. single trace, attacks. Applying statistical methods for the analysis we were able to reveal the secret value k completely. The reason causing the success of our attacks is the key-dependent addressing of the registers and other design blocks, which is an inherent feature of binary kP algorithms. This dependency was successfully exploited in the past by Itoh et al. analyzing many hundreds of kP traces, i.e. this attack is a vertical address-bit differential power analysis attack against Montgomery ladder. The vulnerability of the Montgomery ladder against horizontal address-bit attacks was detected and demonstrated during our investigations. We were able to reveal the scalar k exploiting the address-bit vulnerability in single trace attacks using not only statistical methods, but also Fourier transform, selected clustering methods as well as one of the simplest methods – the automatized simple SCA. We performed successful horizontal address-bit SCA attacks against both types of ECs, i.e. against highly regular Montgomery ladder and against a binary kP algorithm implementing atomic patterns. The success of our attacks shows that the regularity and atomicity principles are not effective against horizontal address-bit attacks. As a means for reducing the attack success, we investigated the hiding ability of the field multiplier which is usually the largest block of kP designs. We implemented our field multiplier for ECs over prime fields corresponding to the 4-segment Karatsuba multiplication formula that reduces the execution time and the energy consumption for a kP operation by about 40 % in comparison to multipliers exploiting the classical multiplication formula. However, the energy consumption per clock remained in our multiplier without significant changes, i.e. the protective hiding properties of the multiplier as a noise source were not decreased. Another advantage of our field multiplier is its inherent resistance to horizontal collision attacks, in contrast to multipliers based on the classic multiplication formula. Additionally, we proposed regular scheduling for the block addressing as an effective strategy for reducing the success of horizontal address-bit attacks. Combining this approach with the hiding features of the field multipliers can increase the resistance of the kP designs for both types of ECs against a broad spectrum of SCA attacks. The mentioned analysis methods can be successfully applied for determining SCA leakage sources in the early design phase.
Mathematically, cryptographic approaches are secure. This means that the time an attacker needs for finding the secret by brute forcing these approaches is about the time of the existence of our world. Practically, an algorithm implemented in hardware is a device that generates a lot of additional data during the calculation process. Its power consumption, electromagnetic radiation, etc. can be measured, saved and analysed for key extraction. Such attacks are called side channel analysis attacks and are significant threats when applying cryptographic algorithms. By considering these attacks when implementing a cryptographic algorithm, it is possible to design an implementation that is more resistant against them.
The goal of this thesis was to design a methodology to securely implement the Montgomery kP-operation using an IHP implementation as a starting point. In addition, the area and energy consumption of the secure Montgomery kP-multiplier should still be highly efficient. The resistance against power analysis attacks of two different IHP ECC implementations was analysed in this thesis. A horizontal power analysis attack using the difference-of-means test was performed with the goal of finding potential leakage sources exploited in side channel analysis attacks, i.e. finding the reasons of a correct extraction of the cryptographic key. For both analysed ECC designs, four key candidates were extracted with a correctness of 90% or more. Through analysis of the implemented Montgomery kP-algorithm’s functionality and its power consumption, it was established that the algorithm’s operation execution flow was the main cause of the implementations’ vulnerability. Thus, a design methodology consisting in changing the Montgomery kP-algorithm operation flow was developed. As a result, the re-designed implementations do not deliver any correctly extracted key candidates whenever the difference-of-means test is performed on them. These re-designs implied an increase on the chip area by about 5% for each implementation. The execution time needed for performing a complete kP-operation was reduced for both designs. Thereby one implementation’s execution time was reduced by 12% in comparison to its original version and even though its power consumption was increased by 9%, its energy consumption per kP-operation was reduced by 4.5%.
Mathematically, cryptographic approaches are secure. This means that the time an attacker needs for finding the secret by brute forcing these approaches is about the time of the existence of our world. Practically, an algorithm implemented in hardware is a device that generates a lot of additional data during calculation. Its power consumption, electromagnetic radiation etc. can be measured, saved and analysed for the key extraction. Such attacks - the side channel analysis attacks (SCA attacks) - are significant threats when applying cryptographic algorithms. By taking the issue of physical attacks into consideration when implementing a cryptographic algorithm, it is possible to design an implementation that is resilient - at least to a certain extend - against side channel analyses. In this report, we give implementation details of the IHP accelerator for the elliptic curve point multiplication. We analysed the implemented algorithm ow and its power consumption using simulated power traces for the 130nm CMOS IHP technology. We made a horizontal power analysis attack using the difference-of-means test with the goal of finding potential SCA leakage sources, i.e. finding the operations in the algorithmic ow that are responsible for the correct extraction of the cryptographic key.
Die Anwendung asymmetrischer Kryptosysteme, z.B. elliptische Kurven Kryptographie (ECC), erfordert große Rechenkapazität die normalerweise auf von mobilen Geräten bzw. drahtlosen Sensorknoten nicht zur Verfügung steht. Die Implementierung der ECC in Hardware reduziert den Zeit- und Energie-Aufwand. Die Optimierung der Hardware-Implementierungen dient nicht nur der weiteren Reduktion des Zeit- und Energieverbrauches sondern hilft darüber hinaus die Herstellungskosten zu verringern, so dass solche Lösungen auch für kostengünstige Geräte einsetzbar werden. Im Rahmen dieser Dissertation wurden Optimierungsmöglichkeiten für die Multiplikation der Polynome, die für EC-Operationen eingesetzt werden, untersucht. Ziel der Optimierungen war, dass die Multiplikation mit einer minimalen Anzahl von Additionen (also XOR-Gattern) und Multiplikationen (also AND-Gattern) durchgeführt werden kann. Im Rahmen dieser Arbeit wurde die iterative Bearbeitung von 10 Multiplikations-Methoden (MM) im Gegensatz zur üblichen rekursiven Bearbeitung untersucht. Dabei wurde eine Reihenfolge der Operationen für jede der untersuchten MM ermittelt, die zu einer reduzierten Anzahl von XOR-Operationen führt. Der Einsatz der optimierten Reihenfolge kann die Komplexität der MM wesentlich reduzieren. Zum Beispiel bei der generalisierten Karatsuba-MM [18] beträgt die Reduktion des XOR-Aufwandes durchschnittlich 39 % für Polynom-Längen bis 600 Bits. Für die IHP 0,13μ-Technologie entspricht diese Reduktion des XOR-Aufwandes einer durchschnittlichen Flächen-Reduktion der Polynom-Multiplizierer um 35 %. Bei der 4-Segment-Karatsuba-MM wird nicht nur der XOR-Aufwand, sondern auch die Signal-Verzögerung im Vergleich zur rekursiven Anwendung der originalen Karatsuba-MM reduziert. Außerdem wurde ein Algorithmus zur Bestimmung einer flächen- und/oder energieoptimalen Kombination der Multiplikations-Methoden entwickelt. Mit dem vorgeschlagenen Algorithmus wurden die flächen- und die energie-optimalen Kombinationen der MM für Polynom-Längen bis 600 Bits bestimmt. Alle ECC-relevanten Polynom-Längen liegen in diesem Bereich. Die durchschnittliche Reduktion der Flächen im Vergleich zu den rekonstruierten Daten aus [30] beträgt 12 %. Zusätzlich wurde ein energieoptimaler serieller Mehr-Takt-Multiplizierer für 233-Bits Polynome auf Basis Karatsuba-ähnlicher Multiplikations-Methoden entwickelt. Dieser Multiplizierer nutzt die Winograd-MM und basiert auf einen flächenoptimierten 78-Bits-Teil-Multiplizierer. Die theoretischen Ergebnisse wurden mit Hilfe von Synthesedaten für die IHP Technologie erfolgreich verifiziert. Der Energieverbrauch und die Ausführungszeit des Designs sind um 24 % bzw. 28 % kleiner als die des Vergleichsdesigns aus [28].