The latest implementations of pairings allow efficient schemes for Pairing Based Cryptography. These make the use of pairings suitable for small and constrained devices (smart phones, smart cards?) in addition to more powerful platforms. As for any cryptographic algorithm which may be deployed in insecure locations, these implementations must be secure against physical attacks, and in particular fault attacks. In this paper, we present the state-of-the-art of fault attacks against pairing algorithms, more precisely fault attacks against the Miller algorithm and the final exponentiation which are the two parts of a pairing calculation.

/pdf/a-survey-of-fault-attacks-in-pairing-based-cryptography-4vim6070lk.pdf

A survey of fault attacks in pairing based cryptography

In the last decade pairings have become an important, and often indispensable, ingredient in the construction of identity-based and attribute-based cryptosystems, as well as group signatures and credential systems. Consequently, the applicability of timing, power, or fault attacks to implementations of pairings is an important research topic. We will review some of the known results in this area.

Tampering Attacks in Pairing-Based Cryptography

Cette these est consacree a l’etude de la securite physique des algorithmesde couplage. Les algorithmes de couplage sont depuis une quinzaine d’annees utilisesa des fins cryptographiques. D’une part, les systemes d’information evoluent, et denouveaux besoins de securite apparaissent. Les couplages permettent des protocolesinnovants, tels que le chiffrement base sur l’identite, les attributs et l’echange tripartien un tour. D’autre part, l’implementation des algorithmes de couplages est devenueefficace, elle permet ainsi d’integrer des solutions cryptographiques a base de couplagedans les systemes embarques.La problematique de l’implementation securisee des couplages dans les systemesembarques va etre etudiee ici. En effet, l’implementation d’algorithmes dedies a lacryptographie sur les systemes embarques souleve une problematique : la securite del’implementation des couplages face aux attaques physiques. Les attaques par canauxauxiliaires, dites passives, contre les algorithmes de couplages sont connues depuisbientot une dizaine d’annees. Nous proposons des etudes pour valider l’efficacite desattaques en pratique et avec des atouts theoriques. De notre connaissance, il y a uneseule attaque pratique dans la litterature, nous l’optimisons d’un facteur dix en termesde nombres de traces. Nous proposons aussi une attaque horizontale, qui nous permetd’attaquer le couplage twisted Ate en une seule trace.Par ailleurs, les contre-mesures n’ont ete que peu etudiees. Nous completons cettepartie manquante de la litterature. Nous proposons de nouveaux modeles d’attaquessur la contre-mesure de randomisation des coordonnees. L’attaque en collision proposeepermet ainsi de donner une reevaluation de la contre-mesure ciblee. Ainsi nousproposons la combinaison de contre-mesures qui, a moindres couts, protegerait de cesattaques.

https://tel.archives-ouvertes.fr/tel-01668403/document

Sécurisation des algorithmes de couplages contre les attaques physiques

Fault injection attacks are a real-world threat to cryptosystems, in particular, asymmetric cryptography. In this paper, we focus on countermeasures which guarantee the integrity of the computation result, hence covering most existing and future fault attacks. Namely, we study the modular extension protection scheme in previously existing and newly contributed variants of the countermeasure on elliptic curve scalar multiplication (ECSM) algorithms. We find that an existing countermeasure is incorrect and we propose new “test-free” variant of the modular extension scheme that fixes it. We then formally prove the correctness and security of modular extension: specifically, the fault non-detection probability is inversely proportional to the security parameter. Finally, we implement an ECSM protected with test-free modular extension during the elliptic curve operation to evaluate the efficient of this method on Edwards and twisted Edwards curves.

/pdf/using-modular-extension-to-provably-protect-edwards-curves-43f7yq00xm.pdf

Using modular extension to provably protect Edwards curves against fault attacks

The latest implementations of pairings allow efficient schemes for Pairing Based Cryptography. These make the use of pairings suitable for small and constrained devices (smart phones, smart cards. . . ) in addition to more powerful platforms. As for any cryptographic algorithm which may be deployed in insecure locations, these implementations must be secure against physical attacks, and in particular fault attacks. In this paper, we present the state-of-the-art of fault attacks against pairing algorithms, more precisely fault attacks against the Miller algorithm and the final exponentiation which are the two parts of a pairing calculation.

/pdf/a-survey-of-fault-attacks-in-pairing-based-cryptography-3qf11zhbeh.pdf

A survey of Fault Attacks in Pairing Based Cryptography.

Pairing based cryptography (PBC) is touted as an efficient approach to address usability and privacy issues in the cyberspace. Like most cryptographic algorithms, PBC must be robust not only against theoretical cryptanalysis but also against practical physical attacks such as fault injections. The computation of the Tate pairing can be divided into two parts, the Miller Algorithm and the Final Exponentiation. In this paper, we describe practical implementations of fault attacks against the Miller Algorithm validating common fault models used against pairings. In the light of the implemented fault attacks, we show that some blinding techniques proposed to protect the algorithm against Side-Channels Analyses cannot be used as countermeasures against the implemented fault attacks.

/pdf/practical-validation-of-several-fault-attacks-against-the-3se2k5m14g.pdf

Marie Paindavoine

Papers

Practical Validation of Several Fault Attacks against the Miller Algorithm