Zero-Value Register Attack on Elliptic Curve Cryptosystem
Zero-Value Register Attack on Elliptic Curve Cryptosystem
复制标题
椭圆曲线密码系统的零值寄存器攻击
DOI：
10.1093/ietfec/e88-a.1.132
复制
发表时间：
2005
期刊：
影响因子：
--
通讯作者：
T. Takagi
中科院分区：
文献类型：
--
作者：
Toru Akishita;T. Takagi
差分功率分析（DPA）可能会破坏内存约束设备上椭圆曲线密码系统（ECC）的实现。 Goubin使用点（0，Y）提出了DPA的变体，该变体在Jacobian坐标或同构类别中不是随机化。这一点通常存在于标准化的椭圆曲线中，我们必须关心这一攻击。在本文中，我们提出零值登记攻击，以扩展Goubin的攻击。请注意，即使一个点没有零值坐标，辅助寄存器也可能为零值。我们研究了无法通过上述随机分组的这些零值寄存器。实际上，我们发现了几个点P =（x，y）导致零值寄存器，例如（1）3x 2 + a = 0，（2）5x 4 + 2ax 2 -4bx + a 2 = 0， （3）p是y坐标自填点等。我们演示了具有这些点的SECG中建议的椭圆曲线。有趣的是，零值寄存器攻击所需的某些条件取决于显式实施加法公式 - 为了抵制这种类型的攻击，我们必须关心如何实施加法公式。最后，我们注意到Goubin的攻击和拟议的攻击假定攻击者可以选择基数P，并且固定秘密标量D是固定的，因此它们不适用于ECDSA。
Differential power analysis (DPA) might break implementations of elliptic curve cryptosystem (ECC) on memory constraint devices. Goubin proposed a variant of DPA using a point (0, y), which is not randomized in Jacobian coordinates or in an isomorphic class. This point often exists in standardized elliptic curves, and we have to care this attack. In this paper, we propose zero-value register attack as an extension of Goubin's attack. Note that even if a point has no zero-value coordinate, auxiliary registers might take zero value. We investigate these zero-value registers that cannot be randomized by the above randomization. Indeed, we have found several points P = (x, y) which cause the zero-value registers, e.g., (1) 3x 2 +a = 0, (2) 5x 4 + 2ax 2 -4bx + a 2 = 0, (3) P is y-coordinate self-collision point, etc. We demonstrate the elliptic curves recommended in SECG that have these points. Interestingly, some conditions required for zero-value register attack depend on explicit implementation of addition formulae - in order to resist this type of attacks, we have to care how to implement the addition formulae. Finally, we note that Goubin's attack and the proposed attack assume that a base point P can be chosen by attackers and a secret scalar d is fixed, so that they are not applicable to ECDSA.