scholarly journals Novel Key Recovery Attack on Secure ECDSA Implementation by Exploiting Collisions between Unknown Entries

2021 ◽  
pp. 1-26
Author(s):  
Sunghyun Jin ◽  
Sangyub Lee ◽  
Sung Min Cho ◽  
HeeSeok Kim ◽  
Seokhie Hong
Keyword(s):  
Power Consumption ◽  
Digital Signatures ◽  
Scalar Multiplication ◽  
Side Channel ◽  
Validation Process ◽  
Key Recovery ◽  
Private Key ◽  
Signature Generation ◽  
Fixed Base ◽  
Key Recovery Attack

In this paper, we propose a novel key recovery attack against secure ECDSA signature generation employing regular table-based scalar multiplication. Our attack exploits novel leakage, denoted by collision information, which can be constructed by iteratively determining whether two entries loaded from the table are the same or not through side-channel collision analysis. Without knowing the actual value of the table entries, an adversary can recover the private key of ECDSA by finding the condition for which several nonces are linearly dependent by exploiting only the collision information. We show that this condition can be satisfied practically with a reasonable number of digital signatures and corresponding traces. Furthermore, we also show that all entries in the pre-computation table can be recovered using the recovered private key and a sufficient number of digital signatures based on the collision information. As case studies, we find that fixed-base comb and T_SM scalar multiplication are vulnerable to our attack. Finally, we verify that our attack is a real threat by conducting an experiment with power consumption traces acquired during T_SM scalar multiplication operations on an ARM Cortex-M based microcontroller. We also provide the details for validation process.

scholarly journals Minerva: The curse of ECDSA nonces

2020 ◽  
pp. 281-308
Author(s):  
Jan Jancar ◽  
Vladimir Sedlacek ◽  
Petr Svenda ◽  
Marek Sys
Keyword(s):  
Real World ◽  
Scalar Multiplication ◽  
Side Channel ◽  
Key Recovery ◽  
Private Key ◽  
New Methods ◽  
Successful Attack ◽  
Benchmark Datasets ◽  
Recovery Methods

We present our discovery of a group of side-channel vulnerabilities in implementations of the ECDSA signature algorithm in a widely used Atmel AT90SC FIPS 140-2 certified smartcard chip and five cryptographic libraries (libgcrypt, wolfSSL, MatrixSSL, SunEC/OpenJDK/Oracle JDK, Crypto++). Vulnerable implementations leak the bit-length of the scalar used in scalar multiplication via timing. Using leaked bit-length, we mount a lattice attack on a 256-bit curve, after observing enough signing operations. We propose two new methods to recover the full private key requiring just 500 signatures for simulated leakage data, 1200 for real cryptographic library data, and 2100 for smartcard data. The number of signatures needed for a successful attack depends on the chosen method and its parameters as well as on the noise profile, influenced by the type of leakage and used computation platform. We use the set of vulnerabilities reported in this paper, together with the recently published TPM-FAIL vulnerability [MSE+20] as a basis for real-world benchmark datasets to systematically compare our newly proposed methods and all previously published applicable lattice-based key recovery methods. The resulting exhaustive comparison highlights the methods’ sensitivity to its proper parametrization and demonstrates that our methods are more efficient in most cases. For the TPM-FAIL dataset, we decreased the number of required signatures from approximately 40 000 to mere 900.

scholarly journals One Bit is All It Takes: A Devastating Timing Attack on BLISS’s Non-Constant Time Sign Flips

2020 ◽  
Vol 15 (1) ◽  
pp. 131-142
Author(s):  
Mehdi Tibouchi ◽  
Alexandre Wallet
Keyword(s):  
Likelihood Estimation ◽  
Constant Time ◽  
Side Channel ◽  
Key Recovery ◽  
Signature Generation ◽  
Fisher Information Metric ◽  
Timing Attack ◽  
Information Metric ◽  
Key Recovery Attack ◽  
Cache Attacks

AbstractAs one of the most efficient lattice-based signature schemes, and one of the only ones to have seen deployment beyond an academic setting (e.g., as part of the VPN software suite strongSwan), BLISS has attracted a significant amount of attention in terms of its implementation security, and side-channel vulnerabilities of several parts of its signing algorithm have been identified in previous works. In this paper, we present an even simpler timing attack against it. The bimodal Gaussian distribution that BLISS is named after is achieved using a random sign flip during signature generation, and neither the original implementation of BLISS nor strongSwan ensure that this sign flip is carried out in constant time. It is therefore possible to recover the corresponding sign through side-channel leakage (using, e.g., cache attacks or branch tracing). We show that obtaining this single bit of leakage (for a moderate number of signatures) is in fact sufficient for a full key recovery attack. The recovery is carried out using a maximum likelihood estimation on the space of parameters, which can be seen as a statistical manifold. The analysis of the attack thus reduces to the computation of the Fisher information metric.

scholarly journals From A to Z: Projective coordinates leakage in the wild

2020 ◽  
pp. 428-453
Author(s):  
Alejandro Cabrera Aldaya ◽  
Cesar Pereida García ◽  
Billy Bob Brumley
Keyword(s):  
Elliptic Curve ◽  
Original Description ◽  
Projective Representation ◽  
Scalar Multiplication ◽  
Side Channel ◽  
Side Channel Attack ◽  
Signature Generation ◽  
The Status ◽  
In The Wild ◽  
Algorithm Implementation

At EUROCRYPT 2004, Naccache et al. showed that the projective coordinates representation of the resulting point of an elliptic curve scalar multiplication potentially allows to recover some bits of the scalar. However, this attack has received little attention by the scientific community, and the status of deployed mitigations to prevent it in widely adopted cryptography libraries is unknown. In this paper, we aim to fill this gap, by analyzing several cryptography libraries in this context. To demonstrate the applicability of the attack, we use a side-channel attack to exploit this vulnerability within libgcrypt in the context of ECDSA. To the best of our knowledge, this is the first practical attack instance. It targets the insecure binary extended Euclidean algorithm implementation using a microarchitectural side-channel attack that allows recovering the projective representation of the output point of scalar multiplication during ECDSA signature generation. We captured 100k traces to estimate the number of traces an attacker would need to compromise the libgcrypt ECDSA implementation, resulting in less than 2k for commonly used elliptic curve secp256r1, demonstrating the attack feasibility. During exploitation, we found two additional vulnerabilities. However, we remark the purpose of this paper is not merely exploiting a library but about providing an analysis on the projective coordinates vulnerability status in widely deployed open-source libraries, filling a gap between its original description in the academic literature and the adoption of countermeasures to thwart it in real-world applications.

scholarly journals Return of the Hidden Number Problem.

2018 ◽  
pp. 146-168 ◽  
Author(s):  
Keegan Ryan
Keyword(s):  
Side Channel ◽  
Proof Of Concept ◽  
Private Key ◽  
Side Channels ◽  
Signature Generation ◽  
Number Problem ◽  
Minimum Number ◽  
Hidden Number Problem ◽  
State Changes ◽  
Full Proof

Side channels have long been recognized as a threat to the security of cryptographic applications. Implementations can unintentionally leak secret information through many channels, such as microarchitectural state changes in processors, changes in power consumption, or electromagnetic radiation. As a result of these threats, many implementations have been hardened to defend against these attacks. Despite these mitigations, this work presents a novel side-channel attack against ECDSA and DSA. The attack targets a common implementation pattern that is found in many cryptographic libraries. In fact, about half of the libraries that were tested exhibited the vulnerable pattern. This pattern is exploited in a full proof of concept attack against OpenSSL, demonstrating that it is possible to extract a 256-bit ECDSA private key using a simple cache attack after observing only a few thousand signatures. The target of this attack is a previously unexplored part of (EC)DSA signature generation, which explains why mitigations are lacking and the issue is so widespread. Finally, estimates are provided for the minimum number of signatures needed to perform the attack, and countermeasures are suggested to protect against this attack.

scholarly journals Cryptanalysis of Round-Reduced Fantomas, Robin and iSCREAM

Cryptography ◽  
2019 ◽  
Vol 3 (1) ◽  
pp. 4 ◽  
Author(s):  
Ashutosh Dwivedi ◽  
Shalini Dhar ◽  
Gautam Srivastava ◽  
Rajani Singh
Keyword(s):  
Side Channel ◽  
Linear Cryptanalysis ◽  
Key Recovery ◽  
Side Channel Analysis ◽  
Linear Characteristic ◽  
Random Behavior ◽  
Channel Analysis ◽  
Key Recovery Attack

In this work, we focus on LS-design ciphers Fantomas, Robin, and iSCREAM. LS-designs are a family of bitslice ciphers aimed at efficient masked implementations against side-channel analysis. We have analyzed Fantomas and Robin with a technique that previously has not been applied to both algorithms or linear cryptanalysis. The idea behind linear cryptanalysis is to build a linear characteristic that describes the relation between plaintext and ciphertext bits. Such a relationship should hold with probability 0.5 (bias is zero) for a secure cipher. Therefore, we try to find a linear characteristic between plaintext and ciphertext where bias is not equal to zero. This non-random behavior of cipher could be converted to some key-recovery attack. For Fantomas and Robin, we find 5 and 7-round linear characteristics. Using these characteristics, we attack both the ciphers with reduced rounds and recover the key for the same number of rounds. We also apply linear cryptanalysis to the famous CAESAR candidate iSCREAM and the closely related LS-design Robin. For iScream, we apply linear cryptanalysis to the round-reduced cipher and find a 7-round best linear characteristics. Based on those linear characteristics we extend the path in the related-key scenario for a higher number of rounds.

scholarly journals Asymmetric key Cryptography using Laplace Transform

2020 ◽  
Vol 9 (4) ◽  
pp. 3083-3087
Keyword(s):  
Network Security ◽  
Laplace Transform ◽  
Inverse Laplace Transform ◽  
Text File ◽  
Key Recovery ◽  
Public And Private ◽  
Plain Text ◽  
Private Key ◽  
Coefficient Corrélation ◽  
Key Recovery Attack

This paper presents a method of Asymmetric key cryptography using Laplace transform and inverse Laplace transform respectively on Maclaurin’s series to attain information and network Security. The public key and private key are used to encrypt and decrypt data in Asymmetric cryptography. Public and private key are generated using Encryption and Decryption algorithms with a numerical example. Frequency allocations of characters in plain text file and cipher text file with proposed algorithm are analyzed using bar diagrams. It has been observed that the repeated character in encipher file has same frequency while running ElGamal and RSA encryption algorithms but differ in proposed algorithm. Time complexity of each algorithm is tested for distinct file size and is presented in a suitable table. Statistical analysis for the proposed algorithm is performed using coefficient correlation and compared with ElGamal, RSA algorithms. All these tests ensure that the proposed algorithm provide network security and key recovery attack.

scholarly journals Cryptanalysis of Loiss Stream Cipher-Revisited

2014 ◽  
Vol 2014 ◽  
pp. 1-7
Author(s):  
Lin Ding ◽  
Chenhui Jin ◽  
Jie Guan ◽  
Qiuyan Wang
Keyword(s):  
Time Complexity ◽  
Stream Cipher ◽  
Linear Equations ◽  
Data Complexity ◽  
Secret Key ◽  
Key Recovery ◽  
Systems Of Linear Equations ◽  
Key Recovery Attack ◽  
Better Than

Loiss is a novel byte-oriented stream cipher proposed in 2011. In this paper, based on solving systems of linear equations, we propose an improved Guess and Determine attack on Loiss with a time complexity of 2231and a data complexity of 268, which reduces the time complexity of the Guess and Determine attack proposed by the designers by a factor of 216. Furthermore, a related key chosenIVattack on a scaled-down version of Loiss is presented. The attack recovers the 128-bit secret key of the scaled-down Loiss with a time complexity of 280, requiring 264chosenIVs. The related key attack is minimal in the sense that it only requires one related key. The result shows that our key recovery attack on the scaled-down Loiss is much better than an exhaustive key search in the related key setting.

scholarly journals Online Template Attacks: Revisited

2021 ◽  
pp. 28-59
Author(s):  
Alejandro Cabrera Aldaya ◽  
Billy Bob Brumley
Keyword(s):  
Power Consumption ◽  
Elliptic Curve ◽  
Side Channel ◽  
Powerful Technique ◽  
Leakage Model ◽  
On Demand ◽  
Side Channels ◽  
Generic Framework ◽  
Template Attacks ◽  
Elliptic Curve Scalar Multiplication

An online template attack (OTA) is a powerful technique previously used to attack elliptic curve scalar multiplication algorithms. This attack has only been analyzed in the realm of power consumption and EM side channels, where the signals leak related to the value being processed. However, microarchitecture signals have no such feature, invalidating some assumptions from previous OTA works.In this paper, we revisit previous OTA descriptions, proposing a generic framework and evaluation metrics for any side-channel signal. Our analysis reveals OTA features not previously considered, increasing its application scenarios and requiring a fresh countermeasure analysis to prevent it.In this regard, we demonstrate that OTAs can work in the backward direction, allowing to mount an augmented projective coordinates attack with respect to the proposal by Naccache, Smart and Stern (Eurocrypt 2004). This demonstrates that randomizing the initial targeted algorithm state does not prevent the attack as believed in previous works.We analyze three libraries libgcrypt, mbedTLS, and wolfSSL using two microarchitecture side channels. For the libgcrypt case, we target its EdDSA implementation using Curve25519 twist curve. We obtain similar results for mbedTLS and wolfSSL with curve secp256r1. For each library, we execute extensive attack instances that are able to recover the complete scalar in all cases using a single trace.This work demonstrates that microarchitecture online template attacks are also very powerful in this scenario, recovering secret information without knowing a leakage model. This highlights the importance of developing secure-by-default implementations, instead of fix-on-demand ones.

Sign in / Sign up

Export Citation Format

Share Document