Exploiting dummy codes in Elliptic Curve Cryptography Andy Russon - PowerPoint PPT Presentation

Exploiting dummy codes in Elliptic Curve Cryptography Andy Russon 4 June 2020

2/20 About me PhD thesis on elliptic curves Orange, and Université de Rennes 1 Risk assessment and audit Interest: challenges (root-me, CryptoHack), korean movies, science-fjction

3/20 Introduction About Elliptic Curve Cryptography: Public-key cryptography with small parameters, keys, signatures, etc Protocols: TLS 1.3, SSH, Bitcoin, Signal, etc Servers, smart cards, IoT devices, etc Parameter size 128-bit security 256-bit security ECC RSA ECC RSA

4/20 Introduction Hard to implement secure and effjcient cryptography. Depends on threat model (physical access to the device, etc) One protection can lead to a vulnerability Passive attacks: timing, power analysis, etc Active attacks: difgerential fault analysis, C safe-errors C safe-error attacks against protected implementations to attack ECDSA 1 . 1 Fouque et al., “Safe-Errors on SPA Protected Implementations with the Atomicity Technique”; Dubeuf, Hely, and Beroulle, “Enhanced Elliptic Curve Scalar Multiplication Secure Against Side Channel Attacks and Safe Errors.”

5/20 In this presentation We extend the previous results, and show that a C safe-error attack is also possible on these implementations: Assembly optimized implementation of P-256: OpenSSL since version 1.0.2 BoringSSL LibreSSL/OpenBSD P-224, P-384 and P-521 in BoringSSL

6/20 Plan 1 Why dummy codes in ECC? 2 Presentation of the attack 3 Why it works 4 Mitigations and conclusion

7/20 Operations on elliptic curves Basic operations: Addition: P + Q Doubling: P + P = 2 P P + O = O + P = P

7/20 Operations on elliptic curves P Q P Q P Basic operations: O Addition: P + Q Doubling: P + P = 2 P P + O = O + P = P E : y 2 = x 3 − 3 x + 137 mod 251

7/20 Operations on elliptic curves P Q P Q P Basic operations: O Addition: P + Q Doubling: P + P = 2 P P + O = O + P = P E : y 2 = x 3 − 3 x + 137 mod 251

7/20 Operations on elliptic curves P Q P Basic operations: O Addition: P + Q Doubling: P + P = 2 P P + O = O + P = P λ = y P − y Q x P − x Q { x P + Q = λ 2 − x P − x Q y P + Q = λ ( x P − x P + Q ) − x P P + Q E : y 2 = x 3 − 3 x + 137 mod 251

7/20 Operations on elliptic curves P Q P Q Basic operations: O Addition: P + Q Doubling: P + P = 2 P P + O = O + P = P λ = 3 x P + a 2 y P 2 P { x 2 P = λ 2 − 2 x P y 2 P = λ ( x P − x 2 P ) − x P E : y 2 = x 3 − 3 x + 137 mod 251

7/20 Operations on elliptic curves fjnd k from P and kP Discrete logarithm problem: hard to Scalar multiplication: Basic operations: P Q P Q P k is often secret (private key or nonce) O Addition: P + Q Doubling: P + P = 2 P P + O = O + P = P kP = P + · · · + P E : y 2 = x 3 − 3 x + 137 mod 251

D D D A D D D A 8/20 P Consequence: same sequence of addition: Solution: perform a dummy point k learns that: remarks the missing addition and From power consumption, attacker P P D D D P A Windowing scalar multiplication P P P D D D P P P For effjciency: split k in groups of consecutive bits (windows) Available operations: point addition (A), point doubling (D) operations for all possible secret k Example: k = 232 = (11 101 000) 2 = O

D D D A D D D A 8/20 P Consequence: same sequence of addition: Solution: perform a dummy point k learns that: remarks the missing addition and From power consumption, attacker Historic of operations: P P D D D P A Windowing scalar multiplication P P P D D D P P For effjciency: split k in groups of consecutive bits (windows) Available operations: point addition (A), point doubling (D) operations for all possible secret k Example: k = 232 = (11 101 000) 2 11 3 P = 3 P

D D D A D D D A 8/20 A Consequence: same sequence of addition: Solution: perform a dummy point k learns that: remarks the missing addition and From power consumption, attacker P P D D D P P P Windowing scalar multiplication P Available operations: point addition (A), point doubling (D) For effjciency: split k in groups of consecutive bits (windows) operations for all possible secret k P D D D Example: k = 232 = (11 101 000) 2 11 3 P = 3 P 2 3 · 3 P 11 000 = 24 P Historic of operations: D D D

D D D A D D D A 8/20 Windowing scalar multiplication Consequence: same sequence of addition: Solution: perform a dummy point k learns that: remarks the missing addition and From power consumption, attacker P P D D D P P A operations for all possible secret k For effjciency: split k in groups of consecutive bits (windows) D D D Available operations: point addition (A), point doubling (D) Example: k = 232 = (11 101 000) 2 11 3 P = 3 P 2 3 · 3 P 11 000 = 24 P 11 101 24 P + 5 P = 29 P Historic of operations: D D D A

D D D A D D D A 8/20 Windowing scalar multiplication Consequence: same sequence of addition: Solution: perform a dummy point k learns that: remarks the missing addition and From power consumption, attacker P P D D D A operations for all possible secret k Available operations: point addition (A), point doubling (D) For effjciency: split k in groups of consecutive bits (windows) D D D Example: k = 232 = (11 101 000) 2 11 3 P = 3 P 2 3 · 3 P 11 000 = 24 P 11 101 24 P + 5 P = 29 P 2 3 · 29 P 11 101 000 = 232 P Historic of operations: D D D A D D D

D D D A D D D A 8/20 A Consequence: same sequence of addition: Solution: perform a dummy point k learns that: remarks the missing addition and From power consumption, attacker Historic of operations: D D D A D D D D D D Windowing scalar multiplication operations for all possible secret k For effjciency: split k in groups of consecutive bits (windows) Available operations: point addition (A), point doubling (D) D D D Example: k = 232 = (11 101 000) 2 11 3 P = 3 P 2 3 · 3 P 11 000 = 24 P 11 101 24 P + 5 P = 29 P 2 3 · 29 P 11 101 000 = 232 P 11 101 000 232 P = 232 P

D D D A D D D A 8/20 A Consequence: same sequence of addition: Solution: perform a dummy point learns that: remarks the missing addition and From power consumption, attacker Historic of operations: D D D A D D D D D D Windowing scalar multiplication operations for all possible secret k D D D Available operations: point addition (A), point doubling (D) For effjciency: split k in groups of consecutive bits (windows) Example: k = 232 = (11 101 000) 2 11 3 P = 3 P k = ∗ ∗ ∗ ∗ ∗ 000 2 3 · 3 P 11 000 = 24 P 11 101 24 P + 5 P = 29 P 2 3 · 29 P 11 101 000 = 232 P 11 101 000 232 P = 232 P

8/20 D D D Consequence: same sequence of addition: Solution: perform a dummy point learns that: remarks the missing addition and From power consumption, attacker Historic of operations: D D D A D D D D D D Windowing scalar multiplication A operations for all possible secret k Available operations: point addition (A), point doubling (D) For effjciency: split k in groups of consecutive bits (windows) Example: k = 232 = (11 101 000) 2 11 3 P = 3 P k = ∗ ∗ ∗ ∗ ∗ 000 2 3 · 3 P 11 000 = 24 P 11 101 24 P + 5 P = 29 P 2 3 · 29 P 11 101 000 = 232 P 11 101 000 232 P = 232 P D D D A D D D A

8/20 D D D Consequence: same sequence of addition: Solution: perform a dummy point learns that: remarks the missing addition and From power consumption, attacker Historic of operations: D D D A D D D D D D Windowing scalar multiplication A operations for all possible secret k Available operations: point addition (A), point doubling (D) For effjciency: split k in groups of consecutive bits (windows) Example: k = 232 = (11 101 000) 2 11 3 P = 3 P k = ∗ ∗ ∗ ∗ ∗ 000 2 3 · 3 P 11 000 = 24 P 11 101 24 P + 5 P = 29 P 2 3 · 29 P 11 101 000 = 232 P 11 101 000 232 P = 232 P D D D A D D D A

9/20 Principle of C safe-error Dummy or not dummy?

9/20 Principle of C safe-error Make a fault in the last point addition (exact details in the article): D D D A D D D A Point addition is not dummy: Incorrect output for kP Point addition is dummy: Correct output for kP Last window is null: k Number of bits of the last window in the targeted implementations: Assembly optimized implementation of P-256: most signifjcant bits BoringSSL (P-224, P-384, P-521): least signifjcant bits �

9/20 Principle of C safe-error Make a fault in the last point addition (exact details in the article): D D D A D D D A Point addition is not dummy: Incorrect output for kP Point addition is dummy: Correct output for kP Last window is null: k Number of bits of the last window in the targeted implementations: Assembly optimized implementation of P-256: most signifjcant bits BoringSSL (P-224, P-384, P-521): least signifjcant bits �

9/20 Principle of C safe-error Make a fault in the last point addition (exact details in the article): D D D A D D D A Point addition is not dummy: Incorrect output for kP Point addition is dummy: Correct output for kP Number of bits of the last window in the targeted implementations: Assembly optimized implementation of P-256: most signifjcant bits BoringSSL (P-224, P-384, P-521): least signifjcant bits � Last window is null: k = ∗ ∗ ∗ ∗ ∗ 000