Singular curve point decompression attack Peter Gnther joint work - PowerPoint PPT Presentation

Singular curve point decompression attack Peter Günther joint work with Johannes Blömer University of Paderborn FDTC 2015, September 13th, Saint Malo Peter Günther (UPB) Decompression Attack FDTC 2015 1 / 18

Elliptic curves Example: E ( R ) : y 2 = x 3 − 3 x + 3 y Elliptic curve E ( K ) Points ( x , y ) ∈ K 2 that fulfill y 2 = x 3 + a 4 x + a 6 x with a 4 , a 6 ∈ K and discriminant ∆ := − 16 ( 4 a 3 4 + 27 a 2 6 ) � = 0 . Peter Günther (UPB) Decompression Attack FDTC 2015 2 / 18

Elliptic curves as additive group Example: E ( R ) : y 2 = x 3 − 3 x + 3 y T P Group operation independent from a 6 : λ = y P − y T x P − x T x x P + T = λ 2 − x P − x T y P + T = λ ( x P − x P + T ) − y P T + P Peter Günther (UPB) Decompression Attack FDTC 2015 3 / 18

Elliptic curves as additive group Example: E ( R ) : y 2 = x 3 − 3 x + 3 y T P Group operation independent from a 6 : λ = 3 x T + a 4 2 y T x 2 T = λ 2 − 2 x T x y 2 T = λ ( x T − x 2 T ) − y T 2 T Peter Günther (UPB) Decompression Attack FDTC 2015 3 / 18

Elliptic curve scalar multiplication and DLOG Scalar multiplication: s ∈ N , P ∈ E ( F q ) : sP := P + P + · · · + P ( s times) P s sP Peter Günther (UPB) Decompression Attack FDTC 2015 4 / 18

Elliptic curve scalar multiplication and DLOG Scalar multiplication: s ∈ N , P ∈ E ( F q ) : sP := P + P + · · · + P ( s times) Discrete logarithm (DLOG): given P , Q = sP , compute s Assumption: complexity of DLOG problem exponential on elliptic curve ⇒ high security already for small F q (e.g. 256 bit) s P s sP Peter Günther (UPB) Decompression Attack FDTC 2015 4 / 18

Elliptic curve scalar multiplication and DLOG Scalar multiplication: s ∈ N , P ∈ E ( F q ) : sP := P + P + · · · + P ( s times) Discrete logarithm (DLOG): given P , Q = sP , compute s Assumption: complexity of DLOG problem exponential on elliptic curve ⇒ high security already for small F q (e.g. 256 bit) Important cryptographic primitive (ECDH, ECDSA, . . . ) s s P s s sP Peter Günther (UPB) Decompression Attack FDTC 2015 4 / 18

Elliptic curve scalar multiplication and DLOG Scalar multiplication: s ∈ N , P ∈ E ( F q ) : sP := P + P + · · · + P ( s times) Discrete logarithm (DLOG): given P , Q = sP , compute s Assumption: complexity of DLOG problem exponential on elliptic curve ⇒ high security already for small F q (e.g. 256 bit) Important cryptographic primitive (ECDH, ECDSA, . . . ) Adversarial environment: Physical protection of s required s s P s s sP Peter Günther (UPB) Decompression Attack FDTC 2015 4 / 18

Invalid point attack on scalar multiplication E : y 2 = x 3 + a 4 x + a 6 Outline of invalid point attacks 1 Group law does not require a 6 2 Move P to weak curve with same a 4 3 Obtain Q = sP for secret s on weak curve 4 Compute DLOG of Q to base P on weak curve 5 Infer DLOG s on original curve Examples weak curve attacks P on curve with smooth order P in small subgroup P on singular curve Peter Günther (UPB) Decompression Attack FDTC 2015 5 / 18

Singular curves with node ( a 4 � = 0) E ( R ) : y 2 = x 3 − 3 x + 3 E ( R ) : y 2 = x 3 − 3 x + 2, ∆ = 0 y y x x Peter Günther (UPB) Decompression Attack FDTC 2015 6 / 18

Singular curves with node ( a 4 � = 0) E ( R ) : y 2 = x 3 − 3 x + 3 E ( R ) : y 2 = x 3 − 3 x + 2, ∆ = 0 y y T P T P x x T + P T + P Peter Günther (UPB) Decompression Attack FDTC 2015 6 / 18

Singular curves with node ( a 4 � = 0) E ( R ) : y 2 = x 3 − 3 x + 3 E ( R ) : y 2 = x 3 − 3 x + 2, ∆ = 0 y y T P T P x x 2 T 2 T Peter Günther (UPB) Decompression Attack FDTC 2015 6 / 18

Singular curves with node ( a 4 � = 0) E ( R ) : y 2 = x 3 − 3 x + 3 E ( R ) : y 2 = x 3 − 3 x + 2, ∆ = 0 y y T P T P E NS ( F q ) ≃ subgroup of F ∗ q or F ∗ q 2 ⇒ DLOG problem subexponential 1 Map DLOG instance to F ∗ q or F ∗ q 2 x x 2 Solve DLOG in F ∗ q or F ∗ q 2 2 T 2 T Peter Günther (UPB) Decompression Attack FDTC 2015 6 / 18

Singular curves with cusp ( a 4 = 0) E ( R ) : y 2 = x 3 + 1 E ( R ) : y 2 = x 3 , ∆ = 0 y y x x Peter Günther (UPB) Decompression Attack FDTC 2015 7 / 18

Singular curves with cusp ( a 4 = 0) E ( R ) : y 2 = x 3 + 1 E ( R ) : y 2 = x 3 , ∆ = 0 y y E NS ( F q ) ≃ F + q ⇒ DLOG problem trivial (by division) 1 Map DLOG instance to F + T T q 2 Solve DLOG in F + q P P x x + P T + P Peter Günther (UPB) Decompression Attack FDTC 2015 7 / 18

Singular curve attack on scalar multiplication For fixed a 4 , there are at most 2 corresponding singular curves Random faults will not provide points on singular curve How do we get a point onto one of them? P Peter Günther (UPB) Decompression Attack FDTC 2015 8 / 18

Our approach: Point decompression Compression Compress : E ( F q ) → F q × { 0 , 1 } ( x , y ) �→ ( x , b ) where b = LSB ( y ) Reduces bandwidth by 50 % Defined in many standards like IEEE 1363, SEC 1, X9.62 Decompression prior to scalar multiplication Peter Günther (UPB) Decompression Attack FDTC 2015 9 / 18

Point compression Decompress Require: E : y 2 = x 3 + a 4 x + a 6 , ( x , b ) ∈ F q × { 0 , 1 } Ensure: ( x , y ) with y 2 = x 3 + a 4 x + a 6 1: v ← x 3 + a 4 x ⊲ v = x 3 + a 4 x ⊲ v = x 3 + a 4 x + a 6 2: v ← v + a 6 3: if √ v ∈ F q then v ← ( − 1 ) b √ v ⊲ v = ( − 1 ) b � x 3 + a 4 x + a 6 4: return ( x , y ) 5: 6: else return O 7: 8: end if Peter Günther (UPB) Decompression Attack FDTC 2015 10 / 18

Point compression Decompress Require: E : y 2 = x 3 + a 4 x + a 6 , ( x , b ) ∈ F q × { 0 , 1 } Similar implementations in IEEE 1363, SEC 1, Ensure: ( x , y ) with y 2 = x 3 + a 6 X9.62, OpenSSL 1: v ← x 3 ⊲ v = x 3 Implicit (partial) point validation: ⊲ v = x 3 2: v ← v + a 6 + a 6 Decompress ( x , b ) ∈ E ( F q ) 3: if √ v ∈ F q then v ← ( − 1 ) b √ v ⊲ v = ( − 1 ) b � x 3 + a 6 4: return ( x , y ) 5: 6: else return O 7: 8: end if Peter Günther (UPB) Decompression Attack FDTC 2015 10 / 18

Attack on decompression Decompress Require: E : y 2 = x 3 + a 4 x + a 6 , ( x , b ) ∈ F q × { 0 , 1 } Ensure: ( x , y ) with y 2 = x 3 + a 4 x + a 6 1: v ← x 3 + a 4 x ⊲ v = x 3 + a 4 x ⊲ v = x 3 + a 4 x + a 6 2: v ← v + a 6 3: if √ v ∈ F q then v ← ( − 1 ) b √ v ⊲ v = ( − 1 ) b � x 3 + a 4 x + a 6 4: return ( x , y ) 5: 6: else return O 7: 8: end if Peter Günther (UPB) Decompression Attack FDTC 2015 11 / 18

Attack on decompression Decompress with a 4 = 0 Require: E : y 2 = x 3 + a 4 x + a 6 , ( x , b ) ∈ F q × { 0 , 1 } Ensure: ( x , y ) with y 2 = x 3 + a 6 1: v ← x 3 ⊲ v = x 3 ⊲ v = x 3 2: v ← v + a 6 + a 6 3: if √ v ∈ F q then v ← ( − 1 ) b √ v ⊲ v = ( − 1 ) b � x 3 + a 6 4: return ( x , y ) 5: 6: else return O 7: 8: end if Peter Günther (UPB) Decompression Attack FDTC 2015 11 / 18

Attack on decompression Decompress with a 4 = 0 and with fault Require: E : y 2 = x 3 + a 4 x + a 6 , ( x , b ) ∈ F q × { 0 , 1 } Ensure: ( x , y ) with y 2 = x 3 + a 6 1: v ← x 3 ⊲ v = x 3 ⊲ v = x 3 2: v ← v + a 6 + a 6 3: if √ v ∈ F q then v ← ( − 1 ) b √ v ⊲ v = ( − 1 ) b � x 3 + a 6 4: return ( x , y ) 5: 6: else return O 7: 8: end if Peter Günther (UPB) Decompression Attack FDTC 2015 11 / 18

Attack on decompression Decompress with a 4 = 0 and with fault Require: E : y 2 = x 3 + a 4 x + a 6 , ( x , b ) ∈ F q × { 0 , 1 } Ensure: ( x , y ) with y 2 = x 3 + a 6 1: v ← x 3 ⊲ v = x 3 ⊲ v = x 3 2: v ← v + a 6 + a 6 3: if √ v ∈ F q then Observation: v ← ( − 1 ) b √ v x quadratic residue ⇒ ⊲ v = ( − 1 ) b � x 3 + a 6 4: output on singular curve return ( x , y ) 5: y 2 = x 3 6: else return O 7: 8: end if Peter Günther (UPB) Decompression Attack FDTC 2015 11 / 18

Hash string to curve Decompress: building block of other algorithms MapToPoint : { 0 , 1 } ∗ → E ( F q ) Require: E : y 2 = x 3 + a 4 x + a 6 , H : { 0 , 1 } ∗ → F q × { 0 , 1 } , M ∈ { 0 , 1 } ∗ , Ensure: P ∈ E ( F q ) 1: i ← 0 2: repeat ⊲ until ( x , b ) is valid compression ( x , b ) ← H ( M � i ) 3: P ← Decompress ( x , b ) 4: i ← i + 1 5: 6: until P � = O 7: return P Peter Günther (UPB) Decompression Attack FDTC 2015 12 / 18

Hash string to curve Decompress: building block of other algorithms MapToPoint : { 0 , 1 } ∗ → E ( F q ) Require: E : y 2 = x 3 + a 4 x + a 6 , H : { 0 , 1 } ∗ → F q × { 0 , 1 } , M ∈ { 0 , 1 } ∗ , Ensure: P ∈ E ( F q ) 1: i ← 0 Atttack: 2: repeat ⊲ until ( x , b ) is valid compression Choose M such that ( x , b ) ← H ( M � i ) 3: H ( M � 0 ) = ( x , b ) with P ← Decompress ( x , b ) 4: quadratic residue x . i ← i + 1 5: 6: until P � = O 7: return P Peter Günther (UPB) Decompression Attack FDTC 2015 12 / 18

Properties of the attack Features of the attack Efficient, especially in the case a 4 = 0 One shot: can be applied to exponentiation with nonce Applications: Point decompression (encryption schemes) Hashing to curve (special signature schemes) Random point sampling (countermeasures) Limitations of the attack Access to Q = sP required For a 4 � = 0: stronger control over ( x , b ) required Attack on plain Decompress still possible Attack on MapToPoint not possible Peter Günther (UPB) Decompression Attack FDTC 2015 13 / 18