Blinded Semi-Static ECDH Authentication for Low-Resource Provers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In resource-constrained environments, existing elliptic curve Diffie-Hellman (ECDH) authentication protocols face challenges due to significant computational and resource constraints on the prover side, particularly in devices like RFID tags, which complicates blinded computations and increases vulnerability to side-channel attacks.
Innovation Solution
A modified ECDH protocol where the prover generates two shares of the private key and sends only the x-coordinates of the resulting points to the verifier, who then reconstructs the points and verifies authenticity using these x-coordinates, shifting computational complexity to the verifier side.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the prover performs blinded computations in ECDH authentication, then security against side-channel attacks is improved, but computational complexity and resource consumption increase
Solution Approach 1:
The private key q is segmented into two shares q1 and q2 such that q = q1 - q2. The prover computes P1 = q1·R and P2 = q2·R separately, then sends both points to the verifier. This segmentation allows blinded computation without requiring the prover to handle the full private key, reducing computational complexity while maintaining security.
Solution Approach 2:
Instead of having the prover perform the final verification computation, the protocol inverts the roles by having the prover send intermediate points P1 and P2, and the verifier completes the verification by computing whether (P1±P2) matches r·Q. This shifts computational burden from the resource-constrained prover to the more capable verifier.
2Measurement precision
If the prover sends complete point coordinates for verification, then authentication accuracy is improved, but communication overhead and processing time increase
Solution Approach 1:
The protocol extracts only the essential x-coordinate information from the complete points P1 and P2 for transmission to the verifier. The verifier then reconstructs the necessary verification data without requiring the prover to send full point coordinates or perform time-consuming final computations, thus reducing processing time while maintaining authentication accuracy.
3Reliability
If resource-constrained devices implement full ECDH authentication, then security requirements are met, but hardware complexity and energy consumption increase
Solution Approach 1:
By segmenting the private key into shares q1 and q2, the prover only needs to perform lightweight scalar multiplications q1·R and q2·R rather than full ECDH computations. This segmentation enables resource-constrained devices to participate in secure authentication with significantly reduced energy consumption.
Solution Approach 2:
The protocol inverts the computational workload distribution by having the verifier perform the more energy-intensive verification computations instead of the prover. This allows resource-constrained devices to meet security requirements while minimizing their energy consumption.
Data Source
AI summary
Various embodiments relate to a data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for an elliptic curve cryptography authentication method based on an elliptic curve in a processor, the instructions, comprising: generating, by a verifier, a random challenge r; multiplying, by the verifier, the random challenge r by a basepoint G to produce R; sending an x coordinate of R to a prover; receiving an x-coordinate of a first point P1 and a second point P2 from the prover, wherein P1 is based on a random share q1 of the private key q of the prover and R, and wherein P2 is based on a random share q2 of the private key q and R; where q=q1−q2; finding a point P1′ on the elliptic curve having an x-coordinate of the first point P1; finding a point P2′ on the elliptic curve having an x-coordinate of the second point P2; and authenticating the prover when an x-coordinate of one of (P1′+P2′) and (P1′−P2′) matches an x-coordinate of r·Q, wherein Q is a public key of the prover.