ECDSA Power Analysis Countermeasure via Operation Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Power analysis attacks pose a vulnerability to the Elliptic Curve Digital Signature Algorithm (ECDSA) by revealing private keys through measurements of power consumption, which existing countermeasures like Messerges' method introduce additional modular operations, seeking a solution that minimizes these additions while maintaining resistance to attacks.
Innovation Solution
Modifying the sequence of arithmetic operations in ECDSA by using random integers as masking factors, such as multiplicative splitting or rearranging operations, to obscure the use of the long-term key, thereby rendering power analysis attacks inapplicable.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Messerges' method is used to counter power analysis attacks, then security against power analysis attacks is improved, but computational overhead increases due to additional modular operations
Solution Approach 1:
The patent segments the computation of the signature component s into multiple parts by introducing a random integer r. Instead of directly computing s = k^(-1)(m + dr) mod q, the computation is divided into s1 = k^(-1)(m + dr mod q) mod q and s2 = s1 * r mod q. This segmentation allows the use of different computational paths that can be masked against power analysis attacks while maintaining the same final result, thereby reducing the need for additional modular operations compared to Messerges' method.
Solution Approach 2:
The patent changes the computational parameters by introducing a random integer r and modifying the computation path. The parameter r is used to create alternative computational expressions: s = k^(-1)(m + dr) mod q is transformed into s1 = k^(-1)(m + dr mod q) mod q followed by s2 = s1 * r mod q. This parameter change enables the system to achieve power analysis resistance through arithmetic properties rather than through additional modular operations, thus reducing computational overhead.
2Reliability
If the sequence of arithmetic operations is modified to mask the long-term key, then resistance to power analysis attacks is improved, but the complexity of the algorithm increases
Solution Approach 1:
The patent introduces dynamics into the algorithm by making the computation path variable through the use of a random integer r. The computation of s is dynamically adjusted: s1 = k^(-1)(m + dr mod q) mod q and s2 = s1 * r mod q. This dynamic approach allows the algorithm to adapt its computational path based on the random value r, masking the actual use of the long-term key d against power analysis attacks while keeping the algorithm structure relatively simple.
Solution Approach 2:
The patent introduces an intermediary variable s1 that mediates between the original computation and the final result s. The intermediary s1 = k^(-1)(m + dr mod q) mod q serves as a bridge, allowing the computation to be split into two steps where the second step (s2 = s1 * r mod q) can be masked against power analysis. This intermediary approach simplifies the overall algorithm structure compared to more complex masking schemes while achieving the same security goal.
3Object-affected harmful factors
If random integers are used as masking factors to obscure the long-term key, then power analysis attacks are rendered inapplicable, but the number of arithmetic operations increases
Solution Approach 1:
The patent changes the arithmetic parameters by introducing a random integer r and modifying the computation to use modular arithmetic properties. Instead of directly computing s = k^(-1)(m + dr) mod q which requires protection against power analysis, the patent uses s1 = k^(-1)(m + dr mod q) mod q and s2 = s1 * r mod q. This parameter change exploits the property that (m + dr) mod q = (m + (dr mod q)) mod q, allowing the computation to be split into operations that are more resistant to power analysis while minimizing the total number of arithmetic operations.
Solution Approach 2:
The patent segments the computation into two parts: s1 = k^(-1)(m + dr mod q) mod q and s2 = s1 * r mod q. This segmentation allows the first part to be computed with protected operations against power analysis, while the second part (multiplication by random r) can be performed with standard operations. The segmentation reduces the total number of protected operations needed compared to applying protection to the entire computation, thus improving productivity while maintaining security.
Data Source
AI summary
Execution of the Elliptic Curve Digital Signature Algorithm (ECDSA) requires determination of a signature, which determination involves arithmetic operations. Some of the arithmetic operations employ a long term cryptographic key. It is the execution of these arithmetic operations that can make the execution of the ECDSA vulnerable to a power analysis attack. In particular, an attacker using a power analysis attack may determine the long term cryptographic key. By modifying the sequence of operations involved in the determination of the signature and the inputs to those operations, power analysis attacks may no longer be applied to determine the long term cryptographic key.