Elliptic Curve Scalar Multiplication for Side-Channel Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic processing methods for multiplying elliptic curve points by a scalar are vulnerable to side-channel attacks, particularly in terms of power consumption patterns that can reveal the scalar value, and face challenges with memory constraints in devices like smart cards.
Innovation Solution
A cryptographic processing method that involves selecting a window of bits in the scalar's binary representation, calculating and storing multiple points using a doubling function, and adding them using an addition function, with optional dummy executions and non-adjacent form processing to obscure bit positions and manage memory efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional double-and-add algorithm is used, then execution time is short, but security against side-channel attacks is poor
Solution Approach 1:
The scalar is divided into windows of w bits, and the algorithm processes these windows sequentially. This segmentation allows the use of pre-computed tables for each window, transforming the simple but insecure bit-by-bit processing into a more complex windowed approach that provides security while maintaining efficiency.
Solution Approach 2:
The patent pre-computes and stores tables of elliptic curve points corresponding to all possible window values before the main computation. This preliminary action eliminates the need for complex computations during the actual scalar multiplication, providing both security through obscured operation patterns and efficiency through table lookup operations.
2Reliability
If window size w is increased, then security against side-channel attacks is improved, but memory consumption increases
Solution Approach 1:
The patent allows the window size w to be adjusted as a parameter to balance security and memory consumption. By changing the window size, users can optimize the algorithm for different security requirements and device constraints, making the solution adaptable to various deployment scenarios.
Solution Approach 2:
The patent computes and stores only the necessary portion of the pre-computation tables corresponding to the chosen window size w. This partial action approach avoids computing and storing unnecessary data, optimizing memory usage while maintaining the security benefits of the windowed approach.
3Reliability
If dummy executions are added, then security against side-channel attacks is improved, but execution time increases
Solution Approach 1:
The patent converts the potential harm of increased execution time into a benefit by using it to mask the actual computation pattern. The dummy executions, while increasing total time, create a uniform operation pattern that prevents timing attacks and other side-channel analyses, transforming a disadvantage into a security advantage.
Data Source
AI summary
The invention relates to a cryptographic processing method comprising multiplication of a point P of an elliptic curve on a Galois field by a scalar k, the multiplication comprising steps of: storing, in a first register, a zero point of the Galois field, executing a loop comprising at least one iteration comprising steps of: selecting a window of w bits in the non-signed binary representation of the scalar k, w being a predetermined integer independent of the scalar k and strictly greater than 1, calculating multiple points of P being each associated with a bit of the window and of the form ±2iP, adding or not in the first register of multiple points stored, depending of the value of the bit of the window with which the multiple points are associated, wherein the loop ends once each bit of the non-signed binary representation of the scalar k has been selected, returning a value stored in the first register. If all the bits of the window selected during an iteration of the loop are zero, the iteration comprises at least one dummy execution of the addition function, and/or if all the bits of the window during an iteration of the loop are non-zero, the multiple points to be added in the first register during the step are determined from a non-adjacent form associated with the window.