Elliptic Curve Security Mechanism Invalid Curve Attack
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Bluetooth Secure Simple Pairing (BT-SSP) protocol is vulnerable to the invalid curve attack, which allows attackers to reveal private keys and derive link keys used for communication, as existing protection methods are either costly in CPU time, inefficient, or require frequent key refreshments that can shorten device lifespan.
Innovation Solution
Implementing an elliptic curve security mechanism that checks the validity of computed values rather than public keys, by performing scalar multiplication with a private key and verifying that the resulting point lies on a predefined elliptic curve, without directly evaluating the public key's validity, and using a constant or randomly generated private key for multiple iterations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the device verifies the validity of received public keys by checking whether they lie on the correct elliptic curve, then security against invalid curve attacks is improved, but CPU time and computational cost increase
Solution Approach 1:
Instead of verifying whether the received public key lies on the correct elliptic curve (direct approach), the patent inverts the approach by computing the result of scalar multiplication and verifying whether that result lies on the curve. This indirect verification method achieves the same security goal while reducing computational overhead.
Solution Approach 2:
The patent introduces an intermediary verification step: rather than directly checking the public key's validity, it uses the computed scalar multiplication result as an intermediary to indirectly verify the public key's validity. This intermediary approach simplifies the verification process and reduces CPU time.
2Reliability
If the device frequently refreshes its private ECDH key, then protection against invalid curve attacks is improved, but device lifespan decreases due to limited memory write cycles
Solution Approach 1:
Instead of protecting the private key by frequent refreshment (direct approach), the patent inverts the approach by protecting against invalid curve attacks through verification of the computed result rather than the input public key. This eliminates the need for frequent key refreshment and associated memory writes.
3Ease of operation
If the device uses a static NFC tag programmed in the factory, then out-of-band authentication is simplified, but security is compromised if the private key changes after tag creation
Solution Approach 1:
Instead of requiring the private key to remain static for NFC tag compatibility (direct approach), the patent inverts the approach by using verification of the computed result to ensure security consistency even when private keys change. This allows both static NFC tags and dynamic key management to coexist securely.
Data Source
AI summary
A communication device having a private key and configured to implement an elliptic curve security mechanism for successful operation of which it: (a) receives a first value from another device, (b) computes a second value as the scalar multiplication of the first value with its private key and (c) returns that second value for use by the other device; the mechanism being such that the first value defines a pair of coordinates representing a first point and the second value defines a pair of coordinates representing a second point and being such that the first value is valid only if it lies on an elliptic curve of predefined form; the device being configured to implement the mechanism by the steps of: receiving data as the first value; making a first evaluation as to whether the first value is a singular point with respect to the elliptic curve; computing the second value as the scalar multiplication of the first value with the private key; making a second evaluation as to whether the second value lies on the elliptic curve; and returning the second value only if the first evaluation is false and the second evaluation is true.