Invalid Curve Attacks in a GLS Setting

In recent years, most speed records for implementations of elliptic curve cryptosystems have been achieved on curves endowed with nontrivial fast endomorphisms, particularly based on the technique introduced by Galbraith, Lin and Scott GLS. Therefore, studying the security of those curves is of prime importance. In this paper, we examine the applicability of the class of attacks introduced by Biehli¾?et al., known as invalid curve attacks, to cryptographic implementations based on GLS curves. In invalid curve attacks, a cryptographic device that computes a secret scalar multiplication $$P\mapsto kP$$Pi¾?kP on a certain elliptic curve $$E/{\mathbb F}_q$$E/Fq receives as input an arbitrary "invalid" point $$\widetilde{P}\not \in E{\mathbb F}_q$$P~i¾?EFq. Biehli¾?et al. observed that the device then computes the scalar multiplication by k on a different elliptic curve $$\widetilde{E}/{\mathbb F}_q$$E~/Fq, and if that curve is weaker than E, the attacker can use the result to recover information about the secret k. The attack doesn't readily adapt to the GLS setting, since the device computes the scalar multiplication as $$P\mapsto k_1P + k_2\psi P$$Pi¾?k1P+k2i¾?P where $$\psi $$i¾? is the efficient endomorphism of the GLS curve E, and if it receives an arbitrary invalid point $$\widetilde{P}$$P~ on a curve $$\widetilde{E}\ne E$$E~i¾?E, the computation of the map $$\psi $$i¾? yields a point on a completely different curve again, and the scalar multiplication outputs gibberish. We show, however, that a large family of invalid points $$\widetilde{P}$$P~ lie on curve stable under $$\psi $$i¾?, and using that observation we can modify the attack of Biehli¾?et al. to effectively recover the secrets $$k_1$$k1 and $$k_2$$k2, although the result of the computation on an invalid point doesn't have the "correct" discrete logarithm.