Methods of Fault Analysis Attacks on Elliptic Curve Cryptosystems

I would like to thank Prof. Johannes Buchmann for his interesting and also entertaining introduction to cryptography and the opportunity to carry on research on fault attacks. I enjoyed the relaxed and friendly atmosphere in his research group. I would also like to thank Daniel Schepers for helpful discussions on fault attacks and for his hints how to improve my work. I really enjoyed the years of my studies with my friends from university and would like to thank Matthias Heidrich, Michelle Seipp, Dörte Beigel and Chris Hellberg, especially, for good questions and discussions how to improve explanations in this thesis. Introduction This thesis presents a special class of attacks on elliptic curve cryptosystems (ECC), called Fault Analysis Attacks (FAA). They belong to the class of Side Channel Attacks (SCA) and try to get information about the secret key by exploiting faults. The attacks are based on the assumption that a fault during a cryptographic computation leads to a faulty result. If the system does not detect the fault and hence prevents the output, the result can be exploited by an adversary: Using the knowledge of correct results, faulted results and the precise place of induced faults an adversary is able to compute the secret key. In Chapter 1 we will give an introduction to arithmetic on elliptic curves. Chapter 2 gives an overview on cryptography based on elliptic curves. We will present the elliptic curve discrete logarithm problem, which provides security of an elliptic curve cryptosystem. Then, we will describe some methods to solve the discrete logarithm problem in order to get the secret key. This leads to security attributes and conditions for a secure ECC. In Chapter 3 we will present different Fault Analysis Attacks assuming an attack on an ECC, which is implemented on a security device, by inducing faults during a computation that uses a private key. If an attacker is able to repeatedly mount attacks on the device, he can successively derive the bit-values of the secret key. We present different approaches of Fault Analysis Attacks and discuss countermeasures to prevent these attacks. A complete overview of countermeasures against FAA is given at the end of Chapter 3. Furthermore, we will analyze other Side Channel Attacks that exploit power consumption of the device and give effective countermeasures in Chapter 4. We will present a model to compare countermeasures with respect to performance, use of registers …