Resistance of the Montgomery Ladder Against Simple SCA: Theory and Practice

The Montgomery kP algorithm i.e. the Montgomery ladder is reported in literature as resistant against simple SCA due to the fact that the processing of each key bit value of the scalar k is done using the same sequence of operations. We implemented the Montgomery kP algorithm using Lopez-Dahab projective coordinates for the NIST elliptic curve B-233. We instantiated the same VHDL code for a wide range of clock frequencies for the same target FPGA and using the same compiler options. We measured electromagnetic traces of the kP executions using the same input data, i.e. scalar k and elliptic curve point P, and measurement setup. Additionally, we synthesized the same VHDL code for two IHP CMOS technologies, for a broad spectrum of frequencies. We simulated the power consumption of each synthesized design during an execution of the kP operation, always using the same scalar k and elliptic curve point P as inputs. Our experiments clearly show that the success of simple electromagnetic analysis attacks against FPGA implementations as well as the one of simple power analysis attacks against synthesized ASIC designs depends on the target frequency for which the design was implemented and at which it is executed significantly. In our experiments the scalar k was successfully revealed via simple visual inspection of the electromagnetic traces of the FPGA for frequencies from 40 to 100 MHz when standard compile options were used as well as from 50 MHz up to 240 MHz when performance optimizing compile options were used. We obtained similar results attacking the power traces simulated for the ASIC. Despite the significant differences of the here investigated technologies the designs’ resistance against the attacks performed is similar: only a few points in the traces represent strong leakage sources allowing to reveal the key at very low and very high frequencies. For the “middle” frequencies the number of points which allow to successfully reveal the key increases when increasing the frequency.

[1]  Alfred Menezes,et al.  Software Implementation of Elliptic Curve Cryptography over Binary Fields , 2000, CHES.

[2]  Alfred Menezes,et al.  Guide to Elliptic Curve Cryptography , 2004, Springer Professional Computing.

[3]  Zoya Dyka,et al.  Increasing the Robustness of the Montgomery kP-Algorithm Against SCA by Modifying Its Initialization , 2016, SECITC.

[4]  Marc Joye,et al.  The Montgomery Powering Ladder , 2002, CHES.

[5]  Zoya Dyka,et al.  On the Influence of the FPGA Compiler Optimization Options on the Success of the Horizontal Attack , 2019, 2019 International Conference on ReConFigurable Computing and FPGAs (ReConFig).

[6]  Kouichi Itoh,et al.  Address-Bit Differential Power Analysis of Cryptographic Schemes OK-ECDH and OK-ECDSA , 2002, CHES.

[7]  Zoya Dyka,et al.  FPGA Implementation of ECC: Low-Cost Countermeasure against Horizontal Bus and Address-Bit SCA , 2018, 2018 International Conference on ReConFigurable Computing and FPGAs (ReConFig).

[8]  Zoya Dyka,et al.  Inherent Resistance of Efficient ECC Designs against SCA Attacks , 2016, 2016 8th IFIP International Conference on New Technologies, Mobility and Security (NTMS).

[9]  Patrick Schaumont,et al.  State-of-the-art of secure ECC implementations: a survey on known side-channel attacks and countermeasures , 2010, 2010 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST).

[10]  Zoya Dyka,et al.  Area efficient hardware implementation of elliptic curve cryptography by iteratively applying Karatsuba's method , 2005, Design, Automation and Test in Europe.

[11]  Zoya Dyka,et al.  Horizontal address-bit DPA against montgomery kP implementation , 2017, 2017 International Conference on ReConFigurable Computing and FPGAs (ReConFig).

[12]  Zoya Dyka,et al.  Horizontal Address-Bit DEMA against ECDSA , 2018, 2018 9th IFIP International Conference on New Technologies, Mobility and Security (NTMS).

[13]  Ricardo Dahab,et al.  Fast Multiplication on Elliptic Curves over GF(2m) without Precomputation , 1999, CHES.

[14]  Zoya Dyka,et al.  Resistance of the Montgomery kP Algorithm against Simple SCA: Theory and Practice , 2020, 2020 IEEE Latin-American Test Symposium (LATS).