Published in

Springer, Designs, Codes and Cryptography, 1(36), p. 33-43, 2005

DOI: 10.1007/s10623-003-1160-8

Links

Tools

Export citation

Search in Google Scholar

Elliptic curve cryptosystems in the presence of permanent and transient faults

Journal article published in 2005 by Mathieu Ciet, Marc Joye
This paper is available in a repository.
This paper is available in a repository.

Full text: Download

Green circle
Preprint: archiving allowed
Orange circle
Postprint: archiving restricted
Red circle
Published version: archiving forbidden
Data provided by SHERPA/RoMEO

Abstract

Elliptic curve cryptosystems in the presence of faults were studied by [Biehl et al., Advances in Cryptology - CRYPTO 2000, Springer Verlag (2000) pp. 131-146]. The first fault model they consider requires that the input point P in the computation of dP is chosen by the adversary. Their second and third fault models only require the knowledge of P. But these two latter models are less 'practical' in the sense that they assume that only a few bits of error are inserted (typically exactly one bit is supposed to be disturbed) either into P just prior to the point multiplication or during the course of the computation in a chosen location. This paper relaxes these assumptions and shows how random (and thus unknown) errors in either coordinates of point P, in the elliptic curve parameters or in the field representation enable the (partial) recovery of multiplier d. Then, from multiple point multiplications, we explain how this can be turned into a total key recovery. Simple precautions to prevent the leakage of secrets are also discussed.