Minerva: The curse of ECDSA nonces

D 2020

Minerva: The curse of ECDSA nonces

JANČÁR, Ján, Vladimír SEDLÁČEK, Petr ŠVENDA a Marek SÝS

Základní údaje

Originální název

Minerva: The curse of ECDSA nonces

Autoři

JANČÁR, Ján (703 Slovensko, garant, domácí), Vladimír SEDLÁČEK (203 Česká republika, domácí), Petr ŠVENDA (203 Česká republika, domácí) a Marek SÝS (703 Slovensko, domácí)

Vydání

Německo, IACR Transactions on Cryptographic Hardware and Embedded Systems, od s. 281-308, 28 s. 2020

Nakladatel

Ruhr-University of Bochum

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

10201 Computer sciences, information science, bioinformatics

Stát vydavatele

Německo

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

elektronická verze "online"

Odkazy

Website

Kód RIV

RIV/00216224:14330/20:00114222

Organizační jednotka

Fakulta informatiky

ISSN

DOI

http://dx.doi.org/10.13154/tches.v2020.i4.281-308

Klíčová slova anglicky

ECDSA; Hidden Number Problem; side-channel attack; lattice attack; smartcard

Štítky

best1, core_A, firank_A

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 31. 5. 2022 14:26, RNDr. Pavel Šmerk, Ph.D.

Anotace

V originále

We present our discovery of a group of side-channel vulnerabilities in implementations of the ECDSA signature algorithm in a widely used Atmel AT90SC FIPS 140-2 certified smartcard chip and five cryptographic libraries (libgcrypt, wolfSSL, MatrixSSL, SunEC/OpenJDK/Oracle JDK, Crypto++). Vulnerable implementations leak the bit-length of the scalar used in scalar multiplication via timing. Using leaked bit-length, we mount a lattice attack on a 256-bit curve, after observing enough signing operations. We propose two new methods to recover the full private key requiring just 500 signatures for simulated leakage data, 1200 for real cryptographic library data, and 2100 for smartcard data. The number of signatures needed for a successful attack depends on the chosen method and its parameters as well as on the noise profile, influenced by the type of leakage and used computation platform. We use the set of vulnerabilities reported in this paper, together with the recently published TPM-FAIL vulnerability [MSE+20] as a basis for real-world benchmark datasets to systematically compare our newly proposed methods and all previously published applicable lattice-based key recovery methods. The resulting exhaustive comparison highlights the methods’ sensitivity to its proper parametrization and demonstrates that our methods are more efficient in most cases. For the TPM-FAIL dataset, we decreased the number of required signatures from approximately 40 000 to mere 900.

Návaznosti

GA20-03426S, projekt VaV

Název: Ověření a zlepšení bezpečnosti kryptografie eliptických křivek

Investor: Grantová agentura ČR, Ověření a zlepšení bezpečnosti kryptografie eliptických křivek

Citovat

JANČÁR, Ján, Vladimír SEDLÁČEK, Petr ŠVENDA a Marek SÝS. Minerva: The curse of ECDSA nonces. Online. In Amir Moradi, Mehdi Tibouchi. IACR Transactions on Cryptographic Hardware and Embedded Systems. Německo: Ruhr-University of Bochum, 2020, s. 281-308. ISSN 2569-2925. Dostupné z: https://dx.doi.org/10.13154/tches.v2020.i4.281-308.

@inproceedings{1669335,
   author = {Jančár, Ján and Sedláček, Vladimír and Švenda, Petr and Sýs, Marek},
   address = {Německo},
   booktitle = {IACR Transactions on Cryptographic Hardware and Embedded Systems},
   doi = {http://dx.doi.org/10.13154/tches.v2020.i4.281-308},
   editor = {Amir Moradi, Mehdi Tibouchi},
   keywords = {ECDSA; Hidden Number Problem; side-channel attack; lattice attack; smartcard},
   howpublished = {elektronická verze "online"},
   language = {eng},
   location = {Německo},
   pages = {281-308},
   publisher = {Ruhr-University of Bochum},
   title = {Minerva: The curse of ECDSA nonces},
   url = {https://minerva.crocs.fi.muni.cz/},
   year = {2020}
}

TY  - JOUR
ID  - 1669335
AU  - Jančár, Ján - Sedláček, Vladimír - Švenda, Petr - Sýs, Marek
PY  - 2020
TI  - Minerva: The curse of ECDSA nonces
PB  - Ruhr-University of Bochum
CY  - Německo
KW  - ECDSA
KW  - Hidden Number Problem
KW  - side-channel attack
KW  - lattice attack
KW  - smartcard
UR  - https://minerva.crocs.fi.muni.cz/
L2  - https://minerva.crocs.fi.muni.cz/
N2  - We present our discovery of a group of side-channel vulnerabilities in implementations of the ECDSA signature algorithm in a widely used Atmel AT90SC FIPS 140-2 certified smartcard chip and five cryptographic libraries (libgcrypt, wolfSSL, MatrixSSL, SunEC/OpenJDK/Oracle JDK, Crypto++). Vulnerable implementations leak the bit-length of the scalar used in scalar multiplication via timing. Using leaked bit-length, we mount a lattice attack on a 256-bit curve, after observing enough signing operations. We propose two new methods to recover the full private key requiring just 500 signatures for simulated leakage data, 1200 for real cryptographic library data, and 2100 for smartcard data. The number of signatures needed for a successful attack depends on the chosen method and its parameters as well as on the noise profile, influenced by the type of leakage and used computation platform. We use the set of vulnerabilities reported in this paper, together with the recently published TPM-FAIL vulnerability [MSE+20] as a basis for real-world benchmark datasets to systematically compare our newly proposed methods and all previously published applicable lattice-based key recovery methods. The resulting exhaustive comparison highlights the methods’ sensitivity to its proper parametrization and demonstrates that our methods are more efficient in most cases. For the TPM-FAIL dataset, we decreased the number of required signatures from approximately 40 000 to mere 900.
ER  -

JANČÁR, Ján, Vladimír SEDLÁČEK, Petr ŠVENDA a Marek SÝS. Minerva: The curse of ECDSA nonces. Online. In Amir Moradi, Mehdi Tibouchi. \textit{IACR Transactions on Cryptographic Hardware and Embedded Systems}. Německo: Ruhr-University of Bochum, 2020, s.~281-308. ISSN~2569-2925. Dostupné z: https://dx.doi.org/10.13154/tches.v2020.i4.281-308.

Podrobný výpis o publikaci