ECTester: Reverse-engineering side-channel countermeasures of
ECC implementations

D 2025

ECTester: Reverse-engineering side-channel countermeasures of ECC implementations

SUCHÁNEK, Vojtěch; Ján JANČÁR; Jan KVAPIL; Petr ŠVENDA; Lukasz Michal CHMIELEWSKI et al.

Základní údaje

Originální název

ECTester: Reverse-engineering side-channel countermeasures of ECC implementations

Autoři

SUCHÁNEK, Vojtěch; Ján JANČÁR ; Jan KVAPIL; Petr ŠVENDA a Lukasz Michal CHMIELEWSKI

Vydání

4. vyd. Německo, IACR Transactions on Cryptographic Hardware and Embedded Systems, od s. 290-316, 27 s. 2025

Nakladatel

Ruhr-University of Bochum

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

10201 Computer sciences, information science, bioinformatics

Stát vydavatele

Německo

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

elektronická verze "online"

Odkazy

URL

Označené pro přenos do RIV

Ano

Kód RIV

RIV/00216224:14330/25:00141400

Organizační jednotka

Fakulta informatiky

ISSN

DOI

https://doi.org/10.46586/tches.v2025.i4.290-316

EID Scopus

2-s2.0-105016374218

Klíčová slova anglicky

elliptic-curve cryptography; black-box implementations; testing; vulnerabilities; reverse-engineering; ECDH; ECDSA

Štítky

core_A, firank_A

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 29. 9. 2025 23:24, RNDr. Ján Jančár, Ph.D.

Anotace

V originále

Developers implementing elliptic curve cryptography (ECC) face a wide range of implementation choices created by decades of research into elliptic curves. The literature on elliptic curves offers a plethora of curve models, scalar multipliers, and addition formulas, but this comes with the price of enabling attacks to also use the rich structure of these techniques. Navigating through this area is not an easy task and developers often obscure their choices, especially in black-box hardware implementations. Since side-channel attackers rely on the knowledge of the implementation details, reverse engineering becomes a crucial part of attacks. This work presents ECTester --- a tool for testing black-box ECC implementations. Through various test suites, \ectester observes the behavior of the target implementation against known attacks but also non-standard inputs and elliptic curve parameters. We analyze popular ECC libraries and smartcards and show that some libraries and most smartcards do not check the order of the input points and improperly handle the infinity point. Based on these observations, we design new techniques for reverse engineering scalar randomization countermeasures that are able to distinguish between group scalar randomization, additive, multiplicative or Euclidean splitting. Our techniques do not require side-channel measurements; they only require the ability to set custom domain parameters, and are able to extract not only the size but also the exact value of the random mask used. Using the techniques, we successfully reverse-engineered the countermeasures on 13 cryptographic smartcards from 5 major manufacturers -- all but one we tested on. Finally, we discuss what mitigations can be applied to prevent such reverse engineering, and whether it is possible at all.

Návaznosti

MUNI/A/1709/2024, interní kód MU

Název: Aplikovaný výzkum na FI: Důvěra v dynamických softwarových ekosystémech, kryptografické implementace včetně uživatelských aspektů, kyberbezpečnostní cvičení, fúze dat pro fyzikální sensory a algoritmy plánování v logistice

Investor: Masarykova univerzita, Aplikovaný výzkum na FI: Důvěra v dynamických softwarových ekosystémech, kryptografické implementace včetně uživatelských aspektů, kyberbezpečnostní cvičení, fúze dat pro fyzikální sensory a algoritmy plánování v logistice

VJ02010010, projekt VaV

Název: Nástroje pro verifikaci bezpečnosti kryptografických zařízení s využitím AI (Akronym: AI-SecTools)

Investor: Ministerstvo vnitra ČR, Tools for AI-enhanced Security Verification of Cryptographic Devices

Citovat

SUCHÁNEK, Vojtěch; Ján JANČÁR; Jan KVAPIL; Petr ŠVENDA a Lukasz Michal CHMIELEWSKI. ECTester: Reverse-engineering side-channel countermeasures of ECC implementations. Online. In IACR Transactions on Cryptographic Hardware and Embedded Systems. 4. vyd. Německo: Ruhr-University of Bochum, 2025, s. 290-316. ISSN 2569-2925. Dostupné z: https://doi.org/10.46586/tches.v2025.i4.290-316.

@inproceedings{2504037,
   author = {Suchánek, Vojtěch and Jančár, Ján and Kvapil, Jan and Švenda, Petr and Chmielewski, Lukasz Michal},
   address = {Německo},
   booktitle = {IACR Transactions on Cryptographic Hardware and Embedded Systems},
   doi = {https://doi.org/10.46586/tches.v2025.i4.290-316},
   edition = {4},
   keywords = {elliptic-curve cryptography; black-box implementations; testing; vulnerabilities; reverse-engineering; ECDH; ECDSA},
   howpublished = {elektronická verze "online"},
   language = {eng},
   location = {Německo},
   pages = {290-316},
   publisher = {Ruhr-University of Bochum},
   title = {ECTester: Reverse-engineering side-channel countermeasures of ECC implementations},
   url = {https://tches.iacr.org/index.php/TCHES/article/view/12411},
   year = {2025}
}

TY  - CONF
ID  - 2504037
AU  - Suchánek, Vojtěch - Jančár, Ján - Kvapil, Jan - Švenda, Petr - Chmielewski, Lukasz Michal
PY  - 2025
TI  - ECTester: Reverse-engineering side-channel countermeasures of ECC implementations
PB  - Ruhr-University of Bochum
CY  - Německo
KW  - elliptic-curve cryptography
KW  - black-box implementations
KW  - testing
KW  - vulnerabilities
KW  - reverse-engineering
KW  - ECDH
KW  - ECDSA
UR  - https://tches.iacr.org/index.php/TCHES/article/view/12411
N2  - Developers implementing elliptic curve cryptography (ECC) face a wide range of implementation choices created by decades of research into elliptic curves. The literature on elliptic curves offers a plethora of curve models, scalar multipliers, and addition formulas, but this comes with the price of enabling attacks to also use the rich structure of these techniques. Navigating through this area is not an easy task and developers often obscure their choices, especially in black-box hardware implementations. Since side-channel attackers rely on the knowledge of the implementation details, reverse engineering becomes a crucial part of attacks. This work presents ECTester --- a tool for testing black-box ECC implementations. Through various test suites, \ectester observes the behavior of the target implementation against known attacks but also non-standard inputs and elliptic curve parameters. We analyze popular ECC libraries and smartcards and show that some libraries and most smartcards do not check the order of the input points and improperly handle the infinity point. Based on these observations, we design new techniques for reverse engineering scalar randomization countermeasures that are able to distinguish between group scalar randomization, additive, multiplicative or Euclidean splitting. Our techniques do not require side-channel measurements; they only require the ability to set custom domain parameters, and are able to extract not only the size but also the exact value of the random mask used. Using the techniques, we successfully reverse-engineered the countermeasures on 13 cryptographic smartcards from 5 major manufacturers -- all but one we tested on. Finally, we discuss what mitigations can be applied to prevent such reverse engineering, and whether it is possible at all.
ER  -

SUCHÁNEK, Vojtěch; Ján JANČÁR; Jan KVAPIL; Petr ŠVENDA a Lukasz Michal CHMIELEWSKI. ECTester: Reverse-engineering side-channel countermeasures of ECC implementations. Online. In \textit{IACR Transactions on Cryptographic Hardware and Embedded Systems}. 4. vyd. Německo: Ruhr-University of Bochum, 2025, s.~290-316. ISSN~2569-2925. Dostupné z: https://doi.org/10.46586/tches.v2025.i4.290-316.

Přehled o publikaci