A multiple power analysis breaks the advanced version of the randomized addition-subtraction chains countermeasure against side channel attacks

Proceedings 2003 IEEE Information Theory Workshop (Cat. No.03EX674) Pub Date : 2003-08-04 DOI:10.1109/ITW.2003.1216723

K. Okeya, K. Sakurai

{"title":"A multiple power analysis breaks the advanced version of the randomized addition-subtraction chains countermeasure against side channel attacks","authors":"K. Okeya, K. Sakurai","doi":"10.1109/ITW.2003.1216723","DOIUrl":null,"url":null,"abstract":"We show that the advanced version of the randomized addition-subtraction chains countermeasure against side channel attacks is vulnerable to a multiple power analysis attack, a new kind of side channel attack, under distinguishability between addition and doubling. The side channel attack takes advantage of information leaked during execution of a cryptographic procedure. The randomized addition-subtraction chains countermeasure was proposed by E. Oswald and M. Aigner (see Lect. Notes in Comp. Sci., vol.2162, p.39-50, 2001), and is based on a random decision inserted into computations. The countermeasure has two versions; the basic version and the advanced version. The basic version has been proved to be vulnerable to a side channel attack. This is due to a shrinkage of states for randomization if a bit of the secret scalar is zero. However, the advanced version does not have such a shrinkage. The multiple power analysis uses plural AD sequences, which are sequences of additions and doublings, and obtained by the distinguishability and measurements. The multiple power analysis relates the AD sequences to each other, and deduces the secret scalar. A point of the multiple power analysis against the advanced version is that two different states are combined, and regarded as the same state. This provides a shrinkage of states if a bit of the secret scalar is zero.","PeriodicalId":363490,"journal":{"name":"Proceedings 2003 IEEE Information Theory Workshop (Cat. No.03EX674)","volume":"13 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2003-08-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"12","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Proceedings 2003 IEEE Information Theory Workshop (Cat. No.03EX674)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/ITW.2003.1216723","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 12

Abstract

We show that the advanced version of the randomized addition-subtraction chains countermeasure against side channel attacks is vulnerable to a multiple power analysis attack, a new kind of side channel attack, under distinguishability between addition and doubling. The side channel attack takes advantage of information leaked during execution of a cryptographic procedure. The randomized addition-subtraction chains countermeasure was proposed by E. Oswald and M. Aigner (see Lect. Notes in Comp. Sci., vol.2162, p.39-50, 2001), and is based on a random decision inserted into computations. The countermeasure has two versions; the basic version and the advanced version. The basic version has been proved to be vulnerable to a side channel attack. This is due to a shrinkage of states for randomization if a bit of the secret scalar is zero. However, the advanced version does not have such a shrinkage. The multiple power analysis uses plural AD sequences, which are sequences of additions and doublings, and obtained by the distinguishability and measurements. The multiple power analysis relates the AD sequences to each other, and deduces the secret scalar. A point of the multiple power analysis against the advanced version is that two different states are combined, and regarded as the same state. This provides a shrinkage of states if a bit of the secret scalar is zero.

查看原文本刊更多论文

多重功率分析打破了随机加减链对抗侧信道攻击的高级版本

我们证明了在加法和加倍可区分的情况下，抗侧信道攻击的随机加减链对策的高级版本容易受到多重功率分析攻击，这是一种新的侧信道攻击。侧信道攻击利用加密过程执行过程中泄露的信息。随机加减链对策是由E. Oswald和M. Aigner提出的。《比较科学》注释。， vol.2162, p.39-50, 2001)，并且基于插入到计算中的随机决策。对策有两个版本;基础版和高级版。基本版本已被证明容易受到侧信道攻击。这是由于如果秘密标量的一个位为零，则随机化状态的收缩。然而，高级版本没有这样的收缩。多重功率分析使用多重AD序列，这些序列是相加和加倍的序列，通过可分辨性和测量得到。多重功率分析将AD序列相互关联，并推导出秘密标量。与高级版本相比，多重功率分析的一个要点是将两种不同的状态合并在一起，并将其视为同一状态。如果秘密标量的某个位为零，则提供状态缩减。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

Proceedings 2003 IEEE Information Theory Workshop (Cat. No.03EX674)

自引率

0.00%

发文量