Tag Info

17

As already said by fgrieu in his answer, this is possible. There are multiple ways to protect deterministic ECDSA against fault attacks, but these ways will depend on your fault model. If you consider only a single fault model, then any construct requiring the attacker to perform two faults to achieve his goal will be an acceptable countermeasure... On the ...

10

Yes, ECDSA (including deterministic) can be protected against fault attacks. An idea is to check any computed signature (by the verifier's algorithm) before releasing the signature (and not releasing anything if the verification fails; perhaps, zeroing the key and declaring the device faulty or under attack). That's a pretty general technique applicable to ...

5

$q$ does not divide $s^e-h(m)$, but $p$ does, so since the gcd must divide both $s^e-h(m)$ and $n$ it's $p$. To be even more explicit, we know that $p$ divides both $s^e-h(m)$ and $n$. The only larger divisor of $n$ that is also divisible by $p$ is $n$ itself, but if $n$ would divide $s^e-h(m)$, then $q$ would also divide $s^e-h(m)$, which we already assumed ...

3

In order to have a successful fault attack on RSA-CRT, you need to work with known values of $e, N$ and of the message $m$, but you should be knowing them already, since you cannot verify the signature without knowing these values. So, at first you should be knowing the public key of the signer: $(e,N)$. Then the signer signs a message $m$, which you should ...

2

The, common, assumption used in that paper is that an attacker can DPA a fixed secret when it's mixed with known (to the attacker) and varying data. The proposed solution was to add random after the key to fill the SHA-512 block size. By doing this: the first SHA-512 computation processes the fixed secret and varying but unknown data, so the attacker can'...

1

This is rather implementation dependent. If this is compiled code (and even slightly optimized), I would expect the compiler to perform 'constant propagation'; that is, it would notice that j always has the value of zero, and so remove j (and effectively replace all instances with 0); of course, those 0's would be subject to even more optimizations (for ...

1

In case you are still wondering, the answer to this question is "Yes". DES can also be targeted by the same sort of attack. This was actually already almost entirely done against DES in a paper from 2006, by F. Amiel, C. Clavier and M. Tunstall called "Fault analysis of DPA-resistant algorithms", you can look at section 6 and the next ones, in which they ...

Only top voted, non community-wiki answers of a minimum length are eligible