Please use this identifier to cite or link to this item:
|Title:||Branch prediction attack on blinded scalar multiplication||Authors:||Bhattacharya, Sarani
|Keywords:||Engineering::Computer science and engineering::Hardware||Issue Date:||2020||Source:||Bhattacharya, S., Maurice, C., Bhasin, S. & Mukhopadhyay, D. (2020). Branch prediction attack on blinded scalar multiplication. IEEE Transactions On Computers, 69(5), 633-648. https://dx.doi.org/10.1109/TC.2019.2958611||Journal:||IEEE Transactions on Computers||Abstract:||In recent years, performance counters have been used as a side channel source to monitor branch mispredictions, in order to attack cryptographic algorithms. However, the literature considers blinding techniques as effective countermeasures against such attacks. In this article, we present the first template attack on the branch predictor. We target blinded scalar multiplications with a side-channel attack that uses branch misprediction traces. Since an accurate model of the branch predictor is a crucial element of our attack, we first reverse-engineer the branch predictor. Our attack proceeds with a first online acquisition step, followed by an offline template attack with a template building phase and a template matching phase. During the template matching phase, we use a strategy we call Deduce Remove, to first infer the candidate values from templates based on a model of the branch predictor, and subsequently eliminate erroneous observations. This last step uses the properties of the target blinding technique to remove wrong guesses and thus naturally provides error correction in key retrieval. In the later part of this article, we demonstrate a template attack on Curve1174 where the double-and-add always algorithm implementation is free from conditional branching on the secret scalar. In that case, we target the data-dependent branching based on the modular reduction operations of long integer multiplications. Such implementations still exist in open source software and can be vulnerable, even if top level safeguards like blinding are used. We provide experimental results on scalar splitting, scalar randomization, and point blinding to show that the secret scalar can be correctly recovered with high confidence. Finally, we conclude with recommendations on countermeasures to thwart such attacks.||URI:||https://hdl.handle.net/10356/147416||ISSN:||1557-9956||DOI:||10.1109/TC.2019.2958611||Rights:||© 2020 Institute of Electrical and Electronics Engineers (IEEE). All rights reserved.||Fulltext Permission:||none||Fulltext Availability:||No Fulltext|
|Appears in Collections:||TL Journal Articles|
Updated on Sep 17, 2021
Items in DR-NTU are protected by copyright, with all rights reserved, unless otherwise indicated.