Scott Fluhrer edited untitled.tex  almost 9 years ago

Commit id: d725b0a8cc3424b620038423e94302cb9bd2a8ec

deletions | additions      

       

To combat these sorts of attacks, one of the strategies that need to be employed is blinding; we include random data in our computations, and while the end results is independent of the random value, the intermediate values are strongly dependent, and thus the correlations between the internal states and anything that the attacker wants (such as the private key) is much weaker.  One such method of blinding Elliptic Curve calculations (first published by Coron\cite{Coron_1999}) took advantage of a property of Elliptic Curve groups; we know an integer $n$ such that $nG = 0$); 0$ (this value $n$ is known as the order of the point $G$).  Coron's method to compute $kG$ would be to select a random value $r$ and computing first $nr+k$, and then $(nr + k)G$. Everytime we would perform a point multiplication, we would select a random $r$, and hence the bits of the integer we're giving to the point multiplication logic is are  independent of the  integer $k$ we're actually multiplying by. However, for special form primes, this turns out not to work. If order of the curve is within the Hasse Interval; that is, we have:  $$| p - hn | < 2\sqrt{p}$$  where $h$ is the cofactor of the curve, and is usually a small power of 2.  - Side channel attacks  - Scalar randomizatoin