椭圆曲线密码ML算法电路实现的功耗攻击  

Implementation of power attack analysis in ML algorithm circuit with elliptic curve cryptosystems

作　　者：韩煜[1] 邹雪城[1] 刘政林[1] 但永平[1] 

机构地区：[1]华中科技大学电子科学与技术系,湖北武汉430074

出　　处：《华中科技大学学报（自然科学版）》2009年第2期21-24,共4页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：教育部2007新世纪优秀人才支持计划资助项目(NCET-07-0328);国家高技术研究发展计划资助项目(2006AA01Z226);湖北省自然科学基金资助项目(2006ABA080)

摘　　要：针对有限域GF(2163)上椭圆曲线密码(ECC)的ML算法电路,实现了一种简单有效的差分功耗分析(DPA)方法.该方法结合单密钥多数据攻击,按密钥比特对功耗轨迹分段差分运算.基于功耗仿真的实验结果表明:仅对单条功耗曲线进行差分分析就能够以极短的时间恢复出密钥比特,从而证明ECC的ML算法实现只具备抗时间攻击和抗简单功耗分析攻击效果,却不能对抗DPA攻击.Power leakages of the Montgomery Ladder （ML） algorithm circuit implementation for elliptic curve cryptosystems over GF（2163） were studied. A simple and effective differential power analysis （DPA） attack was considered. Single-exponent multiple-data （SEMD） was referred. The attack differentiates power traces to multiple subsections according to each key bit. Based on United Microelectronics Corporation （UMC） 0.25 μm, 1.8 V technology library, a simulation-based circuit implementation and experimental platform were built to evaluate the effectiveness of the new attack. Experimental results show that the secret key could be retrieved rapidly using only one power sample. It is concluded that Montgomery Ladder implementation is immune to timing analysis and simple power analysis （SPA） attacks, but still vulnerable to DPA attacks.

关 键 词：椭圆曲线密码 ML算法 功耗攻击 差分功耗分析 单密钥多数据 

分 类 号：TN409[电子电信—微电子学与固体电子学]