The Carry Leakage on the Randomized Exponent

Niveau: Supérieures
The Carry Leakage on the Randomized Exponent Countermeasure Pierre-Alain Fouque 1 , Denis Real 2;3 , Frederi Valette 2 , and Mhamed Drissi 3 1 E ole normale superieure/CNRS/INRIA, 75 Paris, Fran e Pierre-Alain.Fouqueens.fr 2 CELAR, 35 Bruz, Fran e fDenis.Real;Frederi .Valettegdga.defense.gouv.fr 3 INSA-IETR, 20 avenue des oesmes, 35043 Rennes, Fran e fDenis.Real;Mhamed.Drissiginsa-rennes.fr Abstra t. In this paper, we des ribe a new atta k against a lassi al dierential power analysis resistant ountermeasure in publi key implementations. This ountermeasure has been suggested by Coron sin e 1999 and is known as the exponent randomization. Here, we show that even though the binary exponentiation, or the s alar produ t on ellip- ti urves implementation, does not leak information on the se ret key, the omputation of the randomized se ret exponent, or s alar, an leak useful information for an atta ker. Su h part of the algorithm an be not well-prote ted sin e its goal is to avoid atta k during the exponentiation. Consequently, our atta k an be mounted against any kind of exponentiation, even very resistant as soon as the exponent randomization ounter- measure is used.

• prote ted


• bit


• against spa


• has been


• against very


• ted sin


• exponent randomization


• dpa atta