Method and apparatus for generating a public key in a manner that counters power analysis attacks
A public key for an Elliptic Curve Cryptosystem is generated in a manner that acts as a countermeasure to power analysis attacks. In particular, a known scalar multiplication method is enhanced by, in one aspect, performing a right shift on the private key. The fixed-sequence window method includes creation and handling of a translated private key. Conveniently, as a result of the right shift, the handling of the translated private key is made easier and more efficient.
1. A method, for being performed by a computer system, of publishing a public key Q for an Elliptic Curve Cryptosystem given a private key k, a base point P and a window size w, said method for countering power analysis attacks, said method comprising:
defining a table of odd multiples of said base point;
shifting said private key right to create a shifted private key;
translating said shifted private key to a base 2 w , thereby forming a translated, shifted key;
determining, based on said translated, shifted key and said table, an initial value for a scalar multiplication of said private key k and said base point P;
determining, based on said translated, shifted key and said table, a final value for said scalar multiplication, said determining said final value including:
determining that said private key k is even; and
upon determining that said private key k is even, subtracting said base point P from said final value; and
publishing said final value for said scalar multiplication as said public key.
2. The method of claim 1 wherein said translated, shifted key includes a plurality of digits and wherein said determining said initial value comprises:
determining a sum of 2 w−1 and a most significant digit of said plurality of digits; and
assigning, to said initial value for said scalar multiplication, a value in an element of said table indexed by said sum.
3. The method of claim 2 wherein said determining said final value for said scalar multiplication comprises:
for each digit of said plurality of digits, other than said most significant digit:
doubling a current value for said scalar multiplication a number of times equivalent to said window size to form an interim product;
assigning said interim product to said current value for said scalar multiplication;
determining an interim sum of said current value for said scalar multiplication and a value in an element of said table indexed by said each digit; and
assigning said interim sum to said current value for said scalar multiplication;
when a value in an element of said table indexed by a least significant digit has been used in said determining said interim sum, assigning said current value for said scalar multiplication to said final value for said scalar multiplication.
4. The method of claim 1 wherein said odd multiples of said base point P range from −(2 w −1)P to (2 w −1)P.
5. A mobile communication device comprising:
a memory storing a private key k, a base point P and a window size w;
a processor, coupled to said memory, said processor configured to:
define a table of odd multiples of said base point;
shift said private key right to create a shifted private key;
translate said shifted private key to a base 2 w , thereby forming a translated, shifted key;
determine, based on said translated, shifted key and said table, an initial value for a scalar multiplication of said private key k and said base point P;
determine, based on said translated, shifted key and said table, a final value for said scalar multiplication, wherein, to determining said final value said processor is configured to:
determine that said private key k is even; and
subtract said base point P from said final value; and
publish said final value for said scalar multiplication as a public key Q for an Elliptic Curve Cryptosystem.
6. The mobile communication device of claim 5 wherein said translated, shifted key includes a plurality of digits and wherein, to determine said initial value, said processor is further configured to:
determine a sum of a most significant digit of said plurality of digits and 2 w−1 ; and
assign, to said initial value for said scalar multiplication, a value in an element of said table indexed by said sum.
7. The mobile communication device of claim 6 wherein, to determine said final value for said scalar multiplication, said processor is further configured to:
for each digit of said plurality of digits, other than said most significant digit:
double a current value for said scalar multiplication a number of times equivalent to said window size to form an interim product;
assign said interim product to said current value for said scalar multiplication;
determine an interim sum of said current value for said scalar multiplication and a value in an element of said table indexed by said each digit; and
assign said interim sum to said current value for said scalar multiplication;
when a value in an element of said table indexed by a least significant digit has been used in said determining said interim sum, assign said current value for said scalar multiplication to said final value for said scalar multiplication.
8. The mobile communication device of claim 5 wherein said odd multiples of said base point P range from −(2 w −1)P to (2 w −1)P.
9. A computer readable medium containing computer-executable instructions that, when performed by a processor given a private key k, a base point P and a window size w, cause said processor to:
define a table of odd multiples of said base point;
shift said private key right to create a shifted private key;
translate said shifted private key to a base 2 w , thereby forming a translated, shifted key;
determine, based on said translated, shifted key and said table, an initial value for a scalar multiplication of said private key k and said base point P;
determine, based on said translated, shifted key and said table, a final value for said scalar multiplication, wherein, to determining said final value, said instructions cause said processor to:
determine that said private key k is even; and
subtract said base point P from said final value; and
publish said final value for said scalar multiplication as a public key Q for an Elliptic Curve Cryptosystem.
10. The computer readable medium of claim 9 wherein said translated, shifted key includes a plurality of digits and wherein, to determine said initial value, said computer-executable instructions further cause said processor to:
determine a sum of a most significant digit of said plurality of digits and 2 w−1 ; and
assign, to said initial value for said scalar multiplication, a value in an element of said table indexed by said sum.
11. The computer readable medium of claim 9 wherein, to determine said final value for said scalar multiplication, said computer-executable instructions further cause said processor to:
for each digit of said plurality of digits, other than said most significant digit:
double a current value for said scalar multiplication a number of times equivalent to said window size to form an interim product;
assign said interim product to said current value for said scalar multiplication;
determine an interim sum of said current value for said scalar multiplication and a value in an element of said table indexed by said each digit; and
assign said interim sum to said current value for said scalar multiplication;
when a value in an element of said table indexed by a least significant digit has been used in said determining said interim sum, assign said current value for said scalar multiplication to said final value for said scalar multiplication.
12. The computer readable medium of claim 9 wherein said odd multiples of said base point P range from −(2 w −1)P to (2 w −1)P.
13. A method, for being performed by a computer system, of countering power analysis attacks on an operation to determine an elliptic curve scalar multiplication product of a scalar and a base point on an elliptic curve, said base point having a prime order, said method comprising:
defining a table of odd multiples of said base point;
shifting said scalar right to create a shifted scalar;
translating said shifted scalar to a base 2 w , where w is a window size, thereby forming a translated, shifted scalar;
determining, based on said translated, shifted key and said table, an initial value for a scalar multiplication of said scalar and said base point, said determining said final value including:
determining that said private key k is even; and
upon determining that said private key k is even, subtracting said base point P from said final value; and
determining, based on said translated, shifted scalar and said table, a final value for said scalar multiplication product.