Cryptographic scheme with fault injection attack countermeasure
A system, method and elliptic curve cryptography scheme having a fault injection attack resistant protocol. The cryptographic scheme has a first arithmetic operation having at least one of a single input bit, a single output bit, or a single output bit-string that is vulnerable to a fault injection attack. The protocol includes: performing a first arithmetic operation to determine a first output; performing a second arithmetic operation to determine a second output, the second arithmetic operation being a variant of the first arithmetic operation; and comparing the first output and the second output, and if the comparison is incompatible, outputting an invalidity condition, otherwise, outputting the first output.
1. A fault-injection attack resistant protocol for an asymmetric cryptographic scheme, the cryptographic scheme for permitting secure communications between two or more cryptographic correspondent devices, each of the cryptographic correspondent devices comprising a micro-processor and a memory, the memory configured to store a plurality of instructions which when executed by the micro-processor cause the micro-processor to implement the cryptographic scheme, the cryptographic scheme comprising a first arithmetic operation having at least one of a single input bit, a single output bit, or a single output bit-string that is vulnerable to a fault injection attack, the protocol comprising:
executing, by the micro-processor, the first arithmetic operation in pure projective coordinates, using pure Jacobian projective coordinates as input, to determine a first output;
executing, by the micro-processor, a second arithmetic operation in mixed projective coordinates, using affine coordinates and Jacobian projective coordinates as input, to determine a second output, the second arithmetic operation returns an inverse of the first arithmetic operation where the first arithmetic operation has a single output bit or a single output bit-string and the second arithmetic operation takes an inverse input bit of the first arithmetic operation where the first arithmetic operation has a single input bit; and
executing a comparison, by the micro-processor, to compare the first output and the second output, and if the first output and the second output are the same, outputting an invalidity condition to cease secure communications between the cryptographic correspondent devices, otherwise, outputting the first output for an operation of the cryptographic scheme.
2. The protocol of claim 1 , wherein the first arithmetic operation is in pure projective coordinates and the second arithmetic operation is in mixed projective coordinates.
3. The protocol of claim 1 , wherein an input bit of the second arithmetic operation is an inversion of the input bit of the first arithmetic operation and wherein the comparison also outputs an invalidity condition if the first output and the second output are the same.
4. The protocol of claim 1 , wherein if the first output and the second output are not the same, a valid condition is outputted.
5. The protocol of claim 1 , wherein the first arithmetic operation and the second arithmetic operation are performed in constant-time.
6. The protocol of claim 1 , wherein the protocol is incorporated into another cryptographic operation of the cryptographic scheme.
7. The protocol of claim 6 , wherein the protocol is incorporated into at least one of a checking for equality operation, a checking for zero operation, a checking for unity operation, a checking if a variable is a set operation, a checking if a variable is a power of two operation, a conditional variable swapping operation, a conditional variable copying operation, or a cryptographic signature verification operation.
8. The protocol of claim 1 , wherein the asymmetric cryptographic scheme is an elliptic-curve cryptographic scheme.