Analysis of the Fault Attack ECDLP over Prime Field

Algorithm 1

Silver-Pohlig-Hellman algorithm for solving the ECDLP.

Input:  𝑃∈𝐸(𝔽_𝑝), 𝑄∈⟨𝑃⟩, 𝑛=∏^𝑗−1_𝑖=0𝑝^𝑒𝑖_𝑖, where 𝑝_𝑖<𝑝_𝑖+1, 𝑖=0,…,𝑗−2.

Output:  𝑘mod𝑛.

 (1) For 𝑖=0 to 𝑗−1 do

     (1.1) 𝑄^′←𝒪, 𝑘_𝑖←0.

     (1.2) 𝑃_𝑖←(𝑛/𝑝_𝑖)𝑃.

     (1.3) For 𝑡=0 to (𝑒_𝑖−1) do

         (1.3.1) 𝑄_𝑡,𝑖←(𝑛/𝑝_𝑖^𝑡+1)(𝑄+𝑄^′).

         (1.3.2) 𝑊_𝑡,𝑖←log_𝑃𝑖𝑄_𝑡,𝑖.{ECDLP in a subgroup of order ord(𝑃_𝑖).}

         (1.3.3) 𝑄^′←𝑄^′−𝑊_𝑡,𝑖𝑝^𝑡_𝑖𝑃.

         (1.3.4) 𝑘_𝑖←𝑘_𝑖+𝑝^𝑡_𝑖𝑊_𝑡,𝑖.

 (2) Use the CRT to solve the system of congruences 𝑘≡𝑘_𝑖mod𝑝^𝑒𝑖_𝑖.

     This gives us 𝑘mod𝑛

 (3) Return (𝑘)