Analysis of the Fault Attack ECDLP over Prime Field

Algorithm 2

Basic fault attack on ECSM algorithm.

Input:  𝐸_𝐴 and 𝑃=(𝑥_𝑃,𝑦_𝑃)∈𝐸_𝐴(𝔽_𝑝),𝑄=(𝑥_𝑄,𝑦_𝑄)=𝑘𝑃,

𝑤 is a parameter to be chosen later and 𝑞 is the order of point 𝑃.

Output: Scalar 𝑘 partially with a probability.

(1) Randomly choose 𝑥𝑃𝑃,𝑦∈𝔽_𝑝.

    (1.1) 𝐵←𝑦²𝑃−𝑥³𝑃−𝐴𝑥²𝑃.

(2) 𝑃𝑃𝑃←(𝑥,𝑦).

    (2.1) Obtain 𝑛=ord(𝑃) in elliptic curve 𝐸_𝐴,𝐵(𝔽_𝑝).

    (2.2) Choose an integer 1<𝑑<ord(𝑃), compute 𝑑𝑃.

(3) Apply decryption oracle to compute 𝑥_𝑘𝑑𝑃.

    (3.1) 𝑦_𝑘𝑑𝑃←𝑥³_𝑘𝑑𝑃+𝐴𝑥²_𝑘𝑑𝑃+𝐵.

(4) If all the prime factors of 𝑛 are smaller than 𝑤, then

    (4.1) Utilize Algorithm 2 with (𝑑𝑃,𝑘𝑑𝑃,𝑛) to obtain 𝑘mod𝑛.

(5) Return (𝑘mod𝑛)