CN104917608A - Key anti-power attack method - Google Patents
Key anti-power attack method Download PDFInfo
- Publication number
- CN104917608A CN104917608A CN201510256515.2A CN201510256515A CN104917608A CN 104917608 A CN104917608 A CN 104917608A CN 201510256515 A CN201510256515 A CN 201510256515A CN 104917608 A CN104917608 A CN 104917608A
- Authority
- CN
- China
- Prior art keywords
- variable
- scalar multiplication
- previous cycle
- atomic block
- point
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Landscapes
- Storage Device Security (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The invention discloses a key anti-power attack method. The method includes the step that a preset atomic block is utilized to perform point multiplying and/or point adding operation in scalar multiplication, wherein the preset atomic block contains modular multiplication operation, addition operation and subtraction operation. According to the method, the concept of the atomic algorithm is combined with the characteristics of a public key cryptographic algorithm, and therefore, the procedures of point adding operation and point multiplying operation can be optimized; an corresponding variables are adopted to control the internal loop of the scalar multiplication, and the scalar multiplication is converted to a modular multiplication-addition-subtraction atomic block loop. With the method of the invention adopted, computation burden required by the scalar multiplication can be greatly decreased, and the security of keys can be ensured, and the computation speed of the public key cryptographic algorithm can be improved.
Description
Technical field
The present invention relates to field of information security technology, specifically, relate to the method for the anti-power consumption attack of a kind of key.
Background technology
Power consumption attack is that a kind of power consumption of equipment in cryptographic algorithm computational process that utilizes leaks the side-channel attack mode obtaining key.As shown in Figure 1, the power consumption of crypto chip and the instruction and data of algorithm operating closely related, this is also just for power consumption attack provides possibility.Power consumption attack mainly comprises two class power consumption analysis, i.e. simple power consumption analysis (SPA) and differential power consumption analysis (DPA).In SPA process, assailant, by observing the power consumption profile of ciphering process, infers the operation that different time is corresponding, thus Extraction parts or all key.In DPA process, assailant then mainly utilizes the relationship analysis of power consumption and intermediate variable to recover key.
1985, N.Koblitz and V.Miller proposed elliptic curve cryptosystem (ECC) independently of one another.Compare conventional public-key cryptographic algorithm, ECC has that fail safe is high, computational speed is fast, memory space is little, bandwidth requirement is low, calculating parameter is few and the plurality of advantages such as short and small of signing, and it is particularly outstanding in the system of restriction resource.
On December 17th, 2010, for meeting the application demands such as digital certificate service system, national Password Management office has issued SM2 ellipse curve public key cipher algorithm.At present, SM2 algorithm is applied in intelligent card chip more, and power consumption attack has less cipher key search space and higher analysis efficiency, forms very large threat to intelligent card chip fail safe.Along with SM2 algorithm the applying of financial field at home, anti-power consumption attack ability when research SM2 algorithm chip realizes, has great significance to the safety improving China's Financial field.
Summary of the invention
For solving the problem, the invention provides the method for the anti-power consumption attack of a kind of key, described method comprises:
Utilize default atomic block carry out the doubly point in scalar multiplication and/or put add operation, wherein, described default atomic block comprises modular multiplication, add operation and subtraction operation.
According to one embodiment of present invention, described default atomic block comprises a modular multiplication, an add operation and a subtraction operation.
According to one embodiment of present invention, described default atomic block is:
Wherein, Γ is default atomic block,
represent the element of the capable q row of p in register index matrix, R represents register.
According to one embodiment of present invention,
When the some P carrying out scalar multiplication operation is fixing point, the dimension of the register index matrix of described default atomic block is 19 × 9;
When the some P carrying out scalar multiplication operation is on-fixed point, the dimension of the register index matrix of described default atomic block is 24 × 9.
According to one embodiment of present invention, carry out, in the process of key related operations, comprising in the step of carrying out scalar multiplication operation:
According to variable a and the variable p of last circulation, calculate the variable p of previous cycle;
According to variable b
iwith the variable p of previous cycle, calculate the variable a of previous cycle;
According to variable p and the register index matrix of previous cycle, perform the operation preset in atomic block;
Variable i of next circulation is calculated according to the variable i of previous cycle and variable a;
Judge whether next variable i circulated is more than or equal to 0, if so, then repeat above process, otherwise obtain scalar multiplication operating result according to the execution result of default atomic block.
According to one embodiment of present invention, in the process of carrying out scalar multiplication operation, when the some P carrying out scalar multiplication operation is fixing point, calculate variable p and the variable a of previous cycle according to following expression:
Wherein, b
irepresent the value of i-th of the binary number corresponding to integer b.
According to one embodiment of present invention, in the process of carrying out scalar multiplication operation, when the some P carrying out scalar multiplication operation is on-fixed point, calculate variable p and the variable a of previous cycle according to following expression:
Wherein, b
irepresent the value of i-th of the binary number corresponding to integer b.
According to one embodiment of present invention, when the some P carrying out scalar multiplication operation is on-fixed point, the process of carrying out scalar multiplication operation comprises:
According to variable a and the variable p of last circulation, calculate the variable p of previous cycle;
According to variable b
iwith the variable p of previous cycle, calculate the variable a of previous cycle;
If variable j is in the first preset range, then circulate execution:
According to variable p and the register index matrix of previous cycle, perform the operation preset in atomic block;
Variable j is added 1 and enters next circulation;
Variable i of next circulation is calculated according to the variable i of previous cycle and variable a;
Judge whether next variable i circulated is more than or equal to 0, if so, then repeat above process, otherwise obtain scalar multiplication operating result according to the operating result of default atomic block.
According to one embodiment of present invention, in the process of carrying out scalar multiplication operation, when the some P carrying out scalar multiplication operation is on-fixed point, calculate variable p and the variable a of previous cycle according to following expression:
Wherein, b
irepresent the value of i-th of the binary number corresponding to integer b.
According to one embodiment of present invention, in the process generating digital signature, described method generates the variable s in digital signature according to following expression:
s＝[(1+d
A)
-1·(k+r)-r]modn
Wherein, d
athe private key of user A, r represents known variables, and k represents random number, and n represents the rank of basic point.
According to one embodiment of present invention, if the s generated equals 0, then regenerate new random number, and based on described new generating random number s.
According to one embodiment of present invention, the step of the variable r generated in digital signature comprises:
By message M to be signed and the first Hash Value Z
asplicing, combining cipher hash function H
vgenerate variable e;
The k times of point of basic point G on elliptic curve is determined according to random number x;
According to the k times of point of variable e and basic point G, generate the variable r in digital signature.
Atomic arithmetic concept combines with the particularity of SM2 by the anti-power consumption attack method of key provided by the present invention, optimize the flow process of an add operation and doubly point operation, control the inner loop of scalar multiplication by introducing relevant variable, scalar multiplication is converted to the atomic block circulation that mould takes advantage of-Jia-be kept to a group.
Compare existing Atomic arithmetic, method provided by the present invention makes each atomic block operate and saves process of once negating, and register index matrix is optimized for 19 × 9 or 24 × 9 rank by 26 × 10 rank.So also just greatly save the operand required for scalar multiplication, not only ensure that the fail safe of key, also improve the arithmetic speed of SM2 algorithm.
Meanwhile, the expression formula that method provided by the present invention adopts when generating variable s also no longer contains pregnable multiplier rd
a, therefore also just can improve the anti-power consumption attack of key further.In addition, method provided by the present invention only containing once to invert and a mould is taken advantage of when generating variable s, generates the process of s, The method reduces a mould and take advantage of, so not only achieve anti-power consumption attack, also improve service speed in primal algorithm.
Other features and advantages of the present invention will be set forth in the following description, and, partly become apparent from specification, or understand by implementing the present invention.Object of the present invention and other advantages realize by structure specifically noted in specification, claims and accompanying drawing and obtain.
Accompanying drawing explanation
In order to be illustrated more clearly in the embodiment of the present invention or technical scheme of the prior art, do simple introduction by accompanying drawing required in embodiment or description of the prior art below:
Fig. 1 is the schematic diagram of existing SM2 power consumption attack;
Fig. 2 is the flow chart of existing scalar multiplication operation;
Fig. 3 is the flow chart of scalar multiplication operation according to an embodiment of the invention;
Fig. 4 is the flow chart of scalar multiplication operation according to an embodiment of the invention;
Fig. 5 is the flow chart generating digital signature (r, s) according to an embodiment of the invention.
Embodiment
Describe embodiments of the present invention in detail below with reference to drawings and Examples, to the present invention, how application technology means solve technical problem whereby, and the implementation procedure reaching technique effect can fully understand and implement according to this.It should be noted that, only otherwise form conflict, each embodiment in the present invention and each feature in each embodiment can be combined with each other, and the technical scheme formed is all within protection scope of the present invention.
Meanwhile, in the following description, many details have been set forth for illustrative purposes, to provide thorough understanding of embodiments of the invention.But, it will be apparent to those skilled in the art that the present invention can detail here or described ad hoc fashion implement.
In addition, can perform in the computer system of such as one group of computer executable instructions in the step shown in the flow chart of accompanying drawing, and, although show logical order in flow charts, but in some cases, can be different from the step shown or described by order execution herein.
The processes such as digital signature generation, digital signature authentication, public key encryption, public key decryptions and cipher key exchange operations are generally included in public key algorithm (such as SM2 algorithm); and in aforesaid operations process, usually there will be scalar multiplication operation, scalar multiplication is by repeatedly doubly point and some add operation form.
The principle of side channel Atomic arithmetic is that the middle flow process (such as putting add operation and times point operation) operated by cryptographic algorithm is expressed as atomic structure, make the atomic block of instructions that in algorithm implementation, circular treatment is identical, react on power consumption profile and just present identical change rule, thus successfully resist SPA.Since being proposed first from Atomic arithmetic, the Atomic arithmetic of different structure is proposed in succession.But existing atomic structure is all longer, bulk redundancy operation need be added.
For the above-mentioned problems in the prior art, present embodiments provide the method for the anti-power consumption attack of a kind of new key, in the method, utilize default atomic block to carry out scalar multiplication operation, wherein, default atomic block comprises modular multiplication, add operation and subtraction operation.Preferably, a modular multiplication, an add operation and/or a subtraction operation is all comprised in each default atomic block that the present embodiment provides.
As shown in Figure 2, in traditional scalar multiplication calculating process according to b
idifference (b
irepresent the value of i-th of the binary number corresponding to integer b) perform different instructions.For the binary number corresponding to integer b, judge present bit b
ibe whether before 0, first perform 2 times of point operations and (namely perform P
0← 2P
0, namely by 2P
0assignment is to P
0), judge present bit b subsequently
iwhether be 0.
If present bit b
ibe 0, then direct binary number corresponding to integer b moved to right one (namely performing i ← i-1), and continue to perform next circulation.If present bit b
ibe not 0 (i.e. present bit b
ibe 1), then after execution point add operation, the binary number corresponding to integer b is moved to right one (namely performing i ← i-1), continue subsequently to perform next circulation.
This shows, traditional Method for Scalar Multiplication is according to judging b
idetermine whether execution point add operation, and doubly put different from putting the power consumption adding consumption, assailant just can utilize this characteristic to carry out simple power consumption attack SPA to key, judges that doubly some point adds order, thus infer the private key user by observing power consumption.
Atomic arithmetic then by doubly with point add the atomic block being all expressed as same form, make the atomic block of instructions that in algorithm implementation, circular treatment is identical, react on power consumption profile and just present identical change rule, thus successfully resist SPA.
The Atomic arithmetic of existing multiple different structure is proposed in succession at present, finds that its atomic structure is all longer, need add bulk redundancy computing through statistics.The method of the anti-power consumption attack of the key that the present embodiment provides adopts the unified default atomic block optimized to carry out times point operation and some add operation.
In the present embodiment, introduce the change that variable a controls variable i in atomic block implementation.Because point adds different from the default atomic block number of times doubly performed by point operation, and execution point add operation still performs a times point operation is by b
idetermine.Therefore, in the present embodiment, utilize b
idetermine variable a.Particularly, when variable a equals 1, i moves to right one, and jumps into times point next time; If when variable a is not equal to 1 (namely a equals 0), still an add operation or doubly point operation inside perform the operation of corresponding atomic block and do not jump out.In the present embodiment, introduce the register index matrix that variable p controls to choose
in line number.Wherein,
represent the element of the capable q row of p in register index matrix.
Particularly, in the present embodiment, presetting atomic block Γ can be expressed as:
Wherein,
represent the element of the capable q row of p in register index matrix, R represents register.In expression formula (1),
represent register
value be multiplied by register
value after be assigned to register
Fig. 3 shows the flow chart carrying out scalar multiplication operation in the present embodiment.
As shown in Figure 3, in the present embodiment, when carrying out scalar multiplication operation, according to the variable a of last circulation and variable p in step S301, calculate the variable p of previous cycle.And in step s 302 according to according to variable b
iwith the variable p of previous cycle, calculate the variable a of previous cycle.
Particularly, in the present embodiment, in the process of carrying out scalar multiplication operation, when the some P carrying out scalar multiplication operation is fixing point, calculate the variable p of previous cycle and the variable a of previous cycle according to following expression:
Wherein, b
irepresent the value of i-th of the binary number corresponding to integer b.
In the present embodiment, the value of variable a is 0 or 1,
represent the value negate of variable a.That is, when variable a value is 1,
value be 0; When variable a value is 0,
value be 1.
represent by add with the variable p of last circulation after the variable a negate of last circulation the value after 1 carry out product after assignment to the variable p of previous cycle.
In the present embodiment, when the some P carrying out scalar multiplication operation is fixing point, register index matrix
have employed the matrix that dimension is 19 × 9.Particularly, this register index matrix
can be expressed as:
In step S303, the variable p of the previous cycle obtained according to step S301 and register following table matrix perform the associative operation in default atomic block.In step s 304, variable i of next circulation is calculated according to the variable i of previous cycle and variable a.After the variable i obtaining next circulation, can judge in step S305 whether the variable i of next obtained circulation is more than or equal to 0.If the variable i that step S304 obtains is more than or equal to 0, then enters next circulation (by next circulation as previous cycle) and return step S301; Otherwise jump out circulation, and the result data that the data obtained by step S304 operate as scalar multiplication.
In the present embodiment, when the b calculating fixing point P doubly puts, the initial value of i is set to m-2 (m represents the figure place that b comprises when being converted to binary system), the initial value of a is set to 1.The key anti-power consumption attack side ratio juris provided in order to elaboration the present embodiment clearly and advantage, be described for the 2 times of points calculating fixing point P below.
When calculating 2 times of points (namely b is 2) of fixing point P, the initial value of i is 0, and the initial value of a is set to 1.Like this, according to above-mentioned register index matrix
the process calculating 2 times of points of fixing point P can adopt table 1 to be expressed as follows:
Table 1
In Table 1, not specifiedly in each default atomic block redundant operation is operating as.As can be seen from Table 1, P (X
1, Y
1, Z
1) 2 times of some P'(X
2, Y
2, Z
2) can try to achieve by performing 8 default atomic block.
When being fixed a P (X
1, Y
1, Z
1) and some Q (X
2, Y
2, Z
2) some add operation time, the initial value of i is 0, and the initial value of a is set to 1.Like this, according to above-mentioned register index matrix
the process calculating 2 times of points of fixing point P can adopt table 2 to be expressed as follows:
Table 2
In table 2, not specifiedly in each default atomic block redundant operation is operating as.As can be seen from Table 2, P (X is put
1, Y
1, Z
1) can try to achieve by performing 11 default atomic block with the some add operation of putting Q.
As can be seen here, in the method that the present embodiment provides, in the process of carrying out scalar multiplication operation, no matter carry out an add operation or carry out a times point operation, its process is all perform according to register index matrix circular the corresponding operating preset in atomic block.So not only make key related operations process effectively can resist power consumption attack, also shorten the atomic block length in conventional atom block method and decrease the cycle-index of atomic block.
The default atomic block that the present embodiment provides is that mould takes advantage of-addition-subtraction (MUL-ADD-SUB) structure, because SM2 carries out based on the elliptic curve customized, therefore utilizes this default atomic block can simplify more doubly and puts the calculation process adding centre.Meanwhile, namely the sequential transformations utilizing this default atomic block can also realize pilot process divides into groups, and in addition, can also add pseudo-operation, thus heightens the anti-power consumption attack of password further.
In the present embodiment, in the process of carrying out scalar multiplication operation, when the some P carrying out scalar multiplication operation is on-fixed point, calculate the variable p of previous cycle and the variable a of previous cycle according to following expression:
Now, register index matrix
have employed the matrix that dimension is 24 × 9.Particularly, this register index matrix
for:
When a P is on-fixed point, need execution 8 subatom block operations when carrying out times point operation, carrying out an added-time needs execution 16 subatom block operations.Due to 16 and 8 be 8 multiple, therefore in one embodiment of the invention, can also adopt circulation nested inside one-period be 8 for circulation mode to carry out scalar multiplication operation.Now, using for circulation as new atomic block Γ ', by the change of variable p and a control i.Work as b
ia Γ ' is performed when being 0; Work as b
ithree Γ ' are performed when being 1.That is, doubly put execution Γ ', point adds execution twice Γ '.Like this, just on the basis that there is same security with said method, further reduce the number of times calculating variable p, a and i, also just further increase the efficiency of the associative operation (generation of such as digital signature, the checking etc. of digital signature) of public key cryptography.
Particularly, as shown in Figure 4, in the present embodiment, when carry out more doubly or some add operation some P be on-fixed point time, carrying out more doubly and/or putting in the process of add operation, first in step S401 according to the variable a (initial value of variable a is 1) of last circulation and variable p, calculate the variable p of previous cycle, and according to variable b in step S402
iwith the variable p of previous cycle, calculate the variable a of previous cycle.
In the present embodiment, calculate the variable k of previous cycle and the variable a of previous cycle according to following expression:
Subsequently, in step S403, according to variable p and the register index matrix of previous cycle, perform the operation preset in atomic block.Now, default atomic block is expressed as:
In step s 404, the value of variable j is added 1, i.e. j ← j+1.In step S405, judge that the value of this variations per hour j is whether in the first preset range subsequently.In the present embodiment, whether the value of judgment variable j namely judges in the first preset range whether j ∈ [0,7] sets up.If the value of variable j is in the first preset range, then returns step S403 and carry out next circulation new; Otherwise in step S406, the variable i of next circulation is calculated according to the variable i of previous cycle and variable a.
In the present embodiment, calculate the variable i of next circulation according to following expression:
i←i-a (11)
Judge whether next variable i circulated is more than or equal to 0 subsequently in step s 507, if so, then enter next and be cycled to repeat above process; Otherwise just can determine corresponding scalar multiplication result according to the result of the corresponding register obtained in step S403.
As can be seen from foregoing description, Atomic arithmetic concept combines with the particularity of SM2 by the anti-power consumption attack method of key provided by the present invention, optimize an add operation and doubly point operation equiscalar take advantage of the flow process of operation, control the inner loop of scalar multiplication by introducing relevant variable, scalar multiplication is converted to the atomic block circulation that mould takes advantage of-Jia-be kept to a group.
Compare existing Atomic arithmetic, method provided by the present invention makes each atomic block operate and saves process of once negating, and register index matrix is optimized for 19 × 9 or 24 × 9 rank by 26 × 10 rank.So also just greatly save the operand required for scalar multiplication, not only ensure that the fail safe of key, also improve the arithmetic speed of SM2 algorithm.
In existing SM2 endorsement method, generate in the process of digital signature and need to calculate s according to following expression:
s＝[(1+d
A)
-1·(k-r·d
A)]mod n (12)
Wherein, d
arepresent the private key of user A, r represents known variables, and k represents random number, and n represents the rank of basic point.
As can be seen from expression formula (12), in existing SM2 signature algorithm, when generating the s in digital signature (r, s), need to perform mould and take advantage of rd
a.And large digital-to-analogue is taken advantage of and will be related to a large amount of intermediate data, assailant also just can release and known variables d according to known variables r is counter
arelevant intermediate data, then just can determine private key d by the correlation analyzed between power consumption and intermediate data
a, this is differential power attack DPA.
The essence that this method is attacked is attacked multiplier, and for preventing this attack, someone proposes a kind of safeguard procedures of known variables r being carried out to mask.Particularly, the method, when generating the s in digital signature (r, s), first gets random number rand, calculates the inverse rand' of random number rand under mould n subsequently.Calculate variable t again
1=rrand mod n, and then according to variable t
1calculate variable t
2=t
1d
amod n, finally calculates t=t
2rand'mod n=rd
amod n.
Because rand is random number, each mask is all random, therefore compared to original account form (i.e. t=rd
amod n), the variable r originally determined successfully is covered.The energy ezpenditure so also coming in analog chip with regard to making assailant cannot set up suitable power consumption model, thus opposing is attacked.But this method needs extra generation random number rand, and increase is once inverted and twice mould is taken advantage of, and this needs to pay a high price on operating time and resource consumption.
This is to the above-mentioned problems in the prior art, and the method for the anti-power consumption attack of the key that the present embodiment provides is improved the process generating digital signature (r, s).Particularly, as shown in Figure 5, in the present embodiment, generate digital signature time, first in step S501 by signature information M and the first Hash Value Z
asplicing, forms message
namely have:
In step S502, combining cipher hash function H
vgenerate variable e, namely have:
In the present embodiment, in step S502, the data type conversion of the variable e also expression formula (14) obtained is integer.
In step S503, randomizer is utilized to generate random number k, wherein x ∈ [1, n-1].The k times of point of basic point G on arbitrary elliptical curve is determined subsequently according to random number k.In the present embodiment, utilize and preset the k times of point that atomic block calculates basic point G.Certainly, in other embodiments of the invention, other rational methods can also be utilized to calculate the k times of point (such as adopting existing times of point calculating method etc.) of basic point G, the present invention is not limited thereto.
In step S503, after the k calculating basic point G doubly puts, be also integer by obtaining the data type conversion that k doubly puts.After the k obtaining basic point G doubly puts, in step S504, according to the k times of point of variable e and basic point G, generate the r in digital signature.
Particularly, in the present embodiment, generate the variable r in digital signature according to following expression:
r＝(e+x
1)mod n (15)
Wherein, x
1represent the abscissa that the k of basic point basic point G doubly puts.
In the present embodiment, after generating the r in digital signature, also judge in step S505 r whether equal 0 or r+k whether equal n, as long as meet one of them condition, then return step S503 to regenerate random number k, and regenerate the r in digital signature based on this new random number k.
In step S506, according to the private key d of the variable r obtained, random number k and user A
agenerate the s in digital signature.Although the method that existing employing mask generates s originally can determine that r successfully covers, the method needs additionally to generate random number, and needs increase to invert and mould takes advantage of process, and this also just makes, and the operating time is long, resource consumption is excessive.
By analyzing the method for existing generation s, present embodiments provide a kind of method of generation s newly.Particularly, the method that the present embodiment provides generate s time, by existing calculating s expression formula s=[(1+d
a)
-1(k-rd
a)] mod n is out of shape, make in the expression formula after being out of shape no longer containing pregnable multiplier rd
a.Like this, assailant also just cannot for rd
acarry out differential power attack.
Particularly, in the present embodiment, be two parts by multiplication factorization, utilize (1+d
a-1) d is represented
a, continue factorization, utilize (1+d
a)
-1(1+d
a) ≡ 1 carrys out the above-mentioned factor of cancellation, finally merges the multinomial with same factors, thus obtain with former expression formula equivalence not containing multiplier rd
adistortion expression formula, that is:
In the present embodiment, also judge whether the s generated equals 0 in step s 507.If s equals 0, then return step S503 and regenerate random number k, and utilize new random number k to generate r and s.If s is not equal to 0, is then character string by the data type conversion of r and s of generation in step S508, thus obtains the signature (r, s) of message M.
As can be seen from foregoing description, in the present embodiment, the expression formula adopted when generating s also no longer contains pregnable multiplier rd
a, therefore also just can improve the anti-power consumption attack of key further.Meanwhile, the method that the present embodiment provides only containing once to invert and a mould is taken advantage of when generating s, generates the process of s, The method reduces a mould and take advantage of, so not only achieve anti-power consumption attack, also improve service speed in primal algorithm.
It should be understood that disclosed embodiment of this invention is not limited to treatment step disclosed herein, and the equivalent of these features that those of ordinary skill in the related art understand should be extended to substitute.It is to be further understood that term is only for describing the object of specific embodiment as used herein, and and do not mean that restriction.
Special characteristic, structure or characteristic that " embodiment " mentioned in specification or " embodiment " mean to describe in conjunction with the embodiments comprise at least one embodiment of the present invention.Therefore, specification various places throughout occur phrase " embodiment " or " embodiment " might not all refer to same embodiment.
Conveniently, multiple project and/or component units can appear in common list as used herein.But each element that these lists should be interpreted as in this list is identified as member unique separately respectively.Therefore, when not having reverse side to illustrate, in this list, neither one member only can appear in common list the actual equivalent of other member any being just interpreted as same list based on them.
Although above-mentioned example is for illustration of the principle of the present invention in one or more application, but for a person skilled in the art, when not deviating from principle of the present invention and thought, obviously can in form, the details of usage and enforcement does various amendment and need not creative work be paid.Therefore, the present invention is limited by appending claims.
Claims (12)
1. a method for the anti-power consumption attack of key, is characterized in that, described method comprises:
Utilize default atomic block carry out the doubly point in scalar multiplication and/or put add operation, wherein, described default atomic block comprises modular multiplication, add operation and subtraction operation.
2. the method for claim 1, is characterized in that, described default atomic block comprises a modular multiplication, an add operation and a subtraction operation.
3. method as claimed in claim 1 or 2, it is characterized in that, described default atomic block is:
Wherein, Γ is default atomic block,
represent the element of the capable q row of p in register index matrix, R represents register.
4. method as claimed in claim 3, is characterized in that,
When the some P carrying out scalar multiplication operation is fixing point, the dimension of the register index matrix of described default atomic block is 19 × 9;
When the some P carrying out scalar multiplication operation is on-fixed point, the dimension of the register index matrix of described default atomic block is 24 × 9.
5. the method according to any one of Claims 1 to 4, is characterized in that, carries out, in the process of key related operations, comprising in the step of carrying out scalar multiplication operation:
According to variable a and the variable p of last circulation, calculate the variable p of previous cycle;
According to variable b
iwith the variable p of previous cycle, calculate the variable a of previous cycle;
According to variable p and the register index matrix of previous cycle, perform the operation preset in atomic block;
Variable i of next circulation is calculated according to the variable i of previous cycle and variable a;
Judge whether next variable i circulated is more than or equal to 0, if so, then repeat above process, otherwise obtain scalar multiplication operating result according to the execution result of default atomic block.
6. method as claimed in claim 5, is characterized in that, in the process of carrying out scalar multiplication operation, when the some P carrying out scalar multiplication operation is fixing point, calculates variable p and the variable a of previous cycle according to following expression:
Wherein, b
irepresent the value of i-th of the binary number corresponding to integer b.
7. the method as described in claim 5 or 6, is characterized in that, in the process of carrying out scalar multiplication operation, when the some P carrying out scalar multiplication operation is on-fixed point, calculates variable p and the variable a of previous cycle according to following expression:
Wherein, b
irepresent the value of i-th of the binary number corresponding to integer b.
8. the method according to any one of claim 1 ~ 7, is characterized in that, when the some P carrying out scalar multiplication operation is on-fixed point, the process of carrying out scalar multiplication operation comprises:
According to variable a and the variable p of last circulation, calculate the variable p of previous cycle;
According to variable b
iwith the variable p of previous cycle, calculate the variable a of previous cycle;
If variable j is in the first preset range, then circulate execution:
According to variable p and the register index matrix of previous cycle, perform the operation preset in atomic block;
Variable j is added 1 and enters next circulation;
Variable i of next circulation is calculated according to the variable i of previous cycle and variable a;
Judge whether next variable i circulated is more than or equal to 0, if so, then repeat above process, otherwise obtain scalar multiplication operating result according to the operating result of default atomic block.
9. method as claimed in claim 8, is characterized in that, in the process of carrying out scalar multiplication operation, when the some P carrying out scalar multiplication operation is on-fixed point, calculates variable p and the variable a of previous cycle according to following expression:
Wherein, b
irepresent the value of i-th of the binary number corresponding to integer b.
10. the method according to any one of claim 1 ~ 9, is characterized in that, in the process generating digital signature, described method generates the variable s in digital signature according to following expression:
s＝[(1+d
A)
-1·(k+r)-r]modn
Wherein, d
athe private key of user A, r represents known variables, and k represents random number, and n represents the rank of basic point.
11. methods as claimed in claim 10, is characterized in that, if the s generated equals 0, then regenerate new random number, and based on described new generating random number s.
12. methods as described in claim 10 or 11, is characterized in that, the step generating the variable r in digital signature comprises:
By message M to be signed and the first Hash Value Z
asplicing, combining cipher hash function H
vgenerate variable e;
The k times of point of basic point G on elliptic curve is determined according to random number x;
According to the k times of point of variable e and basic point G, generate the variable r in digital signature.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510256515.2A CN104917608B (en) | 2015-05-19 | 2015-05-19 | A kind of method of the anti-power consumption attack of key |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510256515.2A CN104917608B (en) | 2015-05-19 | 2015-05-19 | A kind of method of the anti-power consumption attack of key |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104917608A true CN104917608A (en) | 2015-09-16 |
| CN104917608B CN104917608B (en) | 2018-04-20 |
Family
ID=54086340
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510256515.2A Active CN104917608B (en) | 2015-05-19 | 2015-05-19 | A kind of method of the anti-power consumption attack of key |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104917608B (en) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106712949A (en) * | 2015-11-12 | 2017-05-24 | 中国科学院声学研究所 | Montgomery-based piecewise scalar multiplication calculation method |
| CN109214195A (en) * | 2018-07-26 | 2019-01-15 | 广东工业大学 | A kind of the SM2 ellipse curve signature sign test hardware system and method for resisting differential power consumption attack |
| CN109600232A (en) * | 2018-12-05 | 2019-04-09 | 北京智慧云测科技有限公司 | For attack verifying, means of defence and the device of SM2 signature algorithm |
| CN110022210A (en) * | 2019-03-28 | 2019-07-16 | 思力科（深圳）电子科技有限公司 | Signature sign test method, signature end and sign test end based on elliptic curve cipher |
| CN111211886A (en) * | 2020-04-20 | 2020-05-29 | 成都信息工程大学 | Energy analysis detection method for SM2 decryption algorithm |
| CN112131616A (en) * | 2020-09-15 | 2020-12-25 | 郑州信大捷安信息技术股份有限公司 | Mask operation method and device for SM2 algorithm |
| CN113225187A (en) * | 2021-04-14 | 2021-08-06 | 中国人民解放军战略支援部队信息工程大学 | Energy attack resisting compensation method and system for elliptic curve crypto chip |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20010002486A1 (en) * | 1998-01-02 | 2001-05-31 | Cryptography Research, Inc. | Leak-resistant cryptographic method and apparatus |
| CN1831754A (en) * | 2005-11-04 | 2006-09-13 | 北京浦奥得数码技术有限公司 | Elliptic curve cipher system and implementing method |
| CN101436929A (en) * | 2008-12-18 | 2009-05-20 | 天津大学 | Dot computation method capable of resisting simple current drain aggression |
| CN101562522A (en) * | 2009-05-06 | 2009-10-21 | 深圳先进技术研究院 | Realization method of elliptic curve cryptosystem for preventing side-channel attack |
-
2015
- 2015-05-19 CN CN201510256515.2A patent/CN104917608B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20010002486A1 (en) * | 1998-01-02 | 2001-05-31 | Cryptography Research, Inc. | Leak-resistant cryptographic method and apparatus |
| CN1831754A (en) * | 2005-11-04 | 2006-09-13 | 北京浦奥得数码技术有限公司 | Elliptic curve cipher system and implementing method |
| CN101436929A (en) * | 2008-12-18 | 2009-05-20 | 天津大学 | Dot computation method capable of resisting simple current drain aggression |
| CN101562522A (en) * | 2009-05-06 | 2009-10-21 | 深圳先进技术研究院 | Realization method of elliptic curve cryptosystem for preventing side-channel attack |
Non-Patent Citations (3)
| Title |
|---|
| BENOIˆT CHEVALLIER-MAMES ET AL.: "《Low-cost solutions for preventing simple side-channel analysis: side-channel atomicity》", 《IEEE TRANSACTIONS ON COMPUTERS》 * |
| XIAOWEI HAN ET AL.: "《Algorithm-Based Countermeasures against Power Analysis Attacks for Public-Key Cryptography SM2》", 《COMPUTATIONAL INTELLIGENCE AND SECURITY (CIS), 2014 TENTH INTERNATIONAL CONFERENCE ON》 * |
| 王宏 等: "《基于边信道原子的椭圆曲线标量乘算法》", 《电子科技》 * |
Cited By (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106712949A (en) * | 2015-11-12 | 2017-05-24 | 中国科学院声学研究所 | Montgomery-based piecewise scalar multiplication calculation method |
| CN109214195A (en) * | 2018-07-26 | 2019-01-15 | 广东工业大学 | A kind of the SM2 ellipse curve signature sign test hardware system and method for resisting differential power consumption attack |
| CN109600232A (en) * | 2018-12-05 | 2019-04-09 | 北京智慧云测科技有限公司 | For attack verifying, means of defence and the device of SM2 signature algorithm |
| CN109600232B (en) * | 2018-12-05 | 2021-08-06 | 北京智慧云测科技有限公司 | Attack verification and protection method and device for SM2 signature algorithm |
| CN110022210A (en) * | 2019-03-28 | 2019-07-16 | 思力科（深圳）电子科技有限公司 | Signature sign test method, signature end and sign test end based on elliptic curve cipher |
| CN110022210B (en) * | 2019-03-28 | 2022-03-15 | 思力科（深圳）电子科技有限公司 | Signature verification method based on elliptic curve password, signature end and signature verification end |
| CN111211886A (en) * | 2020-04-20 | 2020-05-29 | 成都信息工程大学 | Energy analysis detection method for SM2 decryption algorithm |
| CN111211886B (en) * | 2020-04-20 | 2020-07-14 | 成都信息工程大学 | Energy analysis detection method for SM2 decryption algorithm |
| CN112131616A (en) * | 2020-09-15 | 2020-12-25 | 郑州信大捷安信息技术股份有限公司 | Mask operation method and device for SM2 algorithm |
| CN112131616B (en) * | 2020-09-15 | 2022-02-18 | 郑州信大捷安信息技术股份有限公司 | Mask operation method and device for SM2 algorithm |
| CN113225187A (en) * | 2021-04-14 | 2021-08-06 | 中国人民解放军战略支援部队信息工程大学 | Energy attack resisting compensation method and system for elliptic curve crypto chip |
| CN113225187B (en) * | 2021-04-14 | 2022-07-12 | 中国人民解放军战略支援部队信息工程大学 | Energy attack resisting compensation method and system for elliptic curve crypto chip |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104917608B (en) | 2018-04-20 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104917608A (en) | Key anti-power attack method | |
| Ye et al. | An efficient chaotic image encryption algorithm based on a generalized Arnold map | |
| CN103023648B (en) | Based on elliptic curves discrete logarithm problem without certificate signature method | |
| Islam et al. | A provably secure identity-based strong designated verifier proxy signature scheme from bilinear pairings | |
| CN105099672A (en) | Hybrid encryption method and device for realizing the same | |
| CN100428140C (en) | Implement method of elliptic curve cipher system coprocessor | |
| US6914986B2 (en) | Countermeasure method in an electronic component using a public key cryptography algorithm on an elliptic curve | |
| KR20110008418A (en) | The masking method for protecting power analysis attacks in seed | |
| CN103023637A (en) | Encryption and search method for revocable keyword search public keys in cloud storage | |
| CN106100844A (en) | Optimization automatic Bilinear map encryption method and the device of method is blinded based on point | |
| CN103942031A (en) | Elliptic domain curve operational method and elliptic domain curve arithmetic unit | |
| CN110071794A (en) | A kind of information ciphering method based on aes algorithm, system and associated component | |
| CN105245343A (en) | On-line off-line signature system and method based on multivariable cipher technology | |
| KR20120129045A (en) | Method for implementing symmetric key encryption algorithm against power analysis attacks | |
| CN105119929A (en) | Safe mode index outsourcing method and system under single malicious cloud server | |
| CN112350827B (en) | Koblitz curve-based elliptic curve encryption and decryption method and system for acceleration scalar multiplication calculation | |
| CN111314054B (en) | Lightweight ECEG block cipher realization method, system and storage medium | |
| CN112737785A (en) | Attribute-based encryption method, system and equipment for complex access policy | |
| CN111897578A (en) | Parallel processing method and device for scalar multiplication on elliptic curve with characteristic of 2 | |
| CN100566241C (en) | Based on the synchronous lightweight key negotiation method of neural network weight | |
| CN113535121B (en) | Safe and efficient mathematical division calculation optimization method based on secret sharing protocol | |
| Reyes et al. | A performance comparison of elliptic curve scalar multiplication algorithms on smartphones | |
| CN101702646B (en) | Data encryption method | |
| KR20100059571A (en) | Apparatus and method for operating inversion of aes with masking method, and aes cipher system and method using thereof | |
| CN101567783A (en) | Elliptical curve encryption and decryption method and device based on II-type Gaussian base field |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |