Fault Attacks on Elliptic Curve Cryptosystems

Abstract

While there is no known subexponential algorithm for the elliptic curve discrete logarithm problem, elliptic curve cryptosystems have been shown to be vulnerable to a wide range of attacks that target their implementation rather than their mathematical foundation. Fault analysis attacks exploit faults that can occur in the implementation of an elliptic curve cryptosystem to discover the secret information partially or fully. Faults can be injected in a variety of ways and almost all parts of the system can be targeted, e.g., the base point, system parameters, intermediate results, dummy operations and validation tests. In this chapter, we review a collection of the known fault analysis attacks on elliptic curve cryptosystems. We also briefly discuss the known countermeasures to various attacks and comment on their effectiveness.