Just a Little Bit More

Joop van de Pol; Nigel P Smart; Yuval Yarom

doi:10.1007/978-3-319-16715-2_1

Just a Little Bit More

Joop van de Pol
, Nigel P Smart
, Yuval Yarom

Cryptography and Information Security

Research output: Chapter in Book/Report/Conference proceeding › Conference Contribution (Conference Proceeding)

59 Citations (Scopus)

Abstract

We extend the Flush+Reload side-channel attack of Benger et al. to extract a significantly larger number of bits of information per observed signature when using OpenSSL. This means that by observing only 25 signatures, we can recover secret keys of the secp256k1 curve, used in the Bitcoin protocol, with a probability greater than 50 percent. This is an order of magnitude improvement over the previously best known result.

The new method of attack exploits two points: Unlike previous partial disclosure attacks we utilize all information obtained and not just that in the least significant or most significant bits, this is enabled by a property of the “standard” curves choice of group order which enables extra bits of information to be extracted. Furthermore, whereas previous works require direct information on ephemeral key bits, our attack utilizes the indirect information from the wNAF double and add chain.

Original language	English
Title of host publication	Topics in Cryptology - CT-RSA 2015
Editors	Kaisa Nyberg
Publisher	Springer International Publishing AG
Pages	3-21
Volume	9048
ISBN (Electronic)	978-3-319-16715-2
ISBN (Print)	978-3-319-16714-5
DOIs	https://doi.org/10.1007/978-3-319-16715-2_1
Publication status	Published - 20 Apr 2015

Publication series

Name	Lecture Notes in Computer Science
Publisher	Springer International Publishing
Volume	9048
ISSN (Print)	0302-9743
ISSN (Electronic)	0302-9743

Access to Document

10.1007/978-3-319-16715-2_1

http://eprint.iacr.org/2014/434Licence: CC BY

Handle.net

Persistent link

COED - Computing on Encrypted Data
Smart, N. P. (Principal Investigator)
1/10/11 → 30/09/15
Project: Research

Cite this

@inproceedings{c34528a087734d6aa7f6e9ca0a434994,

title = "Just a Little Bit More",

abstract = "We extend the Flush+Reload side-channel attack of Benger et al. to extract a significantly larger number of bits of information per observed signature when using OpenSSL. This means that by observing only 25 signatures, we can recover secret keys of the secp256k1 curve, used in the Bitcoin protocol, with a probability greater than 50 percent. This is an order of magnitude improvement over the previously best known result. The new method of attack exploits two points: Unlike previous partial disclosure attacks we utilize all information obtained and not just that in the least significant or most significant bits, this is enabled by a property of the “standard” curves choice of group order which enables extra bits of information to be extracted. Furthermore, whereas previous works require direct information on ephemeral key bits, our attack utilizes the indirect information from the wNAF double and add chain.",

author = "\{van de Pol\}, Joop and Smart, \{Nigel P\} and Yuval Yarom",

year = "2015",

month = apr,

day = "20",

doi = "10.1007/978-3-319-16715-2\_1",

language = "English",

isbn = "978-3-319-16714-5",

volume = "9048",

series = "Lecture Notes in Computer Science",

publisher = "Springer International Publishing AG",

pages = "3--21",

editor = "Kaisa Nyberg",

booktitle = "Topics in Cryptology - CT-RSA 2015",

address = "Switzerland",

}

TY - GEN

T1 - Just a Little Bit More

AU - van de Pol, Joop

AU - Smart, Nigel P

AU - Yarom, Yuval

PY - 2015/4/20

Y1 - 2015/4/20

N2 - We extend the Flush+Reload side-channel attack of Benger et al. to extract a significantly larger number of bits of information per observed signature when using OpenSSL. This means that by observing only 25 signatures, we can recover secret keys of the secp256k1 curve, used in the Bitcoin protocol, with a probability greater than 50 percent. This is an order of magnitude improvement over the previously best known result. The new method of attack exploits two points: Unlike previous partial disclosure attacks we utilize all information obtained and not just that in the least significant or most significant bits, this is enabled by a property of the “standard” curves choice of group order which enables extra bits of information to be extracted. Furthermore, whereas previous works require direct information on ephemeral key bits, our attack utilizes the indirect information from the wNAF double and add chain.

AB - We extend the Flush+Reload side-channel attack of Benger et al. to extract a significantly larger number of bits of information per observed signature when using OpenSSL. This means that by observing only 25 signatures, we can recover secret keys of the secp256k1 curve, used in the Bitcoin protocol, with a probability greater than 50 percent. This is an order of magnitude improvement over the previously best known result. The new method of attack exploits two points: Unlike previous partial disclosure attacks we utilize all information obtained and not just that in the least significant or most significant bits, this is enabled by a property of the “standard” curves choice of group order which enables extra bits of information to be extracted. Furthermore, whereas previous works require direct information on ephemeral key bits, our attack utilizes the indirect information from the wNAF double and add chain.

U2 - 10.1007/978-3-319-16715-2_1

DO - 10.1007/978-3-319-16715-2_1

M3 - Conference Contribution (Conference Proceeding)

SN - 978-3-319-16714-5

VL - 9048

T3 - Lecture Notes in Computer Science

SP - 3

EP - 21

BT - Topics in Cryptology - CT-RSA 2015

A2 - Nyberg, Kaisa

PB - Springer International Publishing AG

ER -

Just a Little Bit More

Abstract

Publication series

Access to Document

Handle.net

Fingerprint

Projects

COED - Computing on Encrypted Data

Cite this