A Fast and Secure Implementation of Sflash

Lecture Notes in Computer Science

In this paper, we present a practical attack on the signature scheme SFLASH proposed by Patarin, Goubin and Courtois in 2001 following a design they had introduced in 1998. The attack only needs the public key and requires about one second to forge a signature for any message, after a one-time computation of several minutes. It can be applied to both SFLASH v2 which was accepted by NESSIE, as well as to SFLASH v3 which is a higher security version.

Lecture Notes in Computer Science, 2007

SFLASH is a signature scheme which belongs to a family of multivariate schemes proposed by Patarin et al. in 1998 [9]. The SFLASH scheme itself has been designed in 2001 [8] and has been selected in 2003 by the NESSIE European Consortium [6] as the best known solution for implementation on low cost smart cards. In this paper, we show that slight modifications of the parameters of SFLASH within the general family initially proposed renders the scheme insecure. The attack uses simple linear algebra, and allows to forge a signature for an arbitrary message in a question of minutes for practical parameters, using only the public key. Although SFLASH itself is not amenable to our attack, it is worrying to observe that no rationale was ever offered for this "lucky" choice of parameters.

Note: This document specifies the updated final version of the Quartz signature scheme, slightly modified as allowed in the second stage of Nessie evaluation process, in order to improve the speed and the security. In some papers that refer to the old version, it is sometimes called Quartz v1 , and Quartz v2 is the new version. This is therefore the only official version of Quartz. We note that the key generation has not changed, the signature computation has changed, and the signature verification has changed slightly. In the Appendix of the present document we summarize all the changes to Quartz, for readers and developers that are acquainted with the previous version. It also includes an explanation why these changes has been made.

Lecture Notes in Computer Science, 1991

Algorithms best suired forflexible smart card applications are based on public key cryptosystems-RSA, zero-knowiedge protocols. .. Their practical implementation (execution in =:I second) entails a computing power beyond the reach of classical smart cards, since large integers (512 bits) have to be manipulated in complex ways (exponentiation). CORSAIR achieves up to 40 (8 bit) MIPS with a clock speed of 6 Mhz. This allows to compute XE mod M, with 512 bit operand& in less than 15 second (0.4 set for a signature). The new smart card is in the final design stage; the first test chips should be available by the end of 1990.

IEEE 17th International Conference on Application-specific Systems, Architectures and Processors (ASAP'06), 2006

public key authentication on 8-bit smart cards. Elliptic curve cryptography is used for its efficiency per bit of key and the Elliptic Curve Digital Signature Algorithm is chosen. For this functionality, an area constrained coprocessor is probably the best approach to perform the most computer-intensive operations at an acceptable speed considering the limited memory and power of the selected platform. For that purpose, the scalar point multiplication in GF(2 m ) in both affine and projective coordinates was implemented in order to compare their performances with the same level of optimization and the same technology. A hardware/software co-design strategy was also used to avoid the need of a dedicated register file.

Lecture Notes in Computer Science, 2008

In this paper we describe the first implementation on smartcard of the code-based authentication protocol proposed by Stern at Crypto'93 and we give a securization of the scheme against side channel attacks. On the whole, this provides a secure implementation of a very practical authentication (and possibly signature) scheme which is mostly attractive for lightweight cryptography.

Smart cards have opened up possibilities for many exciting applications. However, one problem with conventional smart cards is that they only have very limited computational power. As a result, it takes too long for a smart card to perform a single RSA signature operation in real time applications. Server-aided RSA signature computation protocols offer feasible solutions for this problem. The basic idea is to distribute most of the computation to an auxiliary processor which is capable of performing fast multi-precision modular exponentiation. However, the smart card has to guard against the auxiliary processor since it may attempt to obtain information about the secret exponent or to obtain the smart card's signature on a message of its own choosing by supplying the smart card with incorrect values. The only way to defeat these attacks is for the smart card to have some means of verifying the data provided by the auxiliary processor. In this paper, we propose such a secure protocol.

Amongst areas of cryptographic research, there has recently been a widening interest for code-based cryptosystems and their implementations. Besides the a priori resistance to quantum computer attacks, they represent a real alternative to the currently used cryptographic schemes. In this paper we consider the implementation of the Stern authentication scheme and one recent variation of this scheme by Aguilar et al.. These two schemes allow public authentication and public signature with public and private keys of only a few hundreds bits. The contributions of this paper are twofold: first, we describe how to implement a code-based signature in a constrained device through the Fiat-Shamir paradigm, in particular we show how to deal with long signatures. Second, we implement and explain new improvements for code-based zero-knowledge signature schemes. We describe implementations for these signature and authentication schemes, secured against side channel attacks, which drastically improve the previous implementation presented at Cardis 2008 by Cayrel et al.. We obtain a factor 3 reduction of speed and a factor of about 2 for the length of the signature. We also provide an extensive comparison with RSA signatures.

Computer systems science and engineering, 2023

Since the end of the 1990s, cryptosystems implemented on smart cards have had to deal with two main categories of attacks: side-channel attacks and fault injection attacks. Countermeasures have been developed and validated against these two types of attacks, taking into account a well-defined attacker model. This work focuses on small vulnerabilities and countermeasures related to the Elliptic Curve Digital Signature Algorithm (ECDSA) algorithm. The work done in this paper focuses on protecting the ECDSA algorithm against fault-injection attacks. More precisely, we are interested in the countermeasures of scalar multiplication in the body of the elliptic curves to protect against attacks concerning only a few bits of secret may be sufficient to recover the private key. ECDSA can be implemented in different ways, in software or via dedicated hardware or a mix of both. Many different architectures are therefore possible to implement an ECDSA-based system. For this reason, this work focuses mainly on the hardware implementation of the digital signature ECDSA. In addition, the proposed ECDSA architecture with and without fault detection for the scalar multiplication have been implemented on Xilinx field programmable gate arrays (FPGA) platform (Virtex-5). Our implementation results have been compared and discussed. Our area, frequency, area overhead and frequency degradation have been compared and it is shown that the proposed architecture of ECDSA with fault detection for the scalar multiplication allows a trade-off between the hardware overhead and the security of the ECDSA.