具簡單功率分析攻擊防禦之橢圓曲線乘法架構

隨著近年來密碼貨幣的興起，越來越多人開始關注密碼貨幣交易時所使用的安全機制，而"橢圓曲線數位簽章"在驗證時扮演著重要的角色。也由於近年來物聯網應用的普及，為了應用在物聯網上，基於物聯網裝置的晶片面積限制，需要一個輕量的應對方案。此外，近年來越來越多種的功率分析攻擊，橢圓曲線硬體導向的安全系統常由會產生與金鑰相關的功率消耗的運算所組成，這個特徵使其易遭受到功率分析攻擊。在本論文中，我們藉由優化有限域運算中的乘法取餘以及硬體實現中的一些技巧來實現出低晶片面積的橢圓曲線乘法，我們在pre-layout的合成階段中，使用TSMC 0.18-um 製程可以使一個256bit未受到保護的橢圓曲線乘法操作在0.76ms伴隨著64.2k的邏輯閘數，而使用UMC 65-nm 製程可以使一個256bit未受到保護的橢圓曲線乘法操作在0.3ms伴隨著54.7k的邏輯閘數。其中我們提出了使用滑動框架以及自相關來攻擊還未受到保護的硬體設計，並且很簡單地藉由一些裝置取得硬體設計中的秘密金鑰。最後，為了不讓攻擊者成功取得硬體設計中的秘密金鑰，我們也在未受到保護的橢圓曲線乘法上實施蒙哥馬利交換演算法來抵抗簡單功率分析攻擊，我們一樣在TSMC 0.18-um 製程來合成受到保護的橢圓曲線乘法，在pre-layout階段中，一個256bit受到保護的橢圓曲線乘法可以操作在1.09ms伴隨著69.8k的邏輯閘數，而使用UMC65-nm 製程來合成受到保護的橢圓曲線乘法，一個256bit受到保護的橢圓曲線乘法可以操作在0.44ms伴隨著63.5k的邏輯閘數。同時，在SAKURA-G的平台上，我們的設計所產生的power trace可以抵抗簡單功率分析而不被破解。

關鍵字

橢圓曲線密碼學；橢圓曲線異點相加；橢圓曲線同點相加；橢圓曲線乘法；簡單功率分析攻擊；簡單功率分析攻擊之對策；蒙哥馬利交換演算法

並列摘要

With the advance of cryptography currency, more and more people pay attention to Elliptic Curve Digital Signature Algorithm (ECDSA) which plays an indispensable role to validate the transactions. In addition, with the advance of Internet of Things (IoT) in recent years, a light-weight hardware design is needed due to the area constraint in IoT application scenario. Moreover, a naive hardware implementation of Elliptic Curve Algorithm will generate key-dependent power traces which is vulnerable to the Power Analysis Attack. In this thesis, we first design a light-weight unprotected Elliptic Curve Cryptography processor by optimizing the finite field operation Modular Multiplication and leveraging several hardware implementation techniques. After synthesizing in pre-layout stage, our processors can perform a 256-bit ECSM in 0.76ms with 64.2k gate counts in TSMC 0.18-um process and 0.3ms with 54.7k gate counts in UMC 65-nm process. Secondly, we propose using sliding window and auto-correlation to attack the unprotected design, and show that we can easily extract the secret key with low cost equipment using simple power analysis. Finally, in order to thwart the attacker from extracting the secret key, Montgomery Ladder with Swap has been integrated into our processor to counteract the attack of simple power analysis. The final protected ECC processor synthesized in pre-layout using 0.18-um TSMC process technology can perform a 256-bit ECSM in 1.09ms with only 69.8k gate counts and using 65-nm UMC process technology can perform a 256-bit ECSM in 0.74ms with only 64.2k gate counts. Meanwhile, in the SAKURA-G platform, the power trace extract from our design can not be crashed from simple power analysis attack.