Table Of ContentMinimum Requirements for Evaluating
Side-Channel Attack Resistance of
Elliptic Curve Implementations
Document History
Version Date Authors Comment
Wolfgang Killmann, T-Systems GEI GmbH
Table of contents Version 2.0
Table of contents
1 Introduction 7
2 Side-Channel Attacks 9
2.1 Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.2 Equipment and tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.3 Evaluation process and reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.3.1 Application of composite evaluation to SCA . . . . . . . . . . . . . . . . . . . . . . 14
2.3.2 Re-evaluation of TOEs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.3.3 Effort for measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.3.4 Key rank estimation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.4 Examination of Information Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.4.1 Literature and conferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.4.2 Requirements for professional development of evaluators . . . . . . . . . . . . . . . 23
2.5 Note on the requirements for random number generators . . . . . . . . . . . . . . . . . 23
3 Background on Elliptic Curves 25
3.1 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
3.2 Properties of the curve . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
3.3 Additional requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.3.1 Twist Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.3.2 Brown-Gallant-Cheon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
4 Elliptic Curve Implementations 29
4.1 Hierarchical design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
4.2 Finite field / Modular arithmetic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.3 Elliptic curve arithmetic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.3.1 Random numbers for blinding, dummy operations and nondeterministic execution flow 32
4.3.2 Dummy EC-operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
4.3.3 Side-channel atomicity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.3.4 Unified arithmetic and complete formulas . . . . . . . . . . . . . . . . . . . . . . . 33
4.3.5 Coordinate randomisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.3.6 Montgomery form . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.3.7 Curves based on the Edwards form . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.3.8 Randomised curve representation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
4.4 Scalar representation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
4.4.1 Scalar randomisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
4.4.2 Windowing methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
4.4.3 Low weight scalars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
4.4.4 Randomised scalar splitting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
4.4.5 Randomized Scalar representations and NAF . . . . . . . . . . . . . . . . . . . . . 37
4.5 Point randomisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
4.6 Scalar multiplication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
4.6.1 Ladder Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
4.6.2 Comb Methods / Precomputed point methods . . . . . . . . . . . . . . . . . . . . . 40
5 Elliptic Curve Protocol Implementations 41
5.1 Elliptic curve domain parameter sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
4 Federal Office for Information Security
Version 2.0 Table of contents
5.2 Key pair generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
5.3 Key agreement and establishment (e. g. ECDH, ECMQV) . . . . . . . . . . . . . . . . 43
5.4 Protocol for Password Authenticated Connection Establishment (PACE) . . . . . . . . 44
5.5 Private key operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
5.5.1 Signature generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
5.5.2 Asymmetric decryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
5.6 Public key operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
5.6.1 Signature verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
5.6.2 Asymmetric encryption and hybrid schemes . . . . . . . . . . . . . . . . . . . . . . 48
6 Supplementary Material on Attack Scenarios 50
6.1 Reference Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
6.1.1 List of Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
6.1.2 Attack Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
6.2 Correlation-Collision Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
6.3 Horizontal correlation attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Glossary 81
Index 83
References 85
Federal Office for Information Security 5
Table of contents Version 2.0
Abstract
This document provides a guideline for security evaluators to test implementations of
elliptic-curve cryptography over Fp for resistance against side-channel attacks with high
attack potential according to version 3.1 of the Common Criteria (CC). This document
gives the base line of minimum requirements and is not comprehensive. Penetration testing
includes but is not limited to the attacks describe in this document. New developments can
change the security of implementations and it is the responsibility of the security evaluators
to keep their knowledge up to date.
6 Federal Office for Information Security
Version 2.0 1 Introduction
1 Introduction
This document lists a basic set of techniques and requirements which have to be applied and fulfilled
when assessing the side-channel resistance (vulnerability assessment) of cryptographic primitives,
algorithms or protocols that are based on elliptic curves. This document neither claims to provide a
complete list of possible attack methods, nor does it cover all possible approaches for analysing the
side-channel resistance of cryptographic implementations that use elliptic curves. The evaluator shall
always consider that this document is intended to provide a general guideline. This document does
not provide an exhaustive list of all requirements which might arise in the course of a vulnerability
assessment of a Target Of Evaluation (TOE). Typically, each TOE has its own, unique implementation
of Elliptic Curve Cryptography (ECC), because the developers not only follow the current scientific
publications but use intellectual property of their companies. The evaluator has the responsibility to
adapt and extend his or her analysis by using special knowledge of the TOE.
Side-channel analysis on a TOE using ECC in the context of higher Evaluation Assurance Levels (EAL)
according to version 3.1 of the Common Criteria (CC), is not a black box analysis. Typical cases are
composite evaluations which have access to the results of separate evaluations of the hardware security
properties as input. This does not mean, however, that all hardware components have undergone
security analyses sufficient for analysis of the TOE. Some properties of the underlying hardware
may not have security-relevance until they are used in conjunction with the TOE’s implemented
functionalities. For example, an arithmetic coprocessor may not be deemed security-relevant until it is
used to support finite field computations that are bundled in software that is being analysed. These
field arithmetic implementations are the building blocks for elliptic curve point operations such as the
scalar multiplication. The evaluator must have the expertise to leverage the results of existing security
analysis and must be able to identify additional, context-specific attack surfaces to perform a thorough
analysis.
This document is organised as follows: in Chapter 2 we present an overview of side-channel attacks
(SCA), such as simple SCA, differential SCA, template attacks and stochastic approach. In addition,
suitable laboratory equipment and requirements for reporting the analysis results is outlined. We
provide guidelines for standard situations during a CC evaluation such as composite evaluations and
re-evaluations of already-evaluated targets in Section 2.3. In Section 2.4, we provide conference and
literature references to the respective scientific background and attack scenarios. Is is mandatory
to consider such for higher CC Evaluation Assurance Levels. Further, we provide a minimum time
requirements for continuing education and skill enhancement of the evaluation personnel in the field of
ECC and SCA.
Chapter 3 describes elliptic curves, defines notation used in this document, fixes notation and outlines
requirements for security against mathematical attacks, i. e. attacks that do not need extra side-channel
information, and refers to standards for elliptic curves. Guidelines for analysis of the elliptic curve
arithmetic and the underlying field arithmetic are treated in Chapter 4. This includes methods for
scalar multiplication as an essential cryptographic primitive, which is used extensively in ECC. The
guidelines in Chapter 5 are structured primarily by the applications under consideration. Common
application characteristics are addressed in each subsection: Section 5.1 handles domain parameter
choice and validation, Section 5.2 deals with key generation, Section 5.3 follows with key agreement,
Section 5.4 addresses PACE (password authenticated connection establishment) and Sections 5.5
and 5.6 concern asymmetric cryptography applications. Finally, Chapter 6 provides supplementary
material on attack scenarios. Please note that this material is by no means exhaustive and must be
supplemented with the up-to-date knowledge of newly-developed attacks which may be relevant for the
specific properties of an implementation undergoing evaluation.
Federal Office for Information Security 7
1 Introduction Version 2.0
Investigating randomness is not part of this document. Extensive guidelines for this type of investigation
are given in [AIS20] and [AIS31]. This paper assumes that suitable means for generating random
numbers are available for the TOE (optimally a physical and a deterministic RNG). The specific
requirements are discussed in Section 2.5 and the corresponding sections on (ephemeral) key generation
and blinding methods. If these preconditions are not met, details have to be discussed between the
parties involved in the certification process.
This paper focuses on implementations of ECC over prime fields of characteristic greater than three.
Elliptic curves over binary fields will require similar security measures. Some remarks concerning
the secure implementation of ECC on Field Programmable Gate Arrays (FPGAs) are given in
Section 2.4.1.
We concentrate on applications of ECC that are most frequently subjected to CC certifcation. Ap
plications like pairing based cryptography and protocols like ECDAA are not treated explicitly here.
However, most of the guidance given here is also applicable in that context.
While these guidelines are written from the perspective of persons responsible for CC evaluations, there
exists complementing literature from the design perspective. See e. g. [Fan+10].
This work was sponsored and supported by the German Federal Office for Information Security (BSI).
This paper extends the respective version from 2011 providing updated requirements and reflecting
recent scientific developments. Drafts of this paper have been discussed with evaluation labs, certifica
tion bodies, vendors and the scientific community (e. g. within the ECC-Brainpool http://www.ecc
brainpool.org). The authors thank all contributors for their valuable comments.
8 Federal Office for Information Security
Version 2.0 2 Side-Channel Attacks
2 Side-Channel Attacks
2.1 Terms
The Common Criteria for Information Technology Security Evaluation (CC), together with the
companion Common Methodology for Information Technology Security Evaluation (CEM), are an
international standard for the evaluation and certification of IT security products, and form the
technical basis for the Common Criteria Recognition Agreement (CCRA). This international agreement
ensures, amongst other things, that products can be evaluated by competent and independent licensed
laboratories so as to determine the fulfilment of particular security properties, to a certain extent
or assurance (see [CC]). Among the CCRA working groups are the Common Criteria Development
Board (CCDB) and the Common Criteria Maintenance Board (CCMB). These working groups release
mandatory supporting documents (e. g. [CCDB-2012-04-001], [CCDB-2013-05-002], [CCDB-2013-05
001]) and methodology documents (e. g. [CCMB-2012-09-004]) which are of relevance for evaluation
laboratories.
Furthermore the SOG-IS1 agreement covers certificate recognition at higher levels for defined technical
areas as “Smartcards and Similar Devices” and coordinates the standardisation of Common Criteria
protection profiles and certification policies between European Certification Bodies (see [SOGIS]). The
SOG-IS Crypto working group releases a supporting document about agreed cryptographic mechanisms
[SOGIS16]. The “Joint Interpretations Working group” (JIWG) releases several mandatory supporting
documents as [JIL13a], [JIL13b] and [JIL15].
The focus of this guideline lies primarily on high assurance evaluations of TOEs like small physical
devices, so-called Security Integrated Circuits (IC). In addition it covers logical attacks that are also
applicable to software implementations using ECC, such as global timing attacks, chosen input attacks,
etc. Typical examples of TOEs are smartcards with a security processor, FPGAs with an ECC
implementation, or general purpose computing devices running a software implementation. The TOE
has a cryptographic boundary, i. e. a continuous perimeter that establishes the physical boundary of
the TOE security functionality (TSF) that includes all hardware, firmware and software components
implementing the cryptographic functionality. As outlined in [Loc+15], different attack scenarios must
be considered depending on the environment and the types of adversaries its implementation has to
withstand.
Attacks on cryptographic devices differ from attacks on cryptographic algorithms and protocols. They
benefit from the fact that not only mathematical analysis or design analysis (and their application
in an attack on the TOE via the designed user or developer interfaces) is possible, but also physical
analysis of the device that actually executes operations using secret data is possible. This opens
the field of passive and active attacks using the intended interface of the device, as well as invasive,
semi-invasive and non-invasive attacks that open and / or exploit additional, non-intended channels
which, in consequence, may leak information on the secrets such as private key material.
Side-channel analysis (see [Lem07]) uses physical observables resulting from internal states and processes
of a cryptographic computation as additional information source for cryptanalysis. The term ’physical
observable’ is understood to be any property of a physical system state determined by a physical
operation. The outcome of the measurement of physical observables are real-valued vectors.
1Senior Officials Group Information Systems Security
Federal Office for Information Security 9
2 Side-Channel Attacks Version 2.0
In other words, the internal state changes of the physical device (including the state changes caused
by operations with secret keys) cause instantaneous information leakage that can be exploited. Such
side-channel information may arise from observations of
• varying execution time of operations on all granularity levels from clock cycles, over single CPU
instructions to whole algorithm executions, including side-effects introduced by micro-architectural
properties (e. g. cache behaviour and branch prediction),
• varying power consumption during operation,
• varying electro-magnetic emanation during operation,
• varying photonic emission during operation,
• enforced unexpected behaviour (unintended system state changes, that cause leakage on the
designed TOE interface or on side-channels) as a result of transient or permanent device faults,
e. g. induced by irradiation,
and more.
According to [AIS46a], it is possible and recommendable to combine multiple leakage sources in a
security evaluation involving side-channel attacks. An example of this would be combining observations
of power consumption and electro-magnetic emanation.
These typical examples of information leakage should be considered and adapted by the evaluator.
Other side-channels or combinations of it could be deemed relevant depending on the evaluation context,
i. e. Security Target (ST) and the TOE.
The observables of the attack are real-valued vectors that are recorded and stored in such a way that
they are available as input for mathematical (especially statistical) analysis. Side-channel cryptanalysis
typically has the aim to recover secret (private) cryptographic keys, plaintext, or depending on the
scheme, other data. In order to compromise cryptographic keys, side-channel cryptanalysis can also
be used to learn intermediate results or parts of the cryptographic key. The complete key is then
recovered by brute force or mathematical cryptanalysis. Further, side-channel analysis might be used
in an intermediate attack step to learn secret values used in countermeasures such as blinding or
masking. Other scenarios, such as reverse engineering of unknown devices with the goal to learn critical
design information from a black box are used in practice, but for the purpose of a high assurance CC
2
evaluation of an ECC TOE, they are not relevant , because this knowledge has to be passed to the
evaluator by the manufacturer and is assumed to be known a-priori to the evaluator.
An adversary is successful if side-channel enhanced cryptanalysis leads to a critical entropy loss of a
secret cryptographic key (see [Lem07]). The certification body is responsible for the assessment of the
criticality of the entropy loss. In the context of CC, it is sufficient to calculate the attack potential
required by an attacker to perform an attack. The underlying objective is to aid in expressing the
total effort required to mount a successful attack (see [CCDB-2013-05-002]).
The side-channel analysis methods include, but are not limited to
• Simple Power Analysis (SPA),
• Simple Electromagnetic Analysis (SEMA),
• Timing Analysis (TA),
2
The situation is different in the case of low assurance CC evaluations.
10 Federal Office for Information Security
