Re: [Cfrg] Hardware requirements for elliptic curves

[Mike Hamburg <[e-mail]>]

On 9/11/2014 11:06 AM, Torsten Schuetze wrote:
> On Sep 11, 2014 09:22:53 -0700 Mike Hamburg <mike at shiftleft.org>
> wrote:
>
>> Torsten, thanks for the description of smart card hardware and
>> concerns. It was very educational. I expected something looking
>> more like a specialized CPU, where a sparse prime reduction unit
>> could be bolted on easily.
> The only thing I know in this direction are FPGA proposals like
> Güneysu:Paar:2008 CHES 2008 'Ultra High Performance ECC over NIST
> Primes on Commercial FPGAs' and even Sasdrich:Güneysu:2014 ARC 2014
> 'Efficient ECC using Curve25519' which both use the specific DSPs on
> the FPGAs.
>
> These are both great papers with very good performance results. But
> they show what I mean with flexibility: it is not easily possible to
> use 'random' or unstructured primes or even use the original primes
> with enough blinding (because the blinding disturbs the structure).
>
> Some years ago, I was looking for a general GF(p) crypto coprocessor
> on a FPGA (Car2X standardization, like IEEE 1609.2, but without NIST
> primes). The only thing I came up with was Nele Mentens Phd, 2007
> (Montgomery multiplication, coarsely integrated operand scanning) and
> the CHES 2010 paper by N. Guillermin (RNS). Unfortunately, I could not
> find direct comparisons of, say, Brainpool and NIST curves on these
> architectures.
This is interesting but fairly far afield, so I might rather continue 
this part of the thread offlist.
>> You should keep in mind, though, that the curves being proposed are
>> designed for security against local side channels as well as global
>> ones. The submitted implementations are designed not to leak against
>> an adversary who can see all memory addresses accessed and
>> instructions executed, even without blinding.
> It all depends on the adversarial model.
The adversarial model of most crypto software these days is that the 
attacker is running on the same machine as you, as an unprivileged user, 
and through timing channels he can see enough of your data access and 
control flow patterns that they had better not correlate with secret 
data.  This is at least true for OpenSSL (it fails sometimes, though), 
Curve25519 (NaCl, Donna), Goldilocks, and MS NUMS.
>> That's a lot easier than power and fault defense, but we're not
>> slacking on the software side either.
> But you surely know from your company background Cryptography
> Research that electromagnetic attacks in a template like fashion are
> currently the most advanced attacks. And I don't see that one can
> solve this issue without heavy blinding.
>
> Torsten
Right, of course.  And by "power", I meant to include EM, the attacks 
and defenses being very similar in nature.

Thanks for the info,
-- Mike