[saag] Twist Insecurity

[Peter Gutmann <[e-mail]>]

For those who haven't seen it yet, the following paper may be of interest:

  http://eprint.iacr.org/2015/577
  
  Several authors suggest that the use of twist secure Elliptic Curves
  automatically leads to secure implementations. We argue that even for twist
  secure curves a point validation has to be performed. We illustrate this
  with examples where the security of EC-algorithms is strongly degraded, even
  for twist secure curves.

  We show that the usual blindig countermeasures against SCA are insufficient
  (actually they introduce weaknesses) if no point validation is performed, or
  if an attacker has access to certain intermediate points. In this case the
  overall security of the system is reduced to the length of the blinding
  parameter. We emphazise that our methods work even in the case of a very
  high identification error rate during the SCA-phase.

Peter.