High-order attacks against the exponent splitting protection

Abstract

Exponent splitting is a classical technique to protect modular exponentiation against side-channel attacks. Although it is rarely implemented due to efficiency reasons, it is widely considered as a highlysecure solution. Therefore it is often used as a reference to benchmark new countermeasure proposals. In this paper, we make new observations about the statistical behavior of the splitting of the exponent. We look at the correlations between the two shares, and show an important imbalance. Later, we show how to use this imbalance in higher-order attacks (mostly based on address-bit, safe-error and fault analysis). We also present experimental results to estimate their feasibility. © International Association for Cryptologic Research 2006.