A second-order DPA attack breaks a window-method based countermeasure against side channel attacks

Abstract

Möller proposed a countermeasure using window method against side channel attacks. However, its immunity to side channel attacks is still controversial. In this paper, we show Möller’s countermeasure is vulnerable to a second-order differential power analysis attack. A side channel attackis an attackthat takes advantage of information leaked during execution of a cryptographic procedure. An nth-order differential power analysis attackis the side channel attackwhic h uses n different leaked data that correspond to n different intermediate values during the execution. Our proposed attackagainst Möller’s countermeasure finds out the use of same elliptic points, and restricts candidates of the secret scalar value. In these circumstances, the attackcompletely detects the scalar value using Baby-Step-Giant-Step method as a directcomputational attack. For a 160-bit scalar value, the proposed attack restricts the number of candidates of the scalar to a 45-bit integer, and the direct-computational attackcan actually detect the scalar value. Besides, we improve Möller’s countermeasure to prevent the proposed attack. We compare the original method and improved countermeasure in terms of the computational intractability and the computational cost of the scalar multiplication.