[sw,cryptolib] Pad secret scalar with randomness instead of zeros #28251
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit adds a new internal point multiplication which refreshes the blinding on the secret scalar and also extends the number of blinding bits as a SCA countermeasure. Signed-off-by: Hakim Filali <[email protected]>
This commit adds a new test for the internal multiplication, since the scalar_mult_test will be using the blinded version of the internal multiplication and will thus no longer test the basic internal multiplication which is still needed for the sign algorithm. Signed-off-by: Hakim Filali <[email protected]>
This commit changes all point multiplications which use the secret key scalar d to now use the new point multiplication with additional blinding bits and blinding refreshing. Signed-off-by: Hakim Filali <[email protected]>
The preceding commits overflow the memory. For this reason this commit moves all the memory variables into a single file to avoid this issue. Signed-off-by: Hakim Filali <[email protected]>
Most of the tests have to be moved to the hjson framework since the variables have been moved to a single memory file. Signed-off-by: Hakim Filali <[email protected]>
Signed-off-by: Hakim Filali <[email protected]>
This commit adds remasking of the secret key scalar each time the sign routine is executed. This is added as a countermeasure against SCA. Signed-off-by: Hakim Filali <[email protected]>
Signed-off-by: Hakim Filali <[email protected]>
This commit changes all the instructions in the p384 library that violate rules 6 and 7 related to bn.sel instructions. The destination register should not match any of the source registers. The two source registers can't be two shares of the same secret. Signed-off-by: Hakim Filali <[email protected]>
This commit changes all the instructions in the p384 library that violate rule 8 related to bn.mulqacc instructions. After executing a mulqacc instruction on a secret the accumulation register and the flags need to be cleared. Signed-off-by: Hakim Filali <[email protected]>
…/sub This commit changes all the instructions in the p384 library that violate rule 5 or 9 related to bn.mulqacc instructions. After executing a bn.add or bn.sub instructions some sensitive state can remain in the flags. For this reason we need to be careful with these instructions and clear the flags in case they can contain sensitive data. Signed-off-by: Hakim Filali <[email protected]>
This commit changes all the instructions in the p384 library that violate rules 1-4 related to the handling of shares. Shares of the same secret should not be: - in different parts of the same reg - accessed in consecutive instructions - accessed in the same instruction - over write each other In some parts of the p384 library the shares are combined and some of these rules are violated by necessity. Signed-off-by: Hakim Filali <[email protected]>
This commit pads the secret scalar with randomness instead of zeros for the scalar point multiplication of p384. Signed-off-by: Hakim Filali <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit pads the secret scalar with randomness instead of zeros
for the scalar point multiplication of p384.
This PR is based on #28210