Dickson basis multiplier with concurrent error detection against fault attacks for lightweight cryptosystems

Electronics LettersVolume 58, Issue 12 p. 468-470 LetterOpen Access Dickson basis multiplier with concurrent error detection against fault attacks for lightweight cryptosystems Che Wun Chiou, Corresponding Author Che Wun Chiou [email protected] orcid.org/0000-0002-9588-4210 Department of Computer Science and Information Engineering, Chien Hsin University of Science and Technology, Taoyuan City, Taiwan Email: [email protected]Search for more papers by this authorYuh-Sien Sun, Yuh-Sien Sun Department of Electronic Engineering, Chien Hsin University of Science and Technology, Taoyuan City, TaiwanSearch for more papers by this authorChe Wei Liang, Che Wei Liang Department of Computer Science and Information Engineering, Chien Hsin University of Science and Technology, Taoyuan City, TaiwanSearch for more papers by this authorLiang Yu Chen, Liang Yu Chen Department of Computer Science and Information Engineering, Chien Hsin University of Science and Technology, Taoyuan City, TaiwanSearch for more papers by this authorShih En Dai, Shih En Dai Department of Computer Science and Information Engineering, Chien Hsin University of Science and Technology, Taoyuan City, TaiwanSearch for more papers by this authorChen En To, Chen En To Department of Computer Science and Information Engineering, Chien Hsin University of Science and Technology, Taoyuan City, TaiwanSearch for more papers by this authorChen Che Chien, Chen Che Chien Department of Computer Science and Information Engineering, Chien Hsin University of Science and Technology, Taoyuan City, TaiwanSearch for more papers by this author Che Wun Chiou, Corresponding Author Che Wun Chiou [email protected] orcid.org/0000-0002-9588-4210 Department of Computer Science and Information Engineering, Chien Hsin University of Science and Technology, Taoyuan City, Taiwan Email: [email protected]Search for more papers by this authorYuh-Sien Sun, Yuh-Sien Sun Department of Electronic Engineering, Chien Hsin University of Science and Technology, Taoyuan City, TaiwanSearch for more papers by this authorChe Wei Liang, Che Wei Liang Department of Computer Science and Information Engineering, Chien Hsin University of Science and Technology, Taoyuan City, TaiwanSearch for more papers by this authorLiang Yu Chen, Liang Yu Chen Department of Computer Science and Information Engineering, Chien Hsin University of Science and Technology, Taoyuan City, TaiwanSearch for more papers by this authorShih En Dai, Shih En Dai Department of Computer Science and Information Engineering, Chien Hsin University of Science and Technology, Taoyuan City, TaiwanSearch for more papers by this authorChen En To, Chen En To Department of Computer Science and Information Engineering, Chien Hsin University of Science and Technology, Taoyuan City, TaiwanSearch for more papers by this authorChen Che Chien, Chen Che Chien Department of Computer Science and Information Engineering, Chien Hsin University of Science and Technology, Taoyuan City, TaiwanSearch for more papers by this author First published: 17 April 2022 https://doi.org/10.1049/ell2.12500AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract Fault attacks have been proved for efficiently breaking hardware-based elliptic curve cryptosystems. One way for fighting against fault attacks is to design the core multiplier circuit of elliptic curve cryptosystem with concurrent error detection capability. The multiplier with concurrent error detection only outputs its results if no existing error is found. This paper will design a systolic array Dickson basis multiplier with concurrent error detection capability for resisting fault attacks on elliptic curve cryptosystems. Introduction In the last few years, the internet has had a dramatic effect on business operations. Electronic commerce (E-commerce) over the internet has been growing in an exponential manner. However, there are still anxieties on the exchange of money securely and conveniently over the internet. As E-commerce businesses are growing, security has become a serious concern of firms and individuals and more secure technologies are being developed and improved every day. E-commerce security is heavily depended on secret-key (private-key) and public-key cryptosystems. Public-key cryptosystems such as RSA (Rivest, Shamir, Adleman) [1] and elliptic curve cryptography (ECC) [2, 3] can provide functions of authentication, non-repudiation, digital signature, and certification authority for both senders and receivers. ECC has gained more attention in mobile E-commerce (M-commerce) than RSA due to its smaller key size with the same security level. Finite field multiplication over GF(2m) is extensively used in ECC. For achieving sufficient security level, the extremely large size of the field used for ECC is used. The finite field multiplication with such a large modulus requires a considerable amount of resources and becomes the most time-consuming operation in ECC. The efficiency of finite field multiplication is extremely depended on representations of field elements. Three most commonly used bases are polynomial basis (PB) [4], dual basis (DB) [5], and normal basis (NB) [6]. Each basis with distinct advantages can be properly employed in various applications. For example, NB is suitable for realizing exponentiation with multiply-square structure, because it requires almost cost-free hardware for computing square operations. The major disadvantage of NB is that it is difficult to perform multiplication. To overcome this problem, two special classes of NB, termed optimal normal basis (ONB) and Gaussian normal basis (GNB) [6], are used to alleviate its computational complexity. However, only two types, type-1 and type-2, have been found for ONB and then ONB does not exist for all extension fields. GNB can overcome this problem and exists for all extension fields with different type t. For example, the field size m = 571 suggested by NIST (National Institute of Standards and Technology) for ECDSA [7] is with type 10. However, it requires much complexity if its circular property is employed for designing a systolic GNB multiplier with (mt+1) × (mt+1) array size. An alternative solution to this problem is to use the Dickson basis [8, 9] instead of both ONB and GNB. The multiplier using Dickson basis has the same low space complexity as one with ONB. But, Dickson basis almost exists for all extension fields. For example, no ONB exists for field sizes m = 163 and m = 283 which are suggested by NIST, but there do exist irreducible Dickson trinomials for such fields. Chiou et al. [9] developed a unidirectional systolic structure for Dickson basis multiplier with low space and time complexities. Based on the unidirectional systolic Dickson basis multiplier in [9], we will propose a systolic Dickson basis multiplier with concurrent error detection (CED) capability for resisting fault attacks. Hardware-based ECC may leak additional information via side channels. One of the most effective side-channel attacks is the fault attack [10]. Fault attacks inject faults into the hardware devices and then analyse the incorrect outputs to reveal the secret keys. The incorrect outputs of modular multipliers by transient, permanent, or injected faults can help hackers to completely expose the secret keys. Therefore, it is important to design modular multipliers with protection scheme. The outputs of multipliers with fault detection capability are sending out if no error is detected. If an error is detected, the multiplier can recover through rollback and retry, or just outputs a null result. This study will design a Dickson basis multiplier with CED capability. As our best knowledge, there are no works that focus on the fault detection and/or tolerance designs of Dickson basis multipliers over GF(2m). The major contributions of this letter are listed as follows: The first Dickson basis multiplier with concurrent error detection capability is presented. The first design of Dickson basis multiplier for assisting fault attacks on elliptic curve cryptosystems is presented. Preliminaries In this section, we will briefly review Dickson basis, TMVP, and RESO. Suppose that R is a ring and a ∈ R. The nth Dickson polynomial of the first kind (k = 0) [8, 9] with low complexity is represented as the following equation: D n x , a = ∑ i = 1 n / 2 n n − i n − i i − a i x n − 2 i , \begin{equation}{D_n}\left( {x,a} \right) = \sum_{i = 1}^{\left\lfloor {n/2} \right\rfloor } {\frac{n}{{n - i}}\left( { \def\eqcellsep{&}\begin{array}{@{}*{1}{c}@{}} {n - i}\\ i \end{array} } \right){{\left( { - a} \right)}^{{\rm{ }}i}}{x^{n - 2i}}} ,\end{equation} (1)where ⌊n⌋ and ( n − i i ) $( \def\eqcellsep{&}\begin{array}{l} n - i\\ i \end{array} )$ represent the floor function of n and the number of i-combinations of n−i distinct objects, respectively, and D0(x,a) = 2 and D1(x,a) = x. Based on the above equation, Dickson polynomials can be recursively generated as follows: D i x , a = 2 if i = 0 , x if i = 1 , x D i − 1 x , a − a D i − 2 x , a if i ≥ 2 . \begin{equation}{D_i}\left( {x,a} \right) = \left\{ \def\eqcellsep{&}\begin{array}{ll} 2 & {\rm{ if }} \ i = 0,\\[5pt] x & {\rm{ if }} \ i = 1,\\[5pt] x{D_{i - 1}}\left( {x,a} \right) - a{D_{i - 2}}\left( {x,a} \right)& {\rm{ if }} \ i \ge 2. \end{array} \right.\end{equation} (2) In finite field GF(2), only the case of a = 1 for nth Dickson polynomial, Dn(x,1), is considered. Let γi = Di(x,1) and the Dickson basis generated by an irreducible polynomial P with degree m in GF(2) is formed as Ω = {γ1,γ2,…, γm}. For example, γ1 = x, γ2 = x2, γ3 = x3 + x. Any one element A ∈ GF(2m) is represented byA = a1γ1 + a2γ2 + … + amγm, where ai ∈ GF(2) for 1 ≤ i ≤ m. Based on inherent properties in GF(2m), Equation (2) can be rewritten as follows: γ i = 0 if i = 0 , x if i = 1 , γ i = x γ i − 1 + γ i − 2 if 2 ≤ i ≤ m . \begin{equation}{\gamma _i} = \left\{ \def\eqcellsep{&}\begin{array}{ll} 0 & {\rm{ if }} \ i = {\rm{0,}}\\[5pt] x & {\rm{ if }} \ i = {\rm{1,}}\\[5pt] {\gamma _i} = x{\gamma _{i - 1}} + {\gamma _{i - 2}} & {\rm{ if\ 2}} \le i \le m{\rm{.}} \end{array} \right.\end{equation} (3) The irreducible polynomial P is termed as Dickson binomial if P is a two-term polynomial of P = γm + 1. Dickson binomials can be employed for achieving the goal of lightweight cryptography. In this paper, the binomial polynomial P is employed for lightweight cryptosystems. An r × r matrix T is termed Toeplitz matrix if it holds the relation t(i,j) = t(i+1,j+1), where 0 ≤ i, j ≤ r − 2 and t(i,j) is the element at the row i and column j of the matrix T. An r × r matrix H is a Hankel matrix if its elements have the relation h(i,j) = h(i+1,j−1) for 0 ≤ i ≤ r − 2 and 1 ≤ j ≤ r − 1, where h(i,j) is the i, j element of H. Both rows and columns are numbered from 0 to r−1. The product T×V is called a Toeplitz matrix-vector product (TMVP) if V be an r×1 column vector. The RESO method by Patel and Fung [11] has been applied for concurrently detecting errors on NB, DB, and PB multipliers [4-6]. The RESO method computes arithmetic and logic results twice: one uses original operands and the other employs shifted operands. Two computed results are compared and a mismatch indicates at least an error occurred. Let x be the input of an arithmetic and logic unit with function f and its output be f(x). Let c and d be coding and decoding functions, respectively. Thus, both c and d are properly selected such that one has d(f(c(x))) = f(x) for all x. Two computations are executed on such arithmetic and logic unit f, f(x) and d(f(c(x))), and then two computed results are compared: f(x) = d(f(c(x))). A mismatch reveals an existed error. The RESO method employs time redundancy technique. The proposed Dickson basis multiplier with CED capability Let A, B, and C be any three elements in GF(2m) and represented by Dickson basis Ω as follows. A = ∑ i = 1 m a i γ i , $A = \sum\nolimits_{i = 1}^m {{a_i}{\gamma _i}} ,$ B = ∑ i = 1 m b i γ i , $B = \sum\nolimits_{i = 1}^m {{b_i}{\gamma _i}} ,$ C = ∑ i = 1 m c i γ i , $C = \sum\nolimits_{i = 1}^m {{c_i}{\gamma _i}} ,$ where ai,bi,ci ∈ GF(2) for 1 ≤ i ≤ m. Let C be the product of A and B: C = A × BmodP. The Dickson binomial is used to generate elements. We employ P = γm + 1 and has γm + i = γi + γm − i, for i ≥ 1. The product C is computed as follows. C = A B = ∑ i , j = 1 m a i b j γ i + j + ∑ i , j = 1 m a i b j γ i − j . \begin{equation}C = AB = \sum_{i,j = 1}^m {{a_i}{b_j}{\gamma _{i + j}}} + \sum_{i,j = 1}^m {{a_i}{b_j}{\gamma _{\left| {i - j} \right|}}} .\end{equation} (4) The Equation (4) can be rewritten in matrix form with TMVP representations as follows, C = C1+C2+C3, where C 1 = a m a m − 1 … a 2 a 1 a 1 a m … a 3 a 2 … … … … … a m − 2 a m − 3 … a m a m − 1 a m − 1 a m − 2 … a 1 a m × b 1 b 2 … b m − 1 b m , C 2 = a m − 1 0 a m − 1 … a 2 a m − 2 a m − 1 0 … a 3 … … … … … a 1 a 2 a 3 … 0 0 a 1 a 2 … a m − 1 × b m b m − 1 … b 2 b 1 , C 3 = 0 a 1 a 2 … a m − 1 0 0 a 1 … a m − 2 … … … … … 0 0 0 … a 1 0 0 0 … 0 × b 1 b 2 … b m − 1 b m . \begin{eqnarray*} C1 &=& \left[ { \def\eqcellsep{&}\begin{array}{@{}*{5}{c}@{}} {{a_m}}&\quad {{a_{m - 1}}}&\quad {\ldots}&\quad {{a_2}}&\quad {{a_1}}\\[5pt] {{a_1}}&\quad {{a_m}}&\quad {\ldots}&\quad {{a_3}}&\quad {{a_2}}\\[5pt] {\ldots}&\quad {\ldots}&\quad {\ldots}&\quad {\ldots}&\quad {\ldots}\\[5pt] {{a_{m - 2}}}&\quad {{a_{m - 3}}}&\quad {\ldots}&\quad {a{}_m}&\quad {{a_{m - 1}}}\\[5pt] {{a_{m - 1}}}&\quad {{a_{m - 2}}}&\quad {\ldots}&\quad {{a_1}}&\quad {{a_m}} \end{array} } \right] \times \left[ { \def\eqcellsep{&}\begin{array}{@{}*{1}{c}@{}} {{b_1}}\\[5pt] {b{}_2}\\[5pt] {\ldots}\\[5pt] {{b_{m - 1}}}\\[5pt] {{b_m}} \end{array} } \right],\\ C2 &=& \left[ { \def\eqcellsep{&}\begin{array}{@{}*{5}{c}@{}} {{a_{m - 1}}}&\quad 0&\quad {{a_{m - 1}}}&\quad {\ldots}&\quad {{a_2}}\\[5pt] {{a_{m - 2}}}&\quad {{a_{m - 1}}}&\quad 0&\quad {\ldots}&\quad {{a_3}}\\[5pt] {\ldots}&\quad {\ldots}&\quad {\ldots}&\quad {\ldots}&\quad {\ldots}\\[5pt] {{a_1}}&\quad {{a_2}}&\quad {{a_3}}&\quad {\ldots}&\quad 0\\[5pt] 0&\quad {{a_1}}&\quad {{a_2}}&\quad {\ldots}&\quad {{a_{m - 1}}} \end{array} } \right] \times \left[ { \def\eqcellsep{&}\begin{array}{@{}*{1}{c}@{}} {{b_m}}\\[5pt] {{b_{m - 1}}}\\[5pt] {\ldots}\\[5pt] {{b_2}}\\[5pt] {{b_1}} \end{array} } \right],\\ C3 &=& \left[ { \def\eqcellsep{&}\begin{array}{@{}*{5}{c}@{}} {\rm{0}}&\quad {{a_1}}&\quad {{a_2}}&\quad {\ldots}&\quad {{a_{m - 1}}}\\[5pt] 0&\quad 0&\quad {{a_1}}&\quad {\ldots}&\quad {{a_{m - 2}}}\\[5pt] {\ldots}&\quad {\ldots}&\quad {\ldots}&\quad {\ldots}&\quad {\ldots}\\[5pt] 0&\quad 0&\quad 0&\quad {\ldots}&\quad {{a_1}}\\[5pt] 0&\quad 0&\quad 0&\quad {\ldots}&\quad 0 \end{array} } \right] \times \left[ { \def\eqcellsep{&}\begin{array}{@{}*{1}{c}@{}} {{b_1}}\\[5pt] {{b_2}}\\[5pt] {\ldots}\\[5pt] {{b_{m - 1}}}\\[5pt] {{b_m}} \end{array} } \right].\end{eqnarray*} A systolic array Dickson basis multiplier with concurrent error detection capability is shown in Figure 1. Two types of cells in Figure 1, U cell and V cell, are depicted in Figure 2a and b. RESO-1 (RESO with 1 bit shift right) technology is employed for concurrent error detection. C1, C2, and C3 are carried out on Column-vector 1 (V1,1, V2,1, …, Vm,1) to Column-vector m (U1,m, U2,m,…,Um,m) of the systolic array multiplier. C1*, C2*, and C3* are executed on Column-vector 2 (V1,2, V2,2, …, Vm,2), …, Column-vector m (U1,m, U2,m,…,Um,m), and Column-vector 1 (V1,1, V2,1, …, Vm,1). C1*, C2*, and C3* are same as C1, C2, and C3, respectively. But, they are computed on the systolic array by shifting one column vector. In other words, they are calculated from Column-vector 2, Column-vector 3, …, Column-vector m, and Column-vector 1. As the select bit sin of V cell is 0 (1), ain ( a i n ∗ $a_{in}^*$ ) of V cell is selected as input. C1, C1*, C2, C2*, C3, and C3* are inputted in sequential order to the multiplier and are compared in equality checker. A mismatch of C1 and C1*, C2 and C2*, or C3 and C3* indicates an existed error. If the error signal outputs logical 1, outputs of the multiplier will be prohibited. Fig. 1Open in figure viewerPowerPoint Dickson basis multiplier with CED Fig. 2Open in figure viewerPowerPoint The circuits of U and V cells (a) The circuit of U cell, (b) the circuit of V cell Complexity comparisons For comparison results, the 45-nm CMOS FreePDK process kit of NanGate's Library Creator [12] is employed for comparing the proposed multiplier with CED and the one without CED [9]. For easy comparison, only the major part, systolic array multiplier, is used for comparison. Equality checker of the proposed multiplier for checking whether output is correct is not considered for comparison. The cell areas of XOR, AND, Latch, Multiplexer are 1.596, 1.064, 4.522, and 1.862 µm2, respectively. In the case of load capacitance = 0.3656 fF and input transition = 0.0012 ns, the propagation delays of XOR, AND, latch, and Multiplexer are 0.05, 0.02, 0.08, and 0.05 ns, respectively. Comparison results are shown in Table 1. If five m values recommended by NIST, 163, 233, 283, 409, and 571, are used for evaluating comparison results, the proposed systolic Dickson basis multiplier with CED capability spends more 0.4% space complexity and 35% time complexity as compared to the one without CED in [9] on average. Table 2 shows the comparison results. Table 1. Complexity comparisons Multiplier Chiou's multiplier [9] The proposed multiplier Space complexity #AND : m2 #XOR : m2+m #Latch : 2m2+m #AND : m2 #XOR : m2+m #Latch : 2m2+3m #Mux : 2m Time complexity (m+2)(TX+TA+TL) (m+5)(TM+TX+TA+TL) Critical path delay Table 2. Comparison results Multiplier Chiou's multiplier [9] The proposed multiplier M Space (unit: μm2) Time (unit: ns) 163 311,960 314,041 24.75 33.6 233 636,823 639,798 35.25 47.6 283 939,093 942,706 42.75 57.6 409 1,960,359 1,965,581 61.65 82.8 571 3,819,477 3,826,767 85.95 115.2 Conclusion We have presented a systolic array Dickson basis multiplier with CED capability. The proposed multiplier is based on the unidirectional systolic Dickson basis multiplier in [9]. The proposed multiplier with CED spends more 0.4% space complexity and 35% time complexity while comparing with the one without CED in [9]. The proposed multiplier with CED can fight against fault attacks on elliptic curve cryptosystems. Conflict of interest To the best of our knowledge, the named authors have no conflict of interest, financial or otherwise. All authors have completed and declared that: (i) no support, financial or otherwise, has been received from any organization that may have an interest in the submitted work; and (ii) there are no other relationships or activities that could appear to have influenced the submitted work. Open Research Data availability statement Data openly available in a public repository that issues datasets with DOIs. References 1Rivest, R.L., Shamir, A., Adleman, L.: A method for obtaining digital signatures and public-key cryptosystems. Commun. ACM 21(2), 120– 126 (1978) 2Miller, V.S.: Use of elliptic curves in cryptography. In: Proceedings of Crypto 85. Santa Barbara, CA, pp. 417– 426 (1985) 3Koblitz, N.: Elliptic curve cryptosystems. Math. Comput. 48, 203– 209 (1987) 4Lee, C.Y., Chiou, C.W., Lin, J.M.: Concurrent error detection in a polynomial basis multiplier over GF(2m). J. Electron. Test. 22(2), 143– 150 (2006) 5Chiou, C.W., Liang, W.Y., Chang, H.W., Lin, J.M., Lee, C.Y.: Concurrent error detection in semi-systolic dual basis multiplier over GF(2m) using self-checking alternating logic. IET Circuits Devices Syst. 4(5), 382– 391 (2010) 6Chuang, T.-P., Chiou, C. W., Lin, S.S., Lee, C.Y.: Fault-tolerant Gaussian normal basis multiplier over GF(2m). IET Inf. Secur. 6(3), 157– 170 (2012) 7FIPS PUB 186-4 Federal Information Processing Standards Publication Digital Signature Standard (DSS), National Institute of Standards and Technology, pp. 1– 130 (2013) 8Dickson, L.E.: The analytic representation of substitutions on a power of a prime number of letters with a discussion of the linear group. Ann. Math. 11(1/6), 161– 183 (1883) 9Chiou, C.W., Sun, Y.S., Lee, C.M., Liou, J.Y.: Low-complexity unidirectional systolic Dickson basis multiplier for lightweight cryptosystems. Electron. Lett. 55(1), 28– 30 (2019) 10Biehl, I., Meyer, B., Müller, V.: Differential fault attacks on elliptic curve cryptosystems. In: Proceedings of CRYPTO 2000. Santa Barbara, CA, pp. 131– 146 (2000) 11Patel, J. H., Fung, L.Y.: Concurrent error detection in ALU's by recomputing with shifted operands. IEEE Trans. Comput. C-31(7), 589– 595 (1982) 12NanGate Standard Cell Library (2017). http://www.si2.org/openeda.si2.org/projects/nangatelib/ (Accessed on 17 September 2017) Volume58, Issue12June 2022Pages 468-470 FiguresReferencesRelatedInformation