In this paper, we present two explicit invalid-curve attacks on the genus 2 hyperelliptic curve over a finite field. First, we propose two explicit attack models by injecting a one-bit fault in a given divisor. Then, ...In this paper, we present two explicit invalid-curve attacks on the genus 2 hyperelliptic curve over a finite field. First, we propose two explicit attack models by injecting a one-bit fault in a given divisor. Then, we discuss the construction of an invalid curve based on the faulted divisor. Our attacks are based on the fact that the Hyperelliptic Curve Scalar Multiplication (HECSM) algorithm does not utilize the curve parameters and We consider three hyperelliptic curves as the attack targets. For curve with security level 186 (in bits), our attack method can get the weakest invalid curve with security level 42 (in bits); there are 93 invalid curves with security level less than 50. We also estimate the theoretical probability of getting a weak hyperelliptic curve whose cardinality is a smooth integer. Finally, we show that the complexity of the fault attack is subexponential if the attacker can freely inject a fault in the input divisor. Cryptosystems based on the genus 2 hyperelliptic curves cannot work against our attack algorithm in practice.展开更多
指出被广泛使用的电子邮件加密软件PGP(Pretty Good Privacy)的不足。讨论了最新的椭圆曲线密码体制ECC(E llipticCurve Cryptography)与RSA相比的优越性。并把椭圆曲线密码技术应用于电子邮件加密系统,设计并实现了一套电子邮件加密软...指出被广泛使用的电子邮件加密软件PGP(Pretty Good Privacy)的不足。讨论了最新的椭圆曲线密码体制ECC(E llipticCurve Cryptography)与RSA相比的优越性。并把椭圆曲线密码技术应用于电子邮件加密系统,设计并实现了一套电子邮件加密软件。与PGP相比,它的安全程度更高、技术更先进。展开更多
基金supported by the National Basic Research Program （973 Program）under Grant No.2013CB834205 the National Natural Science Foundation of China under Grant No.61272035 the Independent Innovation Foundation of Shandong University under Grant No.2012JC020
文摘In this paper, we present two explicit invalid-curve attacks on the genus 2 hyperelliptic curve over a finite field. First, we propose two explicit attack models by injecting a one-bit fault in a given divisor. Then, we discuss the construction of an invalid curve based on the faulted divisor. Our attacks are based on the fact that the Hyperelliptic Curve Scalar Multiplication (HECSM) algorithm does not utilize the curve parameters and We consider three hyperelliptic curves as the attack targets. For curve with security level 186 (in bits), our attack method can get the weakest invalid curve with security level 42 (in bits); there are 93 invalid curves with security level less than 50. We also estimate the theoretical probability of getting a weak hyperelliptic curve whose cardinality is a smooth integer. Finally, we show that the complexity of the fault attack is subexponential if the attacker can freely inject a fault in the input divisor. Cryptosystems based on the genus 2 hyperelliptic curves cannot work against our attack algorithm in practice.
文摘指出被广泛使用的电子邮件加密软件PGP(Pretty Good Privacy)的不足。讨论了最新的椭圆曲线密码体制ECC(E llipticCurve Cryptography)与RSA相比的优越性。并把椭圆曲线密码技术应用于电子邮件加密系统,设计并实现了一套电子邮件加密软件。与PGP相比,它的安全程度更高、技术更先进。
