Method for securing against fault attacks a verification algorithm of a digital signature of a message

A method for operating a client device to secure the client device against fault attacks while the client device executes a verification algorithm of a digital signature of a message (e) using a public key (Q),

• wherein said digital signature comprises a first part (r) and a second part(s), and
• wherein the digital signature verification algorithm is a DSA (Digital Signature Algorithm) algorithm, G, Q, p, n being integers, wherein
• the client device comprises a processor and memory with software code instructions that execute on the processor to perform:
• generation steps of a plurality of intermediate parameters comprising:
• generating the first intermediate parameter U1 such that:
• U1=e·s−1 mod n;
• generating the second intermediate parameter U2 such that:
• U2=r·s−1 mod n;
• generating the third intermediate parameter X such that X=Gu1·Qu2 mod p;
• generating the fourth intermediate parameter x such that:
• x=X mod n;
• generating the fifth intermediate parameter R such that R=x;
• a signature comparison final step comprising a test of equality between said fifth intermediate parameter and said digital signature first part (r), and in case of equality, validating the digital signature (r, s) for the message e and the public key Q,
• and wherein said method comprises, determining a fault attack against the client device by performing by said client device before said signature comparison final step:
• checking that the first intermediate parameter U1 and/or the second intermediate parameter U2 as generated by the client device is different from zero modulo n;
• computing k times the first intermediate parameter U1 as generated by the client device and/or the second intermediate parameter U2 as generated by the client device and checking that the results of these computations are identical, with k an integer >1;
• performing at least one check of a mathematical relationship among:
• checking that a mathematical relationship between {U1, e, s, n} as generated by the client device is satisfied;
• checking that a mathematical relationship between {U2, r, s, n} as generated by the client device is satisfied;
• checking that a mathematical relationship between {U1, U2, e, r, n} as generated by the client device is satisfied;
• triggering a fault attack countermeasure, comprising at least one selected among a group consisting of interrupting the verification algorithm execution, and rebooting the client device, when at least one of the performed checks has failed thus indicating a fault attack against the client device.

A method for operating a client device to secure the client device against fault attacks while the client device executes a verification algorithm of a digital signature of a message (e) using a public key (Q),

• wherein said digital signature comprises a first part (r) and a second part(s), and
• wherein the digital signature verification algorithm is a GOST 34.11.12 algorithm, n being an integer, G, Q being elliptic curve points, wherein the client device comprises a processor and memory with software code instructions that execute on the processor to perform:
• generation steps of a plurality of intermediate parameters comprising
• generating a sixth intermediate parameter v such that v=e−1 mod n;
• generating the first intermediate parameter U1 such that U1=sv mod n;
• generating the second intermediate parameter U2 such that U2=−rv mod n;
• generating the third intermediate parameter X such that X=[U1]·G+ [U2]·Q;
• generating the fourth intermediate parameter x such that x=x-coordinate (X) mod n;
• generating the fifth intermediate parameter R such that R=x;
• a signature comparison final step comprising a test of equality between said fifth intermediate parameter and said digital signature first part (r), and in case of equality,
• validating the digital signature (r, s) for the message e and the public key Q,
• said method comprising determining a fault attack against the client device by said client device before said signature comparison final step:
• checking that the first intermediate parameter U1 as generated by the client device and/or the second intermediate parameter U2 as generated by the client device is different from zero modulo n,
• computing k times the first intermediate parameter U1 as generated by the client device and/or the second intermediate parameter U2 as generated by the client device and checking that the results of these computations are identical, with k an integer >1,
• performing at least one check of a mathematical relationship among:
• checking that a mathematical relationship between {U1, e, s, n} generated by the client device is satisfied;
• checking that a mathematical relationship between {U2, r, e, n} as generated by the client device is satisfied;
• checking that a mathematical relationship between {U1, U2, r, s, n} as generated by the client device is satisfied;
• triggering a fault attack countermeasure, comprising at least one selected from a group consisting of among interrupting the verification algorithm execution, and rebooting the client device, when at least one of the performed checks has failed thus indicating a fault attack against the client device.

A method for operating a client device to secure the client device against fault attacks while the client device executes a verification algorithm of a digital signature of a message (e) using a public key (Q),

• wherein said digital signature comprises a first part (r) and a second part(s), and
• wherein the digital signature verification algorithm is a SM2 (GM/T 0003.3-2012) algorithm and comprises, n being an integer, G, Q being elliptic curve points, wherein the client device comprises a processor and memory with software code instructions that execute on the processor to perform:
• generation steps of a plurality of intermediate parameters comprising:
• generating a seventh intermediate parameter t such that t=r+s mod n with r and s integers in [1, n−1];
• generating a third intermediate parameter X such that X=[s]·G+[t]·Q, G being a base point of an elliptic curve;
• generating a fourth intermediate parameter x such that x=x-coordinate (X) mod n;
• generating a fifth intermediate parameter R such that R=x+e mod n;
• a signature comparison final step comprising a test of equality between said fifth intermediate parameter and said digital signature first part (r), and in case of equality, validating the digital signature (r, s) for the message e and the public key Q;
• said method comprising determining a fault attack against the client device by said client device before said signature comparison final step performing:
• checking that the fourth intermediate parameter x and/or R-e as generated by the client device is different from zero modulo n;
• computing k times the fourth intermediate parameter x as generated by the client device and/or the fifth intermediate parameter R as generated by the client device and checking that the results of these computations are identical, with k an integer >1;
• checking that at least one mathematical relationship between the third, fourth, fifth intermediate parameters X, x, R and said message e as generated by the client device, is verified comprising:
• checking that R−x mod n=e;
• checking that the resulting point X with x-coordinate x lies on the elliptic curve;
• triggering a fault attack countermeasure, comprising at least one selected from a group consisting of among interrupting the verification algorithm execution, and rebooting the client device, when at least one of the performed checks has failed thus indicating a fault attack against the client device.