Random key rotation: Side-channel countermeasure of NTRU cryptosystem for resource-limited devices. (October 2017)

• Record Type: Journal Article
• Authors: Wang, An; Wang, Ce; Zheng, Xuexin; Tian, Weina; Xu, Rixin; Zhang, Guoshuang
• Is Part Of: Computers & electrical engineering. Volume 63(2017)
• Page Start: 220
• Page End: 231
• Publication Date: 2017-10
• Subjects: NTRU -- Random key rotation -- Power analysis attacks -- Side-channel attacks -- Resource-limited devices; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2017.05.007
• Languages: English
• ISSNs: 0045-7906

Abstract

Highlights: Random key rotation (RKR) scheme for NTRU cryptosystem is proposed. RKR can protect NTRU against the existing side-channel attacks. Efficient RKR implementations by the way of both speed and area first are shown. Abstract: The NTRU algorithm, as IEEE P1363.1 standard, has been widely applied in resource-limited cryptosystems such as wearable embedded systems, smart cards, and so on. In 2013, Zheng et al. presented collision attack on three NTRU countermeasures from Lee et al., which are the only three countermeasures of NTRU against side-channel analysis so far. In this paper, we give a new countermeasure named Random Key Rotation (RKR) against the existing statistical side-channel analysis. According to analysis and experiments on STC89C52 microprocessor, little information of the key is leaked by collision attack, second-order correlation power analysis, etc. Furthermore, implementation schemes of RKR countermeasure in software and hardware are suggested. Under typical parameters, barrel shifter implementation of RKR only costs 8-bit extra register and one extra clock cycle (as well as 16 extra multiplexers). Graphical abstract: