Can Elliptic Curve feature

feature
Cryptography Be Trusted?
A Brief Analysis of the Security of a Popular Cryptosystem

Many smart card, cell phone, Internet of Things (IoT) Layer (TLS/SSL), Internet Key Exchange (IKE),
and Bitcoin businesses have already implemented Secure Shell (SSH), Domain Name System Security
elliptic curve cryptography (ECC), and for good Extensions (DNSSEC), Pretty Good Privacy/Gnu
reason. This asymmetric encryption and decryption Privacy Guard (PGP/GPG), Secure/Multipurpose
method is shown by the US National Institute of Internet Mail Extensions (S/MIME), RFC 3161, most
Standards and Technology (NIST) and third-party things with digital signatures (e.g., digitally signed
studies to significantly outperform its biggest portable document formats [PDFs]), Z and Real Time
competitors, offering significantly shorter keys, lower Transport Protocol (ZRTP), and Secure Internet Live
central processing unit (CPU) consumption and Conferencing (SILC) all deeply rely on asymmetric
lower memory usage.1, 2 encryption and decryption in one way or another.

As security is an instrumental aspect of Once it is established that asymmetric encryption is

cryptography, it is important to evaluate every needed, it is time to choose the best-fitting tool. The
cryptogram carefully—not only for efficiency, statistics look great for ECC. NIST-recommended
but also for imperviousness against all kinds of key-size tables depict the shorter key advantage
cryptographic attacks. There are multiple ways to ECC has. For an equivalent symmetric key size of
assess the security capabilities of ECC to determine 80 bits, RSA requires 1,024 bits, while ECC requires
if it is a worthwhile venture. 160 bits (a 3:1 ratio). When the symmetric key size
grows to 256 bits, the ratio jumps up to 64:1. Thus,
What vulnerabilities or possible weaknesses in design elliptic curves are computationally lighter for longer
exist with ECC? Can ECC withstand the test of time, keys.3 Further studies show that the time different
and what implementation issues does it face? processors take to encrypt and/or decrypt data can
be 400 times faster for ECC than for an equivalent
ECC for Security RSA length.4
Although there is no such thing as a perfect, widely
applicable and unbreakable cryptosystem, there The security side of ECC is complex. As of today,
are many ways to keep data safe when at rest and there are numerous standards defining and
when in motion. There exist a variety of classes of governing it, including the American National
cryptoalgorithms, including hashing algorithms, Standards Institute’s (ANSI) X9.62, the Institute of
symmetric cryptoalgorithms and asymmetric Electrical and Electronics Engineers’ (IEEE) P1363, Do you have
the Standards for Efficient Cryptography Group something
cryptoalgorithms. ECC, just like RSA, falls under
(SECG), NIST’s Federal Information Processing to say about
the asymmetric algorithm (public/private key)
classification. This type of cryptogram solves a Standards (FIPS) 186-2, ANSI X9-63, Brainpool, the this article?
US National Security Agency’s (NSA’s) Suite B, and Visit the Journal
variety of problems, one of which is allowing two
ANSI FRP256V1. pages of the ISACA
nodes or individuals who have never communicated web site (www.isaca.
to each other before to pass information to each org/journal),find the
other in a secure manner. These algorithms are also ECC is adaptable to a wide range of cryptographic
article and click on
a crucial cog in the mechanism of many protocols, schemes and protocols, such as the Elliptic Curve the Comments link to
standards, services and infrastructures. Bitcoin, Diffie-Hellman (ECDH), the Elliptic Curve Digital share your thoughts.
X.509/PKI, Transport Layer Security/Secure Sockets Signature Algorithm (ECDSA) and the Elliptic
Curve Integrated Encryption Scheme (ECIES). The
mathematical inner workings of ECC cryptography
Veronika Stolbikova and cryptanalysis security (e.g., the Weierstrass
Currently works as a principal infrastructure analyst
(information security risk management) at Quintiles. equation that describes elliptical curves, group theory,
Her areas of interest include security posture and quadratic twists, quantum mechanics behind the
vulnerability assessments, security risk management, Shor attack and the elliptic-curve discrete-logarithm
secure development, and cryptography. problem) are complex.

ISACA JOURNAL VOL 3 1

 Currently Known Attacks (a scalar multiplication technique used to compute)
into the ECC instead of using one of the other
There are a significant number of potential similar techniques (e.g., double-and-add, sliding
vulnerabilities to elliptic curves, such as side-channel window). Not only do Montgomery ladders have
attacks and twist-security attacks. These attacks the advantage of providing fast scalar multiplication
threaten to invalidate the security ECC aims to for ECC, but they also tend to behave regularly,
provide to private keys. masking the computation against timing and simple
Side-channel attacks generally occur when power-side-channel attacks.6 Unfortunately, not all
measurements are made on the physical existing ECC curves support the use of ladders.
implementation of a cryptosystem, resulting The number of curves that do not support this
in leaks of information. Side-channel analysis technique is vast (e.g., Anomalous, NIST P-224, BN
includes a variety of attacks, such as simple timing [2,254], BrainpoolP256t1, ANSSI FRP256v1), so it
attacks, simple power attacks, differential power is important to check if one’s ECC implementation
attacks and fault analysis.5 During timing attacks, uses a curve that both implements and supports
for instance, the malicious user measures the Montgomery ladders.7 Furthermore, simple timing
difference in time between observed peaks in power attacks can be prevented by inserting dummy adds
consumption with an oscilloscope. Relying on the into the algorithm to act as an ignored variable;
fact that different operations or input values have a this makes the number of process operations to be
significant time variance, the attacker can deduce performed the same regardless of the value of the
the secret key. Power attacks, on the other hand, secret key.8 DPA-type side-channel attacks can be
are similar to timing attacks except for the fact that prevented in a variety of manners, including adding
the actual shape and amplitude of voltage peaks is
significant entropy to the secret key, disguising
analyzed by the attacker. A variety of power attacks
group points and using randomized projective
exist, including simple power analysis (SPA) and
coordinates.9
differential power analysis (DPA).
Another category of attacks on elliptic curves is
Simple countermeasures exist for all types of
known as twist-security (fault) attacks. Such attacks
side-channel attacks. Both timing and simple-
usually succeed when several conditions are met,
power attacks can be prevented with the
and they all lead to the leakage of the victim’s private
implementation of the Montgomery power ladder
key. Typically during a twist attack, the malicious
party shares a carefully selected public key that
does not lie on the agreed-upon ECC curve and
that will lead to a shared key that can be easily
reversed. After the victim computes a shared key
(computed out of the victim’s private key and the
malicious public key) and computes a hash out
of the shared key, the malicious party is able to
extract the victim’s secret key. Twist attacks can be
broken down into many subcategories including
small-subgroup attacks, invalid-curve attacks
and invalid-curve attacks against Montgomery
ladders. Small-subgroup attacks make it possible
to simply enumerate the victim’s private key by
using a carefully selected point of small order as
the public key. During the much more severe invalid
curve attacks, the attacker picks a point of small

2 ISACA JOURNAL VOL 3

order that lies on an elliptical curve with a different Issues With ECC Implementation
constant coefficient. However, as invalid-curve
attacks are limited by the use of ladders such as the History has shown that, although a secure
aforementioned Montgomery ladder, specific twist implementation of the ECC curve is theoretically
attacks exist against those as well.10 However, possible, it is not easy to achieve. In fact, incorrect
twist-security attacks generally are fairly easily implementations can lead to ECC private key leaks
mitigated by careful choices of curves and validation in a number of scenarios. Such leaks can occur
when incorrect results are calculated and when
of various parameters.
the input does not end up on the selected curve.
Furthermore, they can happen when branch-timing
Possible Future Attacks
errors occur or when cache-timing errors occur. In a
While quantum computing is already facing a large nutshell, a lot of things can go wrong while ECC is
variety of problems, such as its poor decoherence being implemented.13
rates, error correction issues, state preparation
There are numerous examples of how failed
issues and problems with quantum gates,11 its
implementation of ECC algorithms resulted in
advancement may bring additional challenges
significant vulnerabilities in the cryptographic
to ECC once it becomes a technological reality
software. A great example is that of the Sony ECDSA
instead of the theoretical concept it is today. As
security disaster. Although Sony used ECDSA to
quantum computers continue making strides in
sign software for their PlayStation game console,
development, businesses must consider if quantum
they did not properly implement the algorithm. Using
computers have potential implications on their ECC
static parameters instead of random ones made
implementations. Sony’s implementation of the algorithm solvable and Enjoying
subsequently useless.14 this article?
Quantum computing will provide two major
cryptanalytic weapons: Shor’s and Grover’s Furthermore, there are examples of improper • Learn more about,
algorithms (and variations thereof). Shor attacks make implementation of ECC in OpenSSL that resulted discuss and
factoring easy, essentially making it trivial for the in common vulnerabilities, such as Common collaborate on
attacker to uncover the secret key in an asymmetric Vulnerability and Exposure (CVE)-2014-3572, access control and
cryptosystem. Grover attacks make brute-forcing CVE-2014-0076 and CVE-2008-5077. These cybersecurity in the
easier by creating a uniform superposition over all vulnerabilities range from omission of the server key Knowledge Center.
possible inputs, destructively interfering states that are exchange message to malformed signatures. Worse, www.isaca.org/
invalid and, consequently, finding inputs that satisfy such issues can lead to an unauthenticated, remote knowledgecenter
a given function. Shor’s and Grover’s algorithms may attacker gaining access to Secure Sockets Layer
have major implications not only for ECC, but also for (SSL) private keys. Improper implementation issues
asymmetric cryptography altogether. Furthermore, are a frightening security issue and must be tackled
ECC’s advantage in shorter key lengths in classical through security code review, static code analysis
computing will prove to be a disadvantage in quantum and penetration testing.
computing. ECC will be easier to break than RSA
cryptosystems due to a lower qubits (quantum
Possible NSA Backdoor
equivalents of traditional bits) requirement.12 While Over the last 10 years, there has been serious media
quantum computers present a frightening threat and security community speculation that the NSA
to ECC and asymmetric cryptography, this is not inserted a backdoor into one of the ECC standards,
imminent, as quantum computers need to first undermining its strength.15 While there are currently
overcome some very difficult physical limitations. many other third-party Cryptographically Secure

ISACA JOURNAL VOL 3 3

 Pseudo-random Number Generator (CSPRNG) and cryptosystems that can survive extensive community
ECC standards in existence that remain outside of testing over time can be considered as having
the scope of this issue, the suspicions first fell on withstood the test of time. Equally, most security
the Dual Elliptic Curve Deterministic Random Bit analysts strongly advise against using security
Generator (Dual_EC_DRBG) elliptic curve pseudo- through obscurity (relying on the algorithm not to be
random generator that was used in the algorithm. known to the attacker).19
One of the weaknesses publicly identified at the
time had all the markings of a purposefully designed ECC’s strength can be analyzed by determining
CSPRNG backdoor.16 A 2013 Reuters report of a how well it has withstood the test of time. For
secret US $10 million deal with RSA only served example, ECC has faced multiple successful and
to fuel these fires.17 After this revelation and much unsuccessful brute-force attacks. In 2004, a team
public debate, Dual_EC_DRBG was excluded from of mathematicians with 2,600 computers that were
the standards and is no longer used. used over a period of 17 months completed the
Certicom Elliptic Curve Cryptography (ECC) 2-109
However, there are now challenge.20 In 2009, the 112-bit prime ECDLP was
similar suspicions about solved using 200 PlayStation 3 consoles.21 However,
There is no NIST Standard Curves. to date, cryptanalysts believe that the 160 bit-prime
Since the Edward field ECC should remain secure against public
guarantee that any Snowden revelations, attempts until at least 2020.22
one team could there has been
significant concern that For the first 30 or so years of ECC’s existence,
efficiently find the ECC pseudo-random elliptical curves in cryptography were analyzed and
number generator was experimented with mostly for theoretic and aesthetic
all existing and fabricated to inject an reasons. However, during the 1990s, ECC rose in
yet-to-be-discovered NSA backdoor into ECC popularity. This resulted both in publicity backlash and
cryptography.18 However, significant scrutiny of ECC by opponents attempting
weaknesses in a the debate is still to find flaws in it. While the debate between RSA
cryptosystem. ongoing on this subject.
Some cryptographers
and ECC continued, the latter cryptosystem finally
achieved status as an accepted standard. In the
suspect that curves end, however, ECC did not significantly rise to fame
were deliberately until the NSA published “The Case for Elliptic Curve
chosen as having a mathematical weakness known Cryptography” in 2005.23 Nonetheless, it can be said
only to the NSA. Others argue that some security that ECC has been available for everyone to test for
considerations were not widely understood at the quite some time now and that the public should be
time the NIST curves were introduced and that fairly comfortable that ECC is not merely based on
some security issues were due to NIST using the security through obscurity.
US Secure Hash Algorithm 1 (SHA1) to generate
algorithm parameters. Conclusion

Test of Time Despite the significant debate on whether there

is a backdoor into elliptic curve random number
All cryptographers work toward a common goal: generators, the algorithm, as a whole, remains
to create a cryptosystem that is too hard to break. fairly secure. Although there are several popular
In a sense, one could consider a cryptosystem’s vulnerabilities in side-channel attacks, they are easily
resistance capability to malicious attacks as its mitigated through several techniques. Quantum
quality. However, while other products, such as cars, attacks loom over ECC, but they are yet to be
can be tested for quality by their own manufacturer widely available. Although twist-security attacks
or approved third parties, there is no guarantee that can threaten ECC, they can be militated against.
any one team could efficiently find all existing and Furthermore, although longer ECC keys are broken
yet-to-be-discovered weaknesses in a cryptosystem. into publicly every now and then, the same is true
Thus, the security community generally recommends for all other popular algorithm types. But no matter
opening up new cryptoalgorithms for the world to how secure ECC is theoretically, it must be properly
test the system against various types of threats. Only implemented. History has shown that such a thing

4 ISACA JOURNAL VOL 3

is not trivial, as large teams and corporations have videos-within-581/?s=68e141dc91333038e2223
failed to achieve this goal. Above everything else, ee86e3c748f
the aforementioned reality highlights the necessity 15 Schneier, B.; “Did NSA Put a Secret Backdoor
for proper testing of both security and proper
in New Encryption Standard?,” Schneier on
implementation of the algorithm.
Security blog, 15 November 2007, https://www.
Endnotes schneier.com/essays/archives/2007/11/did_nsa_
put_a_secret.html
1 National Security Agency (NSA), “The Case for
16 Schneier, B.; “The NSA Is Breaking Most
Elliptic Curve Cryptography,” USA, 2015
2 Lauter, K.; “Elliptic Curve Cryptography for Encryption on the Internet,” Schneier on Security
Wireless Security,” Microsoft Corp., 2004, blog, 5 September 2013, https://www.schneier.
www.msr-waypoint.com/en-us/um/people/ com/blog/archives/2013/09/the_nsa_is_brea.
klauter/ieeefinal.pdf html#c1675929
3  Op cit, NSA 17 Menn, J.; “Exclusive: Secret Contract
4  Op cit, Lauter
Tied NSA and Security Industry Pioneer,”
5 Bar-El, H.; “Introduction to Side Channel
Attacks,” Discretix Technologies Ltd., 2003 Reuters, 20 December 2013, www.reuters.
6 Joyce, M.; S.-M. Yen; et al.; “The Montgomery com/article/2013/12/20/us-usa-security-rsa-
Powering Ladder,” Cryptographic Hardware idUSBRE9BJ1C220131220
and Embedded Systems, CHES 2002, volume 18 Hales, C.; “The NSA Back Door to NIST,”
2523, Lecture Notes in Computer Science,
Notices of the AMS, vol. 61, no. 2, www.ams.org/
Springer-Verlag, 2003, p. 291-302,
https://choucroutage.com/Papers/ notices/201402/rnoti-p190.pdf
SideChannelAttacks/ches-2002-joye.pdf 19 Douligeris, C.; D. N. Serpanos; “Network
7 Bernstein, D.; T. Lange; et al.; “SafeCurves: Security: Current Status and Future Directions,”
Choosing Safe Curves for Elliptic-curve IEEE, 2007
Cryptography,” http://safecurves.cr.yp.to 20 Certicom, “Certicom Announces Elliptic Curve
8 Kadir, S.; A. Sasongko; et al.; “Simple
Cryptography Challenge Winner,” 27 April 2004,
Power Analysis Attack Against ECC
Processor on FPGA Implementation,” https://www.certicom.com/news-releases/300-
2011, http://140.98.202.196/xpl/ solution-required-team-of-mathematicians-2600-
articleDetails. jsp?arnumber= computers-and-17-months-
6021757&reload=true&searchWithin= 21 Bos, J.; M. Kaigara; et al.; “PlayStation 3
%22Authors%22:.QT.Sasongko,%20A..
Computing Breaks 2^60 Barrier 112-bit Prime
QT.&newsearch=true
9 Coron, J. S.; “Resistance Against Differential ECDLP Solved,” Laboratory for Cryptological
Power Analysis for Elliptic Curve Cryptosystems, Algorithms, 25 November 2015, http://lacal.epfl.
Cryptographic Hardware and Embedded ch/112bit_prime
Systems,” Lecture Notes in Computer Science, 22 Bos, J.; M. Kaigara; et al.; “On the Security
vol. 1717, 1999
of 1024-bit RSA and 160-bit Elliptic Curve
10  Op cit, Bernstein
Cryptography,” Microsoft Research,
11 Ponnath, A.; “Difficulties in the Implementation of
Quantum Computers,” 2006, http://arxiv.org/pdf/ 1 September 2009, http://lacal.epfl.ch/files/
cs/0602096.pdf content/sites/lacal/files/papers/ecdl2.pdf
12 Yan, S. Y.; Quantum Attacks on the Public-Key 23 Koblitz, A. H.; N. Koblitz; A. Menezes; “Elliptic
Cryptosystems, Springer, USA, 2013 Curve Cryptography: The Serpentine Course
13  Op cit, Bernstein
of a Paradigm Shift,” Journal of Number
14 The Central Scrutinizer, “Sony’s PS3 Security Is
Epic Fail—Videos Within,” PSX-Scene Forum, Theory, vol. 131, iss. 8, 2011, p. 781-814
29 December 2010, http://psx-scene.com/ www.sciencedirect.com/science/article/pii/
forums/content/sony-s-ps3-security-epic-fail- S0022314X09000481

ISACA JOURNAL VOL 3 5