Fault attacks on public key elements: application to DLP-based schemes

Many cryptosystems suffer from fault attacks when implemented in physical devices such as smart cards. Fault attacks on secret key elements have successfully targeted many protocols relying on the elliptic curve discrete logarithm problem (ECDLP), the integer factorization problem (IFP) or the discrete logarithm problem (DLP). More recently, faults attacks have also been designed against the public- key elements of ECDLP and IFP-based schemes. In this paper, we present the first fault attacks on the public key elements of DSA and ElGamal, two DLP-based signature schemes. Our attacks fully recover a 160-bit DSA secret key and a 1024-bit ElGamal secret key with ~ 4-10/sup 7/ and ~ 3-10/sup 6/ faulty signatures respectively. Such figures might suggest that DLP-based schemes are less prone to fault attacks than ECDLP- and IFP-based schemes. However, the integrity of public keys should always be checked in order to thwart such attacks since improvements may reduce the required amount of faulty signatures in the near future.Anglai