Cryptographic Hardware and Embedded Systems - CHES 2013

Volume 8086 of the series Lecture Notes in Computer Science pp 365-382

Inverting the Final Exponentiation of Tate Pairings on Ordinary Elliptic Curves Using Faults

  • Ronan LashermesAffiliated withCEA-TechRegUVSQ-PRiSM
  • , Jacques FournierAffiliated withCEA-TechReg
  • , Louis GoubinAffiliated withUVSQ-PRiSM

* Final gross prices may vary according to local VAT.

Get Access


The calculation of the Tate pairing on ordinary curves involves two major steps: the Miller Loop (ML) followed by the Final Exponentiation (FE). The first step for achieving a full pairing inversion would be to invert this FE, which in itself is a mathematically difficult problem. To our best knowledge, most fault attack schemes proposed against pairing algorithms have mainly focussed on the ML. They solved, if at all, the inversion of the FE in some special ‘easy’ cases or even showed that the complexity of the FE is an intrinsic countermeasure against a successful full fault attack on the Tate pairing. In this paper, we present a fault attack on the FE whereby the inversion of the final exponentiation becomes feasible using 3 independent faults.


Tate pairing Ate pairing final exponentiation fault attacks