Inverting the Final Exponentiation of Tate Pairings on Ordinary Elliptic Curves Using Faults

The calculation of the Tate pairing on ordinary curves involves two major steps: the Miller Loop (ML) followed by the Final Exponentiation (FE). The rst step for achieving a full pairing inversion would be to invert this FE, which in itself is a mathematically di cult problem. To our best knowledge, most fault attack schemes proposed against pairing algorithms have mainly focussed on the ML. They solved, if at all, the inversion of the FE in some special `easy' cases or even showed that the complexity of the FE is an intrinsic countermeasure against a successful full fault attack on the Tate pairing. In this paper, we present a fault attack on the FE whereby the inversion of the nal exponentiation becomes feasible using 3 independent faults.