attacking rsa crt signatures with faults on montgomery

Attacking RSACRT Signatures with Faults on Montgomery Multiplication - PowerPoint PPT Presentation

Apr 01, 2024 •227 likes •731 views

Attacking RSACRT Signatures with Faults on Montgomery Multiplication Pierre-Alain Fouque (INRIA) Nicolas Guillermin (DGA) Delphine Lerestreux (DGA) Mehdi Tibouchi (NTT) Jean-Christophe Zapalowicz (INRIA) CHES 2012 Jean-Christophe

  1. Attacking RSA–CRT Signatures with Faults on Montgomery Multiplication Pierre-Alain Fouque (INRIA) Nicolas Guillermin (DGA) Delphine Lerestreux (DGA) Mehdi Tibouchi (NTT) Jean-Christophe Zapalowicz (INRIA) CHES 2012 Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 1 / 15

  2. About this talk Cryptanalysis of RSA–CRT signatures which use of the efficient Montgomery Multiplication whatever the encoding function Fault attacks Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 2 / 15

  3. Montgomery multiplication algorithm Classical modular multiplication uses: multiplications, additions and divisions Montgomery multiplication (CIOS) uses... shifts instead of divisions! ⇒ cost only twice that of a non modular multiplication ¯ x = xR mod q is the Montgomery representation of x ( R constant) y · R − 1 mod q = xy · R mod q CIOS (¯ x , ¯ y ) = ¯ x ¯ Classical representation − → Montgomery representation: CIOS ( x , R 2 mod q ) = xR = ¯ x Montgomery representation − → Classical representation: CIOS (¯ x , 1 ) = xR = x Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 3 / 15

  4. Montgomery multiplication algorithm Classical modular multiplication uses: multiplications, additions and divisions Montgomery multiplication (CIOS) uses... shifts instead of divisions! ⇒ cost only twice that of a non modular multiplication ¯ x = xR mod q is the Montgomery representation of x ( R constant) y · R − 1 mod q = xy · R mod q CIOS (¯ x , ¯ y ) = ¯ x ¯ Classical representation − → Montgomery representation: CIOS ( x , R 2 mod q ) = xR = ¯ x Montgomery representation − → Classical representation: CIOS (¯ x , 1 ) = xR = x Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 3 / 15

  5. Montgomery multiplication algorithm Classical modular multiplication uses: multiplications, additions and divisions Montgomery multiplication (CIOS) uses... shifts instead of divisions! ⇒ cost only twice that of a non modular multiplication ¯ x = xR mod q is the Montgomery representation of x ( R constant) y · R − 1 mod q = xy · R mod q CIOS (¯ x , ¯ y ) = ¯ x ¯ Classical representation − → Montgomery representation: CIOS ( x , R 2 mod q ) = xR = ¯ x Montgomery representation − → Classical representation: CIOS (¯ x , 1 ) = xR = x Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 3 / 15

  6. Exponentiation algorithms Square-and-Multiply MSB Montgomery Ladder 1: function E XP L ADDER ( x , d , q ) x ← CIOS ( x , R 2 mod q ) ¯ 2: 1: function E XP MSB ( x , d , q ) 3: A ← R mod q x ← CIOS ( x , R 2 mod q ) 2: ¯ 4: for i = t down to 0 do 3: A ← R mod q 5: if d i = 0 then 4: for i = t down to 0 do 6: x ← CIOS ( A , ¯ ¯ x ) 5: A ← CIOS ( A , A ) 7: A ← CIOS ( A , A ) 6: if d i = 1 then 8: else if e i = 1 then 7: A ← CIOS ( A , ¯ x ) 9: A ← CIOS ( A , ¯ x ) return CIOS ( A , 1 ) = x d mod q 10: ¯ x ← CIOS (¯ x , ¯ 8: x ) return CIOS ( A , 1 ) = x d mod q 11: Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 4 / 15

  7. RSA–CRT signature p , q : two secret primes N = pq : public modulus e : public exponent d : secret exponent ed ≡ 1 mod (( p − 1 )( q − 1 )) RSA signature : S ≡ M d mod N RSA–CRT signature : 1: function S IGN RSA–CRT ( M ) S p ← M d mod p − 1 mod p 2: S q ← M d mod q − 1 mod q 3:   S = CRT ( S p , S q ) mod N   4: or    S = Garner ( S p , S q ) mod N 5: return S Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 5 / 15

  8. RSA–CRT signature p , q : two secret primes N = pq : public modulus e : public exponent d : secret exponent ed ≡ 1 mod (( p − 1 )( q − 1 )) RSA signature : S ≡ M d mod N RSA–CRT signature : 1: function S IGN RSA–CRT ( M ) S p ← M d mod p − 1 mod p 2: S q ← M d mod q − 1 mod q 3:   S = CRT ( S p , S q ) mod N   4: or    S = Garner ( S p , S q ) mod N 5: return S Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 5 / 15

  9. RSA–CRT signature p , q : two secret primes N = pq : public modulus e : public exponent d : secret exponent ed ≡ 1 mod (( p − 1 )( q − 1 )) RSA signature : S ≡ M d mod N RSA–CRT signature : 1: function S IGN RSA–CRT ( M ) S p ← M d mod p − 1 mod p 2: S q ← M d mod q − 1 mod q 3:   S = CRT ( S p , S q ) mod N   4: 4 × faster!! or    S = Garner ( S p , S q ) mod N 5: return S Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 5 / 15

  10. Bellcore attack 1: function S IGN RSA–CRT ( M ) S p ← M d mod p − 1 mod p 2: S q ← M d mod q − 1 mod q 3:   S = CRT ( S p , S q ) mod N   4: or    S = Garner ( S p , S q ) mod N 5: return S Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 6 / 15

  11. Bellcore attack 1: function S IGN RSA–CRT ( M ) S p ← M d mod p − 1 mod p 2: S q ← M d mod q − 1 mod q 3:   S = CRT ( S p , S q ) mod N   4: or    S = Garner ( S p , S q ) mod N 5: return S Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 6 / 15

  12. Bellcore attack 1: function S IGN RSA–CRT ( M ) S p ← M d mod p − 1 mod p 2: S q ← M d mod q − 1 mod q 3:   S = CRT ( S p , S q ) mod N   4: or    S = Garner ( S p , S q ) mod N 5: return S Attack S p → � S → � S p S S p � = M d mod p � S q = M d mod q S e � = M mod p S e = M mod q � � gcd ( � S e − M mod N , N ) = q Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 6 / 15

  13. Bellcore attack 1: function S IGN RSA–CRT ( M ) 2: M ← µ ( m ) ∈ Z N S p ← M d mod p − 1 mod p µ = deterministic encoding function ⇒ Attack works! 3: S q ← M d mod q − 1 mod q 4:   S = CRT ( S p , S q ) mod N   5: or    S = Garner ( S p , S q ) mod N 6: return S Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 6 / 15

  14. Bellcore attack 1: function S IGN RSA–CRT ( M ) 2: M ← µ ( m ) ∈ Z N S p ← M d mod p − 1 mod p µ = deterministic encoding function ⇒ Attack works! 3: S q ← M d mod q − 1 mod q 4:   S = CRT ( S p , S q ) mod N   5: µ = probabilistic encoding function: or    S = Garner ( S p , S q ) mod N 6: return S Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 6 / 15

  15. Bellcore attack 1: function S IGN RSA–CRT ( M ) 2: M ← µ ( m ) ∈ Z N S p ← M d mod p − 1 mod p µ = deterministic encoding function ⇒ Attack works! 3: S q ← M d mod q − 1 mod q 4:   S = CRT ( S p , S q ) mod N   5: µ = probabilistic encoding function: or    S = Garner ( S p , S q ) mod N 6: return S random sent with signature ⇒ Attack works! Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 6 / 15

  16. Bellcore attack 1: function S IGN RSA–CRT ( M ) 2: M ← µ ( m ) ∈ Z N S p ← M d mod p − 1 mod p µ = deterministic encoding function ⇒ Attack works! 3: S q ← M d mod q − 1 mod q 4:   S = CRT ( S p , S q ) mod N   5: µ = probabilistic encoding function: or    S = Garner ( S p , S q ) mod N 6: return S random sent with signature ⇒ Attack works! otherwise, in general (RSA–PSS . . . ) ⇒ No attack! Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 6 / 15

  17. For now: We focus on hardware designs for RSA signatures using: RSA–CRT Montgomery multiplication regardless of the encoding function Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 7 / 15

  18. Null faults: Presentation Fault model: force a small precomputed value to zero Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 8 / 15

  19. Null faults: Presentation Fault model: force a small precomputed value to zero 1: function CIOS( ¯ x , ¯ y ) 2: a ← 0 y mod 2 r y 0 ← ¯ ¯ 3: r : size of the registers k s.t R = 2 rk ( R > q , gcd ( q , R ) = 1) 4: for j = 0 to k − 1 do a 0 ← a mod 2 r 5: y 0 ) · q ′ mod 2 r q ′ = − q − 1 mod 2 r precomputed u j ← ( a 0 + ¯ x j · ¯ 6: � a + ¯ x j · ¯ y + u j · q � 7: a ← division implemented as right shift 2 r 8: if a ≥ q then a ← a − q yR − 1 mod q return a = ¯ x ¯ 9: Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 8 / 15

  20. Null faults: Presentation Fault model: force a small precomputed value to zero 1: function CIOS( ¯ x , ¯ y ) 2: a ← 0 y mod 2 r y 0 ← ¯ ¯ 3: r : size of the registers k s.t R = 2 rk ( R > q , gcd ( q , R ) = 1) 4: for j = 0 to k − 1 do a 0 ← a mod 2 r 5: y 0 ) · q ′ mod 2 r q ′ = − q − 1 mod 2 r precomputed u j ← ( a 0 + ¯ x j · ¯ 6: � a + ¯ x j · ¯ y + u j · q � 7: a ← division implemented as right shift 2 r 8: if a ≥ q then a ← a − q yR − 1 mod q return a = ¯ x ¯ 9: Objective: S = S q + q · ( q − 1 · ( S p − S q ) mod p ) (Garner) If � S q = 0 then gcd ( � S , N ) = q with a single faulted signature Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 8 / 15

  21. Null faults: Attacks 2 possible recombinations: S = S q + q · ( q − 1 · ( S p − S q ) mod p ) Garner: ⇒ S q in classical representation required 2 attacks: Attacking CIOS ( A , 1 ) ( A = S q ) Attacking consecutive CIOS steps Jean-Christophe Zapalowicz (INRIA) CHES 2012 September, 12th 2012 9 / 15

Recommend

RSA RSA RSA in OpenSSL RSA in Python Cryptography School of Engineering and Technology

RSA RSA RSA in OpenSSL RSA in Python Cryptography School of Engineering and Technology

Cryptography RSA RSA Algorithm Analysis of RSA Implementations of RSA RSA RSA in OpenSSL RSA in Python Cryptography School of Engineering and Technology CQUniversity Australia Prepared by Steven Gordon on 20 Feb 2020, rsa.tex, r1799

869 views • 29 slides
RSA Implementations of RSA RSA in OpenSSL RSA in Python Cryptography School of Engineering

RSA Implementations of RSA RSA in OpenSSL RSA in Python Cryptography School of Engineering

Cryptography RSA RSA Algorithm Analysis of RSA RSA Implementations of RSA RSA in OpenSSL RSA in Python Cryptography School of Engineering and Technology CQUniversity Australia Prepared by Steven Gordon on 20 Feb 2020, rsa.tex, r1799 1

522 views • 29 slides
Side Channel Attack to Actual Cryptanalysis: Breaking CRT-RSA with Low Weight Decryption

Side Channel Attack to Actual Cryptanalysis: Breaking CRT-RSA with Low Weight Decryption

Side Channel Attack to Actual Cryptanalysis: Breaking CRT-RSA with Low Weight Decryption Exponents Santanu Sarkar and Subhamoy Maitra Leuven, Belgium 12 September, 2012 Outline of the Talk RSA Cryptosystem CRT-RSA CRT-RSA having Low Hamming

403 views • 25 slides
Signatures Lecture 22 Signatures Signatures Signatures with various functionality/properties

Signatures Lecture 22 Signatures Signatures Signatures with various functionality/properties

Signatures Lecture 22 Signatures Signatures Signatures with various functionality/properties Signatures Signatures with various functionality/properties Constructions come in different flavors (well sample each flavor): Signatures

1.55k views • 131 slides
RSA-PSS Provable Secure RSA Signatures and their Implementation Overview What is RSA-PSS?

RSA-PSS Provable Secure RSA Signatures and their Implementation Overview What is RSA-PSS?

RSA-PSS Provable Secure RSA Signatures and their Implementation Overview What is RSA-PSS? Why RSA-PSS? Comparing original and standardized PSS Status of Protocols, Standards and Imple- mentations RSA-PSS in X.509

718 views • 19 slides
CRT Detector Simulation Andrew Olivier 7/25/2018 1 CRT Simulation Plan artDAQ Particle

CRT Detector Simulation Andrew Olivier 7/25/2018 1 CRT Simulation Plan artDAQ Particle

CRT Detector Simulation Andrew Olivier 7/25/2018 1 CRT Simulation Plan artDAQ Particle Generator Detector Simulation Geometry Timing CRT Decoder MCTruth Energy Deposit Particle Transport CRT detected in largeant Trigger

407 views • 14 slides
CRT Detsim to Reco: First Pass Richie Diurba (Minnesota) I finally got the code to work as of

CRT Detsim to Reco: First Pass Richie Diurba (Minnesota) I finally got the code to work as of

CRT Detsim to Reco CRT Reco Tracking CRT Detsim to Reco: First Pass Richie Diurba (Minnesota) I finally got the code to work as of 10:45 am CDT diurb001@umn.edu Basics CRT Detsim to Reco CRT Reco Tracking When not doing first year grunt

152 views • 11 slides
Digital Signatures Digital Signatures And Putting It All Together Digital Signatures And

Digital Signatures Digital Signatures And Putting It All Together Digital Signatures And

Digital Signatures Digital Signatures And Putting It All Together Digital Signatures And Putting It All Together Lecture 12 Digital Signatures Digital Signatures Syntax: KeyGen, Sign SK and Verify VK . Security: Same experiment as MAC s,

1.72k views • 142 slides
Facing Up to Faults Facing Up to Faults Facing Up to Faults (v.2.0.1) (v.2.0.1) (v.2.0.1)

Facing Up to Faults Facing Up to Faults Facing Up to Faults (v.2.0.1) (v.2.0.1) (v.2.0.1)

Facing Up to Faults Facing Up to Faults Facing Up to Faults (v.2.0.1) (v.2.0.1) (v.2.0.1) Brian Randell Brian Randell Brian Randell WADS-3, May 2004 1 The Menu The Menu The Menu On Dependability Concepts On Fault Assumptions

600 views • 20 slides
Ubiquitous faults T-79.4001 Seminar on Theoretical Computer Science Tero Pietilinen 4.4.2007

Ubiquitous faults T-79.4001 Seminar on Theoretical Computer Science Tero Pietilinen 4.4.2007

Nature of ubiquitous faults Communication Faults and Agreement Limits to Number of Ubiquitous Faults for Majority Unanimity in Spite of Ubiquitous Faults Ubiquitous faults T-79.4001 Seminar on Theoretical Computer Science Tero Pietilinen

685 views • 36 slides
CRT November Run Plans from the Software Side Richie Diurba diurb001@umn.edu October 25, 2019

CRT November Run Plans from the Software Side Richie Diurba diurb001@umn.edu October 25, 2019

CRT November Run Plans from the Software Side Richie Diurba diurb001@umn.edu October 25, 2019 1/15 Introduction 1 CRT basics and Goals for November Run 2 CRT Coverage Issues and their Solutions 3 CTB Run Outlines 2/15 Who Uses the CRT

372 views • 15 slides
Protodune Cosmic Ray tagger (CRT) Camillo Mariani ProtoDUNE DAQ Review November 3 rd and 4 th

Protodune Cosmic Ray tagger (CRT) Camillo Mariani ProtoDUNE DAQ Review November 3 rd and 4 th

Protodune Cosmic Ray tagger (CRT) Camillo Mariani ProtoDUNE DAQ Review November 3 rd and 4 th Introduction CRT motivations - System overview and trigger signals CRT Readout CRT Event Builder - 2 11/04/2016 Camillo Mariani |

409 views • 9 slides
Outline Review of RSA 1 CPSC 418/MATH 318 Introduction to Cryptography More on RSA,

Outline Review of RSA 1 CPSC 418/MATH 318 Introduction to Cryptography More on RSA,

Outline Review of RSA 1 CPSC 418/MATH 318 Introduction to Cryptography More on RSA, Probabilistic Encryption, Provable Security Against Efficiency of RSA 2 Passive Attacks Security of RSA 3 Mathematical Security of RSA Renate Scheidler

410 views • 7 slides
Signature sizes: RSA signatures are big. a call to action D. J. Bernstein University of

Signature sizes: RSA signatures are big. a call to action D. J. Bernstein University of

Signature sizes: RSA signatures are big. a call to action D. J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Signature sizes: RSA signatures are big. a call to action 1990 Schnorr signatures D. J.

355 views • 21 slides
INTERACTING FAULTS By Tyler Lagasse Faults typically form as a network How do we best

INTERACTING FAULTS By Tyler Lagasse Faults typically form as a network How do we best

INTERACTING FAULTS By Tyler Lagasse Faults typically form as a network How do we best interpret interacting faults and tell between different types of fault interaction? INTRODUCTION HOW DOES A FAULT NETWORK FORM? Forms within single

549 views • 21 slides
Fault Diagnosis of Discrete-Event Systems Alejandro White, Doctoral Candidate Advisor: Dr.

Fault Diagnosis of Discrete-Event Systems Alejandro White, Doctoral Candidate Advisor: Dr.

Fault Diagnosis of Discrete-Event Systems Alejandro White, Doctoral Candidate Advisor: Dr. Karimoddini Motivation Faults are always u Faults are unwanted u Faults are arbitrary u Faults are costly u Faults are DEADLY u Our motivation

495 views • 24 slides
Proposal of nonlinear optics measurements and correction in the IOTA ring M. Hofer , E.H. Maclean,

Proposal of nonlinear optics measurements and correction in the IOTA ring M. Hofer , E.H. Maclean,

Proposal of nonlinear optics measurements and correction in the IOTA ring M. Hofer , E.H. Maclean, R. Toms michael.hofer@cern.ch FAST/IOTA department meeting 1 10/04/2019 = = 2 2

226 views • 6 slides
3 -determinacy and higher type recursion P.D.Welch, CTFM-2017, Waseda Strategies for 0 3

3 -determinacy and higher type recursion P.D.Welch, CTFM-2017, Waseda Strategies for 0 3

0 3 -determinacy and higher type recursion P.D.Welch, CTFM-2017, Waseda Strategies for 0 3 -games: an outline The determinacy of this class of games was proven by Morton Davis 1 and this is a proof in analysis . For, recursively open,

226 views • 18 slides
Matt Watkins David Gao Francisco Lopez (now in San Sebastian) Tassem Sayed Sanliang

Matt Watkins David Gao Francisco Lopez (now in San Sebastian) Tassem Sayed Sanliang

Real world problems Some uses of cp2k in our* group Matt Watkins David Gao Francisco Lopez (now in San Sebastian) Tassem Sayed Sanliang Ling (now in chemistry) Alex Shluger* Modeling the Si/SiO 2 system Role of

727 views • 56 slides
!"#"$%&'()**+'(,$-- ."#"/)012/(&'()**+'0 !"#$%&'(

!"#"$%&'()**+'(,$-- ."#"/)012/(&'()**+'0 !"#$%&'(

!""#$%%&''()*(+*,'&+('-. !"#"$%&'()**+'(,$-- ."#"/)012/(&'()**+'0 !"#$%&'( )*+,%-./'$" -/0)*(+*,'&+('-. !"#$%&'())*+,#)'-%$#').+/01&2+"#$)34

726 views • 57 slides
A Constructive Approach to the Structure Theory for the Group Algebra of the Symmetric Group S n

A Constructive Approach to the Structure Theory for the Group Algebra of the Symmetric Group S n

A Constructive Approach to the Structure Theory for the Group Algebra of the Symmetric Group S n Murray R. Bremner (Canada), together with Sara Madariaga (Spain), and Luiz A. Peresi (Brazil) Department of Mathematics and Statistics,

1.43k views • 129 slides
t Prs rt

t Prs rt

t Prs rt rt r tr t r

671 views • 46 slides
Precision Higgs Measurements at Higgs factories LianTao Wang University of Chicago ICTP .

Precision Higgs Measurements at Higgs factories LianTao Wang University of Chicago ICTP .

Precision Higgs Measurements at Higgs factories LianTao Wang University of Chicago ICTP . Sept. 8, 2016 A first glance beyond the energy frontier 24 Present ATLAS Exotics Searches* - 95% CL Exclusion ATLAS Preliminary s = 8, 13 TeV

1.03k views • 81 slides
Path Integrals, asymptotic expansions and Zeta determinants Matthias Ludewig Universitt

Path Integrals, asymptotic expansions and Zeta determinants Matthias Ludewig Universitt

Path Integrals, asymptotic expansions and Zeta determinants Matthias Ludewig Universitt Potsdam February 11, 2016 Matthias Ludewig (Uni Potsdam) 11.02.16 1 / 24 The heat equation Let L = be a Laplace type operator, acting on

897 views • 64 slides

More recommend