Efficient Leak Resistant Modular Exponentiation in RNS Andrea - PowerPoint PPT Presentation

Efficient Leak Resistant Modular Exponentiation in RNS Andrea Lesavourey (1) , Christophe Negre (1) and Thomas Plantard (2) (1) DALI (UPVD) and LIRMM (Univ. of Montpellier, CNRS), Perpignan, France (2) CCISR, SCIT, University of Wollongong, Wollongong, Australia 24-th Symposium on Computer Arithmetic, London, July 26, 2017 1 / 19

Outline Cryptography 1 RSA cryptosystem Power analysis Montgomery multiplication in RNS Randomized modular exponentiation in RNS 2 Randomized Montgomery multiplication Proposed approach Level of randomization Conclusion 3 2 / 19

Outline Cryptography 1 RSA cryptosystem Power analysis Montgomery multiplication in RNS Randomized modular exponentiation in RNS 2 Randomized Montgomery multiplication Proposed approach Level of randomization Conclusion 3 3 / 19

RSA encryption (Rivest, Shamir and Adleman) Bob chooses p and q two large prime numbers and computes N = pq . He generates E and D two integers such that ED = 1 (mod ( p − 1)( q − 1)). Public Key: N , D . Private Key: E , p , q . Alice encrypts a message m by: c = m D mod N . Bob decrypts c by doing: c E = m ED mod N = m . 4 / 19

An algorithm for modular exponentiation : Right-to-left Square-and-multiply Require: A modulus N , an integer X ∈ [0 , N [ and an exponent E = ( e ℓ − 1 , . . . , e 0 ) 2 Ensure: R = X E (mod N ) ℓ − 1 e i 2 i � 1: R ← 1 X E = X i =0 2: Z ← X 3: for i from 0 to ℓ − 1 do X E = X e ℓ − 1 2 ℓ − 1 ×· · ·× X e 1 2 1 × X e 0 2 0 if e i = 1 then 4: R ← R × Z (mod N ) 5: end if 6: Z ← Z 2 (mod N ) 7: 8: end for 9: return R 5 / 19

Simple power analysis E = ( e ℓ , . . . , e 0 ) 2 and X ∈ [0 , N [ ↑ Square-and-multiply R ← 1 Z ← X for i = 0 to ℓ − 1 do if e i = 1 then mod N R ← R · Z endif Z ← Z 2 mod N endfor return ( R ) 6 / 19

Simple power analysis E = ( e ℓ , . . . , e 0 ) 2 and X ∈ [0 , N [ ↑ Square-and-multiply-always Square-and-multiply Montgomery-ladder R 0 ← 1 R ← 1 R ← 1 R 1 ← 1 Z ← X R ′ ← X Z ← X for i = 0 to ℓ − 1 do for i = ℓ to 1 do for i = 0 to ℓ − 1 do if e i = 1 then if k i = 1 then if e i = 0 then mod N R ← R · Z R ← R · R ′ mod N R 0 ← R 0 · Z mod N endif R ′ ← R ′ 2 else mod N Z ← Z 2 mod N R 1 ← R 1 · Z mod N else endfor endif R ′ ← R · R ′ mod N return ( R ) endfor R ← R 2 Z ← Z 2 mod N endif return ( R 1 ) endfor return ( R ) ↓ ↓ 6 / 19

Differential power analysis m loop 1 loop 2 loop 3 loop 4 loop 5 e 1 = 1 e 2 = 0 e 3 = 1 e 4 = 0 e 5 =?? 7 / 19

Differential power analysis m loop 1 loop 2 loop 3 loop 4 loop 5 e 1 = 1 e 2 = 0 e 3 = 1 e 4 = 0 e 5 =?? 0 r 5 r 1 r 2 r 3 r 4 r ′ 1 5 7 / 19

Differential power analysis m loop 1 loop 2 loop 3 loop 4 loop 5 e 1 = 1 e 2 = 0 e 3 = 1 e 4 = 0 e 5 =?? 0 r 5 r 1 r 2 r 3 r 4 r ′ 1 5 trace 1 trace 2 trace 3 . . . . . . . . . . . . trace L 7 / 19

Differential power analysis m loop 1 loop 2 loop 3 loop 4 loop 5 e 1 = 1 e 2 = 0 e 3 = 1 e 4 = 0 e 5 =?? 0 r 5 r 1 r 2 r 3 r 4 r ′ 1 5 trace 1 Differentials: trace 2 correct guess trace 3 . . . . . wrong guess . . . . . . . trace L 7 / 19

Differential power analysis m loop 1 loop 2 loop 3 loop 4 loop 5 e 1 = 1 e 2 = 0 e 3 = 1 e 4 = 0 e 5 =?? 0 r 5 r 1 r 2 r 3 r 4 r ′ 1 5 trace 1 Differentials: trace 2 correct guess trace 3 . . . . . wrong guess . . . . . . . trace L Counter-measure: Randomization of the exponent and data. 7 / 19

Montgomery multiplication Basic modular multiplication. For X , Y ∈ [0 , N [ Product. Z ← X × Y 1 Reduction. Q ← ⌊ Z / N ⌋ and R ← Z − Q × N 2 8 / 19

Montgomery multiplication Basic modular multiplication. For X , Y ∈ [0 , N [ Product. Z ← X × Y 1 Reduction. Q ← ⌊ Z / N ⌋ and R ← Z − Q × N 2 X Montgomery Multiplication × Y Require: X , Y ∈ [0 , N [ and A = 2 n > N Z 1 Z 0 Ensure: R = X × Y × A − 1 (mod N ) 1: Z ← X × Y 2: Q ← N − 1 × Z (mod A ) 3: R ← ( Z − Q × N ) / A

Montgomery multiplication Basic modular multiplication. For X , Y ∈ [0 , N [ Product. Z ← X × Y 1 Reduction. Q ← ⌊ Z / N ⌋ and R ← Z − Q × N 2 X Montgomery Multiplication × Y Require: X , Y ∈ [0 , N [ and A = 2 n > N Z 1 Z 0 Ensure: R = X × Y × A − 1 (mod N ) − ∗ = Q × N Z 0 1: Z ← X × Y 2: Q ← N − 1 × Z (mod A ) 3: R ← ( Z − Q × N ) / A 8 / 19

Montgomery multiplication Basic modular multiplication. For X , Y ∈ [0 , N [ Product. Z ← X × Y 1 Reduction. Q ← ⌊ Z / N ⌋ and R ← Z − Q × N 2 X Montgomery Multiplication × Y Require: X , Y ∈ [0 , N [ and A = 2 n > N Z 1 Z 0 Ensure: R = X × Y × A − 1 (mod N ) − ∗ = Q × N Z 0 1: Z ← X × Y 2: Q ← N − 1 × Z (mod A ) R 0 3: R ← ( Z − Q × N ) / A × 2 − n R 8 / 19

Montgomery multiplication Basic modular multiplication. For X , Y ∈ [0 , N [ Product. Z ← X × Y 1 Reduction. Q ← ⌊ Z / N ⌋ and R ← Z − Q × N 2 X Montgomery Multiplication × Y Require: X , Y ∈ [0 , N [ and A = 2 n > N Z 1 Z 0 Ensure: R = X × Y × A − 1 (mod N ) − ∗ = Q × N Z 0 1: Z ← X × Y 2: Q ← N − 1 × Z (mod A ) R 0 3: R ← ( Z − Q × N ) / A × 2 − n R Montgomery representation. � X = XA mod N provides 1 Y ) = ( XA ) × ( YA ) × A − 1 mod N = XYA mod N MontMul ( � X , � 2 8 / 19

Montgomery multiplication in residue number system Let A = { a 1 , . . . , a t } be a set t co-prime integers. 9 / 19

Montgomery multiplication in residue number system Let A = { a 1 , . . . , a t } be a set t co-prime integers. An integer X such that 0 ≤ X < A = � t i =1 a i is represented by [ X ] A = ( x 1 = X mod a 1 , . . . , x t = X mod a t ) . 9 / 19

Montgomery multiplication in residue number system Let A = { a 1 , . . . , a t } be a set t co-prime integers. An integer X such that 0 ≤ X < A = � t i =1 a i is represented by [ X ] A = ( x 1 = X mod a 1 , . . . , x t = X mod a t ) . The Chinese remainder theorem tell us that for op ∈ { + , ×} [ X ] A op [ Y ] A = ([ x 1 op y 1 ] a 1 , . . . , [ x t op y t ] a t ) ⇔ X op Y mod A 9 / 19

Montgomery multiplication in residue number system Let A = { a 1 , . . . , a t } be a set t co-prime integers. An integer X such that 0 ≤ X < A = � t i =1 a i is represented by [ X ] A = ( x 1 = X mod a 1 , . . . , x t = X mod a t ) . The Chinese remainder theorem tell us that for op ∈ { + , ×} [ X ] A op [ Y ] A = ([ x 1 op y 1 ] a 1 , . . . , [ x t op y t ] a t ) ⇔ X op Y mod A Montgomery Multiplication in RNS Require: X , Y in A ∪ B Ensure: XYA − 1 mod N in A ∪ B 1: [ Q ] A ← [ XYN − 1 ] A 3: [ Z ] B ← [( XY − QN ) A − 1 ] B 5: return ( Z A∪B ) 9 / 19

Montgomery multiplication in residue number system Let A = { a 1 , . . . , a t } be a set t co-prime integers. An integer X such that 0 ≤ X < A = � t i =1 a i is represented by [ X ] A = ( x 1 = X mod a 1 , . . . , x t = X mod a t ) . The Chinese remainder theorem tell us that for op ∈ { + , ×} [ X ] A op [ Y ] A = ([ x 1 op y 1 ] a 1 , . . . , [ x t op y t ] a t ) ⇔ X op Y mod A Montgomery Multiplication in RNS Require: X , Y in A ∪ B Ensure: XYA − 1 mod N in A ∪ B 1: [ Q ] A ← [ XYN − 1 ] A 2: [ Q ] B ← BE A→B ([ Q ] A ) 3: [ Z ] B ← [( XY − QN ) A − 1 ] B 4: [ Z ] A ← BE B→A ([ Z ] B ) 5: return ( Z A∪B ) 9 / 19

Outline Cryptography 1 RSA cryptosystem Power analysis Montgomery multiplication in RNS Randomized modular exponentiation in RNS 2 Randomized Montgomery multiplication Proposed approach Level of randomization Conclusion 3 10 / 19

Randomization in RNS (LRA CHES 2004) We have � X old = [ XA old ] A old ∪B old we permute the basis elements A old ∪ B old → A new ∪ B new A B a 1 b 1 a 2 b t − 1 a t − 1 a t b t this leads to a new representation of X � X new = [ XA new ] A new ∪B new Cost Two Montgomery multiplications : mod N → XA old A new mod N → XA new mod N . XA old 11 / 19

Randomized square-and-multiply-always Input: N , X ∈ [0 , N [ , E = ( e ℓ − 1 , . . . , e 0 ) 2 and M = { m 1 , . . . , m 2 t } . Output: X E mod N Square-and-mult-always A , B ← random split M Z ← [ � � X ] A∪B , � 1] A∪B , � R 0 ← [ � R 1 ← [ � 1] A∪B for i from 0 to ℓ − 1 do R e i ← MM RNS( � � R e i , � Z , A , B ) Z ← MM RNS( � � Z , � Z , A , B ) end for � return R 1 12 / 19

Randomized square-and-multiply-always Input: N , X ∈ [0 , N [ , E = ( e ℓ − 1 , . . . , e 0 ) 2 and M = { m 1 , . . . , m 2 t } . Output: X E mod N Randomized Square-and-mult-always A , B ← random split M Z ← [ � � X ] A∪B , R 0 ← [ � � 1] A∪B , � R 1 ← [ � 1] A∪B for i from 0 to ℓ − 1 do R e i ← MM RNS( � � R e i , � Z , A , B ) Z ← MM RNS( � � Z , � Z , A , B ) Randomise( A old , B old , A , B ) Z ← Update( � � Z , A old , B old , A , B ) R 0 ← Update( � � R 0 , A old , B old , A , B ) R 1 ← Update( � � R 1 , A old , B old , A , B ) end for � return R 1 12 / 19