SPA resistant Exponentiation based on Bruns GCD algorithm Val erie - PowerPoint PPT Presentation

SPA resistant Exponentiation based on Brun’s GCD algorithm Val´ erie Berth´ e , Thomas Plantard Paris Diderot Universit´ e, University of Wollongong http://www.uow.edu.au/˜ thomaspl thomaspl@uow.edu.au 2019 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 1 / 31

Introduction Introduction 1 Exponentiation based on Euclid Algorithm 2 Exponentiation based on Brun Algorithm 3 Result/Conclusion/Future Works 4 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 2 / 31

Introduction Introduction 1 Exponentiation based on Euclid Algorithm 2 Exponentiation based on Brun Algorithm 3 Result/Conclusion/Future Works 4 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 3 / 31

Exponentiation Exponentiation RSA: in ( Z / ( N Z )) ∗ , compute g e mod N using Modular Multiplication and Squaring. ECC: on a group, compute kP using 2 P and P + Q . Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 4 / 31

Exponentiation Exponentiation RSA: in ( Z / ( N Z )) ∗ , compute g e mod N using Modular Multiplication and Squaring. ECC: on a group, compute kP using 2 P and P + Q . Generic Algorithm Right To Left Left To Right Radix-R exponentiation Radix-R exponentiation with Odd Coefficient Sliding Window Montgomery Ladder Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 4 / 31

Specific Group For ( Z / N Z ) Multiply Always Square Always Square And Multiply Always: 1 replace by N + 1 Exponentiation using multiplicative half-size splitting Montgomery Ladder with Common Operand Multiplication Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 5 / 31

Specific Group For ( Z / N Z ) Multiply Always Square Always Square And Multiply Always: 1 replace by N + 1 Exponentiation using multiplicative half-size splitting Montgomery Ladder with Common Operand Multiplication For ECC NAF Exponentiation: using − P Addition Chain Exponentiation: No Doubling Double Base: exponent in base 2 a 3 b Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 5 / 31

Specific Case Exponentiation with g constant Radix-R exponentiation: exponent in base R = 2 t NAF Representation Comb Method RNS Digit Exponent: exponent represented in base m 0 m 1 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 6 / 31

Specific Case Exponentiation with g constant Radix-R exponentiation: exponent in base R = 2 t NAF Representation Comb Method RNS Digit Exponent: exponent represented in base m 0 m 1 Exponentiation with e random Addition Chain Double Base Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 6 / 31

In this Work Exponentiation Generic Group SPA Protection g variable e given Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 7 / 31

In this Work Exponentiation Generic Group SPA Protection g variable e given Current Solution Radix-R Memorise g i , i ∈ [1 , R ] Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 7 / 31

Exponentiation: g e with e < 2 k Left To Right Exponentiation a ← 1 for i = k − 1 to 0 do a ← a 2 if e i = 1 then a ← a × g Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 8 / 31

Exponentiation: g e with e < 2 k Left To Right Exponentiation a ← 1 for i = k − 1 to 0 do a ← a 2 if e i = 1 then a ← a × g Right To Left Exponentiation a ← 1 , b ← g for i = 0 to k − 1 do if e i = 1 then a ← a × b b ← b 2 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 8 / 31

SPA Attack Recognising Operations XXXXXXXXXXXXXXXXXXXXXXXX Modular Squaring (S): a ← a 2 Modular Multiplication (M): a ← a × g SSMSMSSMSMSSSMSMSMSSSSMS Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 9 / 31

SPA Attack Recognising Operations XXXXXXXXXXXXXXXXXXXXXXXX Modular Squaring (S): a ← a 2 Modular Multiplication (M): a ← a × g SSMSMSSMSMSSSMSMSMSSSSMS Regroup Operations SSMSMSSMSMSSSMSMSMSSSSMS (S)(SM)(SM)(S)(SM)(SM)(S)(S)(SM)(SM)(SM)(S)(S)(S)(SM)(S) Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 9 / 31

SPA Counter Measure Classic Solution: Constant Time Algorithm Goal: Unlink Sequence of Operations to Secret Key Solution: Same Sequence for all secret key Drawback: Average Case=Worst Case Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 10 / 31

SPA Counter Measure Classic Solution: Constant Time Algorithm Goal: Unlink Sequence of Operations to Secret Key Solution: Same Sequence for all secret key Drawback: Average Case=Worst Case A second Solution: Stop parenthesing Phase Goal: Stop Attacker to be able to regroup operations Solution: Use Sequence of Equivalent Operations Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 10 / 31

Squaring Always Taylor Formulae � 2 � 2 � A + B � A − B A × B = − 4 4 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 11 / 31

Squaring Always Taylor Formulae � 2 � 2 � A + B � A − B A × B = − 4 4 Rewriting Modular Squaring (S) : a ← a 2 Modular Multiplication (SS): a ← a × g SSMSMSSMSMSSSMSMSMSSSSMS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 11 / 31

Squaring Always Taylor Formulae � 2 � 2 � A + B � A − B A × B = − 4 4 Rewriting Modular Squaring (S) : a ← a 2 Modular Multiplication (SS): a ← a × g SSMSMSSMSMSSSMSMSMSSSSMS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS Drawback Cost of two S greater than M Only for ( Z / N Z ) Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 11 / 31

Brun Algorithm Introduction 1 Exponentiation based on Euclid Algorithm 2 Exponentiation based on Brun Algorithm 3 Result/Conclusion/Future Works 4 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 12 / 31

Exponentiation based on Euclid Algorithm Exponentiation k a ← g , b ← g 2 2 k k 2 , v ← e − u 2 v u ← e mod 2 2 , e = u + 2 k 2 while v � = 0 do if u > v then u ← u − v b ← b × a else v ← v − u a ← a × b a ← a u Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 13 / 31

Correctness Invariant a u b v = g e Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 14 / 31

Correctness Invariant a u b v = g e Initialisation k 2 ) v ) = g u + v 2 k 2 = g e a u b v = g u ( g 2 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 14 / 31

Correctness Invariant a u b v = g e Initialisation k 2 ) v ) = g u + v 2 k 2 = g e a u b v = g u ( g 2 In the loop a u − v ( ab ) v = a u b v ( ab ) u b v − u = a u b v Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 14 / 31

Example: g 3165 u v a b If u > v ? Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 15 / 31

Example: g 3165 u v a b If u > v ? g 1 g 64 29 49 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 15 / 31

Example: g 3165 u v a b If u > v ? g 1 g 64 g 1+64 g 64 29 49 F 29 49 − 29 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 15 / 31

Example: g 3165 u v a b If u > v ? g 1 g 64 g 1+64 g 64 29 49 F 29 49 − 29 g 65 g 64 29 20 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 15 / 31

Example: g 3165 u v a b If u > v ? g 1 g 64 g 1+64 g 64 29 49 F 29 49 − 29 g 65 g 64 g 65 g 64+65 29 20 T 29 − 20 20 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 15 / 31

Example: g 3165 u v a b If u > v ? g 1 g 64 g 1+64 g 64 29 49 F 29 49 − 29 g 65 g 64 g 65 g 64+65 29 20 T 29 − 20 20 g 65 g 129 9 20 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 15 / 31

Example: g 3165 u v a b If u > v ? g 1 g 64 g 1+64 g 64 29 49 F 29 49 − 29 g 65 g 64 g 65 g 64+65 29 20 T 29 − 20 20 g 65 g 129 g 65+129 g 129 9 20 F 9 20 − 9 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 15 / 31

Example: g 3165 u v a b If u > v ? g 1 g 64 g 1+64 g 64 29 49 F 29 49 − 29 g 65 g 64 g 65 g 64+65 29 20 T 29 − 20 20 g 65 g 129 g 65+129 g 129 9 20 F 9 20 − 9 g 194 g 129 9 11 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 15 / 31

Example: g 3165 u v a b If u > v ? g 1 g 64 g 1+64 g 64 29 49 F 29 49 − 29 g 65 g 64 g 65 g 64+65 29 20 T 29 − 20 20 g 65 g 129 g 65+129 g 129 9 20 F 9 20 − 9 g 194 g 129 g 194+129 g 129 9 11 F 9 11 − 9 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 15 / 31

Example: g 3165 u v a b If u > v ? g 1 g 64 g 1+64 g 64 29 49 F 29 49 − 29 g 65 g 64 g 65 g 64+65 29 20 T 29 − 20 20 g 65 g 129 g 65+129 g 129 9 20 F 9 20 − 9 g 194 g 129 g 194+129 g 129 9 11 F 9 11 − 9 g 323 g 129 9 2 Berthe, Plantard (IRIF, UOW) Exponentiation based on Brun Algorithm 2019 15 / 31