Attacking unbalanced RSA-CRT using SPA（攻击不平衡RSA-CRT使用温泉）.pdfVIP

Attacking unbalanced RSA-CRT using SPA P.A. Fouque*, G. Martinet, G. Poupard (with the participation of Barnaby Martinet-Fouque) DCSSI Crypto Lab, France (*) Ecole Normal Supérieure, France Attacking unbalanced RSA-CRT using SPA CHES 2003 - P.A. Fouque, G. Martinet, G. Poupard 1 Our goal • Power analysis techniques (SPA) are very usefull tools to detect some « events » • Lattice reduction algorithm (LLL) is a very usefull tool for « classical cryptanalysts » • SPA + LLL = new threat for smartcards • this paper : an example of such a combination Attacking unbalanced RSA-CRT using SPA CHES 2003 - P.A. Fouque, G. Martinet, G. Poupard 2 1 RSA CRT + Garner • Goal : efficient computation of modular exponentiation with RSA modulus • Applications : – RSA decryption – RSA signature generation • Input : – modulus n = p .q, exponents e.d = 1 mod φ(n) – message (or ciphertext) m • Output : S = m d mod n Attacking unbalanced RSA-CRT using SPA CHES 2003 - P.A. Fouque, G. Martinet, G. Poupard 3 RSA CRT + Garner • Pre-computation : – dp = d mod p-1 – d = d mod q-1 q -1 – u = q mod p • Algorithm (assume q p) : – s = m dp mod p , s = m dq mod q p q – t = sp - sq ; if t 0 then t = t + p – S (=m d mod n) = sq + (t . u mod p). q (in [0, n-1]) Attacking unbalanced RSA-CRT using SPA CHES 2003 - P.A. Fouque, G. Martinet, G. Poupard 4