CRT RSA Algorithm Protected Against Fault Attacks

Abstract

Abstract. Embedded devices performing RSA signatures are subject to Fault Attacks, particularly when the Chinese Remainder Theorem is used. In most cases, the modular exponentiation and the Garner recombination algorithms are targeted. To thwart Fault Attacks, we propose a new generic method of computing modular exponentiation and we prove its security in a realistic fault model. By construction, our proposal is also protected against Simple Power Analysis. Based on our new resistant exponentiation algorithm, we present two different ways of computing CRT RSA signatures in a secure way. We show that those methods do not increase execution time and can be easily implemented on low-resource devices.

Securing RSA against Fault Analysis by Double Addition Chain Exponentiation

“…The scheme by Boscher et al [10] is based on the rightto-left square-and-multiply-always algorithm [15] which was originally devoted to thwart simple side channel analysis (see Sect. 6.1).…”

“…6.1). In [10], the authors observe that this algorithm computes a triplet (a 0 , a 1 , a 2 ) that equals (m d , m 2 l −d−1 , m 2 l ) at the end of the algorithm, where l denotes the bit-length of d. The principle of their countermeasure is hence to check that a 0 · a 1 · m equals a 2 at the end of the exponentiation. Once again, in case of fault injection, the relation between the a i 's is broken and the fault is detected by the final check.…”

Algorithmic Countermeasures Against Fault Attacks and Power Analysis for RSA-CRT

“…The first fault attack [4] targets an RSA implementation using the Chinese remainder theorem, RSA-CRT, and is known as the Bellcore attack. The Bellcore attack aroused great interest and led to many publications about fault attacks on RSA-CRT,e.g., [1,6,9,11,22]. Countermeasures to prevent the Bellcore attack can be categorized into two families: the first one relies on a modification of the RSA modulus and the second one uses self-secure exponentiation.…”

“…The first such method is based on the Montgomery ladder [9]. This was adapted to the right-to-left version of the square-and-multiplyalways algorithm [5,6] and to double exponentiation [18,22]. We test the security of these methods using an automated testing framework.…”

Using modular extension to provably protect Edwards curves against fault attacks

“…Algorithmic protections have been proposed by Giraud [22] (and many others [16,32,29]) for CRT-RSA, which naturally transpose to ECC, as shown in [28]. These protections are implementation specific (e.g., depend on the chosen exponentiation algorithm) and are thus difficult to automate, requiring specialized engineering skills.…”