Power analysis and countermeasure of RSA cryptosystem

Abstract

SUMMARYPublic-key cryptography such as RSA cryptography and elliptic curve cryptography are used in electronic transactions. Since the security of the cryptography depends on the cryptographic key which is stored on an IC chip, security was believed to have been established as long as we use smart cards. However, since the mid-1990s, one technique after another has been developed for extracting the secret key without unsealing the IC chip. In particular, the power analysis by Kocher's group is an attack that can be carried out by using practical resources, and various applications have been proposed. In this paper, we study the power analysis of modular exponentiation, which is a primitive of RSA cryptography, and its countermeasures. Specifically, starting with the countermeasures to single-exponent multiple-data (SEMD), multiple-exponent single-data (MESD), and zero-exponent multiple-data (ZEMD) attacks of Messerges's group, we illustrate feasible attacks such as the Big Mac attack of Walter and Thompson, the template attack of Chari's group, and an attack proposed by the authors. We propose a countermeasure and present an implementation in a smart card. If the proposed method is applied to 1024-bit modular exponentiation, adequate security can be obtained in a processing time less than twice the time without countermeasures.

Securing RSA against power analysis attacks through non‐uniform exponent partitioning with randomisation

“…The above observations signified that our proposed method to compute modular exponentiation could provide resistance to all sort of power analysis attacks especially CPA. If we compared our work with the previous works in [24, 25] we could see that, in [24] the exponent was partitioned only into two parts and similarly in [25] there were 16 partitions every time. However, in our proposed work, we could generate any number of partitions between 8 and 32.…”

“…This method could decline the correlation while increasing the size of the window which could actually resist CPA. Many other resisting techniques appeared in literature [24–28] which used these concepts more efficiently. However, RSA still remained vulnerable to power analysis attacks in [30–33] which challenged most the resisting techniques.…”

“…In 2006, Kaminaga et al . [24] used this concept and proposed to divide the exponent into two parts and then randomly execute them using the binary bits of a random number. Their work could resist RSA from the attacks proposed by Messerges et al .…”

“…In our proposed work, we have tried to revive the ‘counterpart for randomisation’ by first addressing the limitations in [24, 25] and then exploring their future scopes. Our work could successfully generate any number of non‐uniform partitions of the exponent between 8 and 32.…”

“…One way to resist such attack was to randomise the variations in instantaneous power consumption, another way was to completely hide these variations from attackers. Based on these approaches, many resisting techniques have been designed [19–29]. However, the advancements in DPA and CPA have again questioned the strength of these resisting techniques [30–33].…”