A Formal Proof of Countermeasures against Fault Injection Attacks on - PowerPoint PPT Presentation

A Formal Proof of Countermeasures against Fault Injection Attacks on CRT-RSA Pablo Rauzy Sylvain Guilley rauzy@enst.fr sylvain.guilley@enst.fr pablo.rauzy.name perso.enst.fr/~guilley Telecom ParisTech LTCI / COMELEC / SEN August 24, 2013 — 9h45–10h15 PROOFS 2013 @ Santa Barbara IACR ePrint 2013/506 Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 1 / 31

RSA CRT-RSA The BellCoRe Attack How it works? BellCoRe attack refinement Countermeasures Shamir Countermeasure Aum¨ uller et al. Countermeasure Shortcomings Formal Analysis CRT-RSA Computation Fault Injection Algorithm Description finja Testing Attacks Study of an Unprotected CRT-RSA Computation Study of the Shamir Countermeasure Study of the Aum¨ uller et al. Countermeasure Results Conclusions and Perspectives Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 2 / 31

RSA RSA ( Rivest, Shamir, Adleman ) RSA [RSA78] is an algorithm for public key cryptography. It can be used as both an encryption and a signature algorithm. It works as follows (for simplicity we omit the padding operations): ◮ Let m be the message, ( N , e ) the public key, and ( N , d ) the private key such that d · e ≡ 1 mod ϕ ( N ). ◮ The signature S is computed by S ≡ m d mod N . ◮ The signature can be verified by checking that m ≡ S e mod N . Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 3 / 31

RSA RSA ( Rivest, Shamir, Adleman ) RSA [RSA78] is an algorithm for public key cryptography. It can be used as both an encryption and a signature algorithm. It works as follows (for simplicity we omit the padding operations): ◮ Let m be the message, ( N , e ) the public key, and ( N , d ) the private key such that d · e ≡ 1 mod ϕ ( N ). ◮ The signature S is computed by S ≡ m d mod N . ◮ The signature can be verified by checking that m ≡ S e mod N . Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 3 / 31

CRT-RSA CRT ( Chinese Remainder Theorem ) CRT-RSA [Ko¸ c94] is an optimization of the RSA computation which allows a fourfold speedup. It works as follows: ◮ Let p and q be the primes from the key generation ( N = p · q ). ◮ These values are pre-computed (considered part of the private key): ◮ d p . = d mod ( p − 1) ◮ d q . = d mod ( q − 1) ◮ i q . = q − 1 mod p ◮ S is then computed as follows: ◮ S p = m d p mod p ◮ S q = m d q mod q ◮ S = S q + q · ( i q · ( S p − S q ) mod p ) Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 4 / 31

CRT-RSA CRT ( Chinese Remainder Theorem ) CRT-RSA [Ko¸ c94] is an optimization of the RSA computation which allows a fourfold speedup. It works as follows: ◮ Let p and q be the primes from the key generation ( N = p · q ). ◮ These values are pre-computed (considered part of the private key): ◮ d p . = d mod ( p − 1) ◮ d q . = d mod ( q − 1) ◮ i q . = q − 1 mod p ◮ S is then computed as follows: ◮ S p = m d p mod p ◮ S q = m d q mod q ◮ S = S q + q · ( i q · ( S p − S q ) mod p ) Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 4 / 31

The BellCoRe Attack BellCoRe ( Bell Communications Research ) The BellCoRe attack [BDL97] consists in revealing the secret primes p and q by faulting the computation. It is very powerful as it works even with very random faulting. It works as follows: ◮ The intermediate variable S p (resp. S q ) is faulted as � S p (resp. � S q ). ◮ The attacker thus gets an erroneous signature � S . ◮ The attacker can recover p (resp. q ) as gcd( N , S − � S ). Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 5 / 31

The BellCoRe Attack BellCoRe ( Bell Communications Research ) The BellCoRe attack [BDL97] consists in revealing the secret primes p and q by faulting the computation. It is very powerful as it works even with very random faulting. It works as follows: ◮ The intermediate variable S p (resp. S q ) is faulted as � S p (resp. � S q ). ◮ The attacker thus gets an erroneous signature � S . ◮ The attacker can recover p (resp. q ) as gcd( N , S − � S ). Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 5 / 31

The BellCoRe Attack How it works? For all integer x , gcd( N , x ) can only take 4 values: ◮ 1, if N and x are co-prime, ◮ p , if x is a multiple of p , ◮ q , if x is a multiple of q , ◮ N , if x is a multiple of both p and q , i.e. , of N . Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 6 / 31

The BellCoRe Attack How it works? If S p is faulted ( i.e. , replaced by � S p � = S p ): � � ◮ S − � ( i q · ( S p − S q ) mod p ) − ( i q · ( � S = q · S p − S q ) mod p ) ⇒ gcd( N , S − � S ) = q Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 6 / 31

The BellCoRe Attack How it works? If S q is faulted ( i.e. , replaced by � S q � = S q ): ◮ S − � S ≡ ( S q − � S q ) − ( q mod p ) · i q · ( S q − � S q ) ≡ 0 mod p (because ( q mod p ) · i q ≡ 1 mod p ) ⇒ gcd( N , S − � S ) = p Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 6 / 31

The BellCoRe Attack How it works? If S q is faulted ( i.e. , replaced by � S q � = S q ): ◮ S − � S ≡ ( S q − � S q ) − ( q mod p ) · i q · ( S q − � S q ) ≡ 0 mod p (because ( q mod p ) · i q ≡ 1 mod p ) ⇒ gcd( N , S − � S ) = p Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 6 / 31

The BellCoRe Attack BellCoRe attack refinement This attack has been improved [JLQ99] so it only needs the faulty signature to recover p or q , by computing gcd( N , m − � S e ). ◮ If S p if faulted, then most likely gcd( N , S − � S ) = q , ◮ which means that we have S �≡ � S mod p thus, S e �≡ � S e mod p ; ◮ and that we also have S ≡ � S mod q thus, S e ≡ � S e mod q . ⇒ As S e ≡ m mod N , this proves the result. A symmetrical reasoning can be done if the fault occurs during the computation of S q . Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 7 / 31

The BellCoRe Attack BellCoRe attack refinement This attack has been improved [JLQ99] so it only needs the faulty signature to recover p or q , by computing gcd( N , m − � S e ). ◮ If S p if faulted, then most likely gcd( N , S − � S ) = q , ◮ which means that we have S �≡ � S mod p thus, S e �≡ � S e mod p ; ◮ and that we also have S ≡ � S mod q thus, S e ≡ � S e mod q . ⇒ As S e ≡ m mod N , this proves the result. A symmetrical reasoning can be done if the fault occurs during the computation of S q . Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 7 / 31

Countermeasures Several protections against the BellCoRe attacks have been proposed. Some of them are given below: ◮ Obvious countermeasures: no CRT, or with signature verification; ◮ Shamir [Sha99]; ◮ Aum¨ uller et al. [ABF + 02]; ◮ Vigilant, original [Vig08] and with some corrections by Coron et al. [CGM + 10]; ◮ Kim et al. [KKHH11]. Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 8 / 31

Countermeasures Several protections against the BellCoRe attacks have been proposed. Some of them are given below: ◮ Obvious countermeasures: no CRT, or with signature verification; ◮ Shamir [Sha99]; ◮ Aum¨ uller et al. [ABF + 02]; ◮ Vigilant, original [Vig08] and with some corrections by Coron et al. [CGM + 10]; ◮ Kim et al. [KKHH11]. Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 8 / 31

Countermeasures Shamir Countermeasure ◮ Introduces a small random number r , co-prime with p and q . ◮ Carries out computations modulo p ′ = p · r and q ′ = q · r . ⇒ Allows retrieval of the results by reduction modulo p and modulo q . ⇒ Enables verification by reduction modulo r . Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 9 / 31

Countermeasures / Shamir Countermeasure Algorithm Input : Message m , key ( p , q , d , i q ), 32-bit random prime r Output : Signature m d mod N , or error if some fault injection is detected. 1 p ′ = p · r 2 d p = d mod ( p − 1) · ( r − 1) p = m d p 3 S ′ mod p ′ 4 q ′ = q · r 5 d q = d mod ( q − 1) · ( r − 1) q = m d q 6 S ′ mod q ′ 7 S p = S ′ mod p p 8 S q = S ′ mod q q 9 S = S q + q · ( i q · ( S p − S q ) mod p ) 10 if S ′ p �≡ S ′ mod r then q return error 11 12 else return S 13 14 end Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 10 / 31

Countermeasures / Shamir Countermeasure Algorithm Input : Message m , key ( p , q , d , i q ), 32-bit random prime r Output : Signature m d mod N , or error if some fault injection is detected. 1 p ′ = p · r 2 d p = d mod ( p − 1) · ( r − 1) p = m d p 3 S ′ mod p ′ 4 q ′ = q · r 5 d q = d mod ( q − 1) · ( r − 1) q = m d q 6 S ′ mod q ′ 7 S p = S ′ mod p p 8 S q = S ′ mod q q 9 S = S q + q · ( i q · ( S p − S q ) mod p ) 10 if S ′ p �≡ S ′ mod r then q return error 11 12 else return S 13 14 end Pablo Rauzy (Telecom ParisTech) Formal CRT-RSA Fault Attacks Analysis PROOFS 2013 10 / 31