Algorithm for RSA and Hyperelliptic Curve Cryptosystems Resistant to - PowerPoint PPT Presentation

Algorithm for RSA and Hyperelliptic Curve Cryptosystems Resistant to Simple Power Analysis Christophe Negre ici joined work with T. Plantard (U. of Wollongong, Australia) Journees Nationales GDR IM January 19-th, 2016 1 / 39

Outline Regular exponentiation in RSA cryptosystem 1 RSA encryption Simple power analysis Proposed counter-measure Extension to Hyper-elliptic curve 2 Diffie-Hellmann key exchange Elliptic curve Hyperelliptic curve Proposed regular scalar multiplication Differential power analysis and counter-measures 3 Differential power analysis Counter-measures Conclusion 4 2 / 39

Outline Regular exponentiation in RSA cryptosystem 1 RSA encryption Simple power analysis Proposed counter-measure Extension to Hyper-elliptic curve 2 Diffie-Hellmann key exchange Elliptic curve Hyperelliptic curve Proposed regular scalar multiplication Differential power analysis and counter-measures 3 Differential power analysis Counter-measures Conclusion 4 3 / 39

Outline Regular exponentiation in RSA cryptosystem 1 RSA encryption Simple power analysis Proposed counter-measure Extension to Hyper-elliptic curve 2 Diffie-Hellmann key exchange Elliptic curve Hyperelliptic curve Proposed regular scalar multiplication Differential power analysis and counter-measures 3 Differential power analysis Counter-measures Conclusion 4 4 / 39

RSA encryption Public key: a modulus N = pq and e a public exponent. Private key: the exponent d satisfying ed = 1 mod ( p − 1)( q − 1) . 5 / 39

RSA encryption Public key: a modulus N = pq and e a public exponent. Private key: the exponent d satisfying ed = 1 mod ( p − 1)( q − 1) . Encryption. A message m ∈ { 0 , . . . , N − 1 } is encrypted as c = m e mod N Decryption. c ∈ { 0 , . . . , N − 1 } is decrypted m = c d mod N Correct since: gcd( m , N ) = 1 ⇒ m ( p − 1)( q − 1) ≡ 1 mod N 5 / 39

Square-and-multiply exponentiation Let e = ( e ℓ − 1 , . . . , e 0 ) 2 , we compute m e mod N as follows r ← 1 for i from ℓ − 1 downto 0 do r ← r 2 mod N r ← r × m e i mod N end for return r 6 / 39

Square-and-multiply exponentiation Let e = ( e ℓ − 1 , . . . , e 0 ) 2 , we compute m e mod N as follows r ← 1 for i from ℓ − 1 downto 0 do r ← r 2 mod N r ← r × m e i mod N end for return r Init.: r = 1 Loop 1 : 1 2 × m e ℓ − 1 Loop 2 : ( m e ℓ − 1 ) 2 m e ℓ − 2 = m 2 e ℓ − 1 + e ℓ − 2 Loop 3 : ( m 2 e ℓ − 1 + e ℓ − 2 ) 2 m e ℓ − 3 = m 4 e ℓ − 1 +2 e ℓ − 2 + e ℓ − 3 Etc. 6 / 39

Outline Regular exponentiation in RSA cryptosystem 1 RSA encryption Simple power analysis Proposed counter-measure Extension to Hyper-elliptic curve 2 Diffie-Hellmann key exchange Elliptic curve Hyperelliptic curve Proposed regular scalar multiplication Differential power analysis and counter-measures 3 Differential power analysis Counter-measures Conclusion 4 7 / 39

Simple power analysis Consumption of a circuit computing m e mod N : squaring � = multiplication 8 / 39

Counter-measure of the litterature: square-always Re-express multiplications as squarings: ab = (( a + b ) 2 − a 2 − b 2 ) / 2 Square-and-multiply-always (Clavier et al. 2011) r ← 1 m ′ ← m 2 mod N for i from ℓ − 1 downto 0 do r ← r 2 mod N if e i = 1 then r ← (( r + m ) 2 − m ′ − r 2 ) / 2 mod N end if end for return r Cost = 3 ℓ/ 2 squarings. Drawback: non constant computation time. 9 / 39

Counter-measure of the litterature : square-and-multiply-always Renders the exponentiation regular and constant time. Square-and-multiply-always Coron 99 r ← 1 for i from ℓ − 1 downto 0 do r ← r 2 mod N if e i = 1 then r ← r × m mod N else r ′ ← r × m mod N end if end for return r Cost = ℓ multiplications and ℓ squarings. 10 / 39

Outline Regular exponentiation in RSA cryptosystem 1 RSA encryption Simple power analysis Proposed counter-measure Extension to Hyper-elliptic curve 2 Diffie-Hellmann key exchange Elliptic curve Hyperelliptic curve Proposed regular scalar multiplication Differential power analysis and counter-measures 3 Differential power analysis Counter-measures Conclusion 4 11 / 39

Proposed counter-measure Strategy: multiplicative splitting of m √ with m 0 , m 1 ∼ m = m − 1 × m 1 mod N = N 0 1: r ← m − 1 0 2: for i from ℓ − 1 downto 0 do if e i = 0 then 3: r ← r 2 × m 0 4: else 5: r ← r 2 × m 1 6: end if 7: 8: end for 9: r ← r × m 0 10: return r 12 / 39

Proposed counter-measure Strategy: multiplicative splitting of m √ with m 0 , m 1 ∼ m = m − 1 × m 1 mod N = N 0 1: r ← m − 1 Correctness: 0 2: for i from ℓ − 1 downto 0 At beginning of loop i : r = m α × m − 1 do 0 if e i = 0 then 3: r ← r 2 × m 0 4: else 5: r ← r 2 × m 1 6: end if 7: 8: end for 9: r ← r × m 0 10: return r 12 / 39

Proposed counter-measure Strategy: multiplicative splitting of m √ with m 0 , m 1 ∼ m = m − 1 × m 1 mod N = N 0 1: r ← m − 1 Correctness: 0 2: for i from ℓ − 1 downto 0 At beginning of loop i : r = m α × m − 1 do 0 if e i = 0 then 3: If e i = 0: r ← r 2 × m 0 4: r 2 × m 0 = m 2 α m − 1 0 else 5: r ← r 2 × m 1 6: end if 7: 8: end for 9: r ← r × m 0 10: return r 12 / 39

Proposed counter-measure Strategy: multiplicative splitting of m √ with m 0 , m 1 ∼ m = m − 1 × m 1 mod N = N 0 1: r ← m − 1 Correctness: 0 2: for i from ℓ − 1 downto 0 At beginning of loop i : r = m α × m − 1 do 0 if e i = 0 then 3: If e i = 0: r ← r 2 × m 0 4: r 2 × m 0 = m 2 α m − 1 0 else 5: r ← r 2 × m 1 If e i = 1: 6: r 2 × m 1 ( m 2 α m 1 m − 1 0 ) × m − 1 = end if 7: 0 m 2 α +1 m − 1 = 8: end for 0 9: r ← r × m 0 10: return r 12 / 39

Proposed counter-measure Strategy: multiplicative splitting of m √ with m 0 , m 1 ∼ m = m − 1 × m 1 mod N = N 0 1: r ← m − 1 Correctness: 0 2: for i from ℓ − 1 downto 0 At beginning of loop i : r = m α × m − 1 do 0 if e i = 0 then 3: If e i = 0: r ← r 2 × m 0 4: r 2 × m 0 = m 2 α m − 1 0 else 5: r ← r 2 × m 1 If e i = 1: 6: r 2 × m 1 ( m 2 α m 1 m − 1 0 ) × m − 1 = end if 7: 0 m 2 α +1 m − 1 = 8: end for 0 9: r ← r × m 0 After loop i : r = m 2 α + e i × m − 1 0 . 10: return r 12 / 39

Euclidean algorithm. Principle. Let a , b ∈ N with a ≥ b ≥ 0 gcd( a , b ) = gcd( a − qb , b ) for all q ∈ Z . 13 / 39

Euclidean algorithm. Principle. Let a , b ∈ N with a ≥ b ≥ 0 gcd( a , b ) = gcd( a − qb , b ) for all q ∈ Z . Sequence of modular reductions r 0 ← a r 1 ← b r 2 ← r 0 mod r 1 r 3 ← r 1 mod r 2 . . . r i ← r i − 2 mod r i − 1 . . . gcd ( a , b ) is the last r i � = 0. 13 / 39

Extended Euclidean algorithm Euclidean algorithm. Compute u and v such that Principle. ua + vb = gcd( a , b ) Let a , b ∈ N with a ≥ b ≥ 0 as follows: gcd( a , b ) = gcd( a − qb , b ) 1 We set: u 0 = 1 , v 0 = 0 for all q ∈ Z . u 1 = 0 , v 1 = 1 Sequence of modular reductions 2 We iterate: r 0 ← a u 0 a + v 0 b = r 0 r 1 ← b u 1 a + v 1 b = r 1 × ( − q 1 ) r 2 ← r 0 mod r 1 r 3 ← r 1 mod r 2 u 2 a + v 2 b = r 2 . . . r i ← r i − 2 mod r i − 1 . . . gcd ( a , b ) is the last r i � = 0. 13 / 39

Extended Euclidean algorithm Euclidean algorithm. Compute u and v such that Principle. ua + vb = gcd( a , b ) Let a , b ∈ N with a ≥ b ≥ 0 as follows: gcd( a , b ) = gcd( a − qb , b ) 1 We set: u 0 = 1 , v 0 = 0 for all q ∈ Z . u 1 = 0 , v 1 = 1 Sequence of modular reductions 2 We iterate: r 0 ← a u 0 a + v 0 b = r 0 r 1 ← b u 1 a + v 1 b = r 1 × ( − q 1 ) r 2 ← r 0 mod r 1 r 3 ← r 1 mod r 2 u 2 a + v 2 b = r 2 × ( − q 2 ) . . . u 3 a + v 3 b = r 3 r i ← r i − 2 mod r i − 1 . . . gcd ( a , b ) is the last r i � = 0. 13 / 39

Extended Euclidean algorithm Euclidean algorithm. Compute u and v such that Principle. ua + vb = gcd( a , b ) Let a , b ∈ N with a ≥ b ≥ 0 as follows: gcd( a , b ) = gcd( a − qb , b ) 1 We set: u 0 = 1 , v 0 = 0 for all q ∈ Z . u 1 = 0 , v 1 = 1 Sequence of modular reductions 2 We iterate: r 0 ← a u 0 a + v 0 b = r 0 r 1 ← b u 1 a + v 1 b = r 1 × ( − q 1 ) r 2 ← r 0 mod r 1 r 3 ← r 1 mod r 2 u 2 a + v 2 b = r 2 × ( − q 2 ) . . . u 3 a + v 3 b = r 3 × ( − q 3 ) r i ← r i − 2 mod r i − 1 . . . u 4 a + v 4 b = r 4 × ( − q 4 ) gcd ( a , b ) is the last r i � = 0. . . . 13 / 39

Multiplicative splitting of m We have m and N and we want √ mod N with m 0 , m 1 ∼ m = m − 1 × m 1 = N 0 Extended Euclidean algorithm computes m r 0 N v 0 u 0 14 / 39

Multiplicative splitting of m We have m and N and we want √ mod N with m 0 , m 1 ∼ m = m − 1 × m 1 = N 0 Extended Euclidean algorithm computes m r 1 N v 1 u 1 14 / 39

Multiplicative splitting of m We have m and N and we want √ mod N with m 0 , m 1 ∼ m = m − 1 × m 1 = N 0 Extended Euclidean algorithm computes m r 2 N v 2 u 2 14 / 39

Multiplicative splitting of m We have m and N and we want √ mod N with m 0 , m 1 ∼ m = m − 1 × m 1 = N 0 Extended Euclidean algorithm computes m r 3 N v 3 u 3 14 / 39