Efficient Modular Exponentiation Based on Multiple Multiplications by a Common Operand Christophe NEGRE ( 1 ) , Thomas PLANTARD ( 2 ) and Jean-Marc ROBERT ( 1 ) 1: Team DALI/LIRMM, University of Perpignan, France 2: CCISR, SCIT, (University of Wollongong), Australia Arith22 2015, Lyon, the 22-24th of June 2015 C. Nègre, T. Plantard and J.-M. Robert 1 / 37
Table of Content Problematic 1 RSA Protocol The Modular Exponentiation Simple Power Analysis, Counter-measure Modular Multiplication 2 Montgomery Modular Multiplication Our Objective Contributions 3 A · B , A · C A · B 0 , A · B 1 , . . . , A · B ℓ Application to SPA Protected Modular Exponentiations Experimental Results Conclusion 4 C. Nègre, T. Plantard and J.-M. Robert 2 / 37
Problematic RSA Protocol Table of Content Problematic 1 RSA Protocol The Modular Exponentiation Simple Power Analysis, Counter-measure Modular Multiplication 2 Montgomery Modular Multiplication Our Objective Contributions 3 A · B , A · C A · B 0 , A · B 1 , . . . , A · B ℓ Application to SPA Protected Modular Exponentiations Experimental Results Conclusion 4 C. Nègre, T. Plantard and J.-M. Robert 3 / 37
Problematic RSA Protocol RSA Protocol (Rivest, Shamir and Adlemann): Alice generates the keys. She: Chooses two distinct prime numbers p and q ; Computes N = pq ; Computes φ ( N ) = φ ( p ) φ ( q ) = ( p − 1 )( q − 1 ) = N − ( p + q − 1 ) ; Chooses an integer e such that 1 < e < φ ( N ) and gcd ( e , φ ( N )) = 1; Solves for d given d · e ≡ 1 mod φ ( N ) ; → e is released as the public key exponent, → d is kept as the private key exponent. C. Nègre, T. Plantard and J.-M. Robert 4 / 37
Problematic RSA Protocol RSA Protocol (2) → Bob encrypts using Alice’s public key e : C = M e mod N C. Nègre, T. Plantard and J.-M. Robert 5 / 37
Problematic RSA Protocol RSA Protocol (2) → Bob encrypts using Alice’s public key e : C = M e mod N → Alice decrypts Bob’s message using her secret key d : C d ( M e ) d mod N = mod N M e · d = mod N M 1 mod φ ( N ) = mod N = M C. Nègre, T. Plantard and J.-M. Robert 5 / 37
Problematic RSA Protocol RSA Protocol (2) → Bob encrypts using Alice’s public key e : C = M e mod N → Alice decrypts Bob’s message using her secret key d : C d ( M e ) d mod N = mod N M e · d = mod N M 1 mod φ ( N ) = mod N = M → The main operation is the Modular Exponentiation C. Nègre, T. Plantard and J.-M. Robert 5 / 37
Problematic The Modular Exponentiation Table of Content Problematic 1 RSA Protocol The Modular Exponentiation Simple Power Analysis, Counter-measure Modular Multiplication 2 Montgomery Modular Multiplication Our Objective Contributions 3 A · B , A · C A · B 0 , A · B 1 , . . . , A · B ℓ Application to SPA Protected Modular Exponentiations Experimental Results Conclusion 4 C. Nègre, T. Plantard and J.-M. Robert 6 / 37
Problematic The Modular Exponentiation Square-and-multiply We consider an RSA modulus N such that N < 2 wn . Square-and-multiply Require: N the RSA modulus, g and e = ( e k − 1 , . . . , e 0 ) 2 integers ∈ [ 0 , . . . , N [ , with e k − 1 = 1. Ensure: X = g e mod N Right-to-left Left-to-right X ← 1 X ← g for i = 0 to k − 1 do for i = k − 2 downto 0 do X ← X 2 mod N if e i = 1 then X ← X · g mod N if e i = 1 then g ← g 2 mod N X ← X · g mod N return ( X = g e ) return ( X = g e ) C. Nègre, T. Plantard and J.-M. Robert 7 / 37
Problematic Simple Power Analysis, Counter-measure Table of Content Problematic 1 RSA Protocol The Modular Exponentiation Simple Power Analysis, Counter-measure Modular Multiplication 2 Montgomery Modular Multiplication Our Objective Contributions 3 A · B , A · C A · B 0 , A · B 1 , . . . , A · B ℓ Application to SPA Protected Modular Exponentiations Experimental Results Conclusion 4 C. Nègre, T. Plantard and J.-M. Robert 8 / 37
Problematic Simple Power Analysis, Counter-measure Simple Power Analysis RSA Left-to-right Square-and-multiply Require: N the RSA modulus, g and e = ( e k − 1 , . . . , e 0 ) 2 integers ∈ [ 0 , . . . , N [ , with e k − 1 = 1. Ensure: X = g e mod N X ← g for i = k − 2 downto 0 do X ← X 2 mod N if e i = 1 then X ← X · g mod N return ( X = g e ) C. Nègre, T. Plantard and J.-M. Robert 9 / 37
Problematic Simple Power Analysis, Counter-measure Simple Power Analysis RSA Left-to-right Square-and-multiply Require: N the RSA modulus, g and e = ( e k − 1 , . . . , e 0 ) 2 integers ∈ [ 0 , . . . , N [ , with e k − 1 = 1. Ensure: X = g e mod N X ← g for i = k − 2 downto 0 do X ← X 2 mod N → A squaring corresponds to a low crenel if e i = 1 then X ← X · g mod N return ( X = g e ) C. Nègre, T. Plantard and J.-M. Robert 9 / 37
Problematic Simple Power Analysis, Counter-measure Simple Power Analysis RSA Left-to-right Square-and-multiply Require: N the RSA modulus, g and e = ( e k − 1 , . . . , e 0 ) 2 integers ∈ [ 0 , . . . , N [ , with e k − 1 = 1. Ensure: X = g e mod N X ← g for i = k − 2 downto 0 do X ← X 2 mod N if e i = 1 then X ← X · g mod N → A multiplication corresponds to a high crenel return ( X = g e ) C. Nègre, T. Plantard and J.-M. Robert 9 / 37
Problematic Simple Power Analysis, Counter-measure Simple Power Analysis RSA Left-to-right Square-and-multiply Require: N the RSA modulus, g and e = ( e k − 1 , . . . , e 0 ) 2 integers ∈ [ 0 , . . . , N [ , with e k − 1 = 1. Ensure: X = g e mod N X ← g for i = k − 2 downto 0 do X ← X 2 mod N if e i = 1 then X ← X · g mod N return ( X = g e ) → Vulnerable: the sequence of operations leaks the secret scalar (no regularity.) C. Nègre, T. Plantard and J.-M. Robert 9 / 37
Problematic Simple Power Analysis, Counter-measure Montgomery Binary Ladder Montgomery Require: e = ( e t − 1 , . . . , e 1 , e 0 ) with e t − 1 = 1 , g ∈ Z / N Z Ensure: X = g e mod N 1: X 0 ← g , X 1 ← g 2 mod N 2: for i from t − 2 downto 0 do if ( e i = 0 ) then 3: X 1 ← X 0 · X 1 mod N , X 0 ← X 2 mod N 4: 0 else 5: X 0 ← X 0 · X 1 mod N , X 1 ← X 2 mod N 6: 1 7: return ( X 0 ) Basic Montgomery’s Ladder Modular Exponentiation C. Nègre, T. Plantard and J.-M. Robert 10 / 37
Problematic Simple Power Analysis, Counter-measure Regular Exponentiation Algorithms Joye and Tunstall suggested a 2 t -ary recoding without zero digits: Unsigned-Digit Recoding Algorithm Require: e ≥ 1, m = 2 t , ℓ the m -ary length of e and N the RSA modulus Ensure: e = ( e ℓ − 1 , . . . , e 0 ) with e i ∈ { 1 , . . . , m } , 1 ≤ i ≤ ℓ − 2 1: s ← ( 1 , 1 , . . . , 1 ) m 2: e ′ ← e − s mod N 3: for i = 0 to ℓ − 2 do d ← e ′ mod m 4: e ′ ← ⌊ e ′ / m ⌋ 5: 6: e i ← d + 1 Then, the addition without carry leads to the 0-less recoding: C. Nègre, T. Plantard and J.-M. Robert 11 / 37
Problematic Simple Power Analysis, Counter-measure Regular Exponentiation Algorithms Joye and Tunstall suggested a 2 t -ary recoding without zero digits: Unsigned-Digit Recoding Algorithm Require: e ≥ 1, m = 2 t , ℓ the m -ary length of e and N the RSA modulus Ensure: e = ( e ℓ − 1 , . . . , e 0 ) with e i ∈ { 1 , . . . , m } , 1 ≤ i ≤ ℓ − 2 1: s ← ( 1 , 1 , . . . , 1 ) m 2: e ′ ← e − s mod N 3: for i = 0 to ℓ − 2 do d ← e ′ mod m 4: e ′ ← ⌊ e ′ / m ⌋ 5: 6: e i ← d + 1 Example with t = 4 , m = 10 10 : e = 1 9 7 5 0 4 0 2 3 Then, the addition without carry leads to the 0-less recoding: C. Nègre, T. Plantard and J.-M. Robert 11 / 37
Problematic Simple Power Analysis, Counter-measure Regular Exponentiation Algorithms Joye and Tunstall suggested a 2 t -ary recoding without zero digits: Unsigned-Digit Recoding Algorithm Require: e ≥ 1, m = 2 t , ℓ the m -ary length of e and N the RSA modulus Ensure: e = ( e ℓ − 1 , . . . , e 0 ) with e i ∈ { 1 , . . . , m } , 1 ≤ i ≤ ℓ − 2 1: s ← ( 1 , 1 , . . . , 1 ) m 2: e ′ ← e − s mod N 3: for i = 0 to ℓ − 2 do d ← e ′ mod m 4: e ′ ← ⌊ e ′ / m ⌋ 5: 6: e i ← d + 1 Example with t = 4 , m = 10 10 : e = 1 9 7 5 0 4 0 2 3 = 1 1 1 1 1 1 1 1 1 s Then, the addition without carry leads to the 0-less recoding: C. Nègre, T. Plantard and J.-M. Robert 11 / 37
Problematic Simple Power Analysis, Counter-measure Regular Exponentiation Algorithms Joye and Tunstall suggested a 2 t -ary recoding without zero digits: Unsigned-Digit Recoding Algorithm Require: e ≥ 1, m = 2 t , ℓ the m -ary length of e and N the RSA modulus Ensure: e = ( e ℓ − 1 , . . . , e 0 ) with e i ∈ { 1 , . . . , m } , 1 ≤ i ≤ ℓ − 2 1: s ← ( 1 , 1 , . . . , 1 ) m 2: e ′ ← e − s mod N 3: for i = 0 to ℓ − 2 do d ← e ′ mod m 4: e ′ ← ⌊ e ′ / m ⌋ 5: 6: e i ← d + 1 Example with t = 4 , m = 10 10 : e = 1 9 7 5 0 4 0 2 3 = 1 1 1 1 1 1 1 1 1 s e ′ ← e − s mod N 0 8 6 3 9 2 9 1 2 Then, the addition without carry leads to the 0-less recoding: C. Nègre, T. Plantard and J.-M. Robert 11 / 37
Recommend
More recommend
