WO2013041200A1

WO2013041200A1 - Secret rsa encryption exponent that can be protected against access violation

Info

Publication number: WO2013041200A1
Application number: PCT/EP2012/003872
Authority: WO
Inventors: Sven Bauer; Jürgen PULKUS
Original assignee: Giesecke & Devrient Gmbh
Priority date: 2011-09-19
Filing date: 2012-09-17
Publication date: 2013-03-28
Also published as: DE102011115082A1; EP2759090A1

Abstract

The invention relates to a method for generating a secret RSA decryption exponent d which can be protected against access violation in a processor, having the following steps: a) selecting a construction number z; b) selecting two RSA prime numbers p, q dependent on the selected construction number z; c) calculating the RSA modulus n = p ⋅ q; d) selecting a public RSA encryption exponent e; and e) calculating an (unmasked) RSA decryption exponent d using the selected construction number z. The decryption exponent d is masked into a protected masked decryption exponent d' by: f) selecting a masking number r; and g) calculating the masked RSA decryption exponent d' using the selected construction number z.

Description

Against spying on protectable secret RSA encryption exponent

The invention relates to the field of protecting cryptographic calculations against spying. More particularly, the invention relates to a method for generating a spyware-protected secret RSA decryption exponent in a processor, e.g. in a chip card. The invention further relates to a method for performing a cryptographic calculation in a processor using such a secret RSA decryption exponent.

The asymmetric cryptosystem RSA developed in 1977 by Ronald L. Rivest, Adi Shamir and Leonard Adleman and described for example in US 4,405,829 [1] comprises a public key E = (e, n) and a secret private key D = (d, n), with the public encryption exponent e, the private decryption exponent d and the modulus n = p * q, which is formed as the product of two primes p and q. The public key E = (e, n) is used to obtain a message u according to the relation

(1) x = u ^e modtt

to encrypt a chiff rat x, or to verify a signature. The private key D = (d, n) is used to obtain a message u encrypted to a cipher x according to

(2) u = x ^J modrt

to decrypt or to generate a signature.

The exponents e and d are formed as follows.

1. Choose two appropriate primes p * q to keep secret.

2. Calculate the public RSA modulus

(3) n = p - q.

3. Compute the Eulerian function φ (η) of n

(4) <p (n) = (p-1) - (q-1). 4. As a public encryption exponent e, choose a number e that is apercentric to φ (η) with 1 <e <φ (η).

5. Compute the secret private decryption exponent d according to (5) d = e ^{~ l} (mod φ (η)).

The exponentiation to be performed in the decryption in accordance with the relation (2) u = x ^d mod "is usually carried out according to the" Repeated Square and Multiply "algorithm described, for example, in Alfred Meenezes, Paul C. van Oorschot, and Scott A Vanstone, "Handbook of applied cryptography" (hereafter referred to as [2] "Menezes") is described in Chapter 14.6, Algorithm No. 14.79.

The Square and Multiply algorithm is vulnerable to side-channel attacks, such as power attacks such as simple power analysis (SPA) or differential power analysis (DPA). Side-channel attacks, for example, in Paul C. Kocher, Joshua Jaffe and Benjamin Jun, "Differential power analysis", CRYPTO ^{^} 99th 388-397 (M. Wiener, ed.), LNCS, No 1666, 199 pp. [3] or in Suresh Chari, Josyula R. Rao, and Pankaj Rohatgi, "Template Attack," Cryptographic Hardware and Embedded Systems 2003 (Burt S. Kaliski, Cetin K. Κος, and Christof Paar, eds.), LNCS, no 2523, Springer-Verlag, 2003, pp. 13-28 [4]. For example, in a side channel attack, a performance profile is generated by measuring the power consumption of a processor while performing a computation over time and recording it as a function of time. The performance profile can be used to deduce the data used in the calculation. In the (Repeated) Square and Multiply Algorithm, the exponent d is processed bit by bit and the base x is squared to a first intermediate result and the intermediate result is continuously squared again. If an exponent bit is one, an additional multiplication with the base x is performed. The power consumption of the processor used is usually slightly different for squaring and multiplication. Therefore, in principle, the values of the exponent bits from the power profile, ie the time profile of the power consumption, of the processor in a single implementation of the square and multiply method can be determined by means of a simple power analysis SPA. Noise makes it difficult in practice to determine the values of the exponent bits. Since all exponent bits have to be determined correctly, the probability of success for long exponents by SPA is low in practice. In the case of the differential power analysis DPA, a multiplicity of performance profiles are generated from a multiplicity of exponentiation implementations according to eg equation (2) with always the same decryption exponent d but respectively different basic data x, which are evaluated by means of statistical methods in order to draw conclusions on the decryption exponent d to draw. Here, noise can be extracted from the performance profiles and thus increase the probability of meeting the exponent.

In the article Chevallier-Mämes, B., Ciet, M., Joye, M.: "Low-Cost Solutions for Preventing Simple Side-Channel Analysis: Side-Channel Atomicity"; Cryptology ePrint Archive, Report 2003/237 (2003), http://eprint.iacr.org/ [5], a variant of the Square and Multiply algorithm is disclosed which has improved protection against side channel attacks than the algorithm given in [2] (Menezes).

(6) Variant of the Square and Multiply algorithm from [5]: Input: integers x, d, n; d in binary d

Output: u = x ^d mod «

1 u _Q <- 1

2 «i <-

3 m - 0

4 y - / - i

5 while y> 0 do

6

7 m - (w + i ₇ ) mod 2

8 y <- j + m - l

9 end

10 return u _Q

In order to prevent or at least aggravate side channel attacks such as SPA and DPA, it is further proposed in the prior art to add to the private decoding exponent a for each execution of an exponentiation according to algorithm (2) a - usually different - random number r and thus the decryption exponent d to mask to a masked decryption exponent d 'and to use for decryption or signature computations according to algorithm (2) instead of the decryption exponent d the masked decryption exponent d'. The masked decryption exponent d 'has a different array of exponent bits than the unmasked decryption exponent d in each calculation. Therefore, using a masked exponent, DPA will not improve the probability of hit over SPA. US 5,991,415 A (Shamir) [6] discloses an RSA compliant way to mask the decryption exponent d with a secret random number r randomly chosen for each calculation and the secret Euler function according to the relation (4):

(7) cT = d + r - <p (n).

Carrying out an exponentiation according to relation (2) with a masked decryption exponent d 'according to relation (7) is generally considered safe in the prior art from spying the decryption exponent d by means of DPA.

DE 100 42 234 C2 (Infineon) [7] discloses another way to mask the secret RSA decryption exponent

(8) cT = d + r - Ä (n),

with a secret random number r and the secret Carmichael function λ (η) randomly chosen for each calculation

(9) λ {) = φ (η) I g = φ (ή) I gcd (p - \, q - \),

where φ (η) is still the Euler function and

(10) g = gcd (p - \, q - l)

is the largest common divisor (gcd) of p-1 and q-1.

In the present patent application, an attack method is proposed with which, by carrying out an exponentiation according to relation (2), u = x ^{d '} mod' with a secret private decryption exponent d 'according to relation (7) or (8) masked decryption exponent d 'detect (spy) leaves. The attack procedure is also described in the unpublished document [9]. The proposed attack on the Square and Multiply Algorithm (6) represents a combination of simple performance analysis SPA and differential performance analysis DPA. The attack against a decryption exponent d masked with the Euler function and a random number r uses the fact that approximately just that Half of most significant bits of the publicly known RSA modulus (3) n = pq coincide with the corresponding ones

most significant bits of the secreted Eulerian function (4)

<p (n) = (p-1) · (q-1). The most significant bits of the unmasked decryption exponent d calculated in accordance with Equation (5) d = e ^{~ l} (mod <p (n)) can be obtained as described in Boneh, D. "Twenty Years of Attacks on the RSA Cryptosystem", Notices of the AMS 46, 203-213, 1999 [8] Therefore, only the random number r is unknown in the most significant bits of the mask of the decrypted descrambling exponent d 'On this basis, the one used to mask the secret decryption exponent d can be used Determine random number r with reasonable computational effort Once r is determined, the remaining, lower-order bits of decoding exponent d can be determined.

In the Carmichael function (9) λ () - φ (ή) I g = φ (η) I ggT (p - 1, q - 1), the most significant bits do not match the most significant bits of the quantity gln, ie g by the gCD (10) shared RSA modulus (3) n = p ^■ q, however, there is the greatest common divisor g (10) and thus for the most significant bits usually relatively few options, which can be determined by trial and error. As soon as the most significant bits of the Carmichael function (9) λ (η) are found, the random number r can be determined as in the attack against the Euler function. Once r is determined, let the determine remaining, lower-order bits of the decryption exponent d.

For the attack, a processor executes a modular exponentiation according to relation (2) with the secret decryption exponents d 'dotted with a random number r, and the power consumption of the processor during exponentiation as a function of time is measured and recorded. The recorded power consumption as a function of time is called power profile.

The attack consists of three subsections, namely pickup step, SPA phase and DPA phase. In the acquisition step, a multiplicity of m power profiles of m implementations of an exponentiation (2) are recorded, with masking of the decryption exponent d, each with a newly randomly selected random number r _} . , j = 0 · · · m - 1. In the SPA phase, the performance profiles from the acquisition step are analyzed and from this approximately just half of the most significant bits of the decryption exponent d and Euler's function are determined, and all m random numbers r _} . , j = 0 · · · m - 1 determined. In the DPA phase, the remaining, lower-order bits of the decryption exponent d and the Euler function are determined by means of statistical methods from a plurality of power profiles suitably selected from the plurality.

It is an object of the invention to provide a method for generating an RSA decryption exponent d which allows improved protection against spying. In particular, a method for generating an RSA decryption exponent d is to be specified, which allows good protection against the attack proposed here. Furthermore, a method for generating an improved against side channel protected masked RSA decryption exponent cT based on the generated (unmasked) RSA decryption exponent d. The object is achieved by a method according to claim 1. Advantageous embodiments of the invention are specified in the dependent claims.

The method of claim 1 for generating a spy-resistant secret RSA decryption exponent d in a processor is characterized by the steps

a) selecting a design number z;

b) selecting two RSA primes p, q as a function of the chosen design number z;

c) calculating the RSA modulus n = p - q;

d) selecting a public RSA encryption exponent e;

e) calculating an - unmasked - RSA decryption exponent d using the chosen design number z. By selectively selecting the two RSA primes p, q as a function of the selected design number z, the decryption exponent d is deliberately constructed so that subsequent masking from d to d 'using the selected design number z is particularly efficient. The basis for the efficiency of the (later to be performed) masking of d to d 'is the specific construction method for the unmasked decryption exponent d. The inventive method thus provides a secret RSA decryption exponent d, which, after it has been additionally masked, better protected against spying, that is, in the generated according to claim 1 unmasked form, allowing improved protection against spying on the decryption exponent d.

The design number z is preferably chosen as large as possible, but sufficiently small that there are still sufficient possibilities to select the two prime numbers p, q.

Optionally, the design number z has a bit length lz and the RSA modulus has a bit length lz. The bit length In of the modulus n is already known before the modulus n is calculated, since the RSA calculation is constructed such that the modulus n has a desired bit length, for example 2048 bits for the RSA-2048, 1024 bits for the RSA-1024 etc. For example, the bit length lz of the design number z is selected to be in the bit length range extending from 32 to a quarter of the bit length In of the RSA modulus n (eg, lz to a maximum of 512 if ln = 2048), more preferably in the range from 64 to a quarter of the bit length In of the RSA modulus n, more preferably in the range of 64 to one-eighth of the bit length In of the RSA modulus n (eg lz to a maximum of 256 if ln = 2048). Optionally, the bit length lz of the design number z is exactly 64 bits. The bit length lz of the design number is used to determine how many additional bits an attacker must guess, namely lz if all lz bits are randomly selected, or (lz-1) if the highest bit is set and the remaining bits are selected at random are. Therefore, it is advantageous if z and lz is chosen as large as possible. On the other hand, the bit length lz of the design number should be sufficiently small in comparison to the bit length In of the modulus, since too large a bit length lz of the design number would unfavorably limit the choices for the random numbers p and q. A bit length lz of design number z of 64 bits is a good compromise, especially for RSA-2048 and RSA-1024. The calculation in step e) is preferably designed as: calculating the (unmasked) RSA decryption exponent d according to the calculation rule d = e ^'x mod ((7 - 1) * (q-1) / z) = φ (ή) I z.

The quantity ((p-1) * (q-1) / z) = <p (n) lz, ie the modulus used in the calculation formula for the RSA decryption exponent d, has the Eulerian function conventionally used at this point φ ή) (compare Gig (5)) has the advantage that the most significant bits are not known due to the division by the design number z. Thus, even the most significant bits of the RSA decryption exponent d are not known. The larger z is, the more difficult it is to guess z. In addition, by calculating the decryption exponent d according to the calculation rule d = e ^~ mod ({p - \) - {q - \) lz), the masking function φ (in order to mask d to d 'by means of a random number r) is achieved analogously. ή z can be used, ie the masking can take place according to d '= d + r ^■ (p-1) * (q-1) I z = d + r ^■ φ (η) I z.

For example, the processor is a microprocessor in a smart card or other than card shaped tokens. Optionally, the processor is a crypto-coprocessor associated with a microprocessor.

The calculated RSA decryption exponent d can subsequently be used for in principle any number of exponentiations, respectively decryptions or signature creations, eg according to equation (2). As a rule, the RSA decryption exponent d is still masked before execution of the exponentiation. The selection of the design number z and the prime numbers p, q as well as the calculation of d has to be done only once. Preferably, the prime numbers p, q are formed as follows depending on the design number z, and the (unmasked) decryption exponent d is RSA compliant as follows.

Step b) is preferably designed as: selecting two RSA primes p, q as a function of the selected design number z such that p / z gives remainder one and q / z gives remainder one.

By such a selection of the design number z and the prime numbers p, q, it is achieved that the public encryption exponent e is prime relative to φ (η) I z.

Optionally, a random number z is chosen as the design number z. Optionally, the design number z is a prime number, optionally a non-prime number. A prime and a non-prime construction number each have different advantages and disadvantages, depending on the concrete example.

Optionally, in step d), "selecting a public RSA encryption exponent e", the Euler function <p (n) is computed according to Gig (4), and φ {η) I z is calculated Optionally, the public RSA encryption exponent e is chosen e is prime to φ (η) I z, eg as stated above A method according to the invention for computing a spy protected masked secret RSA decryption exponent d 'in a processor is characterized by the steps of:

a) -e) calculating an (unmasked) RSA decryption exponent d according to a method as stated above; f) selecting a masking number r;

g) calculating the masked RSA decryption exponent d 'using the RSA decryption exponent d, the masking number r and the selected design number z.

Step g) is preferably designed as: calculating the masked RSA decryption exponent d 'according to the calculation rule

d '= d + r ^■ {p-1) * (q-1) I z = d + r * φ (η) I z. The RSA decryption exponent d calculated according to the invention is thus masked with the improved masking function φ (η) I z. This ensures that even the most significant bits of the masked RSA decryption exponent d 'are protected by means of a masking function φ ή) Ι z, which is also secret in these most significant bits, and additionally by means of the random number r, and not by means of the Random number r. In connection with a preferably large size of z, even guessing z is unrealistic.

Optionally, a random number is selected as masking number r. Optionally, the masking number is prime or not prime. In general, the masking number will not be prime.

The decryption exponent d 'masked with the masking number r is usually used only once. For each new use of a masked decryption exponent d ', a new masking number, in particular a random number r, is usually selected and a new masked decryption exponent d' is calculated. Optionally, the public encryption exponent e is chosen to be small, measured in particular by the performance of the processor, for example at most 2 ¹⁷ + 1 or at most 2 ¹⁸ + 1, eg e = 2 ¹⁶ + 1 = 65537. Due to the inventive construction of the RSA primes p and q, the method according to the invention is still safe even if e is small and therefore the attack on a conventionally masked RSA decryption exponent d proposed by the applicant could be successful. The invention thus offers particular protection for an RSA method in which a relatively small public encryption exponent e is used.

A method according to the invention for calculating a modular exponentiation u = x ^{d '} mod in a processor is carried out with a masked RSA decryption exponent d' calculated according to a method as stated above.

Decryption for decrypting a ciphertext x to a plaintext u is performed by modular exponentiation as described above. A signature calculation for signing an input data set x into a signature u is likewise carried out by modular exponentiation as described above.

In a method for sequentially performing a plurality of exponentiations, a new masking number r is selected for each exponentiation and a new masked RSA decrypting exponent d 'is calculated.

In the following the invention will be explained in more detail with reference to exemplary embodiments and with reference to the drawing, in which: Fig. 1 is a histogram for power consumption measurements of squares and multiplications;

Fig. 2 is a schematic power profile T _{} of} a processor in calculating a sequence of squares and multiplications.

1 shows a histogram of a processor for measurements of the current consumption I (in arbitrary units au) of squaring S and multiplication M (multiplication), in which is plotted which current consumption I occurs with which relative frequency F. To generate the histogram, squaring S and multiplication M were carried out with the processor in a targeted manner and the power consumption during the respective operation was determined. Squarings S are represented by black bars, multiplications M by gray bars. For the distributions of the frequencies, for squaring S and multiplications M are separated, standard distributions (bell curves, black for squaring S, gray for multiplications M) and their mean values (vertical arrow S for mean of the squaring or M for mean of the multiplication) located. It can be seen from the histogram that the average power consumption of a squaring is lower than the average power consumption of a multiplication (arrow S is to the left of arrow M, the lower value of I). The actual power consumption of a single operation, squaring S or multiplying M, may be at a different value. The deviation can be represented by the standard deviation of the standard distribution. FIG. 1 further shows that power consumptions of squares occur in which the value of power consumption would suggest that multiplication would have been performed, and vice versa. It follows that when measuring the power consumption of an unknown operation can be specified only with a certain probability, whether a squaring or multiplication was performed. In order to spy out from a modular exponentiation with a processor the masked secret decryption exponent d 'used as an exponentiation exponentiation, performance profiles are obtained from several executions of the exponentiation and analyzed using a histogram such as that shown in FIG.

Fig. 2 shows a schematic power profile Γ. a processor, ie the power P consumed by the processor as a function of time t, in the calculation of a sequence of squares and multiplications, as may occur when carrying out a modular exponentiation. The power profile is equal to the current profile, ie the power consumption as a function of time multiplied by an applied voltage. Each power peak in Figure 2 corresponds to a single operation, squaring S or multiplication M. The overall sequence of power spikes and associated operations provides a corresponding operation profile to the power profile O = SMSSSSMSSSMSM .... According to algorithm (6), line 6, there is one operation sequence squaring and multiplication SM for each exponent bit with value 1, and a single operation squaring S for each exponent bit 0. Thus, the power profile from FIG. 2 corresponds to a processed exponent d = 10001001 1. ... Based on the power consumption of a single operation and the deviation of this power consumption from the expected average value for the respective operation determined from the histogram of FIG. 1, a probability is assigned to each identified operation and a probability profile W is assigned to the operation profile, which indicates with which probability the respective value in the operation profile, S or M, is a squaring S (alternatively: probability that the operation plication is). For example, as stated above with respect to FIG. 2, the probability profile W could have the following shape: W = 0.99,0.65,0.92,0.27,1.00,0.30,0.01,0.63,0.94,0.53,0.02,0.68,0.04,. ... As mentioned above, the attack can be subdivided into three subsections of admission step, SPA phase and DPA phase.

1. Capture step. Accommodating the power profiles in a receiving step, power profiles _T _y, / = 0, · · ^■ m - 1, such as that shown in Figure 2, of m-throughs of the square and multiply algorithm (6) according to relation (7 ) with m 1-bit long random numbers

, , J = 0, · · · m - 1 RS private masked A decryption exponent d '= d + r _j ^{■ φ} (η), j = 0, · · · m - 1 was added. Each performance profile is assigned an operation profile and a probability profile. The sequence of operations in the operation profile reflects the masked exponent d '. The goal is to determine the unmasked exponent d.

2nd SPA phase

For the most significant bits of each power profile T _} , the masking number r is calculated bit by bit on the basis of the equation d'd + r - n valid in this range, with n instead of the Euler function. In the guessing process, the probability profile is taken into account, whereby too poor rate results are sorted out. Once r is guessed, as indicated in [8], the most significant bits of the unmasked decryption exponent d can be guessed if the following conditions are met: the prime numbers p and q are both approximately equal to V «, and the public Encryption exponent is small, for example e = 65537 = 2 ¹⁶ + l. The condition for the limit of e depends on the computing power of a processor used for the calculation. Under the condition that p and q both have approximately the value n, there are only e-1 possible values for the majority of most significant bits of d. Under the further condition that e is small, the plurality of most significant bits of d can be determined by trial and error.

3rd DPA phase

As soon as the most significant bits of the unmasked decryption exponent d and the masking number r from the SPA phase are known, the remaining unknown bits of the unmasked decryption exponent d are determined bit by bit by statistical evaluation, starting in a manner known per se at the least significant bit.

In a masked decryption exponent d 'constructed according to the invention, the guessing of the masking number r is no longer possible because, due to the special selection of the prime numbers p and q, there is no range of equality between the known modulus n-p-q and the secreted masking enhancement used Masking function (p - \) - {q - \) lz exists. In particular, with a large number of masking numbers z, guessing is unrealistic. In addition, even the most significant bits of the unmasked decryption exponent d are better protected due to the improved design of d. Thus, it can not be concluded from performance profiles of Exponentiationen with the masked secret decryption exponent d 'with reasonable computational effort on the unmasked secret decryption exponent d. Literature:

[4] US 4,405,829;

[2] Alfred Menezes, Paul C. van Oorschot, and Scott A. Vanstone, "Handbook of Applied Cryptography," Chapter 14.6, Algorithm No. 14.79;

[3] Paul C. Kocher, Joshua Jaffe and Benjamin Jun, "Differential power analysis", CRYPTO ^{^} 99 (M. Wiener, ed.), LNCS, No 1666, 199, pp 388-397..;

[4] Suresh Chari, Josyula R. Rao, and Pankaj Rohatgi, "Template Attacks," Cryptographic Hardware and Embedded Systems 2003 (Burt S. Kaliski, Cetin K. Κος, and Christof Paar, eds.), LNCS, no 2523, Springer-Verlag, 2003, pp. 13-28;

[5] Chevallier-Mämes, B., Ciet, M., Joye, M.: "Low Cost Solutions for Prevention Simple Side-Channel Analysis: Side-Channel Atomicity; Cryptology ePrint Archive, Report 2003/237 (2003), http://eprint.iacr.org/;

[6] US 5,991,415 A;

[100] DE 100 42 234 C2;

[8] Boneh, D. "Twenty Years of Attacks on the RSA Cryptosystem", Notices of the AMS 46, 203-213, 1999;

[9] Bauer, S., Pulkus, J., "A Combined SPA / DPA Attack Against a Protected RSA Implementation," unpublished.

Claims

Patent claims

A method of generating a spyware-protected secret RSA decryption exponent d in a processor,

characterized by the steps

a) selecting a design number z;

b) selecting two RSA primes p, q as a function of the chosen design number z;

c) calculating the RSA modulus n = p ^■ q;

d) selecting a public RSA encryption exponent e;

e) calculating the RSA decryption exponent d using the chosen design number z.

2. The method of claim 1, wherein the design number z has a bit length lz and the RSA modulus has a bit length In, and wherein the bit length lz of the design number z is in the bit length range extending from 32 to a quarter of the bit length In of RSA Modulus n extends.

3. The method of claim 1 or 2, wherein step e) is configured as: calculating the RSA decryption exponent d according to the calculation rule d = e ^~ mod ((/? -1) · (q-1) / z).

4. The method according to any one of claims 1 to 3,

wherein step b) is configured as: selecting two RSA primes p, q as a function of the selected design number z such that p / z gives remainder one and q / z gives remainder one.

A method of calculating a spy protected masked secret RSA decryption exponent d 'in a processor, characterized by the steps a) -e) calculating an RSA decryption exponent d by a method according to any one of claims 1 to 4;

f) selecting a masking number r;

6. The method of claim 5, wherein as the masking number r a random number is selected.

The method of claim 5 or 6, wherein step g) is configured as: calculating the masked RSA decryption exponent d 'according to the calculation rule d' = d + r * (p-1) * (q-1) / z.

8. Method for calculating a modular exponentiation

u = x ^{d '} mod «

in a processor with a masked RSA decryption exponent d 'calculated by a method according to any one of claims 5 to 7.

9. decryption or signature calculation by modular exponentiation according to claim 8 for decrypting a cipher x to a plaintext u or for signing an input data set x to a signature u.

10. A method for sequentially performing a plurality of exponentiations according to claim 8 or 9, wherein for each exponentiation a new masking number r is selected and a new masked RSA decryption exponent d 'is calculated.