Method suitable for RSA modular exponentiation calculation

Abstract

The invention discloses a method suitable for RSA modular exponentiation calculation. The method comprises the following steps of: 1, acquiring a random number R'; 2, calculating a modular inverse value R of R' to an RSA modulus n, namely R=R'-1mod n; 3, averagely dividing an index into r segments, and ensuring that the length of each segment is s-bit; 4, calculating T1=M (RSA modular exponentiation base number) and Ti+1=2s.Ti, wherein i=1,2,..., n; and 5, performing RSA modular exponentiation calculation. By the quick and safe method suitable for the RSA modular exponentiation calculation, the RSA modular exponentiation calculation can be completed by taking measures of combining average segmentation of the index and base number mask, so that the cycle index in the modular exponentiation calculation is reduced, time cost required by the modular exponentiation calculation is reduced, calculation flows in various conditional branches are balanced, and random elements are added in an input part of modular exponentiation; and therefore, the modular exponentiation calculation can be carried out more quickly and safely.

Description

technical field [0001] The invention relates to modular exponentiation calculation in RSA cryptographic operation (including decryption and signature in the application), in particular to a fast and safe method suitable for RSA modular exponentiation calculation, especially suitable for the application of chips containing the RSA algorithm. Background technique [0002] The RSA algorithm is a widely used encryption algorithm, but the RSA algorithm is vulnerable to SPA (Simple Power Analysis) and DPA (Differential Power Analysis) attacks. The idea of ​​fighting against SPA attacks is to balance the calculation process in each different conditional branch in RSA modular exponentiation, so that the power consumption of each conditional branch is basically the same; while the idea of ​​fighting against DPA is to use a random number to The input of the operation is masked, and the modular exponentiation is calculated with the masked data, and finally the correct calculation resul...

AI Technical Summary

Problems solved by technology

[0004] It can be seen from Algorithm 1 that in traditional RSA modular exponentiation, when the exponent is "1", the modular square and the modular multiplication will be calculated once, and when the exponent is "0", only the modular square will be calculated once. The difference in the calculation process of the conditional branch will cause the difference in power consumption, which is vulnerable to SPA attacks; in addition, the input of the modular exponent is not randomized, so there will be a certain correlation between the exponent and power consumption, so it is vulnerable to DPA attacks

Here, the data length of RSA is assumed to be 1024 bits, and the average ratio of "0" and "1" in the exponent is 1:1. Then it can be deduced that the traditional method to perform an RSA modular exponentiation operation needs to calculate 1024 times of modular squares and 512 times of modular multiplications. high time cost

Images