Method for detecting security defect of shared prime factor of RSA cryptographic chip

Abstract

The invention provides a method for detecting a shared prime factor security defect in an RSA cryptographic chip. The method is particularly suitable for processing cryptographic chips using a large number of RSA public keys, and can effectively and efficiently identify and locate the prime number factors possibly shared by the RSA public keys in the chips so as to improve the security of the chips. A public key modulus n is extracted from a digital certificate, n values of all public keys are multiplied to obtain a product term M, modular operation is further performed on the M to generate a remainder term sequence, division operation is performed on a remainder and the public key n to obtain a divisor term sequence, and finally, the greatest common divisor (GCD) of each term in the divisor term sequence and the corresponding public key n is calculated. Therefore, the unsafe public key with the shared prime factor can be efficiently detected and identified. According to the method, the calculation complexity can be remarkably reduced, so that safety evaluation and defect detection can be quickly and accurately carried out in a large-scale chip production and test environment.

Description

Technical Field

[0001] The present invention relates to the field of functional verification of SoC integrated circuits, and in particular to a technical method for security testing of chips using RSA encryption and signature algorithms. This technology focuses on the identification and verification of shared prime factors in a large-scale RSA public key environment to evaluate and enhance the security performance of the chip. Background Art

[0002] The RSA encryption algorithm is widely used in integrated circuits and security chips, and its security is based on the mathematical difficulty of large number decomposition. In the RSA algorithm, the generation of keys involves selecting two large prime numbers (p, q) and performing a series of mathematical operations. The public key consists of the modulus n and the encryption exponent e, while the private key consists of the modulus n and the decryption exponent d. The encryption process uses the public key to encrypt the plaintext and generate the ciphertext; the decryption process uses the private key to decrypt the ciphertext and restore the original plaintext. The security of the RSA algorithm mainly depends on the difficulty of large number decomposition. Given a modulus n (that is, the product of two prime numbers p and q), there is currently no known efficient algorithm that can decompose its prime factors p and q only from n in a reasonable time. This makes the RSA algorithm highly secure when the key length and parameters are reasonably selected.

[0003] When producing a large number of devices based on the RSA algorithm, if different moduli n in different public keys use shared prime factors, the security of the system will be seriously reduced, and such situations need to be detected before use. The existing detection method uses the greatest common divisor (GCD) algorithm to detect public keys one by one. This process is time-consuming and computationally intensive, especially when the number of public keys reaches more than one million. Therefore, it is of great practical significance to develop an efficient detection method. Summary of the invention

[0004] The present invention proposes a method for efficiently detecting the security flaw of shared prime factors in RSA cryptographic chips. The method is suitable for detecting the problem of a small number (less than 0.01%) of shared prime factors in the public key set of large-scale (e.g., more than 1 million) RSA cryptographic chips, and can significantly reduce the computational complexity, thereby improving the detection efficiency and accuracy.

[0005] Specifically, suppose there is a large-scale data set containing a large number of RSA cryptographic chip public keys, where the modulus n value in the public key (e,n) is used to detect shared factors. For such a large-scale public key set, the traditional method relies on pairing the public keys and performing the greatest common divisor (GCD) calculation, which has a complexity of O(n 2 ), when the number of public keys to be detected is large, the time consumption is very significant. The present invention provides a new method to reduce the computational complexity from O(n 2) is reduced to O(n) by the following steps:

[0006] S1. Extract the modulus of the chip certificate public key: For each RSA public key used in the cryptographic chip certificate (assuming there are x), extract the modulus n to form a sequence (n1, n2, ..., n x ).

[0007] S2. Public key large integer product: For all extracted (n1, n2, ..., n x ), multiply them all together to get a product term M.

[0008] S3. Calculation of remainder sequence: Use M obtained in step S2 to calculate the remainder sequence for all n1, n2, ..., n x The square term modulus, that is, calculate M mod(n1) 2 ,M mod(n2) 2 , ..., M mod(n x ) 2 , and obtain a new sequence (w1,w2,...,w x ).

[0009] S4. Calculation of divisor sequence: Use the sequence (w1, w2, ..., w x ), let each of its terms be divided by the sequence (n1,n2,...,n x ), that is, calculate w1 / n1,w2 / n 2, ...,w x / n x , and obtain a new sequence (z1,z2,...,z x ).

[0010] S5. Shared factor calculation: Use the sequence (z1, z2, ..., z x ), let each of them be respectively and the sequence (n1,n2,...,n x ) to calculate the greatest common divisor of the corresponding items in the formula, that is, to calculate gcd(z1,n1),gcd(z2,n2),...,gcd(z x ,n x ), and obtain a new sequence (g1,g2,...,g x ), if any of the g i If it is greater than 1, it means that there is a shared factor in the public key used by the chip;.

[0011] S6. Insecure public key detection: Use the sequence (g1, g2, ..., g x ), select the item g that is greater than 1i , let it and the corresponding public key modulus n i Compare, if g i <n i , then it means n i Unsafe (there is a shared factor g i ). Technical Effects

[0012] By using the technical steps proposed in the present invention, a large number of insecure public keys can be detected, and the computational complexity of the algorithm is reduced from O(n 2 ) is reduced to O(n), which greatly reduces the required computing resources and can test a small number of security issues that may exist in a large number of chips in a short period of time. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is a flow chart of the present invention; DETAILED DESCRIPTION

[0014] The following is a specific implementation of the present invention, which describes in detail the specific implementation of each step to show the operation details of the method:

[0015] For step S1. Extracting the public key modulus of the chip certificate, firstly, the public key certificates of all the chips to be tested are stored as a database, and the modulus n of each RSA public key (usually in little endian byte format) is converted into a natural number format, thereby forming a sequence of x natural numbers (n1, n2, ..., n x ).

[0016] For step S2. multiply the public key integer, for the sequence (n1, n2, ..., n x ) (usually each element is a large integer of 2048 bits), parallel computing can be used to multiply them using the binary search method, that is, multiple CPU cores are used to calculate the product of every two adjacent elements in parallel to obtain a new sequence with half the size of the original sequence, and then iterate in a loop until the number of sequence elements is 1.

[0017] For step S3. remainder term sequence calculation, the method can be similar to step S2, except that multiple CPU cores are used to calculate M mod(n1) in parallel. 2 ,M mod(n2) 2 , ..., M mod(n x ) 2 , you can also use Montgomery's fast modular exponentiation algorithm to speed up the sequence (w1,w2,...,w x ) calculation process, thereby obtaining the remainder of the square term of each public key modulus, providing the required data for subsequent factor detection.

[0018] For step S4. Divisor term sequence calculation, use the sequence (w1, w2, ..., wx) obtained in step S3. In actual operation, w1 / n1, w2 / n 2, ...,w x / n x The division in the operation is converted into a cyclic subtraction operation, which can reduce the complexity of the CPU calculation sequence (z1, z2, ..., zx).

[0019] For step S5. Sharing factor calculation, in the actual calculation of gcd(z1,n1),gcd(z2,n2),...,gcd(z x ,n x ), we only need to keep the sequence (g1,g2,...,g x ) to reduce storage overhead.

[0020] For step S6. Unsafe public key detection, when an item g greater than 1 is detected i After that, you only need to determine whether its length is equal to the public key modulus (for example, whether it is equal to 2048 bits). If not, it means g i <n i , which can reduce the overhead of numerical comparison.

[0021] In summary, the present invention extracts the public key modulus n from the digital certificate, multiplies the n values ​​of all public keys, performs modular operations to generate a remainder item sequence, further obtains a divisor item sequence, and finally calculates the greatest common divisor of each item in the divisor item sequence and its corresponding public key n, and finds the shared factor, so as to achieve the goal of efficiently detecting and identifying unsafe public keys with shared prime factors. By showing the operational details in actual applications, the present invention can significantly improve the efficiency and accuracy of shared factor detection in a large-scale RSA public key environment. Through the method of the present invention, public keys with security defects can be quickly located and marked, providing an important technical means for large-scale chip security verification.

[0022] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principle and purpose of the present invention. The protection scope of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. Each implementation scheme within its scope shall be subject to the constraints of the present invention.

Claims

1. A method for detecting security flaws in shared prime factors of RSA cryptographic chips, characterized in that: Follow these steps to perform large-scale public key shared prime factor testing: By extracting the chip certificate public key and obtaining the modulus n in the RSA public key, the product term M is obtained by multiplying all the extracted public key moduli using the large integer product method ·Use the remainder term sequence calculation to obtain a specific remainder sequence by taking the modulus of M ·Calculate through the divisor sequence, divide each item in the remainder sequence by its corresponding public key modulus n to get the divisor sequence Calculate the greatest common divisor of the divisor sequence and the corresponding public key n, identify the elements greater than 1, and confirm whether they are shared prime factors of the corresponding public key.

2. The method for extracting the public key modulus and multiplying large integers according to claim 1, characterized in that: First, convert the modulus n of each RSA public key from byte format to natural number format, and then use large integer multiplication operation to multiply all moduli to obtain the product value M of these moduli.

3. The remainder term sequence calculation according to claim 1 or 2, characterized in that: For all public key moduli n1,n2,...,n x Perform square operation and then calculate M mod(n1) 2 ,M mod(n2) 2 , ..., M mod(n x ) 2 , and we get a new sequence, which is the remainder sequence.

4. The divisor term sequence calculation according to any one of claims 1 to 3, characterized in that: Use the remainder item sequence and the public key modulus to perform corresponding division operations on each item to obtain a new sequence, which is the divisor item sequence.

5. The public key shared prime factor detection based on the greatest common divisor calculation according to any one of claims 1 to 4, characterized in that: Using the divisor sequence and the corresponding public key, the greatest common divisor is calculated for each item, and elements greater than 1 are selected, and then it is determined whether they are prime factors of the corresponding public key.

Images