RSA-CRT password data processing method and password chip

Abstract

The embodiment of the invention discloses an RSA-CRT password data processing method and a password chip, and the method comprises the steps: obtaining an RAS-CRT key corresponding to a request identifier carried in a password service request in response to the password service request, the RAS-CRT key comprising a private key; randomizing the first part of private key value in the private key to obtain a randomized private key value of the first part of private key value; on the basis of a target private key value of the first part private key value and a second part private key value in the private key, performing private key operation on to-be-processed data carried by the password service request to obtain target data, and sending password service response data corresponding to the password service request; wherein the password service response data comprises target data; wherein the target private key value is the first part private key value or the randomized private key value of the first part private key value, and the target data is obtained based on the randomized private key value of one or more private key values in the first part private key value.

Description

Technical Field

[0001] The present application relates to but is not limited to the field of information security, and in particular to an RSA-CRT cryptographic data processing method and a cryptographic chip. Background Art

[0002] The RSA algorithm is currently a widely used public key cryptographic algorithm. In order to improve the efficiency of signing or decryption, the Chinese Remainder Theorem (CRT) can be introduced to accelerate it during the decryption or signing stage. The RSA algorithm that introduces the Chinese Remainder Theorem method (RSA-CRT for short) has a performance speed advantage of about 4 to 8 times compared to the traditional RSA algorithm. Therefore, RSA-CRT is more widely used.

[0003] The RSA-CRT algorithm in the related art is vulnerable to side channel attack (SCA), also known as side channel attack, which is a method in which the attacker uses the side channel information leakage such as time consumption, power consumption or electromagnetic radiation of the cryptographic device during operation to obtain the private key or part of the private key information by analyzing the leaked information, and then attacks the cryptographic device, which poses a serious threat to the cryptographic device. Therefore, in order to resist side channel attacks, it is urgently needed to provide a new RSA-CRT cryptographic data processing method. Summary of the invention

[0004] In order to solve the above technical problems, the embodiments of the present application at least provide a RSA-CRT cryptographic data processing method and a cryptographic chip.

[0005] The technical solution of the embodiment of the present application is implemented as follows: In a first aspect, an embodiment of the present application provides a RSA-CRT cryptographic data processing method, the method comprising: In response to the cryptographic service request, obtaining a RAS-CRT key corresponding to the request identifier carried in the cryptographic service request, wherein the RAS-CRT key includes a private key; Randomizing the first part of the private key value in the private key to obtain a randomized private key value of the first part of the private key value; Based on the target private key value of the first part of the private key value and the second part of the private key value in the private key, perform a private key operation on the data to be processed carried by the cryptographic service request to obtain the target data, and send cryptographic service response data corresponding to the cryptographic service request; wherein the cryptographic service response data includes the target data; The target private key value is the first part of the private key value or a randomized private key value of the first part of the private key value, and the target data is obtained based on a randomized private key value of one or more private key values ​​in the first part of the private key value.

[0006] In a second aspect, an embodiment of the present application provides a cryptographic chip, the cryptographic chip comprising: A response module, used for responding to a password service request; An obtaining module, used to obtain a RAS-CRT key corresponding to the request identifier carried in the cryptographic service request, wherein the RAS-CRT key includes a private key; A processing module, configured to perform randomization processing on a first part of a private key value in the private key to obtain a randomized private key value of the first part of the private key value; The processing module is further configured to perform a private key operation on the data to be processed carried by the cryptographic service request based on a target private key value of the first part of the private key value and a second part of the private key value in the private key to obtain target data; wherein the target private key value is the private key value or a randomized private key value of the private key value, and the target data is obtained based on a randomized private key value of one or more private key values ​​in the first part of the private key value; A sending module is used to send cryptographic service response data corresponding to the cryptographic service request; wherein the cryptographic service response data includes the target data.

[0007] In a third aspect, an embodiment of the present application provides a cryptographic chip, the cryptographic chip comprising: a memory and a processor, The memory stores a computer program executable on the processor. When the processor executes the program, part or all of the steps in the method described in the first aspect are implemented.

[0008] In a fourth aspect, an embodiment of the present application provides a cryptographic device, which includes a cryptographic chip.

[0009] In a fifth aspect, an embodiment of the present application provides a storage medium, which stores one or more computer programs, and the one or more computer programs can be executed by one or more processors to implement some or all of the steps in the method described in the first aspect.

[0010] In a sixth aspect, an embodiment of the present application provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements some or all of the steps in the method described in the first aspect.

[0011] The embodiments of the present application at least provide an RSA-CRT cryptographic data processing method and a cryptographic chip, which, in response to a cryptographic service request, obtains a RSA-CRT key corresponding to a request identifier carried in the cryptographic service request, wherein the RAS-CRT key includes a private key; performs randomization processing on a first-part private key value in the private key to obtain a randomized private key value of the first-part private key value; performs private key operation on the data to be processed carried by the cryptographic service request based on a target private key value of the first-part private key value and a second-part private key value in the private key to obtain target data, and sends cryptographic service response data corresponding to the cryptographic service request; wherein the cryptographic service response data includes the target data; wherein the target private key value is the first-part private key value or a randomized private key value of the first-part private key value, and the target data is obtained based on a randomized private key value of one or more private key values ​​in the first-part private key value. The embodiment of the present application randomizes some of the private key values ​​involved in the operation, and performs modular exponentiation operation on the processed data based on at least one randomized private key value, thereby increasing the difficulty for attackers to analyze and crack the data, reducing the possibility of attackers obtaining key information of the RSA private key through side channel analysis, and improving the security of RSA-CRT operations.

[0012] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

[0014] Figure 1 A schematic diagram of the structure of an optional cryptographic chip provided in an embodiment of the present application; Figure 2 A schematic flow chart of an optional RSA-CRT cryptographic data processing method provided in an embodiment of the present application; Figure 3 A flowchart of another optional RSA-CRT cryptographic data processing method provided in an embodiment of the present application; Figure 4 A flowchart of another optional RSA-CRT cryptographic data processing method provided in an embodiment of the present application; Figure 5 A flowchart of an optional RSA-CRT cryptographic data processing method provided in another embodiment of the present application; Figure 6 A flowchart of another optional RSA-CRT cryptographic data processing method provided in another embodiment of the present application; Figure 7A flowchart of another optional RSA-CRT cryptographic data processing method provided in another embodiment of the present application; Figure 8 A schematic diagram of the structure of another optional cryptographic chip provided in an embodiment of the present application; Fig. 9 A schematic diagram of a hardware entity of a cryptographic chip provided in an embodiment of the present application; Fig.10 A hardware entity diagram of a cryptographic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0015] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions of the present application are further elaborated in detail below in conjunction with the drawings and embodiments. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0016] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict. The terms "first / second / third" involved are merely used to distinguish similar objects and do not represent a specific order for the objects. It is understood that "first / second / third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0017] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing this application and are not intended to limit this application.

[0018] The RSA encryption algorithm is the most widely used public key cryptographic algorithm. In order to improve the security of the operation, the RSA non-CRT security operation method is proposed in the traditional technology. The method is implemented based on the cryptographic hardware accelerator. Specifically, the private key exponent d in the modular exponentiation operation is randomly split into two components d1 and d2, a random number k is introduced, and a modular exponentiation operation is performed in combination with the public key e. For example, , transform the private key exponent d as above, and get , combined with the RSA operation characteristics, to achieve equivalent calculation. However, this method still has the problem of low calculation efficiency and possible leakage of key information.

[0019] In modern high-security scenarios, RSA cryptographic calculations are widely used in public key infrastructure (PKI), blockchain, servers, various terminal devices, cryptographic machines (cryptographic accelerator cards), secure communications, digital payments, and other fields. Especially in areas such as banks, governments, and enterprises that need to process sensitive data, it has become a trend to replace the traditional RSA algorithm with the RSA-CRT algorithm while ensuring high security and taking into account performance.

[0020] The RSA-CRT algorithm is an optimization technology in the RSA encryption algorithm, especially in the process of modular exponentiation of large integers, CRT is used to accelerate RSA signing and decryption operations (private key operations). RSA-CRT is particularly suitable for reducing computing time and improving performance, especially when the modulus bits are large, significantly improving the performance of private key operations, and is widely used in practical applications.

[0021] Therefore, the related art proposes the technology of RSA-CRT secure operation, which relies on a hardware-side accelerator that is resistant to side-channel attacks, thereby reducing the risks of simple power analysis (SPA), differential power analysis (DPA), timing analysis attacks, and other risks of Montgomery ladder modular exponentiation hardware accelerators. However, for non-high-security versions of hardware accelerators with ordinary modular exponentiation functions, they are more vulnerable to SPA, DPA or timing analysis attacks. Since the RSA-CRT operation process requires the use of a large amount of secret information including p, q, dp, and dq, which are respectively used in the modulus and exponent, the values ​​are closely related to the private key. Cryptographic devices have more or less secret information leakage problems when executing cryptographic algorithms. The existing side-channel analysis methods enable attackers to obtain the possibility of leaking key information through various information.

[0022] Here, the key generation process of the RSA algorithm, RSA-CRT, the RSA-CRT private key calculation process, and the problems that exist when using RSA-CRT for private key calculation are explained.

[0023] 1) Key generation process for the RSA algorithm The first step is to select two large prime numbers p and q; The second step is to calculate the modulus N, where the modulus N can be obtained by the following formula (1);

[0024] Step 3: Calculate the Euler function , where the Euler function It can be obtained by the following formula (2):

[0025] Step 4: Select a public key e that satisfies ,and ; Step 5: Calculate the private key d, which can be obtained by the following formula (3).

[0026]

[0027] Encryption or signature verification (public key operation) can be calculated using the following formula (4):

[0028] In the public key operation, M represents the data to be processed, which can be plain text data or signed data, C represents the target data after the public key operation, which can be cipher text data or data after signature verification, e represents the public key, and N represents the modulus; Decryption or signing (private key operation) can be calculated using the following formula (5):

[0029] Among them, in the private key operation, C represents the data to be processed, which can be ciphertext data or data to be signed, M represents the target data after the private key operation, which can be plaintext data or signed data, e represents the public key, and N represents the modulus.

[0030] 2) For RSA-CRT RSA-CRT is an optimization technology introduced in the RSA encryption algorithm. Based on the Chinese remainder theorem, it decomposes the calculation into multiple smaller modular operations during the private key operation (RSA decryption and signature), thereby accelerating the modular operation of large numbers and significantly improving the computing efficiency, especially when large integers need to be processed. RSA-CRT can usually achieve a 4-fold acceleration, and if the modular exponentiation can be parallelized, it can be close to 8 times.

[0031] 3) Calculation of RSA-CRT private key The first step is to determine the private key quintuple (p, q, dp, dq, qInv) corresponding to the private key d. Among them, p and q are two randomly generated large prime numbers. dp, dq, qInv can be obtained by the following formula (6).

[0032]

[0033]

[0034]

[0035] The second step is to calculate m1. m1 can be obtained by the following formula (7).

[0036]

[0037] The third step is to calculate m2. m2 can be obtained by the following formula (8).

[0038]

[0039] Step 4: Calculate h. h can be obtained by the following formula (9).

[0040]

[0041] Step 5: Calculate M. M can be obtained by the following formula (10).

[0042]

[0043] For RSA-CRT private key operations, the private key quintuple cannot be made public, because the private key quintuple contains the key information of the private key. Any side channel analysis attack that obtains any of the values ​​will face the serious security risk of private key leakage. RSA-CRT operations use p and q as moduli, and p and q are the large number decomposition problems that are essential for cracking RSA, which directly determine the security of the RSA system. Attacks on p and q are often the key to cracking RSA private keys. Therefore, in order to enhance the security of RSA-CRT, especially in side channel attacks such as inferring p, q, dp, and dq information through time analysis, power analysis, etc., scrambling is required for protection.

[0044] 4) Problems when using RSA-CRT for private key calculation If dp or dq is inferred through analysis, there will also be a serious security risk of private key leakage. For example, if the modulus N (public), public key e (public), ciphertext C (stolen), and dp (obtained through analysis) are known, the key can be inferred. Assuming that d is an RSA-non-CRT private key, it satisfies the relationship shown in formula (11):

[0045] By further deducing formula (11), we obtain formula (12):

[0046] Among them, k is right Business.

[0047] Since RSA-CRT key generation satisfies formula (2), formula (12) is transformed as follows:

[0048] Among them, in the above formula, k is the quotient of d*e divided by (p - 1), and , transform formula (13) as follows,

[0049] Continue to deduce formula (14),

[0050] Transpose formula (15),

[0051] Extract the common term (p - 1) from formula (16)

[0052] From the above premise, it is known that the attacker obtains dp and the public key e. Assume , transform formula (17),

[0053] Since in the RSA-CRT private key operation , so dp < p - 1. Through formula (18), it can be obtained that therefore e > x.

[0054] Therefore, given dp, e, and both p and x are positive integers, the attacker can iterate through , and there must be an x that can satisfy formula (18), thereby calculating p, and then cracking q from the modulus N, and the private key is deduced. Generally, the public key exponent e in the industry is mostly 65537, and the calculation cost is not high. If it is changed from knowing dp and not knowing dq to knowing dq and not knowing dp, there is also a possibility of private key leakage.

[0055] In view of one or more of the above problems, the exemplary embodiments of the present application first provide an RSA-CRT cryptographic data processing method. Combining existing modular exponentiation, modular multiplication, and modular addition and subtraction hardware accelerators, introducing random numbers, and performing random transformation on the data participating in the operation, such as the private key values in the private key used as the exponent and modulus, increases the difficulty of analysis and cracking, and maximally reduces the possibility that the attacker obtains the key information of the RSA private key through side-channel analysis, improving the security of applying RSA-CRT operations.

[0056] Before introducing the embodiments of the present application, briefly describe Fermat's little theorem and some properties of modular arithmetic.

[0057] 1) Regarding Fermat's little theorem For any prime number s and integer ( is the ring of integers modulo s, ), all have the following formula (19)

[0058] Multiply both sides of formula (19) by , we get formula (20):

[0059] Among them, the Euler function can be expressed by formula (21):

[0060] For a prime number s, if , assuming , k is an integer, , using Fermat's little theorem combined with the properties of modular exponentiation, we can get the following formula (22):

[0061]

[0062]

[0063]

[0064] Where k is the quotient of t divided by s-1, and n is the remainder. .

[0065] like , the reverse equation can be obtained as follows (23)

[0066]

[0067]

[0068] Wherein, k is any positive integer.

[0069] 2) Regarding the properties of modular operations

[0070]

[0071] Among them, q3 is the quotient of A divided by B, and u is the remainder of A divided by B ( ),because and They are all multiples of B, and the remainder of the final modulo operation is also u.

[0072] Figure 1 The schematic structural diagram of an optional cryptographic chip provided in the embodiment of the present application is as follows: Here, the cryptographic chip 100 includes a software logic module 110, a hardware cryptographic module 120 and a storage module 130 connected by a bus.

[0073] Among them, the software logic module 110 can be configured to control the hardware cryptographic module 120 to obtain data from the storage module 130 to execute the RSA-CRT cryptographic data processing method provided in the embodiment of the present application. The software logic module 110 can be in the form of a processor (Central Processing Unit, CPU) and the like.

[0074] Among them, the hardware cryptographic module 120 includes multiple operation units and generation units. Some of the operation units in the hardware cryptographic module 120 can be configured to perform modular exponentiation operations in the RSA-CRT algorithm. Another part of the operation units can be configured to perform operations such as modular exponentiation, modular addition, modular subtraction, modular inverse, modular multiplication, etc. related to the embodiments of the present application; here, the operation unit can be a hardware accelerator. The generation unit in the hardware cryptographic module 120 is used to generate true random numbers or true random values, and here, the generation unit can be a true random number generator.

[0075] The storage module 130 is configured to store the acquired data to be processed and the private key of the RSA-CRT algorithm, as well as the sub-private key values ​​of each private key value contained in the private key and multiple random values. A part of the operation units is configured to perform private key operation processing using the data to be processed and the private key of the RSA-CRT algorithm, and after another part of the operation units performs modular exponentiation, modular addition, modular subtraction, modular inverse, modular multiplication and other operations based on the random value and the sub-private key value, the target data is output.

[0076] Reference Figure 2 , Figure 2 A schematic diagram of the implementation flow of an RSA-CRT cryptographic data processing method provided in the embodiment of the present application is applied to a cryptographic chip. Here, the method is combined with Figure 2 The steps shown are explained.

[0077] Step 201: In response to a cryptographic service request, obtain a RAS-CRT key corresponding to a request identifier carried in the cryptographic service request.

[0078] Among them, the RSA-CRT key includes a private key.

[0079] In the embodiment of the present application, the cryptographic service request carries the data to be processed and the request identifier, and the cryptographic service request is used to request the cryptographic chip to perform a private key operation on the data to be processed. The cryptographic service request may be a signature service request for signing the data to be processed, or a decryption service request for decrypting the data to be processed, and the present application does not make any specific restrictions on this.

[0080] In an embodiment of the present application, if the cryptographic service request is a signature service request, the data to be processed may be plaintext data that needs to be signed; if the cryptographic service request is a decryption service request, the data to be processed may be ciphertext data that needs to be decrypted.

[0081] In the embodiment of the present application, the request identifier is used to obtain the RAS-CRT key corresponding to the data to be processed, and the request identifier corresponds to the RAS-CRT key one by one.

[0082] In the embodiment of the present application, the RSA-CRT key includes a public key and a private key, and the public key and the private key correspond one to one. The public key of the RSA-CRT algorithm is (N, e), where N is the first public key value and e is the second public key value. The private key d of the RSA-CRT algorithm is a private key quintuple (p, q, dp, dq, qInv), where p is the first private key value, q is the second private key value, dp is the third private key value, dq is the fourth private key value, and qInv is the fifth private key value. Here, p and q are both large prime numbers, N can be obtained by the above formula (1), and dp, dq, and qInv can be obtained by the above formula (6).

[0083] It should be noted that, according to the quantitative relationship of the modular operation in the above formula (6), the first private key value corresponds to the third private key value, and the second private key value corresponds to the fourth private key value.

[0084] In an embodiment of the present application, the private key in the RSA-CRT key can be pre-stored in a storage module such as a memory of the cryptographic chip, the private key can be obtained from the storage module, and the public key in the RSA-CRT key can be public.

[0085] In some embodiments, the cryptographic chip may be built into the server or client.

[0086] In one case, the cryptographic chip is built into the server, and the manufacturer requests the server with the built-in cryptographic chip to perform RSA-CRT private key calculation on the firmware and other data, and the Certificate Authority (CA) signs the application identification message when issuing the certificate. The server with the built-in cryptographic chip stores the RSA-CRT key of the data. The process of the private key calculation includes: the client sends a cryptographic service request to the server with the built-in cryptographic chip, wherein the cryptographic service request carries the data to be signed / data to be decrypted, and the request identification. Here, the data to be signed can be the firmware image / application identification information, and the data to be decrypted can be the firmware ciphertext / key ciphertext. Furthermore, the server with the built-in cryptographic chip responds to the cryptographic service request, uses the RSA-CRT key corresponding to the request identification, performs private key calculation on the data to be signed / data to be decrypted, and returns the private key calculation result to the client.

[0087] In another example, the cryptographic chip is built into a client such as Ukey. The client with the built-in cryptographic chip performs RSA-CRT private key calculation on the transaction information of the server such as online banking, and the client with the built-in cryptographic chip stores the RSA-CRT key of the client. The private key calculation process includes: the client with the built-in cryptographic chip receives the cryptographic service request sent by the server, wherein the cryptographic service request carries the data to be signed / data to be decrypted, and the request identifier, where the data to be signed / data to be decrypted can be online banking transaction information. Furthermore, the client with the built-in cryptographic chip responds to the cryptographic service request, uses the RSA-CRT key corresponding to the request identifier, performs private key calculation on the data to be signed / data to be decrypted, and returns the private key calculation result to the server.

[0088] Step 202: Randomize the first part of the private key value in the private key to obtain a randomized private key value of the first part of the private key value.

[0089] In this embodiment of the present application, the first part of the private key value in the private key may include a first private key value p, a second private key value q, a third private key value dp and a fourth private key value dq.

[0090] In an embodiment of the present application, after obtaining the RAS-CRT key including the private key corresponding to the request identifier in the cryptographic service request, the cryptographic chip randomizes each private key value in the first part of the private key value in the private key to obtain a randomized private key value for each private key value, that is, the target private key values ​​corresponding to the first private key value, the second private key value, the third private key value and the fourth private key value in the private key, respectively.

[0091] Step 203: Based on the target private key value of the first private key value and the second private key value in the private key, perform private key operation on the data to be processed carried by the cryptographic service request to obtain target data, and send cryptographic service response data corresponding to the cryptographic service request.

[0092] Among them, the cryptographic service response data includes target data.

[0093] The target private key value is the first part private key value or a randomized private key value of the first part private key value, and the target data is obtained based on a randomized private key value of one or more private key values ​​in the first part private key value.

[0094] In an embodiment of the present application, the target private key value may be each private key value in the first part of the private key value, or the target private key value may be a corresponding randomized private key value obtained after randomizing each private key value in the first part of the private key value.

[0095] In an embodiment of the present application, the target private key value of the first part of the private key value may include: the target private key value of the first private key value, the target private key value of the second private key value, the target private key value of the third private key value, and the target private key value of the fourth private key value. Here, the target private key value of the first private key value may be the first private key value, or it may be a randomized private key value of the first private key value; the target private key value of the second private key value may be the second private key value, or it may be a randomized private key value of the second private key value; the target private key value of the third private key value may be the third private key value, or it may be a randomized private key value of the third private key value; the target private key value of the fourth private key value may be the fourth private key value, or it may be a randomized private key value of the fourth private key value. It should be noted that in different operation processes, the target private key values ​​used for different operations may be the same or different, and this embodiment of the present application does not make specific restrictions on this.

[0096] In the embodiment of the present application, the private key d may also include a second part of the private key value, and the second part of the private key value may be a fifth private key value qInv.

[0097] In the embodiment of the present application, the target data may be plaintext data after decrypting the data to be processed, or the target data may be signed data after signing the plaintext data. The present application does not impose any specific restrictions on this.

[0098] In an embodiment of the present application, the target data can be obtained based on the target private key value and the fifth private key value in the first part of the private key value, and the target data is obtained based on a randomized private key value of one or more private key values ​​in the first part of the private key value.

[0099] In an embodiment of the present application, the cryptographic chip performs a private key operation on the data to be processed carried by the cryptographic service request based on the target private key value of the first part of the private key value and the second part of the private key value in the private key, obtains the target data, generates cryptographic service response data carrying the target data corresponding to the cryptographic service request, and sends the cryptographic service response data.

[0100] An embodiment of the present application provides an RSA-CRT cryptographic data processing method, which, in response to a cryptographic service request, obtains a RSA-CRT key corresponding to a request identifier carried in the cryptographic service request, wherein the RAS-CRT key includes a private key; performs randomization processing on a first-part private key value in the private key to obtain a randomized private key value of the first-part private key value; performs private key operations on the data to be processed carried by the cryptographic service request based on a target private key value of the first-part private key value and a second-part private key value in the private key to obtain target data, and sends cryptographic service response data corresponding to the cryptographic service request; wherein the cryptographic service response data includes the target data; wherein the target private key value is the first-part private key value or a randomized private key value of the first-part private key value, and the target data is obtained based on a randomized private key value of one or more private key values ​​in the first-part private key value. The embodiment of the present application randomizes some of the private key values ​​involved in the operation, and performs modular exponentiation operation on the processed data based on at least one randomized private key value, thereby increasing the difficulty for attackers to analyze and crack the data, reducing the possibility of attackers obtaining key information of the RSA private key through side channel analysis, and improving the security of RSA-CRT operations.

[0101] In some embodiments, step 202 performs randomization processing on the first part of the private key value in the private key, and the process of obtaining the randomized private key value of the first part of the private key value is combined with Figure 3 Provide explanation.

[0102] Step 301: For any reference private key value in the first part of the private key value, obtain a pre-stored first reference random value, a second reference random value, a reference sub-private key value and a data type corresponding to the reference private key value.

[0103] In an embodiment of the present application, the reference private key value can be any private key value in the first part of the private key value, such as the reference value can be one of the first private key value p, the second private key value q, the third private key value dp and the fourth private key value dq.

[0104] In the embodiment of the present application, the first reference random value and the second reference random value corresponding to the reference private key value are pre-stored in the storage module of the cryptographic chip, and the first reference random value and the second reference random value can be random numbers randomly generated by the generation unit in the hardware cryptographic module in the cryptographic chip. The first reference random value and the second reference random value can be random prime numbers or other random numbers that are not random prime numbers.

[0105] In the embodiment of the present application, the reference sub-private key value corresponding to the reference private key value is pre-stored in the storage module of the cryptographic chip, and the reference sub-private key value corresponds to the reference private key value one by one. It should be noted that the reference sub-private key value can be a positive number.

[0106] In an embodiment of the present application, the data type includes a first data type and a second data type, the data of the first data type may include a first private key value and a second private key value, and the data of the second data type may include a third private key value and a fourth private key value.

[0107] Step 302: Based on the first reference random value, the second reference random value and the reference sub-private key value, the reference private key value is randomized using a calculation method corresponding to the data type to obtain a reference randomized private key value of the reference private key value.

[0108] In the embodiments of the present application, different data types correspond to different calculation methods.

[0109] In the first case, if the data type is the first data type, the calculation method corresponding to the first data type can be implemented through the following process: Calculate the product of the second reference random value and the reference sub-private key value to obtain a first reference product; calculate the product of the first reference random value and the second reference random value to obtain a second reference product; calculate the sum of the first reference product and the second reference product to obtain a reference randomized private key value.

[0110] In an example, if the reference private key value is the first private key value, the first reference random value may be the first random value, the second reference random value may be the second random value, and the reference sub-private key value may be the first sub-private key value. Since the data type of the first private key value belongs to the first data type, the first randomized private key value of the first private key value can be obtained by using the calculation method corresponding to the first data type through the following formula (26):

[0111] in, is the first randomized private key value, is the first random value, is the second random value, is the first child private key value, is the first private key value.

[0112] In another example, if the reference private key value is the second private key value, the first reference random value may be the third random value, the second reference random value may be the fourth random value, and the reference sub-private key value may be the second sub-private key value. Since the data type of the second private key value belongs to the first data type, the second randomized private key value of the second private key value can be obtained by the following formula (27) using the calculation method corresponding to the first data type.

[0113] in, is the second randomized private key value, is the third random value, is the fourth random value, is the second child private key value, The second private key value.

[0114] In the second case, if the data type is the second data type, the calculation method corresponding to the second data type can be implemented through the following process: Calculate the product of the first reference random value and the second reference random value to obtain a third reference product; calculate the product of the first reference random value and the reference sub-private key value to obtain a fourth reference product; calculate the sum of the reference private key value, the third reference product and the fourth reference product to obtain a reference randomized private key value.

[0115] In an example, if the reference private key value is the third private key value, the first reference random value may be the fifth random value, the second reference random value may be the sixth random value, and the reference sub-private key value may be the third sub-private key value. Since the data type of the third private key value belongs to the second data type, the third randomized private key value of the third private key value can be obtained by the following formula (28) using the calculation method corresponding to the second data type.

[0116] in, is the third randomized private key value, is the third private key value, is the fifth random value, is the sixth random value, It is the value of the third child private key.

[0117] In another example, if the reference private key value is the fourth private key value, the first reference random value may be the seventh random value, the second reference random value may be the eighth random value, and the reference sub-private key value may be the fourth sub-private key value. Since the data type of the fourth private key value belongs to the second data type, the fourth randomized private key value of the fourth private key value can be obtained by using the calculation method corresponding to the second data type through the following formula (29):

[0118] in, is the fourth randomized private key value, is the fourth private key value, is the seventh random value, is the eighth random value, It is the value of the fourth child private key.

[0119] From the above, it can be seen that the embodiment of the present application pre-stores the reference sub-private key value, the first reference random value and the second reference random value corresponding to each reference private key value. By introducing the reference sub-private key value, the first reference random value and the second reference random value, the corresponding reference private key value is randomly transformed to achieve scrambling, thereby reducing the risk of side channel analysis of the reference private key value. At the same time, the actual effective bits of the random number are flexibly controlled, and the actual effective bit length of the reference private key value as the modular exponentiation modulus is increased, thereby increasing the difficulty of analysis and cracking by attackers, minimizing the possibility of attackers obtaining key information of the RSA private key through side channel analysis, and improving the security of RSA-CRT operations.

[0120] In some embodiments, step 203 performs a private key operation on the data to be processed carried by the cryptographic service request based on the target private key value of the first part of the private key value and the second part of the private key value in the private key to obtain the target data. Figure 4 Provide explanation.

[0121] Step 401: Based on the target private key value of the first part of the private key value, perform a modular exponentiation operation on the data to be processed to obtain first intermediate data and second intermediate data.

[0122] In an embodiment of the present application, the first intermediate data can be obtained based on the target private key value of the first private key value and the target private key value of the third private key value, and the second intermediate data can be obtained based on the target private key value of the second private key value and the target private key value of the fourth private key value.

[0123] Here, the first intermediate data may be obtained in the following ways: Case 1: The first intermediate data can be obtained based on the first private key value and the third private key value; Case 2: The first intermediate data can be obtained based on the randomized private key value of the first private key value and the third private key value; Case 3: The first intermediate data can be obtained based on the randomized private key value of the first private key value and the third private key value; Case 4: The first intermediate data can be obtained based on the randomized private key value of the first private key value and the randomized private key value of the third private key value.

[0124] Here, the second intermediate data may be obtained in the following ways: Case 1: The second intermediate data can be obtained based on the second private key value and the fourth private key value; Case 2: The second intermediate data can be obtained based on the randomized private key value of the second private key value and the fourth private key value; Case 3: The second intermediate data can be obtained based on the randomized private key value of the second private key value and the fourth private key value; Case 4: The second intermediate data can be obtained based on the randomized private key value of the second private key value and the randomized private key value of the fourth private key value.

[0125] It should be noted that the first intermediate data and the second intermediate data can be obtained by combining any case of obtaining the first intermediate data with any case of obtaining the second intermediate data.

[0126] In an embodiment of the present application, after obtaining the data to be processed and the RSA-CRT key, a modular exponentiation operation is performed on the data to be processed based on the target private key value of the first private key value and the target private key value of the third private key value to obtain first intermediate data; a modular exponentiation operation is performed on the data to be processed based on the target private key value of the second private key value and the target private key value of the fourth private key value to obtain second intermediate data.

[0127] It can be understood that the first part of the private key value includes the first private key value, the second private key value, the third private key value and the fourth private key value. In step 401, based on the target private key value of the first part of the private key value in the private key, the process of performing modular exponentiation operation on the to-be-processed data to obtain the first intermediate data and the second intermediate data is combined. Figure 5 Provide explanation.

[0128] Step 501: Based on the target private key value of the first private key value as a modulus and / or the target private key value of the third private key value as a power, a modular exponentiation operation is performed on the data to be processed to obtain first intermediate data.

[0129] It can be understood that step 501 performs modular exponentiation operation on the data to be processed based on the target private key value of the first private key value as a modulus and / or the target private key value of the third private key value as a power to obtain the first intermediate data, which can be implemented by the following process: Using the target private key value of the first private key value as a modulus, and / or using the target private key value of the third private key value as a power, a modular exponentiation operation is performed on the data to be processed to obtain first reference intermediate data; using the first private key value as a modulus, a modular operation is performed on the first reference intermediate data to obtain the first intermediate data.

[0130] In the embodiment of the present application, the first reference intermediate data can be obtained by the following formula (30):

[0131] in, is the first reference intermediate data, For the data to be processed, is the target private key value of the third private key value, It can be the third private key value dp or the third randomized private key value ; is the target private key value of the first private key value, It can be the first private key value p or the first randomized private key value .

[0132] In the embodiment of the present application, the first intermediate data can be obtained by the following formula (31):

[0133] in, is the first intermediate data, is the first reference intermediate data, and p is the first private key value.

[0134] In some embodiments, taking the target private key value of the first private key value as a modulus and / or taking the target private key value of the third private key value as a power, performing a modular exponentiation operation on the data to be processed to obtain the first reference intermediate data can be implemented in any of the following ways: Method 1: using the first private key value as a modulus and the third private key value as a power, performing a modular exponentiation operation on the data to be processed to obtain first reference intermediate data; Method 2: using the first private key value as a modulus and the randomized private key value of the third private key value as a power, performing a modular exponentiation operation on the data to be processed to obtain first reference intermediate data; Method 3: using the randomized private key value of the first private key value as a modulus and the third private key value as a power, performing a modular exponentiation operation on the data to be processed to obtain first reference intermediate data; Method 4: Using the randomized private key value of the first private key value as a modulus and the randomized private key value of the third private key value as a power, a modular exponentiation operation is performed on the data to be processed to obtain first reference intermediate data.

[0135] From the above, it can be seen that the embodiment of the present application uses the first private key value after random transformation as the modulus, and / or the third private key value after random transformation as the exponent to participate in the operation, thereby increasing the difficulty of analysis and cracking for attackers, minimizing the possibility of attackers obtaining key information of the RSA private key through side channel analysis, and improving the security of RSA-CRT operation.

[0136] Step 502: Based on the target private key value of the second private key value as a modulus and / or the target private key value of the fourth private key value as a power, perform a modular exponentiation operation on the data to be processed to obtain second intermediate data.

[0137] It can be understood that step 502 performs modular exponentiation operation on the data to be processed based on the target private key value of the second private key value as a modulus and / or the target private key value of the fourth private key value as a power to obtain the second intermediate data, which can be implemented by the following process: Using the target private key value of the second private key value as a modulus, and / or using the target private key value of the fourth private key value as a power, a modular exponentiation operation is performed on the processed data to obtain second reference intermediate data; using the second private key value as a modulus, a modular operation is performed on the second reference intermediate data to obtain second intermediate data.

[0138] In the embodiment of the present application, the second reference intermediate data can be obtained by the following formula (32):

[0139] in, is the second reference intermediate data, For the data to be processed, is the target private key value of the fourth private key value, It can be the fourth private key value dq or the fourth randomized private key value ; is the target private key value of the second private key value, It can be the second private key value q or the second randomized private key value .

[0140] In the embodiment of the present application, the second intermediate data can be obtained by the following formula (33):

[0141] in, is the second intermediate data, is the second reference intermediate data, and q is the second private key value.

[0142] In some embodiments, taking the target private key value of the second private key value as a modulus and / or taking the target private key value of the fourth private key value as a power, performing a modular exponentiation operation on the data to be processed to obtain the second reference intermediate data can be implemented in any of the following ways: Method 1: using the second private key value as a modulus and the fourth private key value as a power, performing a modular exponentiation operation on the data to be processed to obtain second reference intermediate data; or, Method 2: using the second private key value as a modulus and the randomized private key value of the fourth private key value dq as a power, performing a modular exponentiation operation on the data to be processed to obtain second reference intermediate data; or, Method 3: using the randomized private key value of the second private key value as a modulus and the fourth private key value as a power, performing a modular exponentiation operation on the data to be processed to obtain second reference intermediate data; or Method 4: Using the randomized private key value of the second private key value as a modulus and the randomized private key value of the fourth private key value as a power, a modular exponentiation operation is performed on the data to be processed to obtain second reference intermediate data.

[0143] From the above, it can be seen that the embodiment of the present application uses the second private key value after random transformation as the modulus, and / or the fourth private key value after random transformation as the exponent to participate in the operation, thereby increasing the difficulty of analysis and cracking for attackers, minimizing the possibility of attackers obtaining key information of the RSA private key through side channel analysis, and improving the security of RSA-CRT operation.

[0144] Step 402: Based on the first intermediate data, the second intermediate data, and the second part of the private key value, perform a private key operation on the data to be processed to obtain target data.

[0145] In the embodiment of the present application, based on the first intermediate data, the second intermediate data, and the second part of the private key value, performing a private key operation on the data to be processed to obtain the target data may include: If at least one of the first intermediate data and the second intermediate data is obtained by a randomized private key value based on one or more private key values ​​in the first part of the private key value, a private key operation can be performed on the processed data based on the first intermediate data, the second intermediate data, the fifth private key value and the first private key value in the first part of the private key value to obtain the target data.

[0146] If both the first intermediate data and the second intermediate data are obtained based on multiple private key values ​​in the first part of the private key value, a private key operation can be performed on the processed data based on the first intermediate data, the second intermediate data, the fifth private key value and the randomized private key value of the first private key value in the first part of the private key value to obtain the target data.

[0147] In an embodiment of the present application, the cryptographic chip performs a modular exponentiation operation on the processed data based on the target private key value of the first part of the private key value in the private key to obtain the first intermediate data and the second intermediate data, and then performs a private key operation on the processed data based on the first intermediate data, the second intermediate data and the fifth private key value to obtain the target data after the operation.

[0148] In some embodiments, step 402 performs a private key operation on the data to be processed based on the first intermediate data, the second intermediate data, and the second part of the private key value to obtain the target data. Figure 6 Provide explanation.

[0149] Step 601: Obtain a pre-stored ninth random value and a fifth sub-private key value corresponding to a fifth private key value, and a target private key value of a first private key value in a first part of a private key value.

[0150] In the embodiment of the present application, the ninth random value is pre-stored in the storage module of the cryptographic chip, and the ninth random value is a random number randomly generated by the generation unit in the hardware cryptographic module. The ninth random value can be a random prime number or other random number that is not a random prime number, and the present application does not make any specific restrictions on this.

[0151] In an embodiment of the present application, the fifth sub-private key value is pre-stored in a storage module of the cryptographic chip. The fifth sub-private key value is determined based on the fifth private key value and the ninth random value. The fifth sub-private key value can be the difference between the fifth private key value and the ninth random value. It should be noted that the ninth random value is less than the fifth private key value. In this way, the fifth sub-private key value is guaranteed to be a positive number.

[0152] Step 602: Based on the ninth random value, the fifth sub-private key value, and the target private key value of the first private key value, randomize the difference between the first intermediate data and the second intermediate data to obtain third intermediate data.

[0153] It can be understood that step 602 performs random processing on the difference between the first intermediate data and the second intermediate data based on the ninth random value, the fifth sub-private key value and the target private key value of the first private key value to obtain the third intermediate data, which can be implemented by the following steps: Step 621: Using the target private key value of the first private key value as a modulus, perform a modulus operation on the difference between the first intermediate data and the second intermediate data to obtain fourth intermediate data.

[0154] In the embodiment of the present application, the fourth intermediate data can be obtained by the following formula (34):

[0155] in, is the fourth intermediate data, is the first intermediate data, is the second intermediate data, is the difference between the first intermediate data and the second intermediate data, is the target private key value of the first private key value, It can be the first private key value p, or a randomized private key value of the first private key value .

[0156] Step 622, calculating the product of the fourth intermediate data and the ninth random value to obtain a first product; Step 623: Calculate the product of the fourth intermediate data and the fifth sub-private key value to obtain a second product; Step 624: Obtain third intermediate data based on the first product, the second product, the first private key value, and the randomized private key value of the first private key value.

[0157] In one case, step 624 obtains the third intermediate data based on the first product, the second product, the first private key value, and the randomized private key value of the first private key value, which can be implemented by the following process: The sum of the first product and the second product is calculated, and the first private key value and the randomized private key value of the first private key value are used as modulos to perform two modulo operations on the sum to obtain third intermediate data. Specifically, the first product and the second product are summed to obtain a sum; the randomized private key value of the first private key value is used as modulo to perform a modulo operation on the sum to obtain a fourth operation result; the fourth operation result is modulo the first random value to obtain a third intermediate result.

[0158] In the embodiment of the present application, the third intermediate data can be obtained by the following formula (35):

[0159] in, is the third intermediate data, is the fourth intermediate data, is the ninth random value, is the fifth child private key value, is the first private key value, A randomized private key value of the first private key value.

[0160] In another case, in order to reduce the bit width occupation and improve the calculation efficiency, step 624 obtains the third intermediate data based on the first product, the second product, the first private key value and the randomized private key value of the first private key value, which can also be implemented by the following process: The first product is subjected to two modular operations, respectively using the first private key value and the randomized private key value of the first private key value as modulo, to obtain a first operation result; the second product is subjected to two modular operations, respectively using the first private key value and the randomized private key value of the first private key value as modulo, to obtain a second operation result; and the sum of the first operation result and the second operation result is determined as the third intermediate data.

[0161] Specifically, a modulus operation is performed on the first product with the randomized private key value of the first private key value as a modulus to obtain a first intermediate operation result, and a modulus operation is performed on the first intermediate operation result with the first random value as a modulus to obtain a first operation result; a modulus operation is performed on the second product with the randomized private key value of the first private key value as a modulus to obtain a second intermediate operation result, and a modulus operation is performed on the second intermediate operation result with the first random value as a modulus to obtain a second operation result.

[0162] In the embodiment of the present application, the third intermediate data can be obtained by the following formula (36):

[0163] in, is the third intermediate data, is the result of the first operation, is the result of the second operation, is the fourth intermediate data, is the ninth random value, is the fifth child private key value, is the first private key value, is the randomized private key value of the first private key value. In this way, the bit width occupancy is reduced and the calculation efficiency is improved.

[0164] Step 603: Based on the second intermediate data, the third intermediate data and the public key in the RAS-CRT key, perform a private key operation on the data to be processed to obtain the target data.

[0165] It can be understood that step 603 performs private key operation on the data to be processed based on the second intermediate data, the third intermediate data and the public key in the RAS-CRT key to obtain the target data, which can be achieved through the following process: The product between the third intermediate data and the second private key value in the first part of the private key value is calculated to obtain a third product; and the sum of the second intermediate data and the third product is calculated to obtain the target data.

[0166] In the embodiment of the present application, the target data can be obtained by the following formula (37):

[0167] in, For the target data, is the second intermediate data, is the third intermediate data, The second private key value.

[0168] From the above, it can be seen that in the embodiments of the present application, the existing modular exponentiation, modular multiplication, and modular addition and subtraction hardware accelerators are combined, the random numbers generated by the true random number generator, Fermat's little theorem, and the mathematical properties of modular exponentiation and modular operations are introduced, and the exponents and / or moduli involved in the operation are randomized, thereby expanding the actual effective bit length of the modulus and exponent, increasing the difficulty of analysis and cracking, minimizing the possibility of attackers obtaining key information of the RSA private key through side channel analysis, and improving the security of RSA-CRT operations.

[0169] In some embodiments, step 203 performs a private key operation on the data to be processed carried by the cryptographic service request based on the target private key value of the first part of the private key value and the second part of the private key value in the private key to obtain the target data. Figure 7 Provide explanation.

[0170] Step 701: Based on the public key in the RAS-CRT key, randomize the data to be processed to obtain randomized data.

[0171] In the embodiment of the present application, the randomized data may be data obtained by performing randomization processing on the data to be processed based on the public key.

[0172] It can be understood that step 701 performs random processing on the data to be processed based on the public key in the RAS-CRT key to obtain random data, which can be achieved through the following process: Step 711: Obtain the pre-stored multiplicative inverse element of the tenth random value.

[0173] In the embodiment of the present application, the multiplication inverse of the tenth random value is pre-stored in the storage module of the cryptographic chip, and the tenth random value is a random number randomly generated by the generation unit in the hardware cryptographic module. The tenth random value can be a random prime number or other random number that is not a random prime number.

[0174] In the embodiment of the present application, the multiplication inverse element of the tenth random value is a number obtained by performing a modular inverse operation on the tenth random value with the first public key value as the modulus. It should be noted that in the embodiment of the present application, the tenth random value and the multiplication inverse element of the tenth random value are pre-stored, thereby avoiding the computational overhead of generating the tenth random value and the multiplication inverse element of the tenth random value in the RSA-CRT algorithm process, thereby improving computational efficiency.

[0175] Step 712: Based on the multiplication inverse element and the second public key value in the public key, randomize the data to be processed to obtain intermediate randomized data.

[0176] It can be understood that based on the multiplication inverse element and the second public key value in the public key, the data to be processed is processed to obtain intermediate randomized data, which can be achieved through the following process: using the second public key value as a power, performing a power operation on the multiplication inverse element to obtain a third operation result; calculating the product of the third operation result and the data to be processed to obtain intermediate randomized data.

[0177] Here, the second public key value is used as a power to perform a power operation on the inverse element of the multiplication to obtain a third operation result; the product of the third operation result and the data to be processed is calculated to obtain intermediate randomized data. In this way, by introducing the second public key value and the random number, the base of the data to be processed is scrambled, which increases the difficulty for attackers to crack, minimizes the possibility of attackers obtaining key information of the RSA private key through side channel analysis, and improves the security of RSA-CRT operation.

[0178] Step 713: Using the first public key value in the public key as a modulus, perform a modulus operation on the intermediate randomized data to obtain randomized data.

[0179] It can be understood that by combining the non-CRT algorithm characteristics of RSA and introducing public and private key operations, the following formula (38) can be obtained.

[0180]

[0181] Among them, r is the tenth random value, e and d are the public and private key pairs of the RSA key pairing, and C is the base, such as C can be the data to be processed. Since RSA-CRT is an optimized way to accelerate modular exponentiation operations, it is equivalent to RSA-non-CRT operations and can be transformed into RSA-CRT base scrambling.

[0182] In the embodiment of the present application, combined with the RSA non-CRT algorithm characteristics, according to formula (38), the data to be processed is scrambled, and the randomized data can be obtained by the following formula (39):

[0183] in, is the randomized data, r is the tenth random value, is the data to be processed, N is the first public key value, e is the second public key value, is the result of the third operation, For intermediate random data.

[0184] It should be noted that the randomized data is obtained by scrambling the data to be processed, and the data bit length of the data to be processed is not expanded. Therefore, the randomized data has the same data bit length as the data to be processed.

[0185] From the above, it can be seen that the embodiment of the present application introduces the first public key value, the second public key value and the random number to perform base scrambling on the data to be processed, thereby increasing the difficulty for attackers to crack the data, minimizing the possibility of attackers obtaining key information of the RSA private key through side channel analysis, and improving the security of RSA-CRT operations.

[0186] Step 702: Based on the target private key value of the first private key value, the second private key value in the private key, and the public key, perform a private key operation on the randomized data to obtain the target data.

[0187] It can be understood that step 702 performs a private key operation on the randomized data based on the target private key value of the first private key value, the second private key value in the private key, and the public key to obtain the target data, which can be achieved through the following process: Step 721: Based on the target private key value of the first part of the private key value and the second part of the private key value in the private key, perform a private key operation on the randomized data to obtain reference target data.

[0188] In the embodiment of the present application, based on the public key in the RAS-CRT key, random processing is performed on the data to be processed. After obtaining the randomized data, the randomized data is used as the data to be processed, and based on the target private key value of the first part of the private key value and the second part of the private key value in the private key, a private key operation is performed on the randomized data to obtain reference target data. It should be noted that the process of performing a private key operation on the randomized data to obtain the reference target data is similar to the process of performing a private key operation on the data to be processed to obtain the target data in the aforementioned embodiment, that is, the step of performing a private key operation on the randomized data to obtain the reference target data is the same or similar to the step of performing a private key operation on the data to be processed to obtain the target data in the aforementioned embodiment.

[0189] Step 722: Using the first public key value as a modulus, perform a modulus operation on the product of the tenth random value and the reference target data to obtain the target data.

[0190] In the embodiment of the present application, the target data can be obtained by the following formula (40):

[0191] in, For the target data, is the tenth random value, is the reference target data, and N is the first public key value.

[0192] It should be noted that, since the data to be processed is encrypted, after obtaining the reference target data, the reference target data needs to be restored using the tenth random value and the first public key value to obtain the final calculation result.

[0193] Here, in an achievable scenario, an RSA-CRT cryptographic data processing method provided in an embodiment of the present application is described.

[0194] RSA-CRT is an optimization technology in the RSA encryption algorithm, especially in the process of modular exponentiation of large integers, which uses the Chinese remainder theorem to accelerate RSA signing and decryption operations (private key operations). RSA-CRT is particularly suitable for reducing computing time and improving performance, especially when the modulus bits are large, significantly improving the performance of private key operations, and is widely used in practical applications.

[0195] In modern high-security scenarios, RSA cryptographic computing is widely used in public key infrastructure, blockchain, servers, various terminal computing devices, cryptographic machines (cryptographic accelerator cards), secure communications, digital payments, and other fields. Especially in areas such as banks, governments, and enterprises that need to process sensitive data, it has become a trend for RSA-CRT to replace traditional RSA methods while ensuring high security and taking into account performance.

[0196] On these microcontroller unit (MCU) devices with high security requirements, if there is an accelerator that supports modular exponentiation, modular addition and subtraction, and modular multiplication operations, the data processing method provided in the embodiment of the present application can be used through a software data processing solution to implement secure RSA-CRT operations, improve the security of RSA-CRT operations, and reduce the risk of side channel analysis attacks and leakage of key information.

[0197] Continue to refer to Figure 1 As shown, it can be understood as a product schematic diagram of the cryptographic chip of an embodiment of the present application. The application scenarios of the cryptographic chip include but are not limited to the following examples.

[0198] 1) The cryptographic chip is built into the server, and the manufacturer requests the signature / decryption server to perform RSA-CRT private key operations (signature / decryption) on the firmware and other data, and the CA signs the application identification message when issuing the certificate (for the Public Key Infrastructure (PKI) system). Specifically, the client sends the data to be signed / decrypted (data to be signed such as firmware image / application identification information, data to be decrypted such as firmware ciphertext / key ciphertext) to the server (secure signature / decryption server), and the signature / decryption server uses its own private key to perform private key operations (signature / decryption) on the data to be signed / decrypted, and returns the result to the client.

[0199] 2) The password chip is built into the client, and Ukey signs / decrypts online banking transaction information, etc.: Ukey stores the user's RSA-CRT private key internally. After Ukey receives the data to be signed / decrypted from the online banking (server), it uses the private key to perform RSA-CRT private key operations (signing / decryption).

[0200] The software password control module includes the security solution mentioned in the embodiment of the present application, and the hardware password module includes the hardware accelerator and the true random number generator mentioned in the embodiment of the present application, wherein the modular exponentiation, modular addition and subtraction, modular multiplication, modular inverse and other operations used in the RSA-CRT signature can be calculated by the hardware accelerator, and the random number used in the RSA-CRT signature can be generated by the true random number generator. The storage module includes flash memory (FLASH), static random access memory (Static Random Access Memory, SRAM) and / or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc.

[0201] In an achievable scenario, the server receives external data (data to be signed / decrypted), the server CPU executes the software logic module, obtains the private key from the secure storage module, and executes the security solution to perform RSA-CRT private key operations, including obtaining the required random numbers from the hardware cryptographic module (it is not necessary to obtain all the required random numbers at one time, and the random numbers can be obtained when the current calculation step requires it). The data involved in each step of the operation is written into the storage module, the modular operation mode configuration is written into the password register in the hardware cryptographic module, the hardware cryptographic module is started to perform operations such as modular exponentiation, modular addition and subtraction, modular multiplication, and modular inverse, and the operation result is waited for to be written into the storage module by polling the password register. The software logic module reads the result from the storage module. The above steps are repeatedly executed until the final result is calculated, and finally the software logic module reads the final calculation result from the storage module, and the server returns the RSA-CRT private key operation result to the client. Among them, the hardware cryptographic module is implemented by a hardware circuit and can access the storage module.

[0202] The operation steps of the RSA-CRT operation in the embodiment of the present application are as follows: The first step is to obtain the five-tuple (p, q, dp, dq, qInv) of the data to be processed, the public key (N, e) and the private key d corresponding to the public key, where: .

[0203] The second step is to introduce a random number r and transform the data to be processed C to obtain randomized data. This can be achieved by the following formula (41):

[0204] The third step is to introduce random numbers k1, h1, p1, y1, where , , by using random numbers k1, h1, p1, y1, transform the above formula (7) to obtain formula (42),

[0205]

[0206] Step 4: Introduce random numbers k2, h2, q1, y2, where , , by using random numbers k2, h2, q1, y2, transform the above formula (8) to obtain formula (43),

[0207]

[0208] Step 5: Introduce random number u1, where , through u1, m1, m2, transform the above formula (9) to get formula (44),

[0209]

[0210] Step 6. Using formula (45), use the random number r introduced in the second step to obtain the result of the private key operation, and transform and restore the result of the private key operation to obtain the target data.

[0211]

[0212] It should be noted that the random numbers involved in the above-mentioned operations are taken from a true random number generator, and modular multiplication, modular exponentiation, and modular addition and subtraction are implemented using existing hardware accelerators. Combined with the security solution on the software side, the base, exponent, and modulus involved in the operation are all randomized, and the actual effective bits of the random numbers can be flexibly controlled. The actual effective bit length of the modulus and exponent is expanded, which increases the difficulty for attackers to analyze and crack the code, minimizes the possibility of attackers obtaining key information of the RSA private key through side channel analysis, and improves the security of RSA-CRT operations.

[0213] On an MCU device with high security requirements, if there is an accelerator that supports modular exponentiation, modular addition and subtraction, and modular multiplication operations of a common functional version or a secure version, the method of the present invention can be used to implement secure operations of RSA-CRT through a software security solution, thereby improving the security of RSA-CRT private key operations and reducing the risk of side channel analysis and leakage of key information.

[0214] In the embodiment of the present application, the thresholds of the scrambled modular exponentiation and the modulus random value can be set to control the bit size of the modular exponentiation and the modulus after scrambling and expansion. In practical applications, the appropriate threshold can be selected by weighing performance and security. While taking into account performance, security is guaranteed.

[0215] For RSA-CRT security operations, existing hardware accelerators generally implement Montgomery ladder security modular exponentiation. For base and modulus scrambling, these two processes can be designed with dedicated hardware acceleration implementations to further reduce software actions and continue to improve RSA-CRT security operation performance.

[0216] Reference Figure 8 , Figure 8 A schematic diagram of the structure of an optional cryptographic chip provided in an embodiment of the present application, the cryptographic chip 100 includes: A response module 801 is used to respond to a cryptographic service request; The obtaining module 802 is used to obtain a RAS-CRT key corresponding to the request identifier carried in the cryptographic service request, wherein the RAS-CRT key includes a private key; The processing module 803 is used to perform randomization processing on the first part of the private key value in the private key to obtain a randomized private key value of the first part of the private key value; The processing module 803 is further configured to perform a private key operation on the data to be processed carried by the cryptographic service request based on the target private key value of the first part of the private key value and the second part of the private key value in the private key, so as to obtain target data; wherein the target private key value is the private key value or a randomized private key value of the private key value, and the target data is obtained based on a randomized private key value of one or more private key values ​​in the first part of the private key value; The sending module 804 is used to send cryptographic service response data corresponding to the cryptographic service request; wherein the cryptographic service response data includes the target data.

[0217] The embodiment of the present application provides a cryptographic chip, including a memory and a processor, wherein: The memory stores a computer program that can be run on the processor, and when the processor executes the program, some or all of the steps in the above method are implemented.

[0218] An embodiment of the present application provides a cryptographic device, which includes a cryptographic chip.

[0219] The embodiment of the present application provides a storage medium, which stores one or more computer programs, and the one or more computer programs can be executed by one or more processors to implement some or all of the steps in the above method. The storage medium can be transient or non-transient.

[0220] An embodiment of the present application provides a computer program, including a computer-readable code. When the computer-readable code is run in a computer device, a processor in the computer device executes some or all of the steps for implementing the above method.

[0221] The embodiment of the present application provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and when the computer program is read and executed by a computer, some or all of the steps in the above method are implemented. The computer program product can be implemented in hardware, software, or a combination thereof. In some embodiments, the computer program product is specifically embodied as a computer storage medium, and in other embodiments, the computer program product is specifically embodied as a software product, such as a software development kit (SDK), etc.

[0222] It should be noted here that the description of the various embodiments above tends to emphasize the differences between the various embodiments, and the same or similar aspects can be referenced to each other. The description of the above device, storage medium, computer program and computer program product embodiments is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the embodiments of the device, storage medium, computer program and computer program product of this application, please refer to the description of the method embodiment of this application for understanding.

[0223] Fig. 9 A hardware entity diagram of a cryptographic chip provided in an embodiment of the present application, such as Fig. 9 As shown, the hardware entity of the cryptographic chip 100 includes: a processor 901 and a memory 902, wherein the memory 902 stores a computer program that can be run on the processor 901, and the processor 901 implements the following steps when executing the program: In response to the cryptographic service request, obtaining a RAS-CRT key corresponding to the request identifier carried in the cryptographic service request, wherein the RAS-CRT key includes a private key; Randomize the first part of the private key value in the private key to obtain a randomized private key value of the first part of the private key value; Based on the target private key value of the first private key value and the second private key value in the private key, perform a private key operation on the data to be processed carried by the cryptographic service request to obtain the target data, and send cryptographic service response data corresponding to the cryptographic service request; wherein the cryptographic service response data includes the target data; The target private key value is the first part private key value or a randomized private key value of the first part private key value, and the target data is obtained based on a randomized private key value of one or more private key values ​​in the first part private key value.

[0224] Among them, the memory 902 stores a computer program that can be run on the processor. The memory 902 is configured to store instructions and applications executable by the processor 901. It can also cache data to be processed or processed by the processor 901 and each module in the cryptographic chip 100 (for example, image data, audio data, voice communication data, and video communication data). It can be implemented through flash memory (FLASH) or random access memory (Random Access Memory, RAM).

[0225] The processor 901 implements any of the above method steps when executing the program. The processor 901 generally controls the overall operation of the cryptographic chip 100 .

[0226] Fig.10 A hardware entity diagram of a cryptographic device provided in an embodiment of the present application, such as Fig.10 As shown, the cryptographic device 10 includes a cryptographic chip 100 .

[0227] An embodiment of the present application provides a computer storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the steps of the method of any of the above embodiments.

[0228] It should be noted here that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0229] The processor may be at least one of an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Digital Signal Processing Device (DSPD), a Programmable Logic Device (PLD), a Field Programmable Gate Array (FPGA), a Central Processing Unit (CPU), a controller, a microcontroller, and a microprocessor. It is understandable that the electronic device that implements the functions of the processor may also be other, and the embodiments of the present application do not specifically limit this.

[0230] The above-mentioned computer storage medium / memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory (Flash Memory), a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM) and the like; it can also be various terminals including one or any combination of the above-mentioned memories, such as a mobile phone, a computer, a tablet device, a personal digital assistant, etc.

[0231] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the serial number of each step / process mentioned above does not mean the order of execution, and the execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The serial numbers of the embodiments of the present application mentioned above are for description only and do not represent the advantages and disadvantages of the embodiments.

[0232] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0233] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0234] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0235] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0236] A person skilled in the art can understand that: all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, read-only memories (ROM), magnetic disks or optical disks.

[0237] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions for enabling a vehicle-mounted terminal (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0238] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A RSA-CRT cryptographic data processing method, characterized in that: Applied to a cryptographic chip, the method comprises: In response to the cryptographic service request, obtaining a RAS-CRT key corresponding to the request identifier carried in the cryptographic service request, wherein the RAS-CRT key includes a private key; Randomizing the first part of the private key value in the private key to obtain a randomized private key value of the first part of the private key value; Based on the target private key value of the first part of the private key value and the second part of the private key value in the private key, perform a private key operation on the data to be processed carried by the cryptographic service request to obtain the target data, and send cryptographic service response data corresponding to the cryptographic service request; wherein the cryptographic service response data includes the target data; The target private key value is the first part of the private key value or a randomized private key value of the first part of the private key value, and the target data is obtained based on a randomized private key value of one or more private key values ​​in the first part of the private key value.

2. The method according to claim 1, characterized in that The step of performing random processing on the first part of the private key value to obtain a randomized private key value of the first part of the private key value includes: For any reference private key value in the first part of the private key value, obtain a pre-stored first reference random value, a second reference random value, a reference sub-private key value, and a data type corresponding to the reference private key value; Based on the first reference random value, the second reference random value and the reference sub-private key value, the reference private key value is randomized using a calculation method corresponding to the data type to obtain a reference randomized private key value of the reference private key value.

3. The method according to claim 2, characterized in that The data type is a first data type, and the calculation method corresponding to the first data type includes: Calculate the product of the second reference random value and the reference sub-private key value to obtain a first reference product; calculate the product of the first reference random value and the second reference random value to obtain a second reference product; calculate the sum of the first reference product and the second reference product to obtain the reference randomized private key value; The data type is a second data type, and the calculation method corresponding to the second data type includes: Calculate the product of the first reference random value and the second reference random value to obtain a third reference product; calculate the product of the first reference random value and the reference sub-private key value to obtain a fourth reference product; calculate the sum of the reference private key value, the third reference product and the fourth reference product to obtain the reference randomized private key value.

4. The method according to claim 1, characterized in that The target private key value based on the first part of the private key value and the second part of the private key value in the private key, performing a private key operation on the data to be processed carried by the cryptographic service request to obtain the target data, includes: Based on the target private key value of the first part of the private key value, performing a modular exponentiation operation on the data to be processed to obtain first intermediate data and second intermediate data; Based on the first intermediate data, the second intermediate data and the second part of the private key value, a private key operation is performed on the data to be processed to obtain the target data.

5. The method according to claim 4, characterized in that The first part of the private key value includes a first private key value, a second private key value, a third private key value and a fourth private key value, and the target private key value based on the first part of the private key value in the private key performs a modular exponentiation operation on the data to be processed to obtain the first intermediate data and the second intermediate data, including: Based on the target private key value of the first private key value as a modulus and / or the target private key value of the third private key value as a power, performing a modular exponentiation operation on the data to be processed to obtain the first intermediate data; Based on the target private key value of the second private key value as a modulus and / or the target private key value of the fourth private key value as a power, a modular exponentiation operation is performed on the data to be processed to obtain the second intermediate data.

6. The method according to claim 5, characterized in that The step of performing a modular exponentiation operation on the data to be processed using the target private key value based on the first private key value as a modulus and / or the target private key value of the third private key value as a power to obtain the first intermediate data includes: Using the target private key value of the first private key value as a modulus and / or using the target private key value of the third private key value as a power, performing a modular exponentiation operation on the data to be processed to obtain first reference intermediate data; using the first private key value as a modulus, performing a modular operation on the first reference intermediate data to obtain the first intermediate data; The step of performing a modular exponentiation operation on the data to be processed using the target private key value based on the second private key value as a modulus and / or the target private key value of the fourth private key value as a power to obtain the second intermediate data includes: Using the target private key value of the second private key value as a modulus, and / or using the target private key value of the fourth private key value as a power, perform a modular exponentiation operation on the data to be processed to obtain second reference intermediate data; using the second private key value as a modulus, perform a modular operation on the second reference intermediate data to obtain the second intermediate data.

7. The method according to claim 4, characterized in that The second part of the private key value includes a fifth private key value, and based on the first intermediate data, the second intermediate data and the second part of the private key value, a private key operation is performed on the data to be processed to obtain the target data, and the method includes: Obtaining a pre-stored ninth random value and a fifth sub-private key value corresponding to the fifth private key value, and a target private key value of the first private key value in the first part of the private key values; Based on the ninth random value, the fifth sub-private key value, and the target private key value of the first private key value, randomizing the difference between the first intermediate data and the second intermediate data to obtain third intermediate data; Based on the second intermediate data, the third intermediate data and the public key in the RAS-CRT key, a private key operation is performed on the data to be processed to obtain the target data.

8. The method according to claim 7, characterized in that The step of performing random processing on a difference between the first intermediate data and the second intermediate data based on the ninth random value, the fifth sub-private key value, and the target private key value of the first private key value to obtain third intermediate data includes: Using the target private key value of the first private key value as a modulus, performing a modulus operation on the difference between the first intermediate data and the second intermediate data to obtain fourth intermediate data; Calculating a product of the fourth intermediate data and the ninth random value to obtain a first product; Calculate the product of the fourth intermediate data and the fifth sub-private key value to obtain a second product; The third intermediate data is obtained based on the first product, the second product, the first private key value and a randomized private key value of the first private key value.

9. The method according to claim 8, characterized in that The obtaining the third intermediate data based on the first product, the second product, the first private key value, and the randomized private key value of the first private key value comprises: Taking the first private key value and the randomized private key value of the first private key value as moduli, respectively, performing a modulo operation on the first product twice to obtain a first operation result; Taking the first private key value and the randomized private key value of the first private key value as moduli, respectively, performing a modulo operation twice on the second product to obtain a second operation result; The sum of the first operation result and the second operation result is determined as the third intermediate data.

10. The method according to claim 8, characterized in that The step of performing a private key operation on the data to be processed based on the second intermediate data, the third intermediate data and the public key in the RAS-CRT key to obtain the target data includes: Calculate the product of the third intermediate data and the second private key value in the first part of the private key value to obtain a third product; The sum of the second intermediate data and the third product is calculated to obtain the target data.

11. The method according to any one of claims 1 to 10, characterized in that: The target private key value based on the first part of the private key value and the second part of the private key value in the private key, performing a private key operation on the data to be processed carried by the cryptographic service request to obtain the target data, includes: Based on the public key in the RAS-CRT key, randomizing the data to be processed to obtain randomized data; Based on the target private key value of the first part of the private key value, the second part of the private key value in the private key and the public key, a private key operation is performed on the randomized data to obtain the target data.

12. The method according to claim 11, characterized in that The method of performing random processing on the data to be processed based on the public key in the RAS-CRT key to obtain randomized data includes: Obtaining a multiplicative inverse element of a pre-stored tenth random value; Based on the multiplication inverse element and the second public key value in the public key, randomizing the data to be processed to obtain intermediate randomized data; A modulus operation is performed on the intermediate randomized data using the first public key value in the public key as a modulus to obtain the randomized data.

13. The method according to claim 12, characterized in that The step of performing random processing on the data to be processed based on the multiplication inverse element and the second public key value in the public key to obtain intermediate randomized data includes: Using the second public key value as a power, performing a power operation on the multiplication inverse element to obtain a third operation result; The product of the third operation result and the data to be processed is calculated to obtain the intermediate randomized data.

14. The method according to claim 12, characterized in that The step of performing a private key operation on the randomized data based on the target private key value of the first part of the private key value, the second part of the private key value in the private key, and the public key to obtain the target data includes: Based on the target private key value of the first part of the private key value and the second part of the private key value in the private key, performing a private key operation on the randomized data to obtain reference target data; Using the first public key value as a modulus, a modulus operation is performed on the product of the tenth random value and the reference target data to obtain the target data.

15. A cryptographic chip, characterized in that: The password chip comprises: A response module, used for responding to a password service request; An obtaining module, used to obtain a RAS-CRT key corresponding to the request identifier carried in the cryptographic service request, wherein the RAS-CRT key includes a private key; A processing module, configured to perform randomization processing on a first part of a private key value in the private key to obtain a randomized private key value of the first part of the private key value; The processing module is further configured to perform a private key operation on the data to be processed carried by the cryptographic service request based on a target private key value of the first part of the private key value and a second part of the private key value in the private key to obtain target data; wherein the target private key value is the private key value or a randomized private key value of the private key value, and the target data is obtained based on a randomized private key value of one or more private key values ​​in the first part of the private key value; A sending module is used to send cryptographic service response data corresponding to the cryptographic service request; wherein the cryptographic service response data includes the target data.

Images