SECURE SIGNING AND DECRYPTION OF MESSAGES VIA DOUBLE RSA-CRT
Patent Information
- Application Number
- FR2022013110
- Authority / Receiving Office
- FR · FR
- Patent Type
- Patents
- Current Assignee / Owner
- Filing Date
- 2022-12-09
- Publication Date
- 2025-02-21
- Estimated Expiration
- 2042-12-09
Smart Images
Figure 00000019_0000 
Figure 00000019_0001 
Figure 00000020_0000
Abstract
Description
Title of the invention: SECURE MESSAGE SIGNATURE AND DECRYPTION BY DOUBLE RSA-CRT FIELD OF THE INVENTION
[0001] The present invention relates generally to the field of cryptography, and more particularly to the securing of the RSA - Rivest-Shamir-Adleman - algorithm using the Chinese Remainder Theorem - CRT (for Chinese Remainder Theorem), used for the signing or decryption of a message.
[0002] CONTEXT OF THE INVENTION
[0003] Public-key cryptographic methods, such as RSA encryption, are used to encrypt a message either with the private key to obtain a digital signature S of the message verifiable with the public key, or with the public key to obtain an encrypted message that is decryptable with the private key. They are generally implemented in secure cryptographic systems, such as smart cards, secure elements, and secure servers.
[0004] The public key is composed of a modulus N and a public exponent 'e'. The private key is composed of the modulus N and a private or secret exponent 'd'. By construction, d is a modular inverse of e.
[0005] The Chinese Remainder Theorem (CRT) is used with the RSA algorithm to accelerate decryption or signature time. CRT is an algorithm that reduces modular arithmetic with a large modulus to the same calculation for each factor of the modulus. CRT can thus reduce the size of the exponents used in calculations, particularly in the RSA algorithm. The RSA cipher in its CRT version is denoted RSA-CRT.
[0006] RSA-CRT encryption for signing a message or decrypting an encrypted message relies on private modular exponents dp and dq constructed from the private exponent d, specifically dp = d mod(pl) and dq = d mod(ql), where p and q are prime numbers forming the modulus N (N = pq). RSA-CRT encryption performs two modular exponentiations of the message, respectively by the modular exponent dp based on p and by the modular exponent dq based on q, and then recombination of the two results. For example, in the case of signing a message 'm' or decrypting an encrypted message also denoted 'm':
[0007] Sp <- mdp mod p
[0008] Sq <- mdq mod q
[0009] S <- CRTRecombine (Sp, Sq, p, q, iq) where iq = q 1 mod p.
[0010] RSA-CRT encryption is very susceptible to fault injection attacks, typically the so-called Bellcore attack. The Bellcore attack is documented in the publication "On the Importance of Checking Cryptography Protocols for Faults" (D. Boneh et al., EUROCRYPT '97, volume 1233 of LNCS, pages 37-51. Springer, 1997).
[0011] In particular, the private key used for the RSA-CRT signature is completely exposed from a single erroneous signature obtained by fault injection.
[0012] A first level of protection against this attack is possible when the public key is known to the cryptographic encryption system, by simply verifying that SAe=m, i.e. (mAd)Ae = m.
[0013] However, the public exponent e is not always known to the cryptographic system. While it is possible to recalculate the public exponent e by performing the modular inversion of the private exponent d, this calculation is too costly. Nevertheless, the publication US 2009 / 175441 proposes, in [Fig.8], to perform a less costly inversion of public modular exponents ep and eq resulting from the application of the CRT from the private modular exponents dp and dq. However, the necessary modular inversions are generally costly and difficult to secure against side-channel attacks.
[0014] Other protections against these exponent inversions have also been proposed. Typically, one of them performs a double calculation of the signature and compares the results, before outputting one of the results in case of a tie. However, since two identical calculations are performed, this protection mechanism does not protect the encryption against the same error being injected twice in both calculations.
[0015] There is therefore a need to secure a cryptographic system implementing the RSA-CRT algorithm in a secure manner with low computational cost. Summary of the invention
[0016] To this end, the invention proposes a new method for securing the RSA-CRT algorithm to protect the private modular exponents dp and dq either during message signing or during the decryption of an encrypted message. It therefore relates to a method for signing or decrypting, based on the RSA-CRT algorithm, an initial message m in an electronic device, using a private key comprising two modular exponents dp and dq associated with two distinct prime numbers p and q, the RSA-CRT algorithm comprising a first modular exponentiation of modulus p and a second modular exponentiation of modulus q, the method comprising the following steps:
[0017] generate a first data point, S, by a first execution of the RSA-CRT algorithm on m,
[0018] generate a second data point, S', by a second execution of the RSA-CRT algorithm on m, and
[0019] emit an output message based on S or S', if S is consistent with S'.
[0020] The invention relies on the mathematical properties of the RSA algorithm to perform a second, different RSA-CRT computation, thus resistant to the double injection of the same fault. To this end, it is characterized in that the modular exponentiations of the same modulus in the first and second executions of the RSA-CRT algorithm are performed on different messages based on m and / or using different modular exponents.
[0021] Indeed, the choice of a modification, between the two executions, of the message on which the modular exponentiations or the modular exponents used are carried out guarantees different executions and therefore resistant to a double injection of the same fault. At the same time, it makes it possible to verify, via the consistency between the two data S and S' obtained, that no fault has been injected without the need for computations of modular inverses (in particular to obtain the public exponent e or its modular exponents ep and eq) which are costly in resources.
[0022] Correlatively, the invention relates to an electronic device for signing or decrypting, based on the RSA-CRT algorithm, an initial message m using a private key comprising two modular exponents dp and dq associated with two distinct prime numbers p and q, the RSA-CRT algorithm comprising a first modular exponentiation of modulus p and a second modular exponentiation of modulus q, the electronic device comprising a processor configured to:
[0023] generate a first data point, S, by a first execution of the RSA-CRT algorithm on m,
[0024] generate a second data point, S', by a second execution of the RSA-CRT algorithm on m, and
[0025] emit an output message based on S or S', if S is consistent with S',
[0026] the electronic device being characterized in that the modular exponentiations of the same modulus of the first and second executions of the RSA-CRT algorithm are performed on different messages based on m and / or using different modular exponents.
[0027] The electronic device is a cryptographic system that is preferably computer-implementable. Also, the invention also relates to a non-transitory computer-readable medium storing a program that, when executed by a processor of an electronic cryptographic processing device, causes the electronic cryptographic processing device to perform the above method.
[0028] Optional features of embodiments of the invention are defined in the appended claims. Some of these features are explained below with reference to a method, while they can be transposed into device features.
[0029] In one embodiment, the first and second executions of the RSA-CRT algorithm call the same RSA-CRT encryption computer function taking, as inputs, different messages based on m and / or modular exponents of the same modulus which are different. This arrangement advantageously makes it possible to secure the RSA-CRT algorithm without modifying an existing implementation of this algorithm, and consequently without the need to requalify or re-test a new function.
[0030] In one embodiment, the modular exponentiations of the same execution are performed on an identical message.
[0031] Similarly, in one embodiment, the modular exponents of the two modular exponentiations of each execution are obtained by the same function (or transformation) applied respectively to dp and dq. Thus, one function / transformation is used for the first execution, for example the Identity function allowing the application of dp and dq, and a different function / transformation is used for the second execution as explained below.
[0032] According to the invention, the message for the modular exponentiations of the first execution is equal to m. This makes it possible to construct the output message from the first data S resulting from the first execution of the RSA-CRT algorithm.
[0033] According to the invention, the modular exponents of the two modular exponentiations of the first execution are respectively dp and dq, and the output message is S. In this case, the first execution corresponds to the signing or decryption of m using said private key.
[0034] The modular exponents of the two modular exponentiations in the first execution are respectively dp-a and dq-a, with a being a zero integer. In one embodiment, the message for the modular exponentiations in the second execution is (-1)j.mk, with j and k being positive integers, k not equal to zero. In this case, the message to be encrypted / decrypted is modified during the second execution of the RSA-CRT algorithm.
[0035] In particular, the message for the modular exponentiations of the second execution can be m2. Alternatively, the message for the modular exponentiations of the second execution is -(m)2. These configurations advantageously offer low computational complexity (thanks to the small values chosen for j and k) for a significant safety gain.
[0036] According to the invention, the modular exponents of the two modular exponentiations of the second execution are respectively |3.dp+y and |3.dq+y, where |3 is a non-zero positive integer and y is an integer. In this case, the modular exponents for p and q are modified during the second execution of the RSA-CRT algorithm.
[0037] In particular, it can be chosen that [3=1 and y=l]. These small values advantageously offer low computational complexity for a significant safety gain. Of course, other small values can be used, for example [3=1 or 2 and y=0, 1 or 2.
[0038] In one embodiment, the method comprises a step of verifying the consistency of S' with S by comparing S and S', the comparison comparing:
[0039] S' at (-1 / 7 + p '.Sk p.mk 7 mod N, with N=pq, when the message for the modular exponentiations of the second execution is (-1 )'.mk, if y positive, or
[0040] S'.mk 7 mod N to (-1 / 7 +|3'.Sk p mod N, if y negative.
[0041] It should be noted that the expression (-1^ ( 7 + p ' is equivalent to (-1 / 7 + pd) with d the private exponent of the RSA-CRT encryption key (therefore corresponding to dp and dq), insofar as d is odd.
[0042] In a particular embodiment, the comparison comprises:
[0043] the drawing of a random integer Rand,
[0044] calculating a verification value by adding one of the two terms to be compared to Rand followed by subtracting the other term to be compared, and
[0045] the comparison of the check value with Rand, the comparison being positive in case of equality.
[0046] This configuration secures the comparison by avoiding a comparison with 0.
[0047] At least part of the methods according to the invention can be implemented by computer. Consequently, the present invention can take the form of a completely hardware embodiment, a completely software embodiment (comprising firmware, resident software, microcode, etc.), or an embodiment combining software and hardware aspects, all of which can be collectively referred to herein as a "circuit," "module," or "system." Furthermore, the present invention can take the form of a computer program product embedded in any tangible medium having computer-usable program code embedded in the medium. Brief description of the drawings
[0048] Other features and advantages of the invention will become apparent in the description below, illustrated by the attached figures which illustrate exemplary embodiments which are not in any limiting nature.
[0049] Fig. 1 schematically illustrates the main elements of one possible embodiment for a microcircuit card or "smart card".
[0050] Fig. 2 illustrates the general physical appearance of the microcircuit board of Fig. 1.
[0051] Fig. 3 illustrates, from a flowchart, general steps for encrypting (signing) or decrypting a message according to embodiments of the invention.
[0052] Fig. 4 illustrates an embodiment of the process in Fig. 3 calling the same RSA-CRT encryption computer function.
[0053] Fig. 5 illustrates a first example of an embodiment calculating separately S=md mod NetS'=md+1 mod N.
[0054] [Fig.6] illustrates a second example of embodiment separately calculating S=md mod N and S'=m2d mod N.
[0055] [Fig.7] illustrates a third example of embodiment separately calculating S=md mod N and S'=(-m2)d mod N.
[0056] [Fig.8] illustrates a fourth example of embodiment separately calculating S=md mod N and S'=m2(d+1) mod N.
[0057] [Fig.9] illustrates a fifth example of embodiment separately calculating S=md mod N and S'=m2d+1 mod N.
[0058] [Fig. 10] illustrates a sixth embodiment separately calculating S=md 1 mod N and S'=m2(d+1) mod N. DETAILED DESCRIPTION
[0059] The present invention relates to the securing of cryptographic processes based on the RSA-CRT algorithm, for Rivest-Shamir-Adleman and Chinese Remainder Theorem.
[0060] As is known, the RSA-CRT algorithm is an asymmetric key signature / encryption algorithm, based on a public key (e, N) and a private key (p, q, dp, dq, iq) where:
[0061] the modulus N is equal to the product of the large prime numbers p and q: N=pq,
[0062] e is the public exhibitor, chosen between 1 and <e>=(p-1 ).(q-1 ),
[0063] d is the private exponent calculated by modular inversion of e with the modulus <e>: d=e 1 mod ¢, that is to say ed is equivalent to 1 mod ¢,
[0064] dp and dq are the modular exponents based respectively on p and q: dp = d mod(pl) and dq = d mod(ql), and
[0065] iq = q 1 mod p.
[0066] This algorithm can be used to encrypt or sign a message m.
[0067] During encryption, Alice encrypts the message m using the RSA algorithm with Bob's public key (N, e): S = me mod N. The encrypted message S is decrypted by Bob using the RSA algorithm with his own private key (p, q, dp, dq, iq): m = Sd mod N. The Chinese Remainder Theorem allows to speed up the time of this decryption by using dp and dq. A possible implementation of the RSA-CRT function is the following, denoted RSA-CRT(S, (p, q, dp, dq, iq)):
[0068] mp = Sdp mod p
[0069] mq = Sdq mod q
[0070] m = CRTRecombine (mp, mq, p, q, iq). Typically, CRTRecombine (mp, mq, p, q, iq ) = mq + q.(iq.(mp-mq) mod p).
[0071] Symmetrically for the signature of message m, Alice signs message m using the RSA algorithm with her own private key (p, q, dp, dq, iq): S = md mod N. The Chinese Remainder Theorem allows the computation time of the signature to be accelerated by using dp and dq, for example by calling the function RSA-CRT(m, (p, q, dp, dq, iq)):
[0072] Sp = mdp mod p
[0073] Sq = mdq mod q
[0074] S = CRTRecombine (Sp, Sq, p, q, iq). Typically, CRTRecombine (Sp, Sq, p, q, iq) = Sq + q.(iq.(Sp-Sq) mod p).
[0075] The signature S is verified by Bob using the RSA algorithm with Alice's public key (N, e) to calculate a message m': m' = Se mod N, then compare m and m'.
[0076] Subsequently, the explanations and illustrations are provided primarily in connection with the operation of signing message m. Given the symmetry of processing, these also apply to the decryption of a message encrypted by RSA.
[0077] The invention aims to secure the RSA-CRT algorithm executed by an electronic device against fault injection attacks, typically Bellcore attacks. This execution is obtained by a double execution of the RSA-CRT algorithm in which the modular exponentiations of the same modulus (p or q) of the two executions of the RSA-CRT algorithm are performed on different messages based on m and / or using different modular exponents.
[0078] This can be illustrated by two calls to the RSA-CRT function defined above where the parameters are different.
[0079] The consistency between the two results obtained by the two executions is checked, and if so, one of the results is used to generate an output message representing the desired signature (or the decrypted message).
[0080] Consistency between the two results should be understood to mean that these two results are linked by a formula. This ensures that no identical single or double attack has taken place on these executions.
[0081] [Fig.l] schematically represents an electronic data processing device 40 forming a cryptographic system in which the present invention can be implemented. This device 40 comprises a microprocessor 10, with which is associated on the one hand a random access memory 60, for example by means of a bus 70, and on the other hand a non-volatile memory 20 (for example of the EEPROM type), for example through a bus 50.
[0082] The data processing device 40, and specifically the microprocessor 10 which it incorporates, can exchange data with external devices by means of a communication interface 30.
[0083] [Fig.l] schematically represents the transmission of an input data item m received from an external device (not shown) and transmitted from the communication interface 30 to the microprocessor 10. Similarly, the transmission of an output data item S from the microprocessor 10 to the communication interface 30 intended for an external device is represented. This output data item S comes from the processing of data by the microprocessor 10, on the input data item m using a secret key 80 internal to the system, in particular the private key (p, q, d), i.e. (p, q, dp, dq, iq) in its CRT form, and stored in memory.
[0084] Although, for the illustration, the input data and the output data appear on two different arrows, the physical means which allow communication between the microprocessor 10 and the interface 30 may be achieved by unique means, for example a serial communication port or a bus.
[0085] The microprocessor 10 is capable of executing software (or computer program) which allows the data processing device 40 to execute a method according to the invention, examples of which are given below. The software is composed of a series of instructions for controlling the microprocessor 10 which are, for example, stored in the memory 20.
[0086] As a variant, the microprocessor 10 - non-volatile memory 20 - RAM 60 assembly can be replaced by a specific application circuit which then comprises means for implementing the different steps of the method according to the invention.
[0087] Figure 2 represents a microcircuit board that constitutes an example of a cryptographic system according to the invention as shown in Figure 1. The communication interface 30 is in this case implemented by means of the contacts of the microcircuit board. The microcircuit board incorporates a microprocessor 10, a random access memory 60 and a non-volatile memory 20 as shown in Figure 1.
[0088] This microcircuit board is for example compliant with ISO 7816 and equipped with a secure microcontroller which combines the microprocessor (or CPU) 20 and the RAM 60.
[0089] Alternatively, the cryptographic system may be included in a Secure Element (SE), a USB key, a document, or a paper information medium containing a microcircuit on one of its sheets associated with contactless communication methods. Preferably, this involves a portable or pocket-sized electronic device. Of course, the invention also applies to a cryptographic system equipping a personal computer, a mobile device (smartphone, tablet, IoT device, or equivalent) or a server.
[0090] Figure 3 illustrates, using a flowchart, general steps for encrypting (signing) or decrypting a message according to embodiments of the invention. The method can be implemented by an electronic device or cryptographic system as described above to output an encrypted (signed) or decrypted message, or it can be implemented by a software module within the electronic device or cryptographic system to provide the encrypted (signed) or decrypted message to another software module within the electronic device or cryptographic system.
[0091] The process begins at step 300 with the message m to be signed and the private key (p,q,dp,dq,iq). The explanations below are valid for a message m to be decrypted.
[0092] Step 310 consists of a first execution of the RSA-CRT algorithm by the electronic device to obtain a first signature S. The message used for the modular exponentiations of this first execution is m.
[0093] The first modular exponentiation of modulo p 312 uses the exponent dp-a where a is a positive integer (0 or more): Sp = mdp " mod p.
[0094] The second modular exponentiation of modulo q 314 uses the exponent dq-a: Sq = mdq " mod q.
[0095] The two exponentiations can be performed in parallel, or in the reverse order of the figure. The modular exponentiations of the same execution are performed on an identical message, here m. Similarly, the modular exponents of the two modular exponentiations of each of the executions are obtained by the same function or transformation applied respectively to dp and dq, here by the subtraction of a.
[0096] A first data S is then obtained in step 316 by CRT recombination of the two results Sp and Sq of the modular exponentiations 312 and 314. For example, S = Sq + q.(iq.(Sp-Sq) mod p).
[0097] This first data S is equal to S = md " mod N.
[0098] Similarly, step 320 consists of a second execution of the RSA-CRT algorithm by the electronic device to obtain a second signature S'. According to the invention, the modular exponentiations of this second execution use different messages based on m and / or different modular exponents compared to the first execution 310.
[0099] Generally, the message for the modular exponentiations of this second execution 320 is (-l)j.mk, with j and k integers, k non-zero. Typically j can take either the value 0 equivalent to any even value of j, or the value 1 equivalent to any odd value of j. k is preferably positive, but not necessarily.
[0100] To ensure that the messages and / or modular exponents used during the two executions 310 and 320 are different, the following trivial case is avoided: j=0 (or even), k=l, a=-y, [3=1.
[0101] The first modular exponentiation of modulo p 322 uses the exponent |3.dp+y where [3 is a non-zero positive integer and y is an integer (0 or more): S'p = ((-iy.mk)p'dp + 7 mod p.
[0102] The second modular exponentiation of modulo q 324 uses the exponent |3.dq+y: S'q = ((-l)fmk)Mq + 7mod q.
[0103] The two exponentiations can be performed in parallel, or in the reverse order of the figure. The modular exponentiations of the same execution are performed on an identical message, here (-l)j.mk. Similarly, the modular exponents of the two modular exponentiations of each of the executions are obtained by the same function applied respectively to dp and dq, here by the function g(d)= |3.d+y.
[0104] A second data S' is then obtained at step 326 by CRT recombination of the two results S'p and S'q of the modular exponentiations 322 and 324. For example, S' = S'q + q.(iq.(S'p-S'q) mod p).
[0105] This second data S' is equal to S' = ((-iy.mk)pd+ 7 mod N.
[0106] The two executions of the RSA-CRT algorithm 310 and 320 can be carried out in parallel, or in the reverse order of the figure.
[0107] Step 330 consists of verifying the consistency between the two obtained data S and S' to ensure that no fault injection occurred during the two executions 310 and 320 of the RSA-CRT algorithm by the electronic device. Consistency can be verified by comparing S and S' according to a consistency function related to the parameters j, k, a, [3 and y] used. Indeed, the proposed modifications of the message and / or exponents between the two executions rely on the mathematical properties of the RSA-CRT algorithm to allow for a final mathematical verification.
[0108] In one embodiment, the verification includes comparing:
[0109] S' to (-1 / 7 + p'XS.m^p.mk7 mod N, if y is positive, or
[0110] S'.mk 7 mod N at (-l)j ( 7 + p 'XS.m^ p mod N, if y negative.
[0111] In one embodiment, the value T=Sm" is calculated prior to this verification and is used in comparison.
[0112] For security reasons, a random value, denoted Rand, is used to mask this comparison. Typically, in embodiments, comparison 330 includes:
[0113] the drawing of a random integer Rand,
[0114] calculating a check value by adding one of the two terms to be compared to Rand followed by subtracting the other term to be compared. For example, we calculate
[0115] Verif = S' + Rand - (-1 / 7 + p).(Sm")k p.mk7 mod N, if y is positive, or
[0116] Verif =S'.mk 7 mod N + Rand - (-1)J ( 7 + p ).(Sm")kp mod N, if y is negative, and
[0117] the comparison of the Verif check value with Rand, the comparison being positive in case of a tie.
[0118] In case of inconsistency (negative comparison), an execution fault is therefore detected, possibly due to a fault injection, in which case an error is raised at step 350. This error may consist of the absence of an output data from calculations 310 and 320. It may also include the sending of a simple error code.
[0119] In case of consistency (positive comparison), the encrypted (signature) or decrypted message is output at step 340. Generally, the output message is based on S or S'.
[0120] Preferably, the output message is Sm" mod N. In one embodiment, the output message is T, which is calculated beforehand. Advantageously, when a = 0, the first data point S is directly equal to the output message (signature or decrypted message).
[0121] This method according to the invention protects the RSA-CRT algorithm against single faults due to the two executions 310 and 320, but also against identical double faults (one in each execution) due to the different modular messages or exponents used during the two executions 310 and 320.
[0122] Protection against the malicious modification of a few bits of an intermediate value (typically a byte or a machine word) to a random value being obtained by a classical double calculation, it is also obtained by the process of the invention.
[0123] Protection against malicious modification of all bits from an intermediate value to 0 or 1 (for example, 0x00 or OxFF) is now achieved by the method of the invention. Indeed, since the inputs of the RSA-CRT algorithm are different (the message or the modular exponents used), the intermediate values are different, and therefore the same fault on the two RSA-CRT executions necessarily leads to a different fault on the two data S and S'.
[0124] Also, protection against malicious modification of a pointer so that it points to a certain address in RAM is now obtained by the method of the invention. Indeed, even if the modification succeeds in distorting the pointer of an input parameter of the RSA-CRT encryption computer function called, for example that of the message to be used or that of the modular exponents to be used, such that it points to the same value for the two modular exponentiations of the same modulus (p or q) during the two executions 310 and 320, the two data S and S' will not be consistent because the two executions will be carried out on the same message or with the same modular exponents, and no longer with different messages or modular exponents between the two executions.
[0125] It should be noted that conventional protection against execution on a null message (m = 0) can be provided, by prior detection to the RSA-CRT algorithm or by an additional check on m at the beginning of the algorithm.
[0126] The computational costs of the method according to the invention remain contained. It costs the cost of modifying the message m and / or the modular exponents, plus twice the cost of an RSA-CRT execution and the cost of the consistency check, for example the calculation of S' and (-1 / 7 + p).(Sm")k p.mk 7 mod N. These costs can be kept negligible when the parameters k, a, [3 and y are small.
[0127] This is the case, for example, in the embodiments described below, in which the first and second executions of the RSA-CRT algorithm call the same RSA-CRT encryption computer function taking as input different messages based on m and / or modular exponents of the same modulus but different ones. This function is denoted RSA-CRT(m, (p, q, dp, dq, iq)), an implementation of which is described above.
[0128] These embodiments have the advantage of being able to rely on an already existing RSA-CRT function, thus reducing the need for qualification or testing of functions.
[0129] These embodiments are generically illustrated in [Fig. 4]. The first execution 410 calls the RSA-CRT function with the following input data (m, (p, q, dp-a, dq-a, iq). By this first call, the first modular exponentiation 312 is calculated, followed by the second modular exponentiation 314 and the CRT recombination 316. The first data S obtained is therefore identical to that obtained in [Fig. 3].
[0130] Then the second execution 420 calls the RSA-CRT function with the following input data ((-ly.n / , (p,q,[3.dp+Y,[3.dq+Y,iq)). By this second call to the function, the first modular exponentiation 322 is calculated, followed by the second modular exponentiation 324 and the CRT recombination 326. The second data S' obtained is therefore identical to that obtained in [Fig.3].
[0131] The 430 check remains unchanged, as does the output data in step 440 or the emission of an error in step 450.
[0132] Of course, other implementations than calling the same function can be envisaged. This means that other embodiments of the invention may provide different implementations of the RSA-CRT algorithm for the two executions required according to the invention. In particular, the different implementations may already include the parameters j, k, a, [3 and y] such that the two called functions take the same input values, namely (m, (p, q, dp, dq, iq)). Other intermediate implementations (e.g., some parameters are already fixed in the implementations, others are indicated in the input values) can be envisaged.
[0133] Figures 5 to 9 illustrate embodiments where the first execution 310 directly calculates the expected encrypted (signature) or decrypted message: S = md mod N. In these embodiments, the message for the modular exponentiations of the first execution and the modular exponents of the two modular exponentiations of the first execution are respectively m, dp, and dq. Thus, the output message is S. These embodiments therefore differ by the parameters j, k, [3, and y used during the second execution 320.
[0134] In the example of [Fig.5], the second execution 520 of the RSA-CRT algorithm by the electronic device calculates S' = md+1 mod N.
[0135] This corresponds to the embodiment j=0, k=l, a=0, [3=1 and y=l.
[0136] The data S and S' are therefore linked by the formula mS mod N = S'. The latter is so verified at step 530 for example in the form of a comparison between, on one side, mS mod N + Rand - S' and, on the other side, Rand.
[0137] In the example of [Fig.6], the second execution 620 of the RSA-CRT algorithm by the electronic device calculates S' = m2d mod N.
[0138] This corresponds to the embodiment j=0, k=2, a=0, [3=1 and y=0. Note that the same data S and S' are obtained with the following parameters j=0, k=1, a=0, [3=2 and y=0. We thus see that k and [3 are redundant. In a simplified embodiment, k can be omitted. Nevertheless, preferred embodiments retain k and [3 in order to allow a modification of the message taken by the RSA-CRT algorithm between the two executions 310, 320.
[0139] The data S and S' of the embodiment of [Fig.6] are therefore linked by the formula S2 mod N = S'. The latter is therefore verified in step 630 for example in the form of a comparison between, on the one hand, S2 mod N + Rand - S' and, on the other hand, Rand.
[0140] In the example of [Fig.7], the second execution 720 of the RSA-CRT algorithm by the electronic device calculates S' = (-m2)d mod N. It should be noted that in In embodiments using only positive values (to facilitate binary representation), -m can be manipulated as Nm or m.(Nl).
[0141] This example corresponds to the embodiment j=l, k=2, a=0, [3=1 and y=0.
[0142] The data S and S' are also linked by the formula S2 mod N = S'. This the latter is therefore verified at step 730, for example, in the form of a comparison between, on the one hand, S2 mod N + Rand + S' and, on the other hand, Rand.
[0143] In the example of [Fig.8], the second execution 820 of the RSA-CRT algorithm by the electronic device calculates S' = m2 ( d +1) mod N.
[0144] This example corresponds to the embodiment j=0, k=2, a=0, [3=1 and y=l. Note that the same data S and S' are obtained with the following parameters j=0, k=l, a=0, [3=2 and y=2.
[0145] The data S and S' are also linked by the formula (mS)2 mod N = S'. The latter is therefore verified in step 830, for example, in the form of a comparison between, on the one hand, (mS)2 mod N + Rand - S' and, on the other hand, Rand.
[0146] In the example of [Fig.9], the second execution 920 of the RSA-CRT algorithm by the electronic device calculates S' = m2d+1 mod N.
[0147] This example corresponds to the embodiment j=0, k=l, a=0, [3=2 and y=l.
[0148] The data S and S' are also related by the formula m.S2 mod N = S'. This The latter is therefore checked at step 930 for example in the form of a comparison between, on one side, m.S2 mod N + Rand - S' and, on the other side, Rand.
[0149] Fig. 10 illustrates an embodiment where the first execution 310 does not directly calculate the expected encrypted (signature) or decrypted message, but an intermediate data linked to the expected message by the formula: Sm"mod N.
[0150] In the example of [Fig. 10], the first execution 1010 of the RSA-CRT algorithm by the electronic device calculates S = md 1 mod N, that is a=l, and the second execution 1020 of the RSA-CRT algorithm calculates S' = m2(d +1 ' mod N.
[0151] This example corresponds to the embodiment j=0, k=2, a=l, [3=1 and y=l. Note that the same data S and S' are obtained with the following parameters j=0, k=l, a=l, [3=2 and y=2.
[0152] Of course, other values of a can be used. Similarly, any other combination of j, k, [3 and y (for example those in Figures 5 to 9) can be used for the second execution.
[0153] The data S and S' of the example in [Fig. 10] are therefore linked by the formula m2. (mS)2 mod N = S'. The latter is therefore verified in step 1030 for example in the form of a comparison between, on one side, m4.S2 mod N + Rand - S' and, on the other side, Rand.
[0154] In one embodiment, the value T=mS (more generally m".S) can be calculated in step 1025, before comparison 1030. The latter can then consist of verifying m2.T2 mod N = S', for example by comparing, on one side, m2.T2 mod N + Rand - S' and, on the other side, Rand.
[0155] Of course, the present invention is not limited to the embodiments described above by way of example; it extends to other variants. Other embodiments are possible.< / e> < / e>
Claims
Claims
1. Method for signing or decrypting, based on the RSA-CRT algorithm, an initial message m in an electronic device, using a private key comprising two modular exponents dp and dq associated with two distinct prime numbers p and q, the RSA-CRT algorithm comprising a first modular exponentiation (312, 322) of modulus p and a second modular exponentiation (314, 324) of modulus q, the method comprising the following steps: generating a first data item, S, by a first execution (310, 410, 510, 610, 710, 810, 910, 1010) of the RSA-CRT algorithm on m, generating a second data item, S', by a second execution (320, 420, 520, 620, 720, 820, 920, 1020) of the RSA-CRT algorithm on m, and emit (340, 440, 540, 640, 740, 840, 940, 1040) S as output message, if S is consistent with S', characterized in that the modular exponentiations (312, 322;314, 324) of the same module of the first and second executions of the RSA-CRT algorithm are carried out: - on different messages based on m.;
2. The method of claim 1, wherein the first and second executions of the RSA-CRT algorithm call a same RSA-CRT encryption computer function taking, as inputs, different messages based on m and / or modular exponents of the same modulus which are different.
3. Method according to claim 1 or 2, in which the modular exponentiations of the same execution are carried out on an identical message.
4. Method according to one of the preceding claims, in which the modular exponents of the two modular exponentiations of each of the executions are obtained by the same function applied respectively to dp and dq.
5. Method according to one of the preceding claims, in which the message for the modular exponentiations of the second execution is (-l)j.mk, with j and k positive integers, k non-zero. In this case, the message to be encrypted / decrypted is modified during the second execution of the RSA-CRT algorithm.
6. Method according to one of the preceding claims, comprising a step of verifying (330, 430, 530, 630, 730, 830, 930, 1030) the consistency of S' with S by comparing S and S', the comparison comparing: S' to (-1 / 7 + p '.Sk p.mk 7 mod N, with N=pq, when the message for the modular exponentiations of the second execution is (-l)j.mk, if y positive, or S'.mk 7 mod N to (-l / 74^^ p mod N, if y negative.
7. Method according to the preceding claim, in which the comparison comprises: drawing a random integer Rand, calculating a verification value by adding one of the two terms to be compared to Rand followed by subtracting the other term to be compared, and comparing the verification value with Rand, the comparison being positive in the event of equality.
8. Electronic device (40) for signing or decrypting, based on the RSA-CRT algorithm, an initial message m using a private key comprising two modular exponents dp and dq associated with two distinct prime numbers p and q, the RSA-CRT algorithm comprising a first modular exponentiation (312, 322) of modulus p and a second modular exponentiation (314, 324) of modulus q, the electronic device comprising a processor (10) configured to: generate a first data item, S, by a first execution of the RSA-CRT algorithm on m, generate a second data item, S', by a second execution of the RSA-CRT algorithm on m, and emit S as an output message, if S is consistent with S', the electronic device being characterized in that the modular exponentiations of the same modulus of the first and second executions of the RSA-CRT algorithm are performed on different messages based on m.
9. A non-transitory computer-readable medium storing a program that, when executed by a processor of an electronic cryptographic processing device, causes the device cryptographic processing electronics to carry out the method according to one of claims 1 to 7.