Montgomery Transform Value Randomization for SPA Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for countering Simple Power Analysis (SPA) attacks in RSA cryptographic schemes are inadequate, as they either introduce bias or are vulnerable to error attacks, allowing potential unauthorized analysis of private keys.
Innovation Solution
An information security apparatus that performs modular exponentiation using a Montgomery transform value of 1 when a digit of the private key is 0, eliminating bias and making it difficult to distinguish whether a multiplication is performed or not, thereby enhancing security against SPA attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiplication is performed using the value 1 when the private key bit is 0, then the private key cannot be obtained by waveform judgment of power consumption, but the value 1 has a bias towards hamming weight that affects power variations and enables illegitimate analysis of the private key
Solution Approach 1:
The patent changes the parameter used in multiplication from the constant value 1 to a random value r. This parameter change eliminates the hamming weight bias that caused power variations, while still preventing SPA attacks. The random value r ensures that power consumption patterns do not reveal information about the private key bits.
Solution Approach 2:
The patent introduces dynamic randomness into the multiplication process by using a random value r instead of a fixed value 1. This dynamic approach ensures that each multiplication operation has unpredictable power consumption characteristics, making it impossible for attackers to distinguish between different private key bits through power analysis.
2Reliability
If multiplication is performed regardless of whether the private key bit is 0 or 1, then the private key cannot be obtained by whether the multiplication is performed or not, but error attacks can analyze the private key by generating errors during multiplication
Solution Approach 1:
The patent changes the multiplication approach by introducing a random value r and performing multiplication only when the private key bit is 1. When the bit is 0, multiplication by the random value is performed but the result is not used. This parameter change prevents both SPA attacks and error attacks, as the random value ensures that power consumption and error patterns do not reveal private key information.
Solution Approach 2:
The patent uses a random value r as an intermediary element in the multiplication process. This intermediary prevents direct correlation between the private key bits and observable outputs (power consumption, errors), thereby protecting against both SPA and error attacks. The random value acts as a mediator that breaks the information flow to attackers.
Data Source
AI summary
The present invention aims to provide an information security apparatus that counters a simple power analysis attack (SPA) on an information security apparatus such as an RSA cryptosystem. The information security apparatus uses a multiplication with 1 in a Montgomery domain. 1 in the Montgomery domain is determined depending on a modulus and an integer k, which is greater than a number of bits of a modulus p. Therefore, it is hard for attackers who do not know p or k to analyze. Also, even if an analyzer can predict the Hamming weight, it is possible to further improve the safety against the SPA by modifying k or the modulus at random.