RSA-CRT Algorithm Scrambling for Power Analysis Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electronic circuits executing RSA-CRT algorithms are vulnerable to simple power analysis attacks, as the execution of modular exponentiation calculations can reveal sensitive information about the private key, particularly during the recombination step, which is not adequately protected by existing scrambling methods.
Innovation Solution
A method is introduced to scramble the RSA-CRT algorithm by adding a digital quantity to one partial result before the recombination step and canceling its effects afterward, ensuring that the modular addition is non-zero and less than the difference between the partial results, using the relations Xm=[(X″−(X′+R))*(q−1 mod p)]*q+(X′+R) and X=Xm−R*(1−(q−1 mod p)*q, where R is an unpredictable number, to protect against simple power analysis attacks without modifying the partial modular exponentiation steps.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If scrambling is applied to RSA-CRT algorithm execution, then security against power analysis attacks is improved, but the complexity of the calculation process increases
Solution Approach 1:
The patent introduces an intermediary random value R that is added to one of the partial results before recombination. This intermediary value acts as a mask that obscures the power consumption patterns associated with the private key operations, thereby protecting against power analysis attacks while maintaining the overall structure of the RSA-CRT algorithm
Solution Approach 2:
The patent modifies the parameters of the RSA-CRT algorithm by introducing a random value R that changes the state of the partial results during computation. This parameter change (adding R) transforms the power consumption characteristics without altering the fundamental cryptographic functionality, as R is subsequently removed through modular arithmetic operations
2Reliability
If a random quantity is added to partial results, then resistance to simple power analysis attacks is improved, but the precision of the calculation steps is worsened
Solution Approach 1:
The patent applies beforehand cushioning by pre-calculating the compensation value −R×(1−(q−1 mod p)×q) that will be needed to remove the random value R after the recombination step. This ensures that the random value is properly eliminated without introducing errors, maintaining calculation precision while preserving the security benefits of the scrambling operation
3Reliability
If scrambling modifications are introduced to protect the recombination step, then security is improved, but the execution time increases
Solution Approach 1:
The patent applies preliminary action by pre-computing the term (q−1 mod p)×q and storing it for later use. This pre-computation avoids repeating complex modular arithmetic operations during the actual scrambling and unscrambling processes, thereby reducing the time overhead introduced by the security measures while maintaining their effectiveness
Data Source
AI summary
A method and a circuit for scrambling an RSA-CRT algorithm calculation by an electronic circuit, in which a result is obtained from two modular exponentiation calculations, each providing a partial result, and from a recombination step, and in which a first step adds a digital quantity to at least one first partial result before said recombination step; and a second step cancels the effects of this quantity after the recombination step.