RSA Decryption Fault Attack Detection via Modular Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing countermeasures against fault attacks on the Chinese Remainder Theorem used in RSA decryption are inefficient, particularly when using larger public keys, as they either significantly increase calculation time or are impractical due to the need for additional modulo exponentiation operations.
Innovation Solution
A data processor with an arithmetic unit that performs modulo exponentiation operations to detect errors during the Chinese Remainder Theorem process in RSA decryption, calculating C0=Xd′modN and C1=XdmodN, and determining if the product of C0 and C1 matches T=X2^nmodN, allowing for error detection without additional encryption operations and reducing calculation time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the first countermeasure (calculating Xp and Xq each twice) is used to detect fault attacks, then security against fault attacks is improved, but calculation time is significantly increased
Solution Approach 1:
The patent extracts the verification step from a separate re-calculation process and integrates it into the original modulo exponentiation flow. By checking the relationship C0×C1≡T (mod N) during the normal calculation, the system verifies correctness without adding a complete second calculation, thus extracting the security function from the time-consuming re-calculation approach.
Solution Approach 2:
The patent merges the fault detection function with the original decryption calculation by using the same computational steps to both decrypt and verify. The verification of C0×C1≡T (mod N) is combined with the modulo exponentiation process itself, eliminating the need for separate verification calculations and reducing total computation time.
2Reliability
If the second countermeasure (re-encrypting result Z) is used to detect fault attacks, then security against fault attacks is improved, but calculation time is excessively elongated
Solution Approach 1:
The patent extracts only the essential verification element (the modular relationship check) from the complete re-encryption process. Instead of performing a full re-encryption which would require additional modulo exponentiation with the public key, the invention extracts and verifies only the critical mathematical relationship C0×C1≡T (mod N), significantly reducing the verification time while maintaining security.
Solution Approach 2:
The patent changes the verification parameter from a complete re-encryption operation (which would require computing X^e mod M) to a simpler modular multiplication check (C0×C1 mod N). This parameter change transforms an O(log e) operation into an O(1) operation relative to the exponent size, dramatically reducing verification time while preserving fault detection capability.
3Measurement precision
If additional modulo exponentiation operations are performed for verification, then detection precision of fault attacks is improved, but device complexity increases
Solution Approach 1:
The patent merges the verification logic with the existing decryption algorithm flow. The check C0×C1≡T (mod N) is integrated into the modulo exponentiation process itself, using the same computational steps to both perform the decryption and verify its correctness. This merging avoids the need for separate verification routines and additional algorithmic complexity.
Solution Approach 2:
The patent makes the modulo exponentiation operation multi-functional by designing it to simultaneously perform decryption and self-verification. The same computational process generates both the decrypted result and the verification data, allowing one operation to serve multiple purposes and reducing overall system complexity compared to separate decryption and verification routines.
Data Source
AI summary
There is a need to perform recalculation against a fault attack on any public key e within a time period required for one-time modulo exponentiation.A modulo exponentiation operation is expressed as Y=XdmodN. The modulo exponentiation operation is performed to yield C0=Xd′modN, C1=XdmodN, and T=X2^nmodN, where d′ denotes two's complement of d and n denotes the number of bits in d. The modulo exponentiation operation determines whether or not a remainder resulting from the product of a value of C0 and a value of C1 modulo N matches a value of T. The modulo exponentiation operation assigns the value of C1 to Y if a match is found. The modulo exponentiation operation reports an error if a match is not found. The modulo exponentiation operation applies an RSA decryption process to a modulo exponentiation operation using the Chinese remainder theorem.