RSA Signature Generation via Multiplicative Key Splitting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software implementations of RSA cryptosystems are vulnerable to white-box attacks, particularly partial key exposure attacks, and suffer from high computation times, making them impractical for secure use on devices with low processing capabilities like smartphones.
Innovation Solution
The RSA private exponent is split into shares, with one share used for secure generation of an RSA signature using a white-box protection method and the other using lower security requirements, allowing for efficient computation and protection against white-box attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If RSA decryption/signature is implemented in software on open devices, then accessibility and ease of use improve, but vulnerability to white-box attacks increases
Solution Approach 1:
The private key d is segmented into multiple components through multiplicative splitting: d = d1 * d2 (mod φ(N)), where d1 < φ(N) and d2 ≥ φ(N). This segmentation allows the secure processing of only the smaller component d1 on resource-constrained devices, while d2 can be processed with lower security requirements, thus enabling software implementation on open devices while maintaining security against white-box attacks.
2Reliability
If full white-box protection is applied to RSA decryption/signature, then security against white-box attacks improves, but computation time increases
Solution Approach 1:
The computation is segmented into two parts corresponding to the two key components. The secure white-box processing is applied only to the smaller component d1, while the larger component d2 is processed with standard protection measures. This segmentation reduces the overall computation time while maintaining security, as the most time-consuming secure processing is applied to a smaller key component.
Solution Approach 2:
Instead of applying full white-box protection to the entire private key operations, the invention applies partial protection only to the necessary component d1. This partial action approach achieves adequate security protection while significantly reducing the computational overhead associated with full white-box protection schemes.
3Reliability
If private key is stored securely in hardware, then security improves, but device complexity and cost increase
Solution Approach 1:
The private key functionality is segmented such that only the smaller component d1 requires secure storage and processing. This segmented approach allows implementation on simpler devices with lower hardware requirements, as the most security-critical operations are reduced to processing only the essential component d1, rather than requiring full hardware security modules for the entire private key.
Data Source
AI summary
Secure generation of an RSA signature of a message to be signed with a private exponent component d of an RSA key (p, q, N, d, e), by obtaining a hashed message, said hashed message being computed by hashing said message with a public hash function H:{0,1}*→Z*N, generating a first part of the RSA signature from said hashed message and said first private exponent component share, generating a second part of the RSA signature from said first part of the RSA signature and said second private exponent component share, determining the RSA signature from said second part of the RSA signature, and wherein the step of generation of a part of the RSA signature from the smaller private exponent component share among the first and second private exponent component shares is performed using a whitebox protection method and the step of generation of a part of the RSA signature from the bigger private exponent component share among the first and second private exponent component shares is performed using lower security requirements.