Improved CRT-RSA Secret Key Recovery Method from Sliding Window Leakage
- 20 Downloads
In this paper, we discuss side-channel attacks on the CRT-RSA scheme (RSA scheme with Chinese Remainder Theorem) implemented by the left-to-right sliding window method. This method calculates exponentiations by repeating squaring and multiplication. In CHES 2017, Bernstein et al. proposed side-channel attacks on the CRT-RSA signature scheme implemented by the left-to-right sliding window method. We can obtain square-and-multiply sequences by their side-channel attacks, but cannot calculate CRT-RSA secret keys because there are multiple candidates of multiplications. Then, Bernstein et al. calculated CRT-RSA secret keys by using two methods. First, they recovered CRT-RSA secret keys partially and calculated all secret key bits by using the Heninger–Shacham method. Second, they applied the Heninger–Shacham method to square-and-multiply sequences directly. They showed that we can calculate CRT-RSA secret keys more efficiently when we use square-and-multiply sequences directly. They also showed that we can recover CRT-RSA secret keys in polynomial time when \(w \le 4\). Moreover, they experimentally showed that we can recover secret keys of 2048-bit CRT-RSA scheme when \(w=5\). However, their latter method is simple and has room for improvement. Here, we study bit recovery more profoundly to improve their method. First, we calculate the exact rate of all knowable bits. Next, we propose a new method for calculating the proportion of each bit 0 or 1 in each nonrecovery bit. Finally, we propose a new method for calculating CRT-RSA secret key using this bit information. In our proposed algorithm, we extend Bernstein et al.’s method in combination with Kunihiro et al.’s method. We calculate more secret keys when \(w=5\) by our proposed method compared to Bernstein et al.’s method.
KeywordsSide-channel attacks Sliding window method CRT-RSA scheme Secret key recovery
This research was partially supported by JST CREST Grant Number JPMJCR14D6, Japan and JSPS KAKENHI Grant Number JP16H02780.
- 2.Genkin, D., Pachmanov, L., Pipman, I., Tromer, E.: Stealing keys from PCs using a radio: cheap electromagnetic attacks on windowed exponentiation. In: Güneysu, T., Handschuh, H. (eds.) CHES 2015. LNCS, vol. 9293, pp. 207–228. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-48324-4_11CrossRefGoogle Scholar
- 7.İnci, M.S., Gulmezoglu, B., Irazoqui, G., Eisenbarth, T., Sunar, B.: Cache attacks enable bulk key recovery on the cloud. In: Gierlichs, B., Poschmann, A.Y. (eds.) CHES 2016. LNCS, vol. 9813, pp. 368–388. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53140-2_18CrossRefGoogle Scholar
- 10.Kunihiro, N., Shinohara, N., Izu, T.: Recovering RSA secret keys from noisy key bits with erasures and errors. IEICE Trans. Fundam. E97-A, 1273–1284 (2014). https://doi.org/10.1587/transfun.E97.A.1273
- 12.Moriarty, K., Kaliski, B., Jonsson, J., Rusch, A.: PKCS #1: RSA cryptography specifications version 2.2 (2016). https://tools.ietf.org/html/rfc8017
- 14.Percival, C.: Cache missing for fun and profit (2005). http://www.daemonology.net/papers/htt.pdf
- 16.Smith, W.L.: Renewal theory and its ramifications. J. Roy. Stat. Soc. 20, 243–302 (1958). https://doi.org/10.1111/j.2517-6161.1958.tb00294.xMathSciNetCrossRefzbMATHGoogle Scholar
- 17.van Vredendaal, C.: Exploiting Mathematical Structures in Cryptography. Technische Universiteit Eindhoven, Eindhoven (2018)Google Scholar
- 18.Yarom, Y., Falkner, K.: FLUSH+RELOAD: a high resolution, low noise, L3 cache side-channel attack. In: USENIX 2014, pp. 719–732 (2014)Google Scholar