Efficient Leak Resistant Modular Exponentiation in RNS

Transcription

1 Efficient Leak Resistant Modular Exponentiation in RNS Andrea Lesavourey (1), Christophe Negre (1) and Thomas Plantard (2) (1) DALI (UPVD) and LIRMM (Univ. of Montpellier, CNRS), Perpignan, France (2) CCISR, SCIT, University of Wollongong, Wollongong, Australia 24-th Symposium on Computer Arithmetic, London, July 26, / 19

2 Outline 1 Cryptography RSA cryptosystem Power analysis Montgomery multiplication in RNS 2 Randomized modular exponentiation in RNS Randomized Montgomery multiplication Proposed approach Level of randomization 3 Conclusion 2 / 19

3 Outline 1 Cryptography RSA cryptosystem Power analysis Montgomery multiplication in RNS 2 Randomized modular exponentiation in RNS Randomized Montgomery multiplication Proposed approach Level of randomization 3 Conclusion 3 / 19

4 RSA encryption (Rivest, Shamir and Adleman) Bob chooses p and q two large prime numbers and computes N = pq. He generates E and D two integers such that ED = 1 (mod (p 1)(q 1)). Public Key: N, D. Private Key: E, p, q. Alice encrypts a message m by: c = m D mod N. Bob decrypts c by doing: c E = m ED mod N = m. 4 / 19

5 An algorithm for modular exponentiation : Right-to-left Square-and-multiply Require: A modulus N, an integer X [0, N[ and an exponent E = (e l 1,..., e 0 ) 2 Ensure: R = X E (mod N) 1: R 1 2: Z X 3: for i from 0 to l 1 do 4: if e i = 1 then 5: R R Z (mod N) 6: end if 7: Z Z 2 (mod N) 8: end for 9: return R X E = X l 1 e i 2 i i=0 X E = X e l 12 l 1 X e 12 1 X e / 19

6 Simple power analysis E = (e l,..., e 0 ) 2 and X [0, N[ Square-and-multiply R 1 Z X for i = 0 to l 1 do if e i = 1 then R R Z mod N endif Z Z 2 mod N endfor return(r) 6 / 19

7 Simple power analysis E = (e l,..., e 0 ) 2 and X [0, N[ Square-and-multiply R 1 Z X for i = 0 to l 1 do if e i = 1 then R R Z mod N endif Z Z 2 mod N endfor return(r) Square-and-multiply-always R 0 1 R 1 1 Z X for i = 0 to l 1 do if e i = 0 then R 0 R 0 Z mod N else R 1 R 1 Z mod N endif endfor Z Z 2 mod N return(r 1 ) Montgomery-ladder R 1 R X for i = l to 1 do if k i = 1 then R R R mod N R R 2 mod N else R R R mod N R R 2 endif endfor return(r) 6 / 19

8 Differential power analysis m loop 1 e 1 = 1 loop 2 e 2 = 0 loop 3 e 3 = 1 loop 4 e 4 = 0 loop 5 e 5 =?? 7 / 19

9 Differential power analysis m loop 1 e 1 = 1 r 1 loop 2 e 2 = 0 r 2 loop 3 e 3 = 1 r 3 loop 4 e 4 = 0 r 4 loop 5 e 5 =?? 0 r 5 1 r 5 7 / 19

10 Differential power analysis m trace 1 trace 2 trace 3... trace L loop 1 e 1 = 1 r 1 loop 2 e 2 = 0 r 2 loop 3 e 3 = 1 r 3 loop 4 e 4 = 0 r 4 loop 5 e 5 =?? 0 r 5 1 r 5 7 / 19

11 Differential power analysis m loop 1 e 1 = 1 r 1 loop 2 e 2 = 0 r 2 loop 3 e 3 = 1 r 3 loop 4 e 4 = 0 r 4 loop 5 e 5 =?? 0 r 5 1 r 5 trace 1 Differentials: trace 2 trace 3.. correct guess wrong guess. trace L 7 / 19

12 Differential power analysis m loop 1 e 1 = 1 r 1 loop 2 e 2 = 0 r 2 loop 3 e 3 = 1 r 3 loop 4 e 4 = 0 r 4 loop 5 e 5 =?? 0 r 5 1 r 5 trace 1 Differentials: trace 2 trace 3.. correct guess wrong guess. trace L Counter-measure: Randomization of the exponent and data. 7 / 19

13 Montgomery multiplication Basic modular multiplication. For X, Y [0, N[ 1 Product. Z X Y 2 Reduction. Q Z/N and R Z Q N 8 / 19

14 Montgomery multiplication Basic modular multiplication. For X, Y [0, N[ 1 Product. Z X Y 2 Reduction. Q Z/N and R Z Q N Montgomery Multiplication Require: X, Y [0, N[ and A = 2 n > N Ensure: R = X Y A 1 (mod N) 1: Z X Y 2: Q N 1 Z (mod A) 3: R (Z Q N)/A X Y Z 1 Z 0

15 Montgomery multiplication Basic modular multiplication. For X, Y [0, N[ 1 Product. Z X Y 2 Reduction. Q Z/N and R Z Q N Montgomery Multiplication Require: X, Y [0, N[ and A = 2 n > N Ensure: R = X Y A 1 (mod N) 1: Z X Y 2: Q N 1 Z (mod A) 3: R (Z Q N)/A X Y Z 1 Z 0 Z 0 = Q N 8 / 19

16 Montgomery multiplication Basic modular multiplication. For X, Y [0, N[ 1 Product. Z X Y 2 Reduction. Q Z/N and R Z Q N Montgomery Multiplication Require: X, Y [0, N[ and A = 2 n > N Ensure: R = X Y A 1 (mod N) 1: Z X Y 2: Q N 1 Z (mod A) 3: R (Z Q N)/A X Y Z 1 Z 0 Z 0 R 0 2 n R = Q N 8 / 19

17 Montgomery multiplication Basic modular multiplication. For X, Y [0, N[ 1 Product. Z X Y 2 Reduction. Q Z/N and R Z Q N Montgomery Multiplication Require: X, Y [0, N[ and A = 2 n > N Ensure: R = X Y A 1 (mod N) 1: Z X Y 2: Q N 1 Z (mod A) 3: R (Z Q N)/A Montgomery representation. 1 X = XA mod N provides X Y Z 1 Z 0 Z 0 R 0 2 n R = Q N 2 MontMul( X, Ỹ ) = (XA) (YA) A 1 mod N = XYA mod N 8 / 19

18 Montgomery multiplication in residue number system Let A = {a 1,..., a t } be a set t co-prime integers. 9 / 19

19 Montgomery multiplication in residue number system Let A = {a 1,..., a t } be a set t co-prime integers. An integer X such that 0 X < A = t i=1 a i is represented by [X ] A = (x 1 = X mod a 1,..., x t = X mod a t ). 9 / 19

20 Montgomery multiplication in residue number system Let A = {a 1,..., a t } be a set t co-prime integers. An integer X such that 0 X < A = t i=1 a i is represented by [X ] A = (x 1 = X mod a 1,..., x t = X mod a t ). The Chinese remainder theorem tell us that for op {+, } [X ] A op [Y ] A = ([x 1 op y 1 ] a1,..., [x t op y t ] at ) X op Y mod A 9 / 19

21 Montgomery multiplication in residue number system Let A = {a 1,..., a t } be a set t co-prime integers. An integer X such that 0 X < A = t i=1 a i is represented by [X ] A = (x 1 = X mod a 1,..., x t = X mod a t ). The Chinese remainder theorem tell us that for op {+, } [X ] A op [Y ] A = ([x 1 op y 1 ] a1,..., [x t op y t ] at ) X op Y mod A Montgomery Multiplication in RNS Require: X, Y in A B Ensure: XYA 1 mod N in A B 1: [Q] A [XYN 1 ] A 3: [Z] B [(XY QN)A 1 ] B 5: return (Z A B ) 9 / 19

22 Montgomery multiplication in residue number system Let A = {a 1,..., a t } be a set t co-prime integers. An integer X such that 0 X < A = t i=1 a i is represented by [X ] A = (x 1 = X mod a 1,..., x t = X mod a t ). The Chinese remainder theorem tell us that for op {+, } [X ] A op [Y ] A = ([x 1 op y 1 ] a1,..., [x t op y t ] at ) X op Y mod A Montgomery Multiplication in RNS Require: X, Y in A B Ensure: XYA 1 mod N in A B 1: [Q] A [XYN 1 ] A 2: [Q] B BE A B ([Q] A ) 3: [Z] B [(XY QN)A 1 ] B 4: [Z] A BE B A ([Z] B ) 5: return (Z A B ) 9 / 19

23 Outline 1 Cryptography RSA cryptosystem Power analysis Montgomery multiplication in RNS 2 Randomized modular exponentiation in RNS Randomized Montgomery multiplication Proposed approach Level of randomization 3 Conclusion 10 / 19

24 Randomization in RNS (LRA CHES 2004) We have X old = [XA old ] Aold B old we permute the basis elements A old B old A new B new A B a 1 b 1 a 2 a t 1 a t b t b t 1 this leads to a new representation of X X new = [XA new ] Anew B new Cost Two Montgomery multiplications : XA old mod N XA old A new mod N XA new mod N. 11 / 19

25 Randomized square-and-multiply-always Input: N, X [0, N[, E = (e l 1,..., e 0 ) 2 and M = {m 1,..., m 2t }. Output: X E mod N Square-and-mult-always A, B random split M Z [ X ] A B, R 0 [ 1] A B, R 1 [ 1] A B for i from 0 to l 1 do R ei MM RNS( R ei, Z, A, B) Z MM RNS( Z, Z, A, B) end for return R 1 12 / 19

26 Randomized square-and-multiply-always Input: N, X [0, N[, E = (e l 1,..., e 0 ) 2 and M = {m 1,..., m 2t }. Output: X E mod N Randomized Square-and-mult-always A, B random split M Z [ X ] A B, R 0 [ 1] A B, R 1 [ 1] A B for i from 0 to l 1 do R ei MM RNS( R ei, Z, A, B) Z MM RNS( Z, Z, A, B) Randomise(A old, B old, A, B) Z Update( Z, A old, B old, A, B) R 0 Update( R 0, A old, B old, A, B) R 1 Update( R 1, A old, B old, A, B) end for return R 1 12 / 19

27 Randomized square-and-multiply-always Input: N, X [0, N[, E = (e l 1,..., e 0 ) 2 and M = {m 1,..., m 2t }. Output: X E mod N Randomized Square-and-mult-always A, B random split M Z [ X ] A B, R 0 [ 1] A B, R 1 [ 1] A B for i from 0 to l 1 do R ei MM RNS( R ei, Z, A, B) Z MM RNS( Z, Z, A, B) Randomise(A old, B old, A, B) Z Update( Z, A old, B old, A, B) R 0 Update( R 0, A old, B old, A, B) R 1 Update( R 1, A old, B old, A, B) end for return R 1 12 / 19

28 Randomized square-and-multiply-always Input: N, X [0, N[, E = (e l 1,..., e 0 ) 2 and M = {m 1,..., m 2t }. Output: X E mod N Randomized Square-and-mult-always A, B random split M Z [ X ] A B, R 0 [ 1] A B, R 1 [ 1] A B for i from 0 to l 1 do R ei MM RNS( R ei, Z, A, B) Z MM RNS( Z, Z, A, B) Randomise(A old, B old, A, B) Z Update( Z, A old, B old, A, B) R 0 Update( R 0, A old, B old, A, B) R 1 Update( R 1, A old, B old, A, B) end for return R 1 Proposed A, B random split M Z [ X ] A B, R 0 [ 1] A B, R 1 [ 1] A B for i from 0 to l 1 do A e i, B e i random split M R ei MM RNS( R ei, Z, A e i, B e i ) Z MM RNS( Z, Z, A, B) Randomise(A old, B old, A, B) Z Update( Z, A old, B old, A, B) end for return R 1 12 / 19

29 Example For E = 7 = (111) 2 and M = {m 1, m 2, m 3, m 4 } 13 / 19

30 Example For E = 7 = (111) 2 and M = {m 1, m 2, m 3, m 4 } Initialization: A = {m 1, m 2 }, B = {m 3, m 4 } leads to R 1 = m 1 m 2 mod N Z = Xm 1 m 2 mod N 13 / 19

31 Example For E = 7 = (111) 2 and M = {m 1, m 2, m 3, m 4 } Initialization: A = {m 1, m 2 }, B = {m 3, m 4 } leads to R 1 = m 1 m 2 mod N Z = Xm 1 m 2 mod N Loop 1: A 1 = {m 2, m 4 }, B 1 = {m 1, m 3 } we get R 1 = (m 1 m 2 ) (Xm 1 m 2 ) (m 1 }{{} Z 2 m 1 4 }{{} ) Mont. factor = Xm 2 1m 2 m / 19

32 Example For E = 7 = (111) 2 and M = {m 1, m 2, m 3, m 4 } Initialization: A = {m 1, m 2 }, B = {m 3, m 4 } leads to R 1 = m 1 m 2 mod N Z = Xm 1 m 2 mod N Loop 1: A 1 = {m 2, m 4 }, B 1 = {m 1, m 3 } we get R 1 = (m 1 m 2 ) (Xm 1 m 2 ) (m 1 }{{} Z A = {m 1, m 3 }, B = {m 2, m 4 } leads to 2 m 1 4 }{{} ) Mont. factor Z = X 2 m 1 m 3 = Xm 2 1m 2 m / 19

33 Example For E = 7 = (111) 2 and M = {m 1, m 2, m 3, m 4 } Initialization: A = {m 1, m 2 }, B = {m 3, m 4 } leads to R 1 = m 1 m 2 mod N Z = Xm 1 m 2 mod N Loop 1: A 1 = {m 2, m 4 }, B 1 = {m 1, m 3 } we get R 1 = (m 1 m 2 ) (Xm 1 m 2 ) (m 1 }{{} Z A = {m 1, m 3 }, B = {m 2, m 4 } leads to 2 m 1 4 }{{} ) Mont. factor Z = X 2 m 1 m 3 = Xm 2 1m 2 m 1 4 Loop 2: A 1 = {m 1, m 4 }, B 1 = {m 2, m 3 } we get R 1 = Xm1m 2 2 m4 1 (X 2 m 1 m 3 ) (m1 1 m 1 4 ) = X 3 m1m 2 2 m 3 m / 19

34 Example For E = 7 = (111) 2 and M = {m 1, m 2, m 3, m 4 } Initialization: A = {m 1, m 2 }, B = {m 3, m 4 } leads to R 1 = m 1 m 2 mod N Z = Xm 1 m 2 mod N Loop 1: A 1 = {m 2, m 4 }, B 1 = {m 1, m 3 } we get R 1 = (m 1 m 2 ) (Xm 1 m 2 ) (m 1 }{{} Z A = {m 1, m 3 }, B = {m 2, m 4 } leads to 2 m 1 4 }{{} ) Mont. factor Z = X 2 m 1 m 3 = Xm 2 1m 2 m 1 4 Loop 2: A 1 = {m 1, m 4 }, B 1 = {m 2, m 3 } we get R 1 = Xm1m 2 2 m4 1 (X 2 m 1 m 3 ) (m1 1 m 1 4 ) = X 3 m1m 2 2 m 3 m4 2 Etc. 13 / 19

35 Random evolution of the mask After i loop iterations we have and each γ (i) j γ (i+1) j = γ (i) j R (i) i 1 1 = X evolves randomly as + δ (i) j γ (i) j with δ (i) j 2t j=0 e j 2 j j=0 m γ(i) j j { 1, 0, 1} and mod N P(δ (i) j = 1) = 1/8, P(δ (i) j = 1) = 1/8, P(δ (i) j = 0) = 3/4. δ (1) j = 1 δ (2) j = 0 δ (3) j = 1 δ (4) j = 0 δ (5) j = i (loop iterations) 14 / 19

36 Removing the final mask Problem: at the end we have to remove the final mask 2t 2t X = X E m γ(l) j j mod N. j=1 mγ(l) j j=1 j from Strategy: we force γ (l) j to be equal 0 as follows During the first half of the iterations each γ (i) j evolves freely. During the second half we constrain each γ (i) j to decrease toward 0. γ (i) j l i (loop iterations) 15 / 19

37 Level of randomization The probabilities of the mask exponents satisfy P(γ (i) j = d) = d+ (i d)/2 ( i i k k=d k)( P(Γ (i) = Γ) t j=1 P(γ(i) j ) i 2k+d ( 1 2k d ( 3 k d) 8) 4 = γ j ) t j=1 P(γ(i) j = 0) 16 / 19

38 Level of randomization The probabilities of the mask exponents satisfy P(γ (i) j = d) = d+ (i d)/2 ( i i k k=d k)( P(Γ (i) = Γ) t j=1 P(γ(i) j ) i 2k+d ( 1 2k d ( 3 k d) 8) 4 = γ j ) t j=1 P(γ(i) j = 0) Comparison: for a 2048-bit RSA modulus and t = 32: CHES 04: Montgomery-ladder, 4MM RNS per randomization, all masks are controled. Proposed: right-left square-and-multiply-always, 2MM RNS per randomization the masks for R 0 and R 1 are not controled. Approach loop 1 loop 5 loop 10 loop 50 loop 100 CHES Proposed / 19

39 Outline 1 Cryptography RSA cryptosystem Power analysis Montgomery multiplication in RNS 2 Randomized modular exponentiation in RNS Randomized Montgomery multiplication Proposed approach Level of randomization 3 Conclusion 17 / 19

40 Conclusion Secure embedded implementation of RSA: Randomized modular exponentiation But leak resistant arithmetic (CHES 04) is costly: 4 MM RNS per randomization 18 / 19

41 Conclusion Secure embedded implementation of RSA: Randomized modular exponentiation But leak resistant arithmetic (CHES 04) is costly: 4 MM RNS per randomization We proposed: To apply LRA to right-to-left exponentiation. Avoid some correction of Montgomery Factor. This decreases the computational cost: 2 MM RNS per randomization. Increases the level of randomization after a small number of loop. 18 / 19

42 Conclusion Secure embedded implementation of RSA: Randomized modular exponentiation But leak resistant arithmetic (CHES 04) is costly: 4 MM RNS per randomization We proposed: To apply LRA to right-to-left exponentiation. Avoid some correction of Montgomery Factor. This decreases the computational cost: 2 MM RNS per randomization. Increases the level of randomization after a small number of loop. Perspectives: A better estimation of the level of randomization. Is it a good counter-measure against horizontal power analysis? 18 / 19

43 Thank you for your attention! 19 / 19