Wagner s Attack on a Secure CRT-RSA Algorithm Reconsidered FDTC 2006
|
|
|
- Lindsey Walters
- 6 years ago
- Views:
Transcription
1 Wagner s Attack on a Secure CRT-RSA Algorithm Reconsidered FDTC 2006 Johannes Blömer Paderborn University Institute for Computer Science Paderborn, Germany Martin Otto Siemens AG Corporate Technology CT IC3 Munich, Germany
2 Content The "Secure CRT-RSA Algorithm" Wagner s Attack (random faults) Flaw Wagner s Attack (bit and byte version) Outlook: fixing the algorithm Conclusion Page 2 10 Oct 2006 Martin Otto Siemens AG, CT IC3
3 The BOS-Algorithm S p m d modϕ(p t1) mod p t 1 S q m d modϕ(q t2) mod q t 2 S CRT(S p, S q ) t 1 t 2 c 1 (m S e t 1 + 1) mod t 1 c 2 (m S e t 2 + 1) mod t 2 S ig S c 1 c 2 CRT-RSA, enhanced with two strong primes error detection step d e ti 1 modϕ(t i ) infective computation Presented at CCS 2003 by Blömer, Otto, Seifert Aims at protecting CRT-RSA against Bellcore-attacks Page 3 10 Oct 2006 Martin Otto Siemens AG, CT IC3
4 How The Protection Is Intended To Works S p m d modϕ(p t1) mod p t 1 S q m d modϕ(q t2) mod q t 2 S CRT(S p, S q ) t 1 t 2 c 1 (m S e t 1 + 1) mod t 1 c 2 (m S e t 2 + 1) mod t 2 S ig S c 1 c 2 CRT-RSA, enhanced with two strong primes error detection step d e ti 1 modϕ(t i ) infective computation If no error occurred: c 1 = (m m (d e t 1 ) )+1 1mod t 1 If an error occurs: c 2 = (m m)+1 1mod t 2 w.h.p. Final exponentiation: S ig=s c 1 c 2 Page 4 10 Oct 2006 Martin Otto Siemens AG, CT IC3
5 Wagner s Attack (random fault version) What is a random fault? x E x+e(x), where e(x) R [ x, 2 l(x) x 1] Special random fault as proposed by Wagner: Faults do not change the 160 most significant bits number 160 motivated by l(t 1 )=l(t 2 )=80 Attack aims on N in last line: S ig=s c 1c 2 Attack aims at disclosing t 1 and t 2 Fact: Knowledge of t 1 and t 2 breaks the BOS-scheme For details, see the original CCS 03 paper Page 5 10 Oct 2006 Martin Otto Siemens AG, CT IC3
6 Wagner s Attack: Exploiting a Faulty N (1) S p m d modϕ(p t1) mod p t 1 S q m d modϕ(q t2) mod q t 2 S CRT(S p, S q ) t 1 t 2 c 1 (m S e t 1 + 1) mod t 1 c 2 (m S e t 2 + 1) mod t 2 S ig S c 1 c 2 Attack targets N (c 1 c 2 = 1) 1. Gather a correct final result S ig=m d 2. Re-run on same input, attack N in last line S ig 3. Gather a faulty final result S ig=m d mod Ñ Page 6 10 Oct 2006 Martin Otto Siemens AG, CT IC3
7 Wagner s Attack: Exploiting a Faulty N (2) S p m d modϕ(p t1) mod p t 1 S q m d modϕ(q t2) mod q t 2 S CRT(S p, S q ) t 1 t 2 c 1 (m S e t 1 + 1) mod t 1 c 2 (m S e t 2 + 1) mod t 2 S ig S c 1 c 2 S= (S )+k N, with 0 k<2 161, if l(t 1 t 2 ) Attack targets N (c 1 c 2 = 1) 4. S ig S ig S S ig S (S k N) mod Ñ S ig S ig k (N Ñ) mod Ñ 5. Analysis shows: w.h.p. we have that S ig S ig = x k Page 7 10 Oct 2006 Martin Otto Siemens AG, CT IC3
8 Wagner s Attack: Exploiting a Faulty N (3) S p m d modϕ(p t1) mod p t 1 S q m d modϕ(q t2) mod q t 2 S CRT(S p, S q ) t 1 t 2 c 1 (m S e t 1 + 1) mod t 1 S= (S )+k N, with 0 k<2 161, if l(t 1 t 2 ) c 2 (m S e t 2 + 1) mod t 2 S ig S c 1 c 2 5. Analysis shows: w.h.p. we have that Attack targets N (c 1 c 2 = 1) S ig S ig = x k 6. Several attacks and gcd computations reveal k 7. Still, we wish to learn t 1 or t 2... Page 8 10 Oct 2006 Martin Otto Siemens AG, CT IC3
9 Wagner s Attack: The Flaw S p m d modϕ(p t1) mod p t 1 S q m d modϕ(q t2) mod q t 2 S CRT(S p, S q ) t 1 t 2 c 1 (m S e t 1 + 1) mod t 1 c 2 (m S e t 2 + 1) mod t 2 S ig S c 1 c 2 S= (S )+k N, with 0 k<2 161, if l(t 1 t 2 ) S ig=s Attack assumes that k=(s S ig)/n= t 1 t 2 However, k<t 1 t 2, and any value inz t1 t 2 is possible Attack does not reveal t 1 or t 2, it is invalid Page 9 10 Oct 2006 Martin Otto Siemens AG, CT IC3
10 Wagner s Attack (bit and byte fault version) Fault: m E m+e(m), bit fault: e(m)=±2 k (byte fault similar) Assume that m has been attacked in Line 1: S p m d modϕ(p t 1) mod p t 1 Checking step: c 1 = (m m)+1 1 e(m) mod t 1 Infective Step: S ig=s c 1 Fact: given c 1, we have p=gcd(m c 1 S ige, N) Fact: for many e(m), reduction mod t 1 does not happen Fact: all c 1 bit faults can be efficiently enumerated Fact: scheme can be broken easily Page Oct 2006 Martin Otto Siemens AG, CT IC3
11 Enhancement For Bit/Byte Faults S p m d modϕ(p t 1) mod p t 1 S q m d modϕ(q t 2) mod q t 2 S CRT(S p, S q ) t 1 t 2 c 1 (r 1 (m S e t 1 )+1) mod t 1 c 2 (r 2 (m S e t 2 )+1) mod t 2 S ig S γ error detection step introducing 2 γ=c 1 c 2 More general: useγ= f (c 1, c 2, r) with r random Similar to Ciet, Joye at FDTC 2005:γ= r c 1 +(2 l(t i ) r) c 2 2 l(t i ) Choose r as: r=dor r=s or r 1 = p, r 2 = q,...? Page Oct 2006 Martin Otto Siemens AG, CT IC3
12 Conclusion BOS-Algorithm facing random faults Attack as presented at CCS 04 contains flaw Scheme remains unbroken Open point: Can we define (and realize) special fault models to break this algorithm? BOS-Algorithm facing bit and byte faults Original proposal broken easily We propose several ways to correct weakness (without proof) Still consider such faults as hard to achieve on modern hardware Page Oct 2006 Martin Otto Siemens AG, CT IC3
Lost in Translation. Fault Analysis of Infective Security Proofs. Alberto Battistello and Christophe Giraud(y)
Lost in Translation of Infective Security Proofs Alberto Battistello and Christophe Giraud(y) Oberthur Technologies Security Group {a.battistello,c.giraud}@oberthur.com September 11, 2015 Overview Overview
Practical Fault Countermeasures for Chinese Remaindering Based RSA
Practical Fault Countermeasures for Chinese Remaindering Based RSA (Extended Abstract) Mathieu Ciet 1 and Marc Joye 2, 1 Gemplus R&D, Advanced Research and Security Centre La Vigie, ZI Athélia IV, Av.
Protecting RSA Against Fault Attacks: The Embedding Method
Published in L. Breveglieri et al., Eds, Fault Diagnosis and Tolerance in Cryptography (FDTC 2009), IEEE Computer Society, pp. 41 45, 2009. Protecting RSA Against Fault Attacks: The Embedding Method Marc
On some physical attacks of RSA
attacks December 9, 2014 Plan attacks 1 Bugs? attacks N. Wirth has written a lot of books, one is: Programs = Algorithms + Data But a computation has to be done in the real world so, reality is: Programs
Secret Key Leakage from Public Key Perturbation of DLP-based Cryptosystems
Secret Key Leakage from Public Key Perturbation of DLP-based Cryptosystems Alexandre Berzati 1,2, Cécile Canovas-Dumas 1, Louis Goubin 2 1 CEA-LETI/MINATEC, 17 rue des Martyrs, 38054 Grenoble Cedex 9,
RSA with CRT: A New Cost-Effective Solution to Thwart Fault Attacks
RSA with CRT: A New Cost-Effective Solution to Thwart Fault Attacks David Vigilant Cryptography Engineering, Gemalto Security Labs david.vigilant@gemalto.com Abstract. Fault attacks as introduced by Bellcore
Elliptic Curve Cryptosystems in the Presence of Faults
Elliptic Curve Cryptosystems in the Presence of Faults Marc Joye Thomson Security Labs marc.joye@thomson.net Outline Elliptic Curve Cryptography Inducing Faults Fault Attacks Countermeasures Concluding
Efficient RSA Cryptosystem with Key Generation using Matrix
E f f i c i e n t R S A C r y p t o s y s t e m w i t h K e y G e n e r a t i o n u s i n g M a t r i x Efficient RSA Cryptosystem with Key Generation using Matrix Prerna Verma 1, Dindayal Mahto 2, Sudhanshu
Partial Key Exposure: Generalized Framework to Attack RSA
Partial Key Exposure: Generalized Framework to Attack RSA Cryptology Research Group Indian Statistical Institute, Kolkata 12 December 2011 Outline of the Talk 1 RSA - A brief overview 2 Partial Key Exposure
A New Attack on RSA with Two or Three Decryption Exponents
A New Attack on RSA with Two or Three Decryption Exponents Abderrahmane Nitaj Laboratoire de Mathématiques Nicolas Oresme Université de Caen, France nitaj@math.unicaen.fr http://www.math.unicaen.fr/~nitaj
Differential Fault Analysis on DES Middle Rounds
Differential Fault Analysis on DES Middle Rounds Matthieu Rivain Speaker: Christophe Giraud Oberthur Technologies Agenda 1 Introduction Data Encryption Standard DFA on DES Last & Middle Rounds 2 Our Attack
Singular curve point decompression attack
Singular curve point decompression attack Peter Günther joint work with Johannes Blömer University of Paderborn FDTC 2015, September 13th, Saint Malo Peter Günther (UPB) Decompression Attack FDTC 2015
Fault Attacks on RSA Public Keys: Left-To-Right Implementations are also Vulnerable
Fault Attacks on RSA Public Keys: Left-To-Right Implementations are also Vulnerable Alexandre Berzati, Cécile Canovas, Jean-Guillaume Dumas, Louis Goubin To cite this version: Alexandre Berzati, Cécile
Blinded Fault Resistant Exponentiation FDTC 06
Previous Work Our Algorithm Guillaume Fumaroli 1 David Vigilant 2 1 Thales Communications guillaume.fumaroli@fr.thalesgroup.com 2 Gemalto david.vigilant@gemalto.com FDTC 06 Outline Previous Work Our Algorithm
Error-free protection of EC point multiplication by modular extension
Error-free protection of EC point multiplication by modular extension Martin Seysen February 21, 2017 Giesecke & Devrient GmbH, Prinzregentenstraße 159, D-81677 München, e-mail: m.seysen@gmx.de Abstract
RSA Key Extraction via Low- Bandwidth Acoustic Cryptanalysis. Daniel Genkin, Adi Shamir, Eran Tromer
RSA Key Extraction via Low- Bandwidth Acoustic Cryptanalysis Daniel Genkin, Adi Shamir, Eran Tromer Mathematical Attacks Input Crypto Algorithm Key Output Goal: recover the key given access to the inputs
arxiv: v3 [cs.cr] 31 Jan 2011
![arxiv: v3 [cs.cr] 31 Jan 2011](/thumbs/78/77428866.jpg "arxiv: v3 [cs.cr] 31 Jan 2011")
arxiv:0901.0911v3 [cs.cr] 31 Jan 2011 Fault Attacks on RSA Public Keys: Left-To-Right Implementations are also Vulnerable Alexandre Berzati Cécile Canovas, Jean-Guillaume Dumas Louis Goubin February 1,
Public Key Perturbation of Randomized RSA Implementations
Public Key Perturbation of Randomized RSA Implementations A. Berzati, C. Dumas & L. Goubin CEA-LETI Minatec & Versailles St Quentin University Outline 1 Introduction 2 Public Key Perturbation Against R2L
On Double Exponentiation for Securing RSA against Fault Analysis
On Double Exponentiation for Securing RSA against Fault Analysis Duc-Phong Le 1, Matthieu Rivain 2, and Chik How Tan 1 1 Temasek Laboratories, National University of Singapore {tslld,tsltch}@nus.edu.sg
Dynamic Runtime Methods to Enhance Private Key Blinding
Dynamic Runtime Methods to Enhance Private Key Blinding Karine Gandolfi-Villegas and Nabil Hamzi Gemalto Security Labs {nabil.hamzi,karine.villegas}@gemalto.com Abstract. In this paper we propose new methods
Implementation Tutorial on RSA
Implementation Tutorial on Maciek Adamczyk; m adamczyk@umail.ucsb.edu Marianne Magnussen; mariannemagnussen@umail.ucsb.edu Adamczyk and Magnussen Spring 2018 1 / 13 Overview Implementation Tutorial Introduction
Mathematics of Cryptography
Modulo arithmetic Fermat's Little Theorem If p is prime and 0 < a < p, then a p 1 = 1 mod p Ex: 3 (5 1) = 81 = 1 mod 5 36 (29 1) = 37711171281396032013366321198900157303750656 = 1 mod 29 (see http://gauss.ececs.uc.edu/courses/c472/java/fermat/fermat.html)
Lemma 1.2. (1) If p is prime, then ϕ(p) = p 1. (2) If p q are two primes, then ϕ(pq) = (p 1)(q 1).
1 Background 1.1 The group of units MAT 3343, APPLIED ALGEBRA, FALL 2003 Handout 3: The RSA Cryptosystem Peter Selinger Let (R, +, ) be a ring. Then R forms an abelian group under addition. R does not
Polynomial Selection. Thorsten Kleinjung École Polytechnique Fédérale de Lausanne
Polynomial Selection Thorsten Kleinjung École Polytechnique Fédérale de Lausanne Contents Brief summary of polynomial selection (no root sieve) Motivation (lattice sieving, monic algebraic polynomial)
Lattice-Based Fault Attacks on RSA Signatures
Lattice-Based Fault Attacks on RSA Signatures Mehdi Tibouchi École normale supérieure Workshop on Applied Cryptography, Singapore, 2010-12-03 Gist of this talk Review a classical attack on RSA signatures
Alternative Approaches: Bounded Storage Model
Alternative Approaches: Bounded Storage Model A. Würfl 17th April 2005 1 Motivation Description of the Randomized Cipher 2 Motivation Motivation Description of the Randomized Cipher Common practice in
Introduction to Cryptology. Lecture 20
Introduction to Cryptology Lecture 20 Announcements HW9 due today HW10 posted, due on Thursday 4/30 HW7, HW8 grades are now up on Canvas. Agenda More Number Theory! Our focus today will be on computational
Sign Change Fault Attacks On Elliptic Curve Cryptosystems (extended version)
Sign Change Fault Attacks On Elliptic Curve Cryptosystems (extended version) Johannes Blömer 1, Martin Otto 1,3, Jean-Pierre Seifert 2 1 : Paderborn University 2 : Intel Corporation Institute for Computer
Lecture 14 More on Digital Signatures and Variants. COSC-260 Codes and Ciphers Adam O Neill Adapted from
Lecture 14 More on Digital Signatures and Variants COSC-260 Codes and Ciphers Adam O Neill Adapted from http://cseweb.ucsd.edu/~mihir/cse107/ Setting the Stage We will cover in more depth some issues for
Elliptic Curve Cryptography and Security of Embedded Devices
Elliptic Curve Cryptography and Security of Embedded Devices Ph.D. Defense Vincent Verneuil Institut de Mathématiques de Bordeaux Inside Secure June 13th, 2012 V. Verneuil - Elliptic Curve Cryptography
Cryptography. pieces from work by Gordon Royle
Cryptography pieces from work by Gordon Royle The set-up Cryptography is the mathematics of devising secure communication systems, whereas cryptanalysis is the mathematics of breaking such systems. We
Algorithmic Number Theory and Public-key Cryptography
Algorithmic Number Theory and Public-key Cryptography Course 3 University of Luxembourg March 22, 2018 The RSA algorithm The RSA algorithm is the most widely-used public-key encryption algorithm Invented
Number theory (Chapter 4)
EECS 203 Spring 2016 Lecture 12 Page 1 of 8 Number theory (Chapter 4) Review Compute 6 11 mod 13 in an efficient way What is the prime factorization of 100? 138? What is gcd(100, 138)? What is lcm(100,138)?
Introduction to Side Channel Analysis. Elisabeth Oswald University of Bristol
Introduction to Side Channel Analysis Elisabeth Oswald University of Bristol Outline Part 1: SCA overview & leakage Part 2: SCA attacks & exploiting leakage and very briefly Part 3: Countermeasures Part
ELECTROMAGNETIC FAULT INJECTION: TOWARDS A FAULT MODEL ON A 32-BIT MICROCONTROLLER
ELECTROMAGNETIC FAULT INJECTION: TOWARDS A FAULT MODEL ON A 32-BIT MICROCONTROLLER Nicolas Moro 1,3, Amine Dehbaoui 2, Karine Heydemann 3, Bruno Robisson 1, Emmanuelle Encrenaz 3 1 CEA Commissariat à l
Secret sharing schemes
Secret sharing schemes Martin Stanek Department of Computer Science Comenius University stanek@dcs.fmph.uniba.sk Cryptology 1 (2017/18) Content Introduction Shamir s secret sharing scheme perfect secret
Fault Attacks and Countermeasures
Dissertation Fault Attacks and Countermeasures Martin Otto martin@martin-otto.de Fakultät für Elektrotechnik, Informatik und Mathematik Institut für Informatik Universität Paderborn Betreuer: Prof. Dr.
Why One Should Also Secure RSA Public Key Elements
Why One Should Also Secure RSA Public Key Elements [Published in L. Goubin and M. Matsui, Eds., Cryptographic Hardware and Embedded Systems CHES 2006, vol. 4249 of Lecture Notes in Computer Science, pp.
Introduction to Modern Cryptography. Benny Chor
Introduction to Modern Cryptography Benny Chor RSA Public Key Encryption Factoring Algorithms Lecture 7 Tel-Aviv University Revised March 1st, 2008 Reminder: The Prime Number Theorem Let π(x) denote the
Formal Fault Analysis of Branch Predictors: Attacking countermeasures of Asymmetric key ciphers
Formal Fault Analysis of Branch Predictors: Attacking countermeasures of Asymmetric key ciphers Sarani Bhattacharya and Debdeep Mukhopadhyay Indian Institute of Technology Kharagpur PROOFS 2016 August
Introduction to Cryptography. Susan Hohenberger
Introduction to Cryptography Susan Hohenberger 1 Cryptography -- from art to science -- more than just encryption -- essential today for non-military applications 2 Symmetric Crypto Shared secret K =>
CPE 776:DATA SECURITY & CRYPTOGRAPHY. Some Number Theory and Classical Crypto Systems
CPE 776:DATA SECURITY & CRYPTOGRAPHY Some Number Theory and Classical Crypto Systems Dr. Lo ai Tawalbeh Computer Engineering Department Jordan University of Science and Technology Jordan Some Number Theory
The security of RSA (part 1) The security of RSA (part 1)
The modulus n and its totient value φ(n) are known φ(n) = p q (p + q) + 1 = n (p + q) + 1 The modulus n and its totient value φ(n) are known φ(n) = p q (p + q) + 1 = n (p + q) + 1 i.e. q = (n φ(n) + 1)
Advanced Topics in Cryptography
Advanced Topics in Cryptography Lecture 6: El Gamal. Chosen-ciphertext security, the Cramer-Shoup cryptosystem. Benny Pinkas based on slides of Moni Naor page 1 1 Related papers Lecture notes of Moni Naor,
Shor s Prime Factorization Algorithm
Shor s Prime Factorization Algorithm Bay Area Quantum Computing Meetup - 08/17/2017 Harley Patton Outline Why is factorization important? Shor s Algorithm Reduction to Order Finding Order Finding Algorithm
Security Level of Cryptography Integer Factoring Problem (Factoring N = p 2 q) December Summary 2
Security Level of Cryptography Integer Factoring Problem (Factoring N = p 2 ) December 2001 Contents Summary 2 Detailed Evaluation 3 1 The Elliptic Curve Method 3 1.1 The ECM applied to N = p d............................
1 What are Physical Attacks. 2 Physical Attacks on RSA. Today:
Today: Introduction to the class. Examples of concrete physical attacks on RSA A computational approach to cryptography Pseudorandomness 1 What are Physical Attacks Tampering/Leakage attacks Issue of how
Differential Fault Analysis of AES using a Single Multiple-Byte Fault
Differential Fault Analysis of AES using a Single Multiple-Byte Fault Subidh Ali 1, Debdeep Mukhopadhyay 1, and Michael Tunstall 2 1 Department of Computer Sc. and Engg, IIT Kharagpur, West Bengal, India.
Side Channel Attack to Actual Cryptanalysis: Breaking CRT-RSA with Low Weight Decryption Exponents
Side Channel Attack to Actual Cryptanalysis: Breaking CRT-RSA with Low Weight Decryption Exponents Santanu Sarkar and Subhamoy Maitra Leuven, Belgium 12 September, 2012 Outline of the Talk RSA Cryptosystem
RSA. Ramki Thurimella
RSA Ramki Thurimella Public-Key Cryptography Symmetric cryptography: same key is used for encryption and decryption. Asymmetric cryptography: different keys used for encryption and decryption. Public-Key
THE RSA ENCRYPTION SCHEME
THE RSA ENCRYPTION SCHEME Contents 1. The RSA Encryption Scheme 2 1.1. Advantages over traditional coding methods 3 1.2. Proof of the decoding procedure 4 1.3. Security of the RSA Scheme 4 1.4. Finding
Public-Key Cryptosystems CHAPTER 4
Public-Key Cryptosystems CHAPTER 4 Introduction How to distribute the cryptographic keys? Naïve Solution Naïve Solution Give every user P i a separate random key K ij to communicate with every P j. Disadvantage:
Fast Cryptanalysis of the Matsumoto-Imai Public Key Scheme
Fast Cryptanalysis of the Matsumoto-Imai Public Key Scheme P. Delsarte Philips Research Laboratory, Avenue Van Becelaere, 2 B-1170 Brussels, Belgium Y. Desmedt Katholieke Universiteit Leuven, Laboratorium
On the strength comparison of ECC and RSA
SHARCS 2012 (Special-Purpose Hardware for Attacking Cryptographic Systems) Date: 17-18 March 2012 Place: Washington, DC, USA On the strength comparison of ECC and RSA Masaya Yasuda, Takeshi Shimoyama,
Number Theory. CSS322: Security and Cryptography. Sirindhorn International Institute of Technology Thammasat University CSS322. Number Theory.
CSS322: Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 29 December 2011 CSS322Y11S2L06, Steve/Courses/2011/S2/CSS322/Lectures/number.tex,
Attacking RSA CRT Signatures with Faults on Montgomery Multiplication
Attacking RSA CRT Signatures with Faults on Montgomery Multiplication Pierre-Alain Fouque, Nicolas Guillermin, Delphine Leresteux, Mehdi Tibouchi, Jean-Christophe Zapalowicz To cite this version: Pierre-Alain
Cryptography. Course 1: Remainder: RSA. Jean-Sébastien Coron. September 21, Université du Luxembourg
Course 1: Remainder: RSA Université du Luxembourg September 21, 2010 Public-key encryption Public-key encryption: two keys. One key is made public and used to encrypt. The other key is kept private and
Homework 4 for Modular Arithmetic: The RSA Cipher
Homework 4 for Modular Arithmetic: The RSA Cipher Gregory V. Bard April 25, 2018 This is a practice workbook for the RSA cipher. It is not suitable for learning the RSA cipher from scratch. However, there
RSA RSA public key cryptosystem
RSA 1 RSA As we have seen, the security of most cipher systems rests on the users keeping secret a special key, for anyone possessing the key can encrypt and/or decrypt the messages sent between them.
Cosc 412: Cryptography and complexity Lecture 7 (22/8/2018) Knapsacks and attacks
1 Cosc 412: Cryptography and complexity Lecture 7 (22/8/2018) Knapsacks and attacks Michael Albert michael.albert@cs.otago.ac.nz 2 This week Arithmetic Knapsack cryptosystems Attacks on knapsacks Some
International Journal of Advanced Research in Computer Science and Software Engineering
Volume 2, Issue 8, August 2012 ISSN: 2277 128X International Journal of Advanced Research in Computer Science and Software Engineering Research Paper Available online at: www.ijarcsse.com An Efficient
Attacks on RSA & Using Asymmetric Crypto
Attacks on RSA & Using Asymmetric Crypto Luke Anderson luke@lukeanderson.com.au 7 th April 2017 University Of Sydney Overview 1. Crypto-Bulletin 2. Breaking RSA 2.1 Chinese Remainder Theorem 2.2 Common
Seifert s RSA Fault Attack: Simplified Analysis and Generalizations
Seifert s RSA Fault Attack: Simplified Analysis and Generalizations James A. Muir School of Computer Science Carleton University jamuir@scs.carleton.ca 15 December 2005 21:11:36 EST Abstract Seifert recently
Correcting Errors in Private Keys Obtained from Cold Boot Attacks
Correcting Errors in Private Keys Obtained from Cold Boot Attacks Hyung Tae Lee, HongTae Kim, Yoo-Jin Baek, and Jung Hee Cheon ISaC & Department of Mathmathical Sciences, SNU 2011. 11. 30. 1 / 17 Contents
Improving the efficiency of Generalized Birthday Attacks against certain structured cryptosystems
Improving the efficiency of Generalized Birthday Attacks against certain structured cryptosystems Robert Niebuhr 1, Pierre-Louis Cayrel 2, and Johannes Buchmann 1,2 1 Technische Universität Darmstadt Fachbereich
Efficient and Secure Algorithms for GLV-Based Scalar Multiplication and Their Implementation on GLV-GLS Curves
Efficient and Secure Algorithms for GLV-Based Scalar Multiplication and Their Implementation on GLV-GLS Curves SESSION ID: CRYP-T07 Patrick Longa Microsoft Research http://research.microsoft.com/en-us/people/plonga/
Multilinear Maps over the Integers From Design to Security. The Mathematics of Modern Cryptography Workshop, July 10th 2015
Multilinear Maps over the Integers From Design to Security Tancrède Lepoint CryptoExperts The Mathematics of Modern Cryptography Workshop, July 10th 2015 2 / 30 Timeline: The Hype Cycle of Multilinear
CSc 466/566. Computer Security. 5 : Cryptography Basics
1/84 CSc 466/566 Computer Security 5 : Cryptography Basics Version: 2012/03/03 10:44:26 Department of Computer Science University of Arizona collberg@gmail.com Copyright c 2012 Christian Collberg Christian
Remote Timing Attacks are Practical
Remote Timing Attacks are Practical by David Brumley and Dan Boneh Presented by Seny Kamara in Advanced Topics in Network Security (600/650.624) Outline Traditional threat model in cryptography Side-channel
Solution to Midterm Examination
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467a: Cryptography and Computer Security Handout #13 Xueyuan Su November 4, 2008 Instructions: Solution to Midterm Examination This is a closed book
IIT KHARAGPUR FDTC September 23, South Korea, Busan. FDTC 2014 (South Korea, Busan) IIT KHARAGPUR September 23, / 67
IIT KHARAGPUR Differential Fault Analysis on the Families of SIMON and SPECK Ciphers Authors: Harshal Tupsamudre, Shikha Bisht, Debdeep Mukhopadhyay (IIT KHARAGPUR) FDTC 2014 South Korea, Busan September
Cryptography and Number Theory
Chapter 2 Cryptography and Number Theory 2.1 Cryptography and Modular Arithmetic 2.1.1 Introduction to Cryptography For thousands of years people have searched for ways to send messages in secret. For
Differential Fault Analysis on the families of SIMON and SPECK ciphers
Differential Fault Analysis on the families of SIMON and SPECK ciphers Harshal Tupsamudre, Shikha Bisht, Debdeep Mukhopadhyay Indian Institute of Technology, Kharagpur Abstract. In 2013, the US National
DM49-2. Obligatoriske Opgave
DM49-2. Obligatoriske Opgave Jacob Christiansen, moffe42, 130282 Thomas Nordahl Pedersen, nordahl, 270282 1/4-05 Indhold 1 Opgave 1 - Public Exponent 2 1.1 a.................................. 2 1.2 b..................................
Computing the RSA Secret Key is Deterministic Polynomial Time Equivalent to Factoring
Computing the RSA Secret Key is Deterministic Polynomial Time Equivalent to Factoring Alexander May Faculty of Computer Science, Electrical Engineering and Mathematics University of Paderborn 33102 Paderborn,
Sliding right into disaster - Left-to-right sliding windows leak
Sliding right into disaster - Left-to-right sliding windows leak Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal and
A DPA Attack against the Modular Reduction within a CRT Implementation of RSA
A DPA Attack against the Modular Reduction within a CRT Implementation of RSA Bert den Boer, Kerstin Lemke, and Guntram Wicke T-Systems ISS GmbH Rabinstr. 8, D-53111 Bonn, Germany BdenBoer@tpd.tno.nl,
1 Recommended Reading 1. 2 Public Key/Private Key Cryptography Overview RSA Algorithm... 2
Contents 1 Recommended Reading 1 2 Public Key/Private Key Cryptography 1 2.1 Overview............................................. 1 2.2 RSA Algorithm.......................................... 2 3 A Number
Theme : Cryptography. Instructor : Prof. C Pandu Rangan. Speaker : Arun Moorthy CS
1 C Theme : Cryptography Instructor : Prof. C Pandu Rangan Speaker : Arun Moorthy 93115 CS 2 RSA Cryptosystem Outline of the Talk! Introduction to RSA! Working of the RSA system and associated terminology!
KTH, NADA , and D1449 Kryptografins grunder. Lecture 6: RSA. Johan Håstad, transcribed by Martin Lindkvist
Lecture 6: RSA Johan Håstad, transcribed by Martin Lindkvist 2006-01-31, 2006-02-02 and 2006-02-07 1 Introduction Using an ordinary cryptosystem, encryption uses a key K and decryption is performed by
L7. Diffie-Hellman (Key Exchange) Protocol. Rocky K. C. Chang, 5 March 2015
L7. Diffie-Hellman (Key Exchange) Protocol Rocky K. C. Chang, 5 March 2015 1 Outline The basic foundation: multiplicative group modulo prime The basic Diffie-Hellman (DH) protocol The discrete logarithm
A DPA attack on RSA in CRT mode
A DPA attack on RSA in CRT mode Marc Witteman Riscure, The Netherlands 1 Introduction RSA is the dominant public key cryptographic algorithm, and used in an increasing number of smart card applications.
COMS W4995 Introduction to Cryptography October 12, Lecture 12: RSA, and a summary of One Way Function Candidates.
COMS W4995 Introduction to Cryptography October 12, 2005 Lecture 12: RSA, and a summary of One Way Function Candidates. Lecturer: Tal Malkin Scribes: Justin Cranshaw and Mike Verbalis 1 Introduction In
Security II: Cryptography exercises
Security II: Cryptography exercises Markus Kuhn Lent 2015 Part II Some of the exercises require the implementation of short programs. The model answers use Perl (see Part IB Unix Tools course), but you
Cryptanalysis of Unbalanced RSA with Small CRT-Exponent
Cryptanalysis of Unbalanced RSA with Small CRT-Exponent Alexander May Department of Mathematics and Computer Science University of Paderborn 3310 Paderborn, Germany alexx@uni-paderborn.de Abstract. We
Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography
Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography Peter Schwabe October 21 and 28, 2011 So far we assumed that Alice and Bob both have some key, which nobody else has. How
Notes. Number Theory: Applications. Notes. Number Theory: Applications. Notes. Hash Functions I
Number Theory: Applications Slides by Christopher M. Bourke Instructor: Berthe Y. Choueiry Fall 2007 Computer Science & Engineering 235 Introduction to Discrete Mathematics Sections 3.4 3.7 of Rosen cse235@cse.unl.edu
Shift Cipher. For 0 i 25, the ith plaintext character is. E.g. k = 3
Shift Cipher For 0 i 25, the ith plaintext character is shifted by some value 0 k 25 (mod 26). E.g. k = 3 a b c d e f g h i j k l m n o p q r s t u v w x y z D E F G H I J K L M N O P Q R S T U V W X Y
Fast Lattice-Based Encryption: Stretching SPRING
Fast Lattice-Based Encryption: Stretching SPRING Charles Bouillaguet 1 Claire Delaplace 1,2 Pierre-Alain Fouque 2 Paul Kirchner 3 1 CFHP team, CRIStAL, Université de Lille, France 2 EMSEC team, IRISA,
CS March 17, 2009
Discrete Mathematics CS 2610 March 17, 2009 Number Theory Elementary number theory, concerned with numbers, usually integers and their properties or rational numbers mainly divisibility among integers
DIFFERENTIAL FAULT ANALYSIS ATTACK RESISTANT ARCHITECTURES FOR THE ADVANCED ENCRYPTION STANDARD *
DIFFERENTIAL FAULT ANALYSIS ATTACK RESISTANT ARCHITECTURES FOR THE ADVANCED ENCRYPTION STANDARD * Mark Karpovsky, Konrad J. Kulikowski, Alexander Taubin Reliable Computing Laboratory,Department of Electrical
A CRYPTANALYTIC ATTACK-ON THE LU-LEE PUBLIC-KEY CRYPTOSYSTEM
Philips J. Res. 35, 301-306, 1980 R J022 A CRYPTANALYTIC ATTACK-ON THE LU-LEE PUBLIC-KEY CRYPTOSYSTEM by J.-M. GOETHALS and C. COUVREUR Abstract We present a method for finding the secret decryption key
Introduction to Cryptology. Lecture 2
Introduction to Cryptology Lecture 2 Announcements 2 nd vs. 1 st edition of textbook HW1 due Tuesday 2/9 Readings/quizzes (on Canvas) due Friday 2/12 Agenda Last time Historical ciphers and their cryptanalysis
Lecture 1: Introduction to Public key cryptography
Lecture 1: Introduction to Public key cryptography Thomas Johansson T. Johansson (Lund University) 1 / 44 Key distribution Symmetric key cryptography: Alice and Bob share a common secret key. Some means
8 Elliptic Curve Cryptography
8 Elliptic Curve Cryptography 8.1 Elliptic Curves over a Finite Field For the purposes of cryptography, we want to consider an elliptic curve defined over a finite field F p = Z/pZ for p a prime. Given
Impact of Extending Side Channel Attack on Cipher Variants: A Case Study with the HC Series of Stream Ciphers
Impact of Extending Side Channel Attack on Cipher Variants: A Case Study with the HC Series of Stream Ciphers Goutam Paul and Shashwat Raizada Jadavpur University, Kolkata and Indian Statistical Institute,
Iterated Encryption and Wiener s attack on RSA
Iterated Encryption Euler s function Euler s function: φ(n) = {1 x n : gcd(x, n) = 1} Theorem (Euler) If n is a positive integer and m is a positive integer coprime to n then m φ(n) mod n = 1. Iterated
New attacks on RSA with Moduli N = p r q
New attacks on RSA with Moduli N = p r q Abderrahmane Nitaj 1 and Tajjeeddine Rachidi 2 1 Laboratoire de Mathématiques Nicolas Oresme Université de Caen Basse Normandie, France abderrahmane.nitaj@unicaen.fr
Lecture 6: Cryptanalysis of public-key algorithms.,
T-79.159 Cryptography and Data Security Lecture 6: Cryptanalysis of public-key algorithms. Helsinki University of Technology mjos@tcs.hut.fi 1 Outline Computational complexity Reminder about basic number
A new attack on RSA with a composed decryption exponent
A new attack on RSA with a composed decryption exponent Abderrahmane Nitaj and Mohamed Ould Douh,2 Laboratoire de Mathématiques Nicolas Oresme Université de Caen, Basse Normandie, France abderrahmane.nitaj@unicaen.fr