Pablo Rauzy
ABSTRACT
In our paper at PROOFS 2013, we formally studied a few known countermeasures to protect CRT-RSA against the BellCoRe fault injection attack. However, we left Vigilant's countermeasure and its alleged repaired version by Coron et al. as future work, because the arithmetical framework of our tool was not sufficiently powerful. In this paper we bridge this gap and then use the same methodology to formally study both versions of the countermeasure. We obtain surprising results, which we believe demonstrate the importance of formal analysis in the field of implementation security. Indeed, the original version of Vigilant's countermeasure is actually broken, but not as much as Coron et al. thought it was. As a consequence, the repaired version they proposed can be simplified. It can actually be simplified even further as two of the nine modular verifications happen to be unnecessary. Fortunately, we could formally prove the simplified repaired version to be resistant to the BellCoRe attack, which was considered a ``challenging issue" by the authors of the countermeasure themselves.
- {ABF+02} Christian Aumüller, Peter Bier, Wieland Fischer, Peter Hofreiter, and Jean-Pierre Seifert. Fault Attacks on RSA with CRT: Concrete Results and Practical Countermeasures. In Burton S. Kaliski, Jr., Çetin Kaya Koç, and Christof Paar, editors, CHES, volume 2523 of Lecture Notes in Computer Science, pages 260--275. Springer, 2002. Google Scholar
Digital Library
- {BDL97} Dan Boneh, Richard A. DeMillo, and Richard J. Lipton. On the Importance of Checking Cryptographic Protocols for Faults. In Proceedings of Eurocrypt'97, volume 1233 of LNCS, pages 37--51. Springer, May 11-15 1997. Konstanz, Germany. DOI: 10.1007/3-540-69053-0_4. Google Scholar
- {BGZB09} Gilles Barthe, Benjamin Grégoire, and Santiago Zanella-Béguelin. Formal certification of code-based cryptographic proofs. In 36th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2009, pages 90--101. ACM, 2009. Google ScholarDigital Library
- {CCGV13} Maria Christofi, Boutheina Chetali, Louis Goubin, and David Vigilant. Formal verification of an implementation of CRT-RSA Vigilant's algorithm. Journal of Cryptographic Engineering, 3(3), 2013. DOI: 10.1007/s13389-013-0049-3.Google ScholarCross Ref
- {CGM+10} Jean-Sébastien Coron, Christophe Giraud, Nicolas Morin, Gilles Piret, and David Vigilant. Fault Attacks and Countermeasures on Vigilant's RSA-CRT Algorithm. In Luca Breveglieri, Marc Joye, Israel Koren, David Naccache, and Ingrid Verbauwhede, editors, FDTC, pages 89--96. IEEE Computer Society, 2010. Google ScholarDigital Library
- {HMER13} Karine Heydemann, Nicolas Moro, Emmanuelle Encrenaz, and Bruno Robisson. Formal Verification of a Software Countermeasure Against Instruction Skip Attacks. Cryptology ePrint Archive, Report 2013/679, 2013. http://eprint.iacr.org/.Google Scholar
- {JT11} Marc Joye and Michael Tunstall. Fault Analysis in Cryptography. Springer LNCS, March 2011. http://joye.site88.net/FAbook.html. DOI: 10.1007/978-3-642-29656-7; ISBN 978-3-642-29655-0.Google Scholar
- {KJJ96} Paul C. Kocher, Joshua Jaffe, and Benjamin Jun. Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems. In Proceedings of CRYPTO'96, volume 1109 of LNCS, pages 104--113. Springer-Verlag, 1996. Google ScholarDigital Library
- {Koç94} Çetin Kaya Koç. High-Speed RSA Implementation, November 1994. Version 2, ftp://ftp.rsasecurity.com/pub/pdfs/tr201.pdf.Google Scholar
- {Pai99} Pascal Paillier. Public-Key Cryptosystems Based on Composite Degree Residuosity Classes. In EUROCRYPT, volume 1592 of Lecture Notes in Computer Science, pages 223--238. Springer, May 2-6 1999. Prague, Czech Republic. Google ScholarDigital Library
- {RG13} Pablo Rauzy and Sylvain Guilley. A Formal Proof of Countermeasures Against Fault Injection Attacks on CRT-RSA. Cryptology ePrint Archive, Report 2013/506, 2013. http://eprint.iacr.org/.Google Scholar
- {RSA78} Ronald L. Rivest, Adi Shamir, and Leonard M. Adleman. A Method for Obtaining Digital Signatures and Public-Key Cryptosystems. Commun. ACM, 21(2):120--126, 1978. Google ScholarDigital Library
- {Sha99} Adi Shamir. Method and apparatus for protecting public key schemes from timing and fault attacks, November 1999. Patent Number 5,991,415; also presented at the rump session of EUROCRYPT '97.Google Scholar
- {TW12} Mohammad Tehranipoor and Cliff Wang, editors. Introduction to Hardware Security and Trust. Springer, 2012. ISBN 978-1-4419-8079-3.Google ScholarCross Ref
- {Vig08} David Vigilant. RSA with CRT: A New Cost-Effective Solution to Thwart Fault Attacks. In Elisabeth Oswald and Pankaj Rohatgi, editors, CHES, volume 5154 of Lecture Notes in Computer Science, pages 130--145. Springer, 2008. Google ScholarDigital Library
- {Vig10} David Vigilant. Countermeasure securing exponentiation based cryptography, Feb 17 2010. European patent, EP 2154604 A1.Google Scholar
- {vWWM11} Jasper G. J. van Woudenberg, Marc F. Witteman, and Federico Menarini. Practical Optical Fault Injection on Secure Microcontrollers. In Luca Breveglieri, Sylvain Guilley, Israel Koren, David Naccache, and Junko Takahashi, editors, FDTC, pages 91--99. IEEE, 2011. Google ScholarDigital Library
Index Terms
- Formal Analysis of CRT-RSA Vigilant's Countermeasure Against the BellCoRe Attack: A Pledge for Formal Methods in the Field of Implementation Security
Recommendations
A new CRT-RSA algorithm secure against bellcore attacks
CCS '03: Proceedings of the 10th ACM conference on Computer and communications securityIn this paper we describe a new algorithm to prevent fault attacks on RSA signature algorithms using the Chinese Remainder Theorem (CRT-RSA). This variant of the RSA signature algorithm is widely used on smartcards. Smartcards on the other hand are ...
A CRT-based RSA countermeasure against physical cryptanalysis
HPCC'05: Proceedings of the First international conference on High Performance Computing and CommunicationsThis paper considers a secure and practical CRT-based RSA signature implementation against both side channel attacks (including power analysis attack, timing attack, and most specially the recent MRED attack) as well as the various CRT-based fault ...
Hardware fault attack on RSA with CRT revisited
ICISC'02: Proceedings of the 5th international conference on Information security and cryptologyIn this paper, some powerful fault attacks will be pointed out which can be used to factorize the RSA modulus if CRT is employed to speedup the RSA computation. These attacks are generic and can be applicable to Shamir's countermeasure and also ...
Comments