Attacking Noisy Secret CRT-RSA Exponents in Binary Method

Abstract

In this paper, we perform a security evaluation on the RSA encryption scheme with the Chinese remainder theorem (CRT-RSA), against side-channel attacks. We discuss the methods for recovering the CRT-RSA secret keys by observing physical information. In the CRT-RSA scheme, we calculate the exponentiations by repeated squaring and multiplication operations during decryption. The square-and-multiply sequences of the exponentiation can be obtained by side-channel attacks. However, errors occur in the square and multiply sequences because of physical-information observation errors, due to which the secret keys cannot be recovered by using Bernstein et al.’s method, even if window size \(w=1\) in sliding window exponentiation. In this paper, we propose an algorithm for correcting the errors in the square-and-multiply sequences, and for obtaining the correct secret keys, when the square-and-multiply sequences are generated at \(w=1\), namely, the binary method. Moreover, we theoretically prove that the expected time complexity of our algorithm is in polynomial time, when the error rate is less than 5.8%.