Exposure Attacks Research Articles

Small Public Exponent Brings More: Improved Partial Key Exposure Attacks against RSA

Let (N,e) be a public key of the RSA cryptosystem, and d be the corresponding private key. In practice, we usually choose a small e for quick encryption. In this paper, we improve partial private key exposure attacks against RSA with a small public exponent e. The key idea is that under such a setting we can usually obtain more information about the prime factor of N and then by solving a univariate modular polynomial with Coppersmith's method, N can be factored in polynomial time. Compared to previous results, we reduce the number of d's leaked bits needed to mount the attack by log_2 (e) bits. Furthermore, our experiments show that for 1024-bit N, our attack can achieve the theoretical bound on a personal computer, which verified our attack.

Partial Exposure Attacks on a New RSA Variant

In 2022, Cotan and Teşeleanu presented a variant of the RSA cryptosystem where the modulus is of the form N=pq, and the private and the public exponents satisfy ed≡1(modψn(N)) with n≥2, and ψn(N)=pn−1qn−1(p−1)(q−1). This variant of RSA was recently cryptanalyzed by Nitaj, Adenan, and Ariffin at Africacrypt 2024. In this paper, we push further the cryptanalysis of the scheme of Cotan and Teşeleanu by presenting a method to solve the equation xH(y)+c≡0(mode) where c is a constant that is independent of x and y. This enables us to propose more attacks on the scheme, including a partial key exposure attack, an attack when the most significant bits of one of the prime factors are known, and an attack when the least significant bits of one of the prime factors are known.

New partial key exposure attacks on RSA with additive exponent blinding

Partial key exposure attacks present a significant threat to RSA-type cryptosystems. These attacks factorize the RSA modulus by utilizing partial knowledge of the decryption exponent, which is typically revealed by side-channel attacks, cold boot attacks, etc. In practice, the RSA implementations typically employ countermeasures to resist physical attacks, such as additive exponent blinding d′=d+rφ(N)\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$d' = d + r \\varphi (N)$$\\end{document} with unknown random blinding factor r. Although there are a couple of partial key exposure attacks on blinding RSA, these attacks require a considerable amount of leakage and fail to work when e is up to full size. In this paper, we propose new partial key exposure attacks on RSA with additive exponent blinding, focusing on leakage scenarios where the Most Significant Bits (MSBs) or Least Significant Bits (LSBs) of d′\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$d'$$\\end{document} are revealed. For the case where e is small, we first recover partial information of p by solving the quadratic congruence equation, and then find the small roots of the integer equation to recover entire private key. Our method relaxes the attack requirements, for instance, we reduce the amount of MSBs for a successful attack from 75 to 25% when e≈N0.25\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$e \\approx N^{0.25}$$\\end{document} and r≈N0\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$r\\approx N^{0}$$\\end{document}. Furthermore, we propose new attacks using the unique algebraic relationship in blinding RSA, which extend the attack to the case where e is of full size.

Partial prime factor exposure attacks on some RSA variants

In this paper, we consider five variants of the RSA cryptosystem, where the modulus is N=pq, and the public key e and the secret key d satisfy ed−k(p2+p+1)(q2+q+1)=1 or ed−k(p2−1)(q2−1)=1. Our results show that if a certain amount of the most significant bits of p are known so that |p−p0|=Nβ with a known p0, then one can factor the RSA modulus with a better bound than low private exponent attacks. We also present the experimental results to verify our analysis.

Partial key exposure attack on RSA using some private key blocks

Partial key exposure attack on RSA using some private key blocks

How Secure is Exponent-blinded RSA–CRT with Sliding Window Exponentiation?

This paper presents the first security evaluation of exponent-blinded RSA–CRT implementation with sliding window exponentiation against cache attacks. Our main contributions are threefold. (1) We demonstrate an improved cache attack using Flush+Reload on RSA–CRT to estimate the squaring–multiplication operational sequence. The proposed method can estimate a correct squaring–multiplication sequence from one Flush+Reload trace, while the existing Flush+Reload attacks always contain errors in the sequence estimation. This is mandatory for the subsequent steps in the proposed attack. (2) We present a new and first partial key exposure attack on exponent-blinded RSA–CRT with a random-bit leak. The proposed attack first estimates a random mask for blinding exponent using a modification of the Schindler–Wiemers continued fraction attack, and then recovers the secret key using an extension of the Heninger–Shacham branch-and-prune attack. We experimentally show that the proposed attack on RSA–CRT using a practical window size of 5 with 16-, 32-, and 64-bit masks is carried out with complexity of 225.6, 267.7, and 2161, respectively. (3) We then investigate the tradeoffs between mask bit length and implementation performance. The computational cost of exponent-blinded RSA–CRT using a sliding window with a 32- and 64-bit mask are 15% and 10% faster than that with a 128-bit mask, respectively, as we confirmed that 32- and 64-bit masks are sufficient to defeat the proposed attack. Our source code used in the experiment is publicly available.

Corrections to “Experimental Study of Adversarial Magnetic Field Exposure Attacks on Toggle MRAM Chips” [Mar 22 1480-1485

In the above article <xref ref-type="bibr" rid="ref1" xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">[1]</xref> , the magnetic field strength mentioned was “700 KGauss.” The occurrence of “K” in the units is an inadvertent, unintentional typographical error. The correct value must be “700 Gauss” in the last sentence of Section III-A and in the captions of Figs. 5–11.

Generic Construction of Forward-Secure Revocable Identity-Based Signature and Lattice-Based Instantiations

Forward-secure revocation is a powerful cryptographic technique to alleviate key exposure attacks on identity-based cryptosystems. In recent years, quantum computers have made some breakthroughs, so in the foreseeable future, existing cryptographic systems will be subject to quantum attacks. However, known forward-secure revocable identity-based signature (FS-RIBS) schemes were designed over bilinear pairing groups and may suffer from quantum computing attacks. To address this issue, this paper proposes a generic method to construct FS-RIBS schemes, taking (hierarchical) IBS schemes as a basic component. By instantiating it with some post-quantum (hierarchical) IBS schemes, e.g., lattice-based (hierarchical) IBS, we immediately obtain six FS-RIBS schemes under the hardness of the small integer solution problem, which is secure against quantum computing attacks.

One Truth Prevails: A Deep-learning Based Single-Trace Power Analysis on RSA–CRT with Windowed Exponentiation

In this paper, a deep-learning based power/EM analysis attack on the state-of-the-art RSA–CRT software implementation is proposed. Our method is applied to a side-channel-aware implementation with the Gnu Multi-Precision (MP) Library, which is a typical open-source software library. Gnu MP employs a fixed-window exponentiation, which is the fastest in a constant time, and loads the entire precomputation table once to avoid side-channel leaks from multiplicands. To conduct an accurate estimation of secret exponents, our method focuses on the process of loading the entire precomputation table, which we call a dummy load scheme. It is particularly noteworthy that the dummy load scheme is implemented as a countermeasure against a simple power/EM analysis (SPA/SEMA). This type of vulnerability from a dummy load scheme also exists in other cryptographic libraries. We also propose a partial key exposure attack suitable for the distribution of errors inthe secret exponents recovered from the windowed exponentiation. We experimentally show that the proposed method consisting of the above power/EM analysis attack, as well as a partial key exposure attack, can be used to fully recover the secret key of the RSA–CRT from the side-channel information of a single decryption or a signature process.

Revisiting the Polynomial-Time Equivalence of Computing the CRT-RSA Secret Key and Factoring

The Rivest–Shamir–Adleman (RSA) cryptosystem is currently the most influential and commonly used algorithm in public-key cryptography. Whether the security of RSA is equivalent to the intractability of the integer factorization problem is an interesting issue in mathematics and cryptography. Coron and May solved the above most fundamental problem and proved the polynomial-time equivalence of computing the RSA secret key and factoring. They demonstrated that the RSA modulus N=pq can be factored in polynomial time when given RSA key information (N,e,d). The CRT-RSA variant is a fast technical implementation of RSA using the Chinese Remainder Theorem (CRT), which aims to speed up the decryption process. We focus on the polynomial-time equivalence of computing the CRT-RSA secret key and factoring in this paper. With the help of the latest partial key exposure attack on CRT-RSA, we demonstrate that there exists a polynomial-time algorithm outputting the factorization of N=pq for edp,edq&lt;N3/2 when given the CRT-RSA key information (N,e,dp,dq). We apply Coppersmith’s lattice-based method as a basic mathematical tool for finding the small root solutions of modular polynomial equations. Furthermore, we provide validation experiments to illustrate the correctness of the CRT-RSA modulus factorization algorithm, and show that computing the CRT-RSA secret key and factoring its modulus is polynomial-time equivalent by using concrete numerical examples.

Enhanced Authentication Protocol for the Internet of Things Environment

The Internet of Things (IoT) is among the most promising technologies of the future, and its development has garnered attention worldwide. However, the rise of the IoT has been accompanied by a proportionate increase in security concerns regarding communication between IoT entities. Recently, Alzahrani et al. proposed an identity-based authentication and key agreement protocol for an IoT environment, wherein a physically unclonable function was employed. They claimed that their protocol can resist various types of attacks; however, after thorough analysis, we determined it to be ineffective against privileged internal attacks, physical IoT device capture attacks, stolen-verifier attacks, and known temporary information exposure attacks. To resolve these security weaknesses, we propose a new authentication and key agreement protocol. In addition, we demonstrate that the proposed protocol is provably secure in real-or-random (ROR) model and Burrows–Abadi–Needham (BAN) logic, resisting known attacks while incurring low communication and computation costs.

Experimental Study of Adversarial Magnetic Field Exposure Attacks on Toggle MRAM Chips

Systematic study of magnetoresistive random access memory (MRAM) chip behavior under external magnetic field exposure is important from security and reliability viewpoint. Some of the errors due to field exposure can possibly be exploited by miscreants as fault injection (FI) or denial-of-service (DoS) attacks on commercial-off-the-self (COTS) MRAM chips. In this study, we investigate the impact of exposure to strong external magnetic field on COTS toggle MRAM chips. In particular, we experimentally demonstrate: 1) change in current consumption during write/read operations and 2) occurrence of different types of errors, on different capacity MRAM chips, when exposed to external magnetic field. External magnetic field leads to corruption of stored data and temporary/permanent failures during read and write operations. Experiments are performed by applying magnetic fields from different directions of the chip. We observed that exposure to external magnetic field results in increase in chip read and chip write current by a range of ~1%–7% and ~1%–9%, respectively. In some cases, more than 95% of data corruption occurred instantaneously on field exposure. We also investigated the impact of field exposure on the nature of errors. As field exposure time increased the type of errors changed from temporary to permanent errors. We observed that switching failure from “1 s” to “0 s” is the dominating error type.

(In)Security of Ring-LWE Under Partial Key Exposure

Abstract We initiate the study of partial key exposure in Ring-LWE (RLWE)-based cryptosystems. Specifically, we (1) Introduce the search and decision Leaky R-LWE assumptions (Leaky R-SLWE, Leaky R-DLWE), to formalize the hardness of search/decision RLWE under leakage of some fraction of coordinates of the NTT transform of the RLWE secret. (2) Present and implement an efficient key exposure attack that, given certain 1/4-fraction of the coordinates of the NTT transform of the RLWE secret, along with samples from the RLWE distribution, recovers the full RLWE secret for standard parameter settings. (3) Present a search-to-decision reduction for Leaky R-LWE for certain types of key exposure. (4) Propose applications to the security analysis of RLWE-based cryptosystems under partial key exposure.

Extended partial key exposure attacks on RSA: Improvement up to full size decryption exponents

Partial key exposure attacks on RSA have been intensively studied by using lattice-based Coppersmith's methods. Ernst et al. (Eurocrypt'05) studied the problem by considering three attack scenarios; (1) the most significant bits (MSBs) of a secret exponent d known, (2) the least significant bits (LSBs) of d known, (3) both the MSBs and the LSBs of d known. The proposed attacks were valuable since they were the first results to handle full size exponents e. Takayasu and Kunihiro (SAC'14, Theoretical Computer Science'19) proposed improved attacks for (1) and (2) when d is sufficiently small, i.e., d<N0.5625 for (1) and d<N0.368 for (2), by utilizing a linearization technique. In this paper, we extend Takayasu-Kunihiro's attacks and improve Ernst et al.'s attack for (3). In particular, our attack contains Takayasu-Kunihiro's attacks for (1) and (2) as special cases when the amount of given LSBs and MSBs are zero, respectively. Furthermore, as opposed to Takayasu-Kunihiro's attacks, our improvement against Ernst et al.'s attack is not limited to small secret exponents such as d<N0.5625. Indeed, we are able to improve Ernst et al.'s attack almost up to full size decryption exponents, i.e., even when d is close to N. Technically, the extension is not straightforward. We first modify Takayasu-Kunihiro's lattice basis matrix for (2), so that it is compatible to embed the given MSBs. The modification is crucial for embedding both the MSBs and the LSBs simultaneously to the matrix.

A Robust IoT-Based Three-Factor Authentication Scheme for Cloud Computing Resistant to Session Key Exposure

With the development of Internet of Things (IoT) technologies, Internet-enabled devices have been widely used in our daily lives. As a new service paradigm, cloud computing aims at solving the resource-constrained problem of Internet-enabled devices. It is playing an increasingly important role in resource sharing. Due to the complexity and openness of wireless networks, the authentication protocol is crucial for secure communication and user privacy protection. In this paper, we discuss the limitations of a recently introduced IoT-based authentication scheme for cloud computing. Furthermore, we present an enhanced three-factor authentication scheme using chaotic maps. The session key is established based on Chebyshev chaotic-based Diffie–Hellman key exchange. In addition, the session key involves a long-term secret. It ensures that our scheme is secure against all the possible session key exposure attacks. Besides, our scheme can effectively update user password locally. Burrows–Abadi–Needham logic proof confirms that our scheme provides mutual authentication and session key agreement. The formal analysis under random oracle model proves the semantic security of our scheme. The informal analysis shows that our scheme is immune to diverse attacks and has desired features such as three-factor secrecy. Finally, the performance comparisons demonstrate that our scheme provides optimal security features with an acceptable computation and communication overheads.

A Novel Message Authentication Scheme With Absolute Privacy for the Internet of Things Networks

With the rapid development and massive deployment of the Internet of things (IoT) networks, security related issues in the IoT networks have been paid more and more attention to. Among all the security concerns, message authentication is critical in preventing the unauthorized messages from being transmitted in the IoT networks. Many message authentication schemes have been proposed based on the public-key cryptosystem, where the key management is simple and scalable. Identity based cryptosystem is a special type of public-key cryptosystem and can further ease the process of the key management since the public keys can be obtained easily. In this paper, we devise an efficient message authentication with enhanced privacy (IMAEP) scheme using the identity based signature. Our proposed scheme can provide both unconditional privacy as well as the enhanced privacy under full key exposure attack. Our proposed scheme can also provide existential unforgeability under the adaptive chosen-message-and-identity attack. Compared with the scheme that has the same level of anonymity and security, our proposed scheme has much lower computational overhead, and can provide extra unconditional privacy. Next we propose an extended IMAEP (EIMAEP) scheme for the general access structures where the message is signed by a group of users instead of one user. We also conduct comprehensive analysis and demonstrate that the EIMAEP scheme can achieve the same level of privacy and unforgeability as the IMAEP scheme.

Lattice-Based Privacy-Preserving and Forward-Secure Cloud Storage Public Auditing Scheme

Aiming at reducing the local storage burden and computational costs, numerous individuals and enterprises are willing to outsource their data to the cloud server. Meanwhile, due to the loss of the actual physical control over their data files once outsourced to the cloud server, how to guarantee the cloud server keep user’s data integrity is an important security issue to be addressed urgently. Accordingly, multiple data integrity checking schemes based on the traditional cryptosystem have been proposed. However, with the advent and development of quantum computer, these existing data integrity checking schemes are no longer secure. Thus, it is necessary to study the new scheme which can resist quantum attack to adapt to the quantum era. In this work, we put forward a novel scheme named lattice-based privacy-preserving and forward-secure cloud storage public auditing scheme (LB-PPFS). Our proposed scheme is not only quantum-attack-against, but also enjoy the privacy-preserving and forward-secure property. In the proposed scheme, a curious auditor cannot learn any knowledge of user’s data because the original data is encapsulated with a random number. In addition, the lattice basis delegation technique is adopted to achieve forward security for resisting key exposure attack. Based on the hardness assumptions of SIS problem from lattice, we prove that the proposed scheme can achieve formally provable security. Besides, the theoretical analysis and performance evaluation demonstrate that the proposed scheme is effective and feasible to guarantee the quantum security for the data integrity in cloud storage.

Study of UV stability, biodegradability and physical properties of rosin derivative cross-linked wood polymer composites

ABSTRACTThis work deals with the synthesis of biodegradable and UV resistant wood polymer composites (WPCs) via compression moulding technique. As outdoor applications become more widespread, durability becomes an issue. Ultraviolet exposure can lead to photodegradation, which results in a change in appearance and mechanical properties. In this study, we examined the performance of WPCs after UV exposure and microbial attack. The rate of degradation was found to decrease by the addition of a higher percentage of rosin derivatives. The bacterial growth on the samples and morphological features of the bacterial-degraded samples were investigated by UV spectrophotometry and Scanning Electron Microscope (SEM) study, respectively. The UV-degraded samples were also analysed by Fourier Transform Infrared (FTIR) spectroscopy and SEM study. It was observed that with the incorporation of 40 wt-% of divinylacrylicpimaric acid (DAPA) significantly improved the UV stability, mechanical, thermal and other physical properties of the WPCs.

Server-aided Revocable IBE with Identity Reuse

Abstract Efficient key revocation in Identity-based Encryption (IBE) has been a both fundamental and critical problem when deploying an IBE system in practice. Boneh and Franklin proposed the first revocable IBE (RIBE) scheme where the size of key updates is linear in the number of users. Then, Boldyreva, Goyal and Kumar proposed the first scalable RIBE by using the tree-based approach where the size of key updates is $O(r\log (N/r))$ and the size of every user’s long-term secret key is $O(\log N)$ with $N$ being the number of users and $r$ the number of revoked users. Recently, Qin et al. presented the notion of server-aided RIBE where the size of every user’s long-term secret key is $O(1),$ and users do not need to communicate with Key Generator Center (KGC) during every key updates. However, users must change their identities once their secret keys are revoked as they cannot decrypt ciphertexts by using their revoked secret keys. To address the above problem, we formalize the notion of RIBE with identity reuse. In our system model, users can obtain a new secret key called the reuse secret key from KGC when their secret keys are revoked. The decryption key can be derived from the reuse secret key and new key updates while it cannot be derived from the revoked secret key and the new key updates. We present a concrete construction that is secure against adaptive-ID chosen plaintext attacks and decryption key exposure attacks under the $\mathsf{ADDH}1$ and $\mathsf{DDH}2$ assumptions in the standard model. Furthermore, we extend it to server-aided RIBE scheme with identity reuse property that is more suitable for lightweight devices.

(Dual) server-aided revocable attribute-based encryption with decryption key exposure resistance

Attribute-based encryption (ABE) is a promising approach that enables scalable access control on encrypted data. However, one of the main efficiency drawbacks of ABE is the lack of practical user revocation mechanisms. In ESORICS 2016, Cui et al. proposed the first cloud server-aided revocable ABE scheme to achieve efficient user revocation. However, the cloud server cannot be fully compromised by an adversary. Otherwise, it will suffer from local decryption key exposure (DKE) attacks. In this paper, we first revisit Cui et al. security model, and enhance it by capturing the DKE attacks on user’s local decryption keys and meanwhile allowing the adversary to fully corrupt the cloud server. We then construct a server-aided revocable ABE based on Rouselakis–Waters ciphertext-policy ABE (CCS 2013). It was showed that our scheme is secure in the new security model and maintains the outstanding properties of efficient user revocation, short local ciphertext size and fast local decryption. Further, we propose a dual framework for server-aided revocable ABE, in which the update keys are distributed to local users rather than the cloud server. With the exception of interaction with the KGC, the local user still has the same efficiency as that of first scheme.