Secret Exponent Research Articles

One Truth Prevails: A Deep-learning Based Single-Trace Power Analysis on RSA–CRT with Windowed Exponentiation

In this paper, a deep-learning based power/EM analysis attack on the state-of-the-art RSA–CRT software implementation is proposed. Our method is applied to a side-channel-aware implementation with the Gnu Multi-Precision (MP) Library, which is a typical open-source software library. Gnu MP employs a fixed-window exponentiation, which is the fastest in a constant time, and loads the entire precomputation table once to avoid side-channel leaks from multiplicands. To conduct an accurate estimation of secret exponents, our method focuses on the process of loading the entire precomputation table, which we call a dummy load scheme. It is particularly noteworthy that the dummy load scheme is implemented as a countermeasure against a simple power/EM analysis (SPA/SEMA). This type of vulnerability from a dummy load scheme also exists in other cryptographic libraries. We also propose a partial key exposure attack suitable for the distribution of errors inthe secret exponents recovered from the windowed exponentiation. We experimentally show that the proposed method consisting of the above power/EM analysis attack, as well as a partial key exposure attack, can be used to fully recover the secret key of the RSA–CRT from the side-channel information of a single decryption or a signature process.

Profiled side channel attacks against the RSA cryptosystem using neural networks

Profiled attacks employing machine learning techniques for secret information extraction are currently one of the main interests of the research community working on side channel attacks. In this work, we tackle the use of machine learning methods to perform a power consumption based side channel attack against asymmetric cryptosystems. In particular, we analyze different machine-learning based strategies to retrieve the secret exponent from a square-and-multiply-always modular exponentiation in RSA cryptosystem software implementations. We validate our proposals conducting effective attacks against the modular exponentiation contained in the BearSSL software library, a timing side-channel hardened public library. The experimental validation shows that our attack strategy improves the state-of-art solution and is able to retrieve the correct exponent value with a single trace from the attacked device, and, in the worst case, with an exhaustive search in a set of candidates containing a few hundred possible values for the sought secret.

Using Genetic Algorithm in Inner Product to Resist Modular Exponentiation From Higher Order DPA Attacks

Evolutionary computation techniques have always provided fascinating results in all the fields of science and engineering. However in the area of computer security, their contribution has been comparatively very less. More specifically if we consider the side-channel attacks, use of these nature based techniques have been very nominal. Therefore, we proposed a secure protocol in this paper to combat against the Higher Order Differential Power Analysis attacks on modular exponentiation based cryptosystems using one of the popular evolutionary computation techniques. The proposed work first uses Genetic Algorithm for splitting the huge exponent within the modular exponentiation into multiple non-uniform shares. Then, this shares are randomly chosen for computing individual modular exponentiation with the help of nearest neighbor algorithm. Using Genetic Algorithm, our proposed protocol can generate reasonable number of shares which exposes secret exponent at the least. As a result, it provides significant resistance to Higher Order Differential Power Analysis attacks. Moreover, randomization in computing individual modular exponentiation secures the cryptosystem from generic power analysis attacks like SPA and DPA.

Double random phase encoding schemes with perfect forward secrecy for robust image cryptography

Digital cryptosystems can provide perfect forward secrecy (PFS) for key exchange protocols based on the Diffie–Hellman (DH) scheme. However, key exchange algorithms are optimally designed only to encode small datasets, such as text and voice sets, which makes rapidly processing large-scale datasets difficult. In this paper, we propose new schemes that can efficiently and securely provide PFS in double random phase encoding (DRPE) schemes for robust image cryptography. We demonstrate that the proposed complex sinusoidal waveform versions of the DH algorithm with fusion of a random phase mask (RPM) and ephemeral secret exponents can guarantee PFS. Different experimental results reveal that the proposed schemes can enhance the security of DRPE-based image cryptosystems using a one-time RPM and PFS. We also propose a ring-type PFS scheme in which an unlimited number of users can securely share a temporary session key, which is an extension of PFS for only two users. We provide formal proof for the schemes and prove feasibility through numerical simulations.

Clustering Collision Power Attack on RSA-CRT

In this paper, we propose two new attack algorithms on RSA implementations with CRT (Chinese remainder theorem). To improve the attack efficiency considerably, a clustering collision power attack on RSA with CRT is introduced via chosen-message pairs. This attack method is that the key parameters dp and dq are segmented by byte, and the modular multiplication collisions are identified by k-means clustering. The exponents dp and dq were recovered by 12 power traces of six groups of the specific message pairs, and the exponent d was obtained. We also propose a second order clustering collision power analysis attack against RSA implementation with CRT, which applies double blinding exponentiation. To reduce noise and artificial participation, we analyze the power points of interest by preprocessing and k-means clustering with horizontal correlation collisions. Thus, we recovered approximately 91% of the secret exponents manipulated with a single power curve on RSA-CRT with countermeasures of double blinding methods.

Extended partial key exposure attacks on RSA: Improvement up to full size decryption exponents

Partial key exposure attacks on RSA have been intensively studied by using lattice-based Coppersmith's methods. Ernst et al. (Eurocrypt'05) studied the problem by considering three attack scenarios; (1) the most significant bits (MSBs) of a secret exponent d known, (2) the least significant bits (LSBs) of d known, (3) both the MSBs and the LSBs of d known. The proposed attacks were valuable since they were the first results to handle full size exponents e. Takayasu and Kunihiro (SAC'14, Theoretical Computer Science'19) proposed improved attacks for (1) and (2) when d is sufficiently small, i.e., d<N0.5625 for (1) and d<N0.368 for (2), by utilizing a linearization technique. In this paper, we extend Takayasu-Kunihiro's attacks and improve Ernst et al.'s attack for (3). In particular, our attack contains Takayasu-Kunihiro's attacks for (1) and (2) as special cases when the amount of given LSBs and MSBs are zero, respectively. Furthermore, as opposed to Takayasu-Kunihiro's attacks, our improvement against Ernst et al.'s attack is not limited to small secret exponents such as d<N0.5625. Indeed, we are able to improve Ernst et al.'s attack almost up to full size decryption exponents, i.e., even when d is close to N. Technically, the extension is not straightforward. We first modify Takayasu-Kunihiro's lattice basis matrix for (2), so that it is compatible to embed the given MSBs. The modification is crucial for embedding both the MSBs and the LSBs simultaneously to the matrix.

Recovering Secrets From Prefix-Dependent Leakage

AbstractWe discuss how to recover a secret bitstring given partial information obtained during a computation over that string, assuming the computation is a deterministic algorithm processing the secret bits sequentially. That abstract situation models certain types of side-channel attacks against discrete logarithm and RSA-based cryptosystems, where the adversary obtains information not on the secret exponent directly, but instead on the group or ring element that varies at each step of the exponentiation algorithm.Our main result shows that for a leakage of a single bit per iteration, under suitable statistical independence assumptions, one can recover the whole secret bitstring in polynomial time. We also discuss how to cope with imperfect leakage, extend the model to k-bit leaks, and show how our algorithm yields attacks on popular cryptosystems such as (EC)DSA.

An Automated End-to-End Side Channel Analysis Based on Probabilistic Model

In this paper, we propose a new automated way to find out the secret exponent from a single power trace. We segment the power trace into subsignals that are directly related to recovery of the secret exponent. The proposed approach does not need the reference window to slide, templates nor correlation coefficients compared to previous manners. Our method detects change points in the power trace to explore the locations of the operations and is robust to unexpected noise addition. We first model the change point detection problem to catch the subsignals irrelevant to the secret and solve this problem with Markov Chain Monte Carlo (MCMC) which gives a global optimal solution. After separating the relevant and irrelevant parts in signal, we extract features from the segments and group segments into clusters to find the key exponent. Using single power trace indicates the weakest power level of attacker where there is a very slight chance of acquiring as many power traces as needed for breaking the key. We empirically show the improvement in accuracy even with presence of high level of noise.

Analysis of the RSA-cryptosystem in abstract number rings

Quantum computers can be a real threat to some modern cryptosystems (such as the RSA-cryptosystem). The analogue of the RSA-cryptosystem in abstract number rings is not affected by this threat, as there are currently no factorization algorithms using quantum computing for ideals. In this paper considered an analogue of RSA-cryptosystem in abstract number rings. Proved the analogues of theorems related to its cryptographic strength. In particular, an analogue of Wiener’s theorem on the small secret exponent is proved. The analogue of the re-encryption method is studied. On its basis the necessary restrictions on the parameters of the cryptosystem are obtained. It is also shown that in numerical Dedekind rings the factorization problem is polynomial equivalent to factorization in integers.

Connecting the Dots: Privacy Leakage via Write-Access Patterns to the Main Memory

Data-dependent access patterns of an application to an untrusted storage system are notorious for leaking sensitive information about the user's data. Previous research has shown how an adversary capable of monitoring both read and write requests issued to the memory can correlate them with the application to learn its sensitive data. However, information leakage through only the write access patterns is less obvious and not well studied in the current literature. In this work, we demonstrate an actual attack on power-side-channel resistant Montgomery's ladder based modular exponentiation algorithm commonly used in public key cryptography. We infer the complete 512-bit secret exponent in ~ 3.5 minutes by virtue of just the write access patterns of the algorithm to the main memory. In order to learn the victim algorithm's write access patterns under realistic settings, we exploit a compromised DMA device to take frequent snapshots of the application's address space, and then run a simple differential analysis on these snapshots to find the write access sequence. The attack has been shown on an Intel Core(TM) i7-4790 3.60GHz processor based system. We further discuss a possible attack on McEliece public-key cryptosystem that also exploits the write-access patterns to learn the secret key.

A secured modular exponentiation for RSA and CRT-RSA with dual blinding to resist power analysis attacks

Blinding has been one of the most effective approaches to resist power analysis attacks on asymmetric cryptosystems like RSA. Blinding is similar to masking in symmetric cryptosystems, but masking can be implemented in various ways like Boolean, affine, polynomial masking, etc. However, for asymmetric cryptosystems with modular exponentiation as a fundamental operation, arithmetic masking or simply blinding has been extremely popular. In this paper, we have presented a secured approach for modular exponentiation in RSA and CRT-RSA cryptosystems with dual blinding. Through dual blinding, we have masked both secret exponent and message twice before executing the fundamental operations. We have also injected two ineffectual instructions between the fundamental operations and blinded the intermediate results to felicitate hiding and resist simple power analysis. The implementation results shows that with a nominal penalty, RSA and CRT-RSA with dual blinding can effectively resist some popular simple power analysis and differential power analysis attacks to a significant extent.

Cryptanalysis of Server-Aided RSA Protocols with Private-Key Splitting

We analyze the security and the efficiency of interactive protocols where a client wants to delegate the computation of an RSA signature given a public key, a public message and the secret signing exponent. We consider several protocols where the secret exponent is splitted using some algebraic decomposition. We first provide an exhaustive analysis of the delegation protocols in which the client outsources a single RSA exponentiation to the server. We then revisit the security of the protocols RSA-S1 and RSA-S2 that were proposed by Matsumoto, Kato and Imai in 1988. We present an improved lattice-based attack on RSA-S1 and we propose a simple variant of this protocol that provides better efficiency for the same security level. Eventually, we present the first attacks on the protocol RSA-S2 that employs the Chinese Remainder Theorem to speed up the client's computation. The efficiency of our (heuristic) attacks has been validated experimentally.

ANOTHER PROOF OF WIENER'S SHORT SECRET EXPONENT

Wiener’s short secret exponent attack is a well-known crypt-analytical result upon the RSA cryptosystem using a Diophantine’s method called continued fractions. We recall that Wiener’s attack works efficiently on RSA with the condition that the secret exponent . Later, the upper bound was improved satisfying . In this work, we present another proof to Wiener’s short secret exponent satisfying . We remark that our result is slightly better than the previously mentioned attacks.

Updatable Ciphertext-Policy Attribute-Based Encryption Scheme With Traceability and Revocability

Ciphertext-policy attribute-based encryption (CP-ABE) can offer fine-grained access control over encrypted data, which is suitable for complex commercial applications. However, since the same decryption privileges could be shared by multiple users in the one-to-many encryption mechanism, it is dangerous that a malicious user misuses his secret key but cannot be traced. In addition to further security, when the malicious user has been caught, it is required to revoke him from the system. To address these problems, we propose a novel updatable CP-ABE scheme supporting white-box traceability and traitor revocation. In the proposed scheme, a “fixed point” is embedded into the user's secret key to achieving the traceability and each user is assigned with a unique identifier for revocation. Moreover, the secret exponent used to encrypt a message is divided into two parts: one is assigned to access policy and the other to the revocation list. Therefore, only a part of the ciphertext components needs to be updated when the revocation list is changed, which greatly simplifies the process of ciphertext update. Compared to the previous works, our scheme is more efficient, and can achieve valid revocation and ciphertext update. In addition, the traceability of the proposed scheme is depended on the l-Strong Difffie-Hellman assumption, and the indistinguishability security under selective access policy and chosen-plaintext attacks in the standard model is reduced to the Decisional q-Bilinear Diffie-Hellman assumption. Furthermore, the experimental results show that the proposed scheme is efficient.

A Practical Collision-Based Power Analysis on RSA Prime Generation and Its Countermeasure

We analyze the security of RSA prime generation implemented on embedded devices by a practical power analysis attack. Unlike previous differential power analysis-based attack on primality tests of RSA prime generation exploiting the deterministic relationship among multiple prime candidates manipulated by consecutive primality tests, we propose a collision-based power analysis attack on the Miller-Rabin test for a single prime candidate which can recover the secret prime with a single attempt by exploiting collision characteristics of simple power analysis resistant modular exponentiation algorithms. Hence, our attack does not require the incremental prime search assumption and is applicable when countermeasures against previous attacks are deployed since it also does not require the assumption of trial divisions with small primes on prime candidates. For a realistic setting, where five 512-bit modular exponentiations are operated on an ARM Cortex-M4 microcontroller as recommended by FIPS 186-4 standard, we successfully recover the secret exponent to an extent that a feasible exhaustive search is needed for the full recovery of the secret prime. This is a first practical result of recovering a full secret of modular exponentiation which manipulates 512-bit RSA primitives with collision-based power analysis in a single attempt, where the previous attack demonstrates the result for 192-bit ECC primitive implementations. We also present a countermeasure against our attack which requires only one additional modular subtraction for the loop of square-and-multiply-always exponentiation algorithm. An experimental result for the effectiveness of our proposed countermeasure is presented.

New Cryptanalytic Attack on RSA Modulus N = pq Using Small Prime Difference Method

This paper presents new short decryption exponent attacks on RSA, which successfully leads to the factorization of RSA modulus N = p q in polynomial time. The paper has two parts. In the first part, we report the usage of the small prime difference method of the form | b 2 p − a 2 q | &lt; N γ where the ratio of q p is close to b 2 a 2 , which yields a bound d &lt; 3 2 N 3 4 − γ from the convergents of the continued fraction expansion of e N − ⌈ a 2 + b 2 a b N ⌉ + 1 . The second part of the paper reports four cryptanalytic attacks on t instances of RSA moduli N s = p s q s for s = 1 , 2 , … , t where we use N − ⌈ a 2 + b 2 a b N ⌉ + 1 as an approximation of ϕ ( N ) satisfying generalized key equations of the shape e s d − k s ϕ ( N s ) = 1 , e s d s − k ϕ ( N s ) = 1 , e s d − k s ϕ ( N s ) = z s , and e s d s − k ϕ ( N s ) = z s for unknown positive integers d , k s , d s , k s , and z s , where we establish that t RSA moduli can be simultaneously factored in polynomial time using combinations of simultaneous Diophantine approximations and lattice basis reduction methods. In all the reported attacks, we have found an improved short secret exponent bound, which is considered to be better than some bounds as reported in the literature.

Side-Channel Vulnerabilities of Unified Point Addition on Binary Huff Curve and Its Countermeasure

Unified point addition for computing elliptic curve point addition and doubling is considered to be resistant to simple power analysis. Recently, new side-channel attacks, such as recovery of secret exponent by triangular trace analysis and horizontal collision correlation analysis, have been successfully applied to elliptic curve methods to investigate their resistance to side-channel attacks. These attacks turn out to be very powerful since they only require leakage of a single power consumption trace. In this paper, using these side-channel attack analyses, we introduce two vulnerabilities of unified point addition on the binary Huff curve. Also, we propose a new unified point addition method for the binary Huff curve. Furthermore, to secure against these vulnerabilities, we apply an equivalence class to the side-channel atomic algorithm using the proposed unified point addition method.

Partial key exposure attacks on RSA: Achieving the Boneh–Durfee bound

Thus far, several lattice-based algorithms for partial key exposure attacks on RSA, i.e., given the most/least significant bits (MSBs/LSBs) of a secret exponent d and factoring an RSA modulus N, have been proposed such as Blömer and May (Crypto'03), Ernst et al. (Eurocrypt'05), and Aono (PKC'09). Due to Boneh and Durfee's small secret exponent attack, partial key exposure attacks should always work for d<N0.292 even without any partial information. However, it was difficult task to make use of the given partial information without losing the quality of Boneh–Durfee's attack. In particular, known partial key exposure attacks fail to work for d<N0.292 with only few partial information. Such unnatural situation stems from the fact that the additional information makes underlying modular equations involved. In this paper, we propose improved attacks when a secret exponent d is small. Our attacks are better than all known previous attacks in the sense that our attacks require less partial information. Specifically, our attack is better than all known ones for d<N0.5625 and d<N0.368 with the MSBs and the LSBs, respectively. Furthermore, our attacks fully cover the Boneh–Durfee bound, i.e., they always work for d<N0.292. At a high level, we obtain the improved attacks by fully utilizing unraveled linearization technique proposed by Herrmann and May (Asiacrypt'09). Although Herrmann and May (PKC'10) already applied the technique to Boneh–Durfee's attack, we show elegant and impressive extensions to capture partial key exposure attacks. More concretely, we construct structured triangular matrices that enable us to recover more useful algebraic structures of underlying modular polynomials. We embed the given MSBs/LSBs to the recovered algebraic structures and construct our partial key exposure attacks. In this full version, we provide overviews and explicit proofs of the triangular matrix constructions. We believe that the additional explanations help readers to understand our techniques.

On the Generalizations of Megrelishvili Protocol for Group Key Distribution

This article presents an extension of our previous research in &amp;lt;cite&amp;gt;AW17&amp;lt;/cite&amp;gt; where we propose two variants of Megrelishvili key distribution schemes and investigate some of their elementary theoretical security analysis. We briefly discuss the two protocols in &amp;lt;cite&amp;gt;AW17&amp;lt;/cite&amp;gt; and propose another two schemes which are more efficient than the preceding ones. Additionally, we also devise efficient procedures for constructing a new mutual key if the group membership is altered. Furthermore, we discuss the security of the protocols rigorously and we provide a sufficient condition for breaking the protocols by way of solving several instances of &lt;em&gt;Megrelishvili vector-matrix problems&lt;/em&gt; (MVMP). We prove that the secret group key can be recovered easily if an attacker can express the sum of the secret exponents of the participants as a linear combination of the secret exponents excerpted from the transmission. Based on this result, we reason that our Megrelishvili key distribution schemes are theoretically at least as secure as the standard two-party Megrelishvili key exchange procedure.

Comparative Modular Exponentiation with Randomized Exponent to Resist Power Analysis Attacks

We present a secure variant of modular exponentiation implemented in RSA and CRT-RSA to resist power analysis attacks. For speeding up the computation, modular exponentiation is generally done through “squaring and multiplication” according to the binary bit of the secret exponent. This is popularly known as straight forward method. However, such computation leaves behind distinct traces of power consumption leading to power analysis attacks. These attacks were so powerful that they could reveal the secret exponent or the key challenging the vulnerability of any cryptosystem. In this work, we have enhanced the security of modular exponentiation by first randomizing the exponent or the secret key and then executing comparative bitwise squaring and multiplication. Our proposed work could be implemented in left-to-right or right-to-left without any modification of the algorithm which removed the dependency of “squaring and multiplication” on the bits of the key. As RSA decryption has more security privilege, we have implemented our proposed work only while decrypting the message. However, it can be used during encryption too. The randomized key, bit-independent squaring–multiplication and comparative modular exponentiation would generate non-uniform and random power traces resisting it from power analysis attacks.