A Coding-Theoretic Approach to Recovering Noisy RSA Keys

Abstract

Inspired by cold boot attacks, Heninger and Shacham (Crypto 2009) initiated the study of the problem of how to recover an RSA private key from a noisy version of that key. They gave an algorithm for the case where some bits of the private key are known with certainty. Their ideas were extended by Henecka, May and Meurer (Crypto 2010) to produce an algorithm that works when all the key bits are subject to error. In this paper, we bring a coding-theoretic viewpoint to bear on the problem of noisy RSA key recovery. This viewpoint allows us to cast the previous work as part of a more general framework. In turn, this enables us to explain why the previous algorithms do not solve the motivating cold boot problem, and to design a new algorithm that does (and more). In addition, we are able to use concepts and tools from coding theory-channel capacity, list decoding algorithms, and random coding techniques-to derive bounds on the performance of the previous and our new algorithm.

RSA Meets DPA: Recovering RSA Secret Keys from Noisy Analog Data

“…They also showed that the bound for the error probability is given by 0.084 if the associated secret key is (p, q). Paterson et al proposed an algorithm correcting error bits that occurs asymmetrically at Asiacrypt 2012 [10]. They adopted a coding theoretic approach for designing a new algorithm and analyzing its performance.…”

“…The previous works [4,5,8,10] considered an erasure and/or error setting, where each bit of the secret key is either erased or flipped. Thus, the noisy version of the secret key is composed of discrete symbols, that is, {0, 1} and the erasure symbol "?".…”

“…Paterson et al [10] concluded that it is an open problem to generalize their approach to the case where soft information (that is, analog data) about the secret bits is available. This is the problem we address in this paper.…”

“…First, we modify the algorithm of Paterson et al [10] to adapt an analog data; while their algorithm takes a (noisy) binary bit sequence as input. For the modification, we introduce the concept of score; a node with a low score will be discarded, whereas a node with the highest score will be kept and generate a subtree of depth t with 2 t leaf nodes.…”

“…This section presents an overview of the methods [4,5,10] using binary trees to recover the secret key of the RSA cryptosystem. We use similar notations to those in [4].…”