A Secure Algorithm for Inversion Modulo 2k

Abstract

Modular inversions are widely employed in public key crypto-systems, and it is known that they imply a bottleneck due to the expensive computation. Recently, a new algorithm for inversions modulo p k was proposed, which may speed up the calculation of a modulus dependent quantity used in the Montgomery multiplication. The original algorithm lacks security countermeasures; thus, a straightforward implementation may expose the input. This is an issue if that input is a secret. In the RSA-CRT signature using Montgomery multiplication, the moduli are secrets (primes p and q). Therefore, the moduli dependent quantities related to p and q must be securely computed. This paper presents a security analysis of the novel method considering that it might be used to compute secrets. We demonstrate that a Side Channel Analysis leads to disclose the data being manipulated. In consequence, a secure variant for inversions modulo 2 k is proposed, through the application of two known countermeasures. In terms of performance, the secure variant is still comparable with the original one.

Profiling Attack against RSA Key Generation Based on a Euclidean Algorithm

“…In [11,20], the proposed countermeasure to protect the BEEA from SPA is based on Equation (6). The same technique is also used to protect the modular inversion in the well-known open source library Mbed TLS [21].…”

“…In Equation ( 5), the secret is blinded before the GCD execution. On the other hand, notice how the same secret is manipulated in plaintext in Equation (6). This is not relevant when SPA is the only threat being considered, and we emphasize that these countermeasures aim to mitigate such attacks.…”

“…The latter can be conveniently used to accelerate the computation. Other methods to produce a −1 mod p k were introduced in [3][4][5][6]. The special case of these methods for modulo 2 k is useful to compute the Montgomery constant.…”