Clustering Collision Power Attack on RSA-CRT

Abstract

In this paper, we propose two new attack algorithms on RSA implementations with CRT (Chinese remainder theorem). To improve the attack efficiency considerably, a clustering collision power attack on RSA with CRT is introduced via chosen-message pairs. This attack method is that the key parameters d p and d q are segmented by byte, and the modular multiplication collisions are identified by k-means clustering. The exponents d p and d q were recovered by 12 power traces of six groups of the specific message pairs, and the exponent d was obtained. We also propose a second order clustering collision power analysis attack against RSA implementation with CRT, which applies double blinding exponentiation. To reduce noise and artificial participation, we analyze the power points of interest by preprocessing and k-means clustering with horizontal correlation collisions. Thus, we recovered approximately 91% of the secret exponents manipulated with a single power curve on RSA-CRT with countermeasures of double blinding methods.

Revisiting the Polynomial-Time Equivalence of Computing the CRT-RSA Secret Key and Factoring

“…Attack Type Used Method ours, [35] factoring attack lattice-based method [37] factoring attack elliptic curve method [6,12,17,18,38] small CRT-exponent attack lattice-based method [19][20][21][22][23] partial key exposure attack lattice-based method [24][25][26][27][28] side-channel attack power-based method [39][40][41] key recovery attack tree-based method Notice that we experimentally verify our CRT-RSA modulus factorization algorithm for small CRT exponents. A limiting factor in achieving large CRT exponents is that we need to perform the lattice reduction algorithm with large lattice dimension in such cases.…”

“…In addition, the partial-key-exposure attacks such as [19][20][21][22][23] were studied due to the consideration of partial leakage of the CRT-RSA private key. From the implementation aspect, side-channel attacks such as [24][25][26][27][28] were proposed by exploiting the side-channel information leakage during the running process of the CRT-RSA algorithm.…”