Efficient Leak Resistant Modular Exponentiation in RNS

Abstract

Cryptography RSA cryptosystem Power analysis Montgomery multiplication in RNS 2 Randomized modular exponentiation in RNS Randomized Montgomery multiplication Proposed approach Level of randomization 3 Conclusion 2 / 19 Outline 1 Cryptography RSA cryptosystem Power analysis Montgomery multiplication in RNS 2 Randomized modular exponentiation in RNS Randomized Montgomery multiplication Proposed approach Level of randomization 3 Conclusion 3 / 19 RSA encryption (Rivest, Shamir and Adleman) Bob chooses p and q two large prime numbers and computes N = pq. He generates E and D two integers such that ED = 1 (mod (p − 1)(q − 1)).

Generating Very Large RNS Bases

“…In a domain such as cryptography, arithmetic operations are performed modulo large numbers that are often prime, the use of RNS becomes more complicate as modular reduction requires a conversion of RNS bases [20], [21], [22], [23]. This last point has generated a rich literature, in particular around the choice of bases for efficient implementations [15], [24], [25], [26]. RNS are also particularly interesting for countering attacks by faults, as the addition of redundancy elements at the base level makes it possible to set up fault detection [27].…”

Generating Residue Number System Bases

“…There is a rich literature on RNS for cryptography focused on conversion algorithms and their integration into the cryptographic protocols (using different architectures such as field-programmable gate array (FPGA)) [15], [16], [17], [18] or fault detections [19], [20] where the choice of the RNS base is crucial. A frequent challenge is encountered with implementations on small operator devices, which restricts the size of the elements of the RNS bases and thus their numbers [21], [22].…”

Resilience of Randomized RNS Arithmetic with Respect to Side-Channel Leaks of Cryptographic Computation

“…In [15], the authors showed that we can draw randomly a RNS base from a set of moduli, to randomize an execution with a small cost. Since their publication, this work was used and cited in different papers [14], [16], [17], [18], [19]. To our knowledge, no one established a complete study of the randomness behavior of such approach, and what kind of protection it can get.…”