Resilience of Randomized RNS Arithmetic with Respect to Side-Channel Leaks of Cryptographic Computation

Abstract

In this paper, we want to promote the influence of randomized arithmetic on the leaks during a code execution. When somebody wants to extract some specific information from these leaks, one can observe different emanations of the device like power consumption. These leaks mostly come from the variations of the Hamming distances of the successive states of the system. This phenomenon is particularly critical for cryptographic devices. Our work evaluates the resilience of randomized moduli in Residue Number System (RNS) against Correlation Power Analysis (CPA), Differential Power Analysis (DPA). Our analysis is illustrated through the evaluation of scalar multiplication on an elliptic curve using the Montgomery Powering Ladder (MPL) algorithm which protects from Simple Power Analysis (SPA). We also propose an evaluation based on the Maximum Likelihood Estimator (MLE), which crosses the information of the whole state vector, instead of analysing only the current state like with CPA or DPA. Furthermore, MLE gives better performance and smooths the results allowing a better evaluation of the behaviour of the leakage. Our experimental evaluation suggests that the number of observations, needed to perform exploitable information leakage, is proportional to the number of possible RNS bases.

Fast verification and public key storage optimization for unstructured lattice-based signatures

“…Their work only considered primes as it was easy to count them for security purposes, and did not have a way to randomly generate pairwise coprime sets and let alone count them: opening the path to pairwise coprime sets, which includes sets of prime numbers, would allow them to keep a similar level of security with smaller sets or smaller moduli as the number of possible combinations increases. The approach of using large combination sets to enhance the security is not new: it has been used to increase the amount of possible number representations possible to thwart side-channels attacks [4,10,35].…”

“…As we do not require modular inverses or base extensions, we could also use redundant arithmetic or random draws of moduli without resorting on coprimality. Like in [4,10,35], a high number of possible combinations is at the core of the security, and our generator provide it. The issue is the lack of guaranteed coprimality and maybe the computation of modular inverses in constant time without branching, but this could be a (very difficult) further research direction.…”

Generating Very Large RNS Bases

“…RNS are also particularly interesting for countering attacks by faults, as the addition of redundancy elements at the base level makes it possible to set up fault detection [27]. Finally, the random drawing of bases ensures that the same calculation produces different patterns at each evaluation, making learning possible leakage of information more difficult [28].…”

A software comparison of RNS and PMNS

“…These two representations support the paralellization of the computation since operations over each moduli or coefficients are independent. Furthermore, both arithmetics have sidechannel attack resistance properties [9], [16], [17].…”