RSA Meets DPA: Recovering RSA Secret Keys from Noisy Analog Data

Abstract

Abstract. We discuss how to recover RSA secret keys from noisy analog data obtained through physical attacks such as cold boot and side channel attacks. Many studies have focused on recovering correct secret keys from noisy binary data. Obtaining noisy binary keys typically involves first observing the analog data and then obtaining the binary data through quantization process that discards much information pertaining to the correct keys. In this paper, we propose two algorithms for recovering correct secret keys from noisy analog data, which are generalized variants of Paterson et al.'s algorithm. Our algorithms fully exploit the analog information. More precisely, consider observed data which follows the Gaussian distribution with mean (−1) b and variance σ 2 for a secret key bit b. We propose a polynomial time algorithm based on the maximum likelihood approach and show that it can recover secret keys if σ < 1.767. The first algorithm works only if the noise distribution is explicitly known. The second algorithm does not need to know the explicit form of the noise distribution. We implement the first algorithm and verify its effectiveness. This is the full version of [7].

Cold Boot Attacks in the Discrete Logarithm Setting

“…For instance, RSA-based reconstruction procedures usually start with the least significant bits (LSB) [8,9,13,14,15,18,20], but it is also possible to begin with the most significant bits (MSB) [19]. It is typical to use an iterative process to guess a couple of bits of the key and assess the plausibility of the guess on the basis of both a model of the decay process and the available redundancy in the encoding.…”

“…At this juncture the algorithm will prepend all bit-strings of length − to all the strings in CandSet (cf. lines [13][14][15][16]. Each of these new strings x is then compared against the public key Q = aP , via the calculation xP .…”

“…We then (cf. lines [10][11][12][13][14][15][16][17][18][19][20] repeat the procedure by combining each surviving candidate with all possible bit combinations in the tw positions that will allow us to compute the next t comb components, which are…”

“…There is now an abundance of literature concerning the recovery of private keys in this manner. RSA key-recovery algorithms are without doubt the most popular [4,8,9,12,14,15,18,20], whilst symmetric-key cryptographic schemes have received a…”

Towards Optimal Bounds for Implicit Factorization Problem

“…Later, Kunihiro et al [12] discussed secret key recovery from noisy secret key sequences with both errors and erasures. Recently, Kunihiro and Honda [11] discussed how to recover RSA secret keys from noisy analog data.…”