DE10042234C2 - Method and device for performing a modular exponentiation in a cryptographic processor - Google Patents

Description

The present invention relates to cryptography and particularly on modular exponentiation as one of the most important arithmetic operations, for example in public key cryptography.

For a few years now there have been so-called information leak attacks on cryptography processors, which try to obtain secret data from the calculation of the modular exponentiation, which is one of the central computing operations, for example in public key cryptography processes. A dominant method of this type is, for example, the RSA method for generating an RSA signature of a message M, ie C: = M ^d mod N.

Alternatively, in addition to the RSA signature, the modular expon tation, for example, for RSA decryption be applied. In this case, M is the encrypted post dir while C is the decrypted message. from that it can be seen that the modular exponentiation at both encryption, such as B. the RSA signature, as well with decryption, such as B. the RSA Decryption, can be used. The math Operation remains the same, the meanings of the variables However, C and M are exactly opposite in both cases.

With an RSA signature, module N is usually be knows while the exponent d is secret.

So-called information leak attacks try to get out of the Be calculation of the modular exponentiation of secret data for example via the secret key or exponent d win. The following are only examples  Publications noted: P. Kocher "Timing Attacks on Implementations of DH, RSA, DSS and other systems "(Proc. Of CRYPTO'96), D. Boneh, R. DeMillo, R. Lipton "On the Impor Dance of Checking Cryptographic Protocols for Faults "(Proc. Of EUROCRYPT'97), P. Kocher, J. Jaffe, B. Jun "Differential Power Analysis "(Proc. Of CRYPTO'99) and J. Quisquater, D. Samyde "Electromagnetic Analysis Attacks" (Rumpsession of EUROCRYPT'00).

In the following will be made to FIG. 3, which shows a flowchart of a conventional modular exponentiation. The algorithm begins in a block 100 and first initializes the required variables, namely the module N, the exponent d and the message M to be signed or alternatively the message to be decrypted (in the case of RSA decryption) in a block 102 . The encrypted symbol C in the case of an RSA signature or the decrypted symbol C in the case of RSA decryption is calculated from these variables using the usual modular exponentiation formula given in block 104 . The result is then output in a block 106 , after which the algorithm is ended in a block 108 .

This general scheme for calculating the modular exponentiation given in block 104 does not include any countermeasures against any form of attack, e.g. B. a timing attack, a performance attack or a radiation attack.

DE 198 28 936 A1 comprises a method and a device for processing data, in order to better protect a modular exponentia against external attacks. The method disclosed in DE 198 28 936 A1 is approximately as recorded in FIG. 4. In contrast to the known exemplary embodiment shown in FIG. 3, in the known method shown in FIG. 4, exponent d is randomized using a Random number r ₁ and a randomization of the base using a random number r _{2 are} proposed. In detail, the variables M, d, N and ϕ (N) are initialized in a block 110 . ϕ (N) represents the so-called Euler ϕ function, which is defined by (p - 1) × (q - 1), as can be seen in the equation shown in FIG. 4. A random number r _{1 is then selected} in a step 112 to randomize the exponent. A random number r _{2 is then selected} in a step 114 to randomize the base M. The modular exponentiation shown in block 116 is then carried out in the known method in order to obtain the processed symbol C in block 106 , after which the algorithm is ended.

A similar process is also described in U.S. Patent No. 5,991,415 by Adi Shamir. Again, the EU ler's ϕ function for randomizing the exponent puts.

Another method for calculating the modular exposure is to carry out the modular exponentiation using the Chinese residual theorem (CRT; CRT = Chinese Residue or Reminder Theorem). Modular exponentiation using the Chinese residual theorem is known in the art and is described, for example, in the Handbook of Applied Cryptography by Menezes, van Oorschort and van Sto ne, pages 610 to 613, published by Springer-Verlag. First, the necessary variables M, d _p , d _q , p and q are initialized in a block 118 . As shown in Fig. 5 below, p and q are the secret RSA prime numbers, the product of which gives the module N. The variable d is again the secret RSA exponent. The auxiliary quantities d _p and d _q are calculated, as is also shown in FIG. 5. ϕ (p) here again means the Euler ϕ function.

The quantities C _p and C _q are then calculated in accordance with the Chinese remainder theorem, as shown in blocks 120 and 122 , respectively. The size x _p results from C _p and C _q , as illustrated in a block 124 . The processed symbol C then results from the determination equation for C, which is shown in a block 126 in FIG. 5. It should be pointed out that FIG. 5 shows the modular exponentiation using the Chinese residual theorem according to the HL Garner algorithm.

The previous defense measures of the At can be tacked according to the calculation of the exponentiation divide into two groups: non-use or Be Use of the Chinese residual rate to calculate the modu laren exponentiation. Countermeasures for both cases are in U.S. Patent No. 5,991,415 and are based on essentially on a randomized calculation of the modula ren exponentiation.

The use of the Chinese remainder of the sentence for modular exponentiation, as shown in FIG. 5, does not provide any countermeasures against so-called differential fault attacks according to Boneh, DeMillo and Lipton. So-called fault attacks are based on introducing errors into the cryptographic calculation and identifying the key by analyzing the mathematical and statistical properties of the incorrectly calculated results. Among the many techniques proposed for inserting such errors are the use of ionizing radiation, unusual operating temperatures, power and clock changes, and laser-based chip microsurgery. Certain attacks are differential, meaning that both correct and erroneous calculations are performed using the same input, after which the differences in the results are analyzed. For more details and other such attacks, reference is made to US Pat. No. 5,991,415.

One way to circumvent these attacks is to essentially perform the calculation shown in FIG. 5 twice, with it being preferred to use different algorithms. If any discrepancy between the two results is found, the cryptographic processor, which is housed, for example, in a cash card or smart card, should not provide any output. This creates strong protection against accidental errors, which only have a very low probability of affecting two calculations in an identical manner. However, this measure leads to a reduction in the computing speed by a factor of 2. However, such a reduction is often intolerable, particularly in smart card implementations which entail limited computing power. If in particular the widespread use of money cards or ID cards with Si gnaturchips is considered, it is clear that the cryptographic algorithm must be very secure, but must be limited in the computing power required, otherwise the acquisition costs for reading devices become so immense that such a system will only achieve very poor market acceptance.

However, it follows that in cryptographic systems na Of course, security is an essential factor that ever but on the efficiency of the calculation, d. H. a sensible one and economical use of computing resources, also a ge important factor is which often ultimately about it will decide whether a system is accepted by the market or not.  

U.S. Patent No. 5,046,094 discloses a server supported calculation method for calculating the RSA Equation, where a message by an exponent is exponentiated and modular using a module is reduced. This is done using random numbers a derived exponent is generated from the exponent. An auxiliary unit then calculates the RSA equation under Use the derived exponent and return it Result back to a main unit. The main unit then calculated using that derived from the Exponent calculated encrypted message and the Module an encrypted message as it goes through Use of the original exponent has been obtained would. The derived exponent is calculated by summing the original exponents and a random number and by modularly reducing the result of the summation below Using the Carmichael function as a module.

The object of the present invention is a Method and device for performing a modula to create their exponentiation, which is highly secure supply standard, but not too high at the same time hen require computing effort.

This task is accomplished by a method for performing a modular exponentiation according to claim 1 or by a device for carrying out a modular exponentia tion solved according to claim 13.  

The present invention is based on the knowledge that the use of Euler's ϕ function for randomizing the exponent d provides effective protection against external attacks, since this randomization leads to a strong homogenization of the current and time profile when calculating the modular exponentiation that, however, the computing effort can be considerable. According to the invention, a randomization of the exponent d using the Euler ϕ function is therefore assumed. Instead of this, a randomization using the Carmichael el λ function is used, which leads to a significant reduction in the computing power required with a similarly large safety standard. The randomized exponent d 'results from the following relationship:

d ': = d + r ₁ .λ (N)

This randomization is supported by the following identity:

M ^{(λ (N))} = 1 mod N

So:

M ^{(d + r ₁ .λ (N))} = M ^d mod N

The module N of the modular exponentiation is usually a so-called RSA module of the form N = p. q, where p and q are two prime numbers of equal length. The following relationship applies between the Euler ϕ function and the Carmichael λ function:

λ (N) = ϕ (N) / ggT (p - 1, q - 1).

It can be seen that the Carmichael λ function is smaller than the Euler ϕ function by the greatest common divisor (ggT) of (p - 1) and (q - 1). The exponent is thus a few bits shorter than the exponent that has been randomized using the Euler function, so that the modified modular exponentiation can be calculated more quickly than can be achieved with the system shown in FIG. 4.

It should be noted that the Carmichael λ function can not only be formed with two prime numbers, but using any number of prime numbers, so long the product of the number of prime numbers equal to the module N is. Expressed in words, λ is made up of the quotient the product of at least two numbers and the largest ge common divisor defined from the at least two numbers where each of the numbers is equal to the difference between egg is a prime number and one, and the product of which is at least two prime numbers that match the at least two numbers reasons, is equal to the module (N).

For two prime numbers p, q the function λ is calculated as follows:

λ = (p - 1) (q - 1) / ggT (p - 1, q - 1)

The function λ is calculated as follows for three prime numbers p, q, r:

λ = (p - 1) (q - 1) (r - 1) / ggT (p - 1, q - 1, r - 1)

Analogously, the function λ for any number of prim numbers are formed.

According to preferred embodiments of the present Er is the randomization of the exponent using of the Carmichaelian λ function for a calculation of the modular exponentiation either with or without Chinese Remaining sentence inserted.

Preferred embodiments of the present invention are made below with reference to the accompanying figures explained in more detail. Show it:

Fig. 1 is a flowchart of the method according to a first embodiment of the present invention without using the Chinese remainder theorem;

. 2A and 2B are a flow chart of the method according to a second embodiment of the present OF INVENTION dung using the Chinese remainder theorem;

FIG. 3 shows a known method for calculating the modular exponentiation;

Fig. 4 is a known method with randomized Exponen th for calculating the modular exponentiation without using the Chinese remainder theorem; and

Fig. 5, a known method for calculating the modular exponentiation using the Chinese remainder theorem.

Fig. 1 shows a flowchart of a method according to a first embodiment of the present invention. The method is started by a block 10 . The necessary variables M, d, N and λ are then initialized in a block 12 . λ represents the Carmichael λ function and, as shown in Fig. 1 bottom left, is calculated from the prime numbers p and q, the product of the prime numbers p and q giving the module N. It should be pointed out that the Carmichael function can be used not only if the two prime numbers p, q have the same length, but that this function can always be taken if the product of p and q has the module N results.

In a step 14 , a random number is chosen, for example between 0 and 2 ³² , which is used to randomize the exponent. Optionally, a random number r ₂ can be selected in a step 16 , with which the base, ie the symbol M, can be randomized in order to distribute the power consumption and performance profiles of a crypto processor even more homogeneously, so that it makes attackers even harder will find out secret information.

However, it should be noted that the Randomi the exponent using the Carmichaelian λ function a significant increase in security against In formation leaks and that randomization the base is only optional for further protection can be used.

With the determination equation given in block 18 , the processed symbol, which is the encrypted symbol in the case of the RSA signature, or which is the decrypted symbol in the case of RSA decryption, is calculated. The value for C is finally stored in block 20 , after which the algorithm ends in block 22 . Regarding the randomization of the base, the following should be noted. If the base M is replaced by the base M + r ₂ .M, where r _{0 is} a random n-bit number, there is no change in the final results, since the following relationship applies:

(M + r ₀ .N) = N mod N

Regarding the random numbers r ₁ and r ₂ , the following is noted. It is preferred to take the same 32-bit numbers if module N is a 1024-bit module. If the module N is a 2048-bit module, it is preferred to take 64-bit numbers for r ₁ and r ₂ . It should be noted in particular that the length of the random numbers enables two din ge to be achieved. First, the higher randomization increases security. On the other hand, however, the processing speed is also increased, which, however, is in any case better by using the Carmichael λ function according to the invention than using the Eu lers ϕ function, since the relationship between λ and ϕ is not dependent on the length of the numbers r ₁ and r ₂ depends. The choice of the random numbers r ₁ and r ₂ thus provides a substantial flexibility in that with one and the same algorithm or with one and the same chip for a multitude of different requirements, an optimal relationship between security on the one hand and calculation effort on the other hand is created can. If the random numbers are chosen to be very short, processing is quick, but security could suffer. On the other hand, if the random numbers are used very long for high-security applications in which the processing speed is not an essential criterion, a maximum security standard can be achieved without further ado.

FIG. 2A shows a second exemplary embodiment according to the present invention, in which, like the first exemplary embodiment shown in FIG. 1, both the exponent and the base are randomized. Un terschied to that shown in Fig. 1 embodiment is the calculation of modular exponentiation using the Chinese remainder theorem in the example in Fig. 2A execution 2B and FIG. Instead. For this purpose, M, d, p and q are initialized in block 12 , where M is again the symbol to be processed, while d is the exponent and p and q are two prime numbers, the product of which corresponds to the module M. In a step 14 , a parameter t is selected, the parameter t being a random prime number, which preferably has a length between 16 and 32. In principle, however, the length in bits of the parameter t can be set as desired. In addition, the random numbers r ₁ and r _{2 are} selected in steps 14 and 16 , wherein in a step 24 the randomized base M _{t is} calculated using the random number r ₂ , while in a block 26 the randomized exponent d _t using the Random number r _{1 is} calculated. It should be noted that the equation for the λ function given at the bottom left in FIG. 1 is already written out in block 26 . The individual parameters C _pt , C _qt , x _pt and C _t are then calculated in blocks 28 to 34 in accordance with the equations given in FIG. 2A, it being particularly pointed out that, for example, in block 28 the Carmichaelian λ- Function of p and t is calculated, while in block 30 the Car michael λ function of q and t is calculated.

Note that the equations in Fig. 2A change accordingly when using a Carmichael function with more than two prime numbers. Please refer to the "Handbook of Applied Cryptography".

It is then determined in a block 36 whether the expression C _t - C _qt ) mod t = 0 is fulfilled. This check ensures that no errors have been made while performing the calculations in blocks 24 through 34 . An error due to a conscious attack in the sense of a differential fault attack, for example due to physical stress on the crypto processor, would also be detected here. If the condition shown in block 36 is not met, the calculation of the modular exponentiation is aborted (block 38 ). At the same time, no output is generated, so that an attacker receives no data with which he could possibly determine the secret exponent. If the condition given in block 36 is met, a jump is made to block 40 , in which the processed symbol is calculated according to the equation given in block 40 in FIG. 2b. The processed symbol is finally stored in a block 20 , whereupon the algorithm is ended in a block 22 .

Particular attention should be drawn to the error check in block 36 . In contrast to the prior art, in which the flowchart shown in FIG. 5 is processed twice, it takes up considerably less computing time, since no double processing is required. Block 36 thus provides a kind of self-test function by checking the relationship between the parameters C _t , C _qt and t.

Compared to the double processing of the concept for error checking shown in FIG. 5, a factor 2 of computation time savings with almost the same security standard is created in addition to the computation time savings by the randomization of the exponent according to the invention.

It should be noted that the inventive method ren or the device according to the invention on different Ways can be implemented. That is itself understandable a purely software-based implementation on egg nem general purpose computer conceivable, for example, an RSA-Si gnatur or perform an RSA decryption. Still be however, the applications of the invention are more preferred Concept in crypto processors on cash cards, smart cards, Identify or similar, as these items are in large pieces numbers are to be used and therefore readers with be limited budget are essential. With such users The concept of the invention can be partially or so can even be completely implemented in hardware.

Claims (13)

1. A method for performing a modular exponentiation in a cryptographic processor using a symbol (M), an exponent (d) and a module (N), with the following steps:
Obtaining ( 14 ) a random number (r ₁ );
Combining the exponent (d) with the product of the random number (r ₁ ) and a randomization number λ to obtain a randomized exponent,
where λ is defined by the quotient of the product of at least two numbers and the greatest common divisor of the at least two numbers, each of the numbers being equal to the difference between a prime number and one, and the product of the at least two prime numbers, which is based on the at least two numbers, is equal to the module (N); and
Performing ( 18 ; 28-40 ) modular exponentiation using the symbol (M), the module (N) and the randomized exponent to obtain a processed symbol (C) as a result. 2. The method of claim 1, wherein the following equation is used in the performing step:
C = M ^{(d + r ₁ .λ)} mod N
where r _{1 is} the random number, where N is the module,
where λ is the Carmichaelian function, where d is the exponent, where M is the symbol, and where C is the processed symbol. 3. The method of claim 1, further comprising the steps of:
Selecting ( 16 ) another random number (r ₂ );
Combining ( 24 ) the symbol with the product of the further random number (r ₂ ) and the module N to obtain a ran-dominated symbol; and
where the following equation is used in the performing step:
C = (M + r ₂ .N) ^{(d + r ₁ .λ)} mod N
where r _{1 is} the random number, where r _{2 is} the additional random number, where N is the module, where λ is the Car Michael function, where d is the exponent, where M is the symbol, and where C is the processed symbol is. 4. The method according to any one of the preceding claims, at which is the step of performing the modular expons tiation using the Chinese remainder sentence is carried out. 5. The method of claim 4, wherein the randomization number λ is calculated using two prime numbers, and wherein the step of performing the modular exponentiation using the Chinese residual theorem comprises the following steps:
Selecting ( 13 ) a third random number t:
Calculate ( 28 ) C _pt using the following equation:
C _pt = (M _t mod pt) ^ [d _t mod [(p - 1) (q - 1) / ggT (p - 1, q - 1)]] mod pt
where M _{t represents} a randomized symbol and is given as follows,
M _t = M + r ₂ N
and where dt is the randomized exponent and so is given
d _t = d + r _1. [(p - 1) (q - 1) / ggT (p - 1, q - 1)]
where r _{1 is} the random number, where r _{2 is} the further random number, where N is the module, where d is the exponent, where M is the symbol, and where C is the processed symbol;
Calculate ( 30 ) C _qt using the following equation:
C _qt = (M _t mod qt) ^ [d _t mod [(q - 1) (t - 1) / ggT (q - 1, t - 1)]] mod pt
Calculate ( 32 ) x _pt using the following equation:
x _pt = (C _pt - C _qt ) (q ^-1 mod p) mod pt
Calculate ( 34 ) C _t using the following equation:
C _t = C _qt + x _pt q
Compute ( 40 ) the processed symbol using the following equation:
C = C _t mod N 6. The method according to claim 5, comprising the following steps before the step of calculating ( 40 ) the processed symbol:
Checking ( 36 ) whether an error has occurred;
if an error has occurred, cancel ( 38 ) without outputting a result; and
if no error has occurred, continue ( 40 ) the modular exponentiation. 7. The method of claim 1, wherein in the step of selecting ( 14 ) a random number, a 16-32 bit random number is selected if the module (M) is 1024 bits long, and wherein a 32-64- Bit random number is selected if the module (M) is 2048 bits long. 8. The method of claim 3, wherein in the step of selecting ( 16 ) a further random number, a 16-32 bit random number is selected if the module (M) is 1024 bits long, and wherein a 32-64 bit Random number is selected if the module (M) is 2048 bits long. 9. The method of claim 5, wherein in the step of selecting ( 13 ) a third random number, a prime number with a length between 16 and 32 bits is selected. 10. The method according to any one of the preceding claims, at the exponent (d) is secret while the module (N) is known. 11. The method according to any one of the preceding claims, at which the cryptographic processor using the modular exponentiation a signature (C) of the symbol  (M), where the symbol is the To be signed represents while the processed symbol represents the represents signed message. 12. The method according to any one of claims 1 to 10, in which the cryptographic processor using the mo decular exponentiation decrypts, so that the symbol (M) is an encrypted message represents, and the processed symbol (C) ent represents encrypted message. 13. Device for carrying out a modular exponentia tion, with the following features:
means for obtaining ( 14 ) a random number (r ₁ );
a device for combining the exponent (d) with the product of the random number (r ₁ ) and a randomization number λ in order to obtain a randomized exponent, where λ is the quotient of the product of at least two numbers and the largest common A divisor is defined from the at least two numbers, each of the numbers being equal to the difference between a prime number and one, and the product of the at least two prime numbers on which the at least two numbers are based is equal to the module (N) is; and
means for performing ( 18 ; 28-40 ) modular exponentiation using the symbol (M), the module (N) and the randomized exponent to obtain a processed symbol (C) as a result.