KR101341810B1 - Method for protecting information against PA and FA using CRT-RSA - Google Patents

Abstract

비트 길이의 p와

비트 길이의 q를 이용하는 CRT-RSA 모듈러 지수승 알고리즘을 이용하여 전력 분석 공격과 오류 주입 공격으로부터 정보(m)를 보호하는 방법에 있어서, 보호 대상 정보 m, 두 소수 p와 q, 비밀키 d를 p-1로 모듈러 연산한 d_p(= d mod (p-1)), d를 q-1로 모듈러 연산한 d_q(= d mod (q-1)), p의 역수를 q로 모듈러 연산한 I_p(= p^-1 mod q), p와 d_p의 합인 T_p, q와 d_q의 합인 T_q, p와 I_p의 합인

,을 입력받고, p와 q보다 작은 수 r를 랜덤하게 선택하고, m, d_p, p, r, T_p를 이용하여 제1 데이터 쌍 (S'_p, S_P, p')을 생성하고, m, d_q, q, r, T_q를 이용하여 제2 데이터 쌍(S'_q, S_q, q')을 생성하며, S_p와 S'_q의 곱을

로 모듈러 연산한 값

과 S'_p와 S_q의 곱을

로 모듈러 연산한 값

을 산출하고, S'_p와 S'_q를 이용하여 m의 암호화된 정보(S)의 제1 중간값 S₁을 산출하고, S_p와 S_q를 이용하여 S의 제2 중간값 S₂을 산출한 다음, 레지스터(C₁)에

, к₁, 및 к₂를 이용하여 산출된 값을 저장하고, 레지스터(C₂)에 C₁, m, S₁, к₂, 및 N을 이용하여 산출된 값을 저장하고, p', q', 및 к₁를 이용하여 재산출된 값을 레지스터(C₁)에 저장된 값과 비교하고, S를 C₂, S₂, C₁, к₁, 및 к₂ 를 이용하여 생성하는 것을 특징으로 한다.The present invention relates to a method of robust information protection against power analysis attacks and fault injection attacks using Chinese Reminder Theorem-Rivest Shamir Adleman (CRT-RSA). The present invention relates to a method of protecting information by implementing a modular exponentiation algorithm capable of expressing a computational speed.
Two different prime numbers satisfying N = pq according to the present invention

Bit length p and

A method of protecting information (m) from a power analysis attack and an error injection attack using a CRT-RSA modular exponential algorithm using a bit length q, the protected object information m, two prime numbers p and q, and a secret key d d _p (= d mod (p-1)) modularized with p-1, d _q (= d mod (q-1)) modularized with d minus q-1, and inverse of p I _p (= p ^-1 mod q), T _p , the sum of p and d _p , T _q , the sum of q and d _q , and the sum of p and I _p

Input a, randomly select a number r smaller than p and q, generate a first data pair (S ' _p , S _P , p') using m, d _p , p, r, and T _p Create a second data pair (S ' _q , S _q , q') using m, d _q , q, r, and T _q , and multiply S _p by S ' _q .

Modulated value with

And the product of S ' _p and S _q

Modulated value with

For the calculation, and S _'p and S' by using the _q by calculating a first intermediate value S ₁ of the encryption information (S) in m, and the second of the S by using the S _p and S _q 2 Median S ₂ After calculating, the register (C ₁ )

, к ₁ , And store the value computed using к ₂ , store the value computed using C ₁ , m, S ₁ , к ₂ , and N in register C ₂ , p ', q', and к The value recalculated using ₁ is compared with the value stored in the register C ₁ , and S is generated using C ₂ , S ₂ , C ₁ , к ₁ , and к ₂ .

Description

How to protect information against power analysis attacks and fault injection attacks using Crt-Rss {Method for protecting information against PA and FA using CRT-RSA}

The present invention relates to a method for protecting information from a power attack attack and a fault injection attack, and more particularly, a power analysis attack using a Chinese Reminder Theorem-Rivest Shamir Adleman (CRT-RSA). The present invention relates to a method of protecting information that is robust against error injection and error injection attacks, and in particular, by implementing a modular exponentiation algorithm that can guarantee safety against the above-mentioned two attacks and express high speed of computation. It is about how to protect information.

With the advent of the information society, the protection of information using cryptographic algorithms and cryptographic protocols is increasing in importance. Among these cryptographic algorithms, public key cryptographic algorithms solve the disadvantages of secret key cryptographic algorithms, including the Advanced Encryption Standard (AES), such as key distribution, digital signatures, etc. It is quickly becoming an application.

There are symmetric key encryption method and public key encryption method for encrypting the transmitted contents. Among the public key encryption methods, RSA (Rivest Shamir Adleman) public key is widely used. There is an encryption method.

On the other hand, since side channel attack was introduced by Kocher in 1996, various attack methods for encryption algorithm of embedded device were introduced. Sub-channel attacks, which are classified as passive attack methods, use an attacker's time by executing the algorithm, the amount of power used during the operation of the algorithm, and the electromagnetic waves, and attack each time attack (TA) and simple power analysis (Simple Power Analysis). SPA), differential power analysis (DPA), and electromagnetic-analysis (EMA).

Active attacks inject a modified external clock, change the temperature, or attack the device using a laser such as X-ray, and this type of active attack is called a fault attack (FA).

In 1996, after Bellcore introduced the method of error injection in the RSA cryptosystem (CRT-RSA) using the Chinese Remainder Theorem (CRT), various public key cryptography algorithms such as DES, RSA, ElGamal, ECC, AES, etc. Attack was attacked by the method. On the other hand, the operation that is the basis of the public key cryptographic algorithm is a modular exponentiation algorithm, which also needs to be securely implemented for power analysis and error injection attacks.

The present invention was created to meet the above needs, and the problem to be solved by the present invention is a modular index in the CRT-RSA to be particularly robust to power analysis attacks and error injection attacks, and to express a high computational speed. By implementing the multiplication algorithm, we propose a way to protect the information.

비트 길이의 p와

비트 길이의 q를 이용하는 CRT-RSA 모듈러 지수승 알고리즘을 이용하여 전력 분석 공격과 오류 주입 공격으로부터 정보(m)를 보호하는 방법에 있어서, 상기 보호 대상 정보 m, 상기 두 소수 p와 q, 비밀키 d를 p-1로 모듈러 연산한 d_p(= d mod (p-1)), 상기 d를 q-1로 모듈러 연산한 d_q(= d mod (q-1)), 상기 p의 역수를 상기 q로 모듈러 연산한 I_p(= p^-1 mod q), 상기 p와 d_p의 합인 T_p, 상기 q와 d_q의 합인 T_q, 상기 p와 I_p의 합인

,을 입력받고, 상기 p와 상기 q보다 작은 수 r를 랜덤하게 선택하는 단계; 상기 m, d_p, p, r, T_p를 이용하여 제1 데이터 쌍 (S'_p, S_p, p')을 생성하고, 상기 m, d_q, q, r, T_q를 이용하여 제2 데이터 쌍 (S'_q, S_q, q')을 생성하는 단계; 상기 S_p와 상기 S'_q의 곱을

로 모듈러 연산한 값

과 상기 S'_p와 상기 S_q의 곱을

로 모듈러 연산한 값

을 산출하는 단계; 상기 S'_p와 상기 S'_q를 이용하여 상기 m의 암호화된 정보(S)의 제1 중간값 S₁을 산출하고, 상기 S_p와 상기 S_q를 이용하여 상기 S의 제2 중간값 S₂을 산출하는 단계; 레지스터(C₁)에 상기

, 상기 к₁, 및 상기 к₂를 이용하여 산출된 값을 저장하는 단계; 레지스터(C₂)에 상기 C₁, 상기 m, 상기 S₁, 상기 к₂, 및 상기 N을 이용하여 산출된 값을 저장하는 단계; 및 상기 p', 상기 q', 및 상기 к₁를 이용하여 재산출된 값을 상기 레지스터(C₁)에 저장된 값과 비교하는 단계; 상기 S를 상기 C₂, 상기 S₂, 상기 C₁, 상기 к₁, 및 상기 к₂ 를 이용하여 생성하는 단계를 포함하는 CRT-RSA를 이용하여 전력 분석 공격과 오류 주입 공격으로부터 정보(m)를 보호하는 방법을 제공한다.In order to achieve the above object, the present invention provides two different prime numbers satisfying N = pq.

Bit length p and

A method of protecting information (m) from a power analysis attack and an error injection attack using a CRT-RSA modular exponential algorithm using a bit length q, the protected object information m, the two prime numbers p and q, and a secret key d _p (= d mod (p-1)) modularized to d-1, d _q (= d mod (q-1)) modularized to d-1, and reciprocal of p the q in the modular arithmetic ^{_{I p (= p -1 mod q}} ), wherein the sum of p and d _p sum T _p, q and the sum of d _q T _q, wherein p and I _p of the

Receiving, and randomly selecting p and a number r smaller than q; The first data pairs S ' _p , S _p , p' are generated using the m, d _p , p, r, and T _p , and the m, d _q , q, r, and T _q are generated. Generating two data pairs (S ' _q , S _q , q'); The product of S _p and S ' _q

Modulated value with

And the product of S ' _p and S _q

Modulated value with

; The first intermediate value S ₁ of the encrypted information S of m is calculated using the S ′ _p and the S ′ _q , and the second intermediate value S of the S is calculated using the S _p and S _q . Calculating ₂ ; Above in register C ₁

Storing a value calculated using the k ₁ and the k ₂ ; Storing a value calculated using C ₁ , m, S ₁ , к ₂ , and N in a register (C ₂ ); Comparing the value recalculated using the p ', the q', and the k ₁ with a value stored in the register C ₁ ; Information (m) from a power analysis attack and an error injection attack using a CRT-RSA comprising generating the S using the C ₂ , the S ₂ , the C ₁ , the k ₁ , and the k ₂ . Provide a way to protect it.

According to an embodiment of the present invention, the generation of the first data pair (S ' _p , S _p , p') is a modular exponential algorithm (M, d ' _p , p, r, T _p as input) A modular exponentiation algorithm is used to generate the second data pairs S ' _q , S _q and q' in order to generate a modular exponentiation algorithm using m, d ' _q , q, r, and T _q as inputs. It can be made by.

In addition, the modular exponentiation algorithm inputs the protected object information m, a binary number x, Z (the p or the q), the r, and t _z which is p + d _p or q + d _q having a length of n bits. Receiving step; Initializing a predetermined number K using the x; A value obtained by modularizing the m by the product of r and Z (m mod rZ), and registering the square of m by the product of r and Z (m mod rZ) ² mod rZ to register 1 (a [1]) and the difference between the initial value (m ² mod rZ) of a [1] and the initial value (m mod rZ) of a [0] (a [1]). -a [0]) into register 2 (a [2]) to initialize a [0], a [1], a [2]; Iteratively calculating the values of a [0] and a [1] by each bit unit except the most significant bit and least significant bit of x; A [0] · a [0] mod of a [0] and a [0] obtained by the iterative operation and a value (a [0] mod rZ) modulated by a product of r and Z generating rZ) as the final value of a [1]; Updating the predetermined number K; A [2] obtained through the iterative operation and a [0] obtained through the iterative operation as a result of a modular operation as a product of r and t _z -K (a [0] mod r ( t _z - K Generating a product (a [2] · a [0] mod r ( t _z - K )) as the final value of a [0]; And generating a final value of a [2] by using the final value of a [1] and the final value of a [0].

In order to solve the above problems, the present invention provides a computer-readable recording medium having recorded thereon a program for executing a method for protecting information from the above-described power analysis attack and error injection attack on a computer.

According to the present invention, a reliable information security scheme is provided for all possible error injection attacks and power analysis attacks, thereby providing reliability and safety of information encryption, and reducing the amount of computation compared to the conventional CRT-RSA encryption algorithm, thereby increasing the speed of computation. Can provide.

1 is a flowchart of a method of protecting information from a power analysis attack and an error injection attack according to a preferred embodiment of the present invention.
2 is a diagram illustrating an algorithm of a method of protecting information from a power analysis attack and an error injection attack according to an exemplary embodiment of the present invention.
3 is a flow chart of a modular exponential power method according to an embodiment of the present invention used in step 120 of FIG.
4 is a diagram illustrating a modular exponential algorithm according to an exemplary embodiment of the present invention used in step 120 of FIG. 1.
Figure 5 shows a brief comparison of the two representative methods of the conventional attack prevention method and the present invention.

The present invention will now be described more fully hereinafter with reference to the accompanying drawings, in which exemplary embodiments of the invention are shown. In the following description, It is to be noted that the same reference numerals are given to the drawings and that elements of other drawings can be cited when necessary in the description of the drawings. In the following description, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

1 is a flowchart of a method of protecting information from a power analysis attack and an error injection attack according to a preferred embodiment of the present invention.

2 is a diagram illustrating an algorithm of a method of protecting information from a power analysis attack and an error injection attack according to an exemplary embodiment of the present invention.

1 and 2, a method of protecting information from a power analysis attack and an error injection attack according to an embodiment of the present invention will be described in detail below.

The following process is a process of accurately calculating the RSA signature S (= m ^d mod N) for the given protected object information m when no error occurs.

In step 110, first, a value required for deriving the encrypted information S to be robust to the error injection attack and the power analysis attack is received or selected from the protection target information m (step 1 of FIG. 2).

비트 길이의 p와

비트 길이의 q, 비밀키 d를 p-1로 모듈러 연산한 d_P(= d mod (p-1)), 상기 d를 q-1로 모듈러 연산한 d_q(= d mod (q-1)), 상기 p의 역수를 상기 q로 모듈러 연산한 I_p(= p^-1 mod q), 상기 p와 d_p의 합인 T_p, 상기 q와 d_q의 합인 T_q, 상기 p와 I_p의 합인

를 입력받고, 상기 p와 q 보다 작은 r를 랜덤하게 선택한다(도 2의 step 1).That is, two different prime numbers

Bit length p and

Q of bit length, d _P (= d mod (p-1)), modulated by secret key d with p-1, d _q (= d mod (q-1), modularized with d-1 ), of the p modular inverse calculation by I _p (= a q of the p ^-1 mod q), wherein p and d _p sum T _p, q and the sum of d _q T _q, wherein p and I _p of the Sum

Is input and randomly selects r smaller than p and q (step 1 of FIG. 2).

는 스마트 카드의 ROM에 저장되어 있는 것이 바람직하다. 한편, C₁과 C₂는 각각

비트 레지스터이다.In this case, the input parameters m, p, q, d _p , d _q , I _p , T _p , T _q ,

Is preferably stored in the ROM of the smart card. On the other hand, C ₁ and C ₂ are

Bit register.

개의 상위 비트들과, S₂의

개의 하위 비트들로 이루어져 있다. 여기서, S₁은 m^d-1 mod N이고, S₂는 m^d mod N이다. 여기서, N=pq이다.If the values input or selected in step 110 become the input values of the algorithm, the final output value is S (= m ^d mod N), and if nonzero к ₁ and nonzero к ₂ are equal, S is mS ₁ mod N. of

High bits and S ₂

Consists of four lower bits. Where S ₁ is m ^d-1 mod N and S ₂ is m ^d mod N. Where N = pq.

Multiplied by a random value r to p-1 eseo step 115, by adding a secret key exponent d _p is a secret key exponent d _p is randomized, and generates a d _'p. Similarly, q-1 and then multiplied by a random value r to, by adding a secret key exponent d _q, and generates a secret key exponent d _q are the randomized d _'q (in Fig. 2 step 2).

In step 120, m, d ' _p , p, r, and T _p are used to generate a first data pair (S' _p , S _p , p '), and m, d' _q , q, r, T _q Generates a second data pair (S ' _q , S _q , q') (step 3 of FIG. 2).

The generation of these two data pairs is performed by a modular exponentiation algorithm. In step 3 of FIG. 2, the modular exponentiation algorithm is denoted by 'Algorithm 2 ()', and the modular exponentiation in the present invention is performed. The algorithm is implemented as shown in FIG. That is, the CRT value is calculated using the exponential power algorithm.

A first data pair and a second data pair are generated using the modular exponential algorithm shown in FIG. 4 (step 3 of FIG. 2), and tuples S ' _p , S _p , p', and S ' _q of each data pair are generated. , S _q , q ') results in

로 모듈러 연산한 값

과 상기 S'_p와 상기 S_q의 곱을

로 모듈러 연산한 값

을 산출한다(도 2의 step 4).After generation of the first data pair and the second data pair in step 120, the product of S _p and S ′ _q is calculated in step 130.

Modulated value with

And the product of S ' _p and S _q

Modulated value with

Is calculated (step 4 of FIG. 2).

The calculation of к ₁ and к ₂ checks whether the buffer containing (S ' _p , S _p ) or (S' _q , S _q ) is set to (0,0) It is done for. If there is no fault, к ₁ and к ₂ have the same value, which means that there is a high probability that к ₁ and к ₂ are not zero.

Accordingly, if κ ₁ and κ ₂ are the same, it is determined that there is no error, and if κ ₁ and κ ₂ are not the same, an error can be detected.

In this case, к ₁ and к ₂ may be calculated as follows.

은 p와 q의 비트 길이이다.here,

Is the bit length of p and q.

In step 140, the first intermediate value S ₁ for obtaining the encrypted information S of m using the S ' _p and the S' _q and the S using the S _p and the S _q are obtained. The second intermediate value S ₂ is calculated (step 5 of FIG. 2). The calculation of the first intermediate value and the second intermediate value may be specifically performed as follows.

Here, CRT _Our (a, b) means a function that performs Chinese Reminder Theorem (CRT) with a and b as inputs.

-I_p)+S_p mod p'q'이다.CRT _Our (S _p , S _q ) = (((S _q -S _p ) mod rq ') I _p mod rq') (

-I _p ) + S _p mod p'q '.

The second intermediate value S ₂ is calculated to detect whether there are errors in k ₁ and k ₂ . That is, the second intermediate value to be added to, к ₁ when calculating the (S _2), because it out from the к ₂ S 'in step 190, an error if the к к ₁ and ₂ are not the same is detected in step 140.

In this case, S ₂ is calculated by adding k ₁ to m ^d mod p'q '.

, 상기 p, 상기 q, 상기 к₁, 및 상기 к₂를 이용하여 구현한다(도 2의 step 6).After calculating the first intermediate value and the second intermediate value in step 140 (step 5 of FIG. 2), the value to be input to the register C ₁ is described in step 150.

, P, q, k ₁ , and k ₂ (step 6 of FIG. 2).

C ₁ is calculated to detect whether or not k ₁ and k ₂ are 0, and specifically, it may be calculated as follows.

here,

비트 길이를 갖는 상위 비트(upper bit)를 모두 '1' 로 구현한다. 그리고 2^x는 x 비트만큼의 쉬프트-레프트 연산(shift-left operation)을 의미한다.That is, using a ₁ к к and ₂ non-zero of C ₁

Implement all the upper bits having a bit length as '1'. And 2 ^x means a shift-left operation by x bits.

이고,

이

이므로, 만일 к₁과 к₂이 같은 경우, C₁은 다음과 같다.If there is no error,

ego,

this

, If к ₁ and When к ₂ is equal, C ₁ is

이다.here ,

to be.

이면,

이다.if,

If so,

to be.

이고,If к ₁ and к ₂ are 0,

ego,

는 bitwise XOR 연산을,

는 x의 logical 0에서 logical 1(또는 그 반대)로의 스위칭 상태(switching state)를 의미한다.to be. here

Is a bitwise XOR operation,

Denotes a switching state from logical 0 of logical x to logical 1 (or vice versa).

이다.therefore,

to be.

In step 160, the value to be input to the register C ₂ is implemented using the C ₁ , the m, the S ₁ , the k _2, and the N (step 7 of FIG. 2).

C ₂ may be specifically as follows.

Where ∧ means bitwise AND operation.

을 포함하는 레지스터를 μ라고 표시하면,here,

If the register containing is denoted as μ ,

It is expressed as

이다.here,

to be.

In step 170, the register C ₁ of p is recalculated as follows.

If there is no error attack, C ₁ can be expressed as

개의 상위 비트들이 (11...11)₂이거나 (00...01)₂ 인지 확인함으로써, к ₁에 발생한 오류를 감지할 수 있다. 즉, 만일 к ₁=0이 되는 오류가 발생하면 C₁은 상위 비트가 (00...01)₂의 값을 갖게 된다.Thus, C ₁

By checking whether the top bits are (11 ... 11) ₂ or (00 ... 01) ₂ , an error occurring at к ₁ can be detected. That is, if the к ₁ = 0 is the error that occurs is C ₁ has a value of upper bits is (00 ... 01) _2.

In step 180, S 'is generated using the C ₂ , the S ₂ , the C ₁ , the k ₁ , and the k ₂ (step 9 of FIG. 2).

S 'may be specifically generated as follows.

If к ₁ is not 0, S 'can be generated by performing the following steps.

을 포함하는 레지스터를

로 나타내기로 한다.here,

Register containing

It is represented by.

이고,

이고,

이다.here,

ego,

ego,

to be.

는 C₁을

비트만큼 오른쪽 시프트 연산을 함으로써 수행된다.And,

C ₁

This is done by doing a right shift operation by bits.

Thus, if there are no errors in k ₁ , k ₂ , C ₁ , C ₂ , and other parameters, the following equation is satisfied.

therefore,

If there are no errors in step 190, к ₁ = Since k ₂ , S can be expressed as In step 190 we subtract к ₂ from S ', so к ₁ = You can check whether it is к ₂ .

In the conventional method, the secret values can be known by using the S value in which an error occurs. However, in the present invention, even if the S value in which an error occurs is known, the secret value is not known.

3 is a flow chart of a modular exponential power method according to an embodiment of the present invention used in step 120 of FIG.

4 is a diagram illustrating a modular exponential algorithm according to an exemplary embodiment of the present invention used in step 120 of FIG. 1.

The modular exponential algorithm according to the present invention inputs the protected information m, a binary number x having an n-bit length, modulus Z (= p or q), the r, and t _z , and the Montgomery exponential ladder algorithm ( Montgomery ladder algorithm powering analogy) to the m ^x mod Z instead of ^{(m x-1 mod rZ,} m x mod rZ, Z) to the output.

However, unlike the Montgomery exponential ladder algorithm, the modular exponential algorithm in the present invention uses an additional register (a [2]), which prevents a second order fault attack. It is to.

In the modular exponential algorithm according to the present invention, x is d _p + r ( p −1), d _q + r ( q −1), and t _z is p + d _p or q + d _q as an input parameter. This randomization process can protect against bit-reset error attacks and differential power analysis attacks.

In step 300, the protected object information m, a binary number x having an n-bit length, a modulus Z (= pq), r, and tZ are received.

In step 310, a predetermined number K is initialized using x (step 1 of FIG. 4).

Initialization by step 1 of FIG. 4 may be specifically performed as follows.

In operation 320, the modular exponential algorithm according to the present invention modulates m by a product of r and Z (m mod rZ) to a [0], and squares of m to a product of r and Z. The difference between the initial value (m ² mod rZ) of a [1] and the initial value (m mod rZ) of a [0] is calculated as a [1] by a modular operation value (m ² mod rZ). 1] -a [0]) into a [2] to initialize a [0], a [1], and a [2] (step 2 of FIG. 4).

In operation 330, the values of a [0] and a [1] are obtained by iterative operation (for loop operation) for each bit unit except for the most significant bit and the least significant bit of x (steps 3 to step of FIG. 4). 9).

The iterative operation by steps 3 to 9 of FIG. 4 may be specifically performed as follows.

At the end of the loop operation, K = x - rZ .

In operation 340, the product of a [0] obtained through the iterative operation and the value a [0] mod rZ, which is modularized by multiplying r and N by a [0] · a [ 0] mod rZ) is generated as the final value (output value) of a [1] (step 10 of FIG. 4). At this time, Z ^* = rZ.

After the final value (output value) of a [1] is generated, the predetermined number K is updated in step 350 (step 11 of FIG. 4). Renewal of K may be specifically performed as follows.

If the exponential algorithm is used in the CRT-RSA algorithm,

K = d _p - r or K = d _q - r .

By adding r to K in step 350, the output t _z - K becomes p or q because K becomes d _p or d _q (step 11 in FIG. 4).

In operation 360, a [2] obtained through the iterative operation and a [0] obtained through the iterative operation are modulated by a product of r and t _z -K (a [0] mod r ( t _z - K )) (a [2] .a [0] mod r ( t _z -K )) is generated as the final value (output value) of a [0] (step 12 in FIG. 4).

In step 370, a final exponent (output value) of a [2] is generated using the final value of a [1] and the final value of a [0], thereby completing the modular exponential algorithm according to the present invention. Step 13 of FIG. 4).

At this time, the calculation of the final value (output value) of a [2] may be specifically performed as follows.

In step 380, the output of the modular exponential algorithm according to the present invention becomes ( a [1], a [2], t _z - K ) (step 14 of FIG. 4).

In the exponential algorithm according to the present invention, register a [2] is additionally used. Therefore, three elements (a [0], a [1], a [2]) used during the exponential multiplication algorithm satisfy the following relationship.

a [0] m = a [1] mod rZ and a [2] = ± ( a [0] -a [1]) mod rZ

Additional registers a [2] used are a [0] -a [1] if n-i is even and a [1] -a [0] if odd. Where n is the bit length of the exponent and i is the loop counter.

Similar to the Montgomery powering ladder algorithm, the exponential ladder algorithm according to the present invention performs a square operation and a multiplication operation using a [2] as shown in the following equation.

Change the output register from (a [0], a [1]) to (a [1], a [2]) to avoid skipping steps 10, 12, and 13 of FIG.

On the other hand, the reference value t _z can be used to check whether an error has occurred in the exponent x, modulus Z, or loop counter. That is, t _z - K does not become p or q if all loops are not executed or an error is entered during loop execution.

In addition, K is updated in step 6 of FIG. 4 in order to prevent the opcode sequence from being skipped due to a lasting error.

If step 6 of FIG. 4 is skipped, an error can be detected since ( t _z - K ) ≠ Z (= p or q ) at the end.

The exponential power algorithm according to the present invention is safe for simple power analysis (SPA) because it has a structure for executing the same operation sequence for each loop independent of the bit value of the exponent. Also, by hiding exponents and modulus with new random values in each operation, the values used in between are always randomized. This prepares you for all known statistical power analysis attacks, such as DPA, RPA, and (Z-1) attacks.

Hereinafter, the present invention will be compared with the conventional attack prevention method.

Figure 5 shows a brief comparison of the two representative methods of the conventional attack prevention method and the present invention.

은 모듈러스 p 또는 q의 비트 길이이고, b는 임의의 정수의 비트 길이이다.For comparison, we consider security and computational load.

Is a bit length of modulus p or q and b is a bit length of any integer.

Among the existing methods, the Dottax_Griaud algorithm shown in FIG. 5 is the most effective method for the computational load, and the Ebeid_Lembert algorithm is the most effective method in terms of stability. Therefore, the following is to present a comparison with these two approaches.

-비트 수,

-비트 모듈러스의

-비트 지수를 갖는 2번의 지수승(exponentiation), 2개의

-비트 숫자의 1번의 곱셈, 2개의

-비트 숫자의 1번의 곱셈 및

-비트와 b-비트 숫자의 2번의 곱셈이 요구된다.The present invention is based on the CRT-RSA algorithm as described above.

Number of bits,

-Bit modulus

Two exponentiations with bit exponents, two

1 multiplication of the number of bits, two

1 multiplication of the bit number and

Two multiplications of the -bit and b-bit numbers are required.

이다.Therefore, the time complexity of the CRT-RSA according to the present invention, except for the extra operations (addition and logic operations),

to be.

In addition, the present invention does not perform any inverse operation and does not need to know about the public exponent e. In general, when using Java cards, only the private key and the corresponding X.509 certificate are stored on the card. In other words, requesting a public key is not always available. Thus, the present invention has a low computational load when compared to the existing protection schemes. Therefore, the present invention can operate effectively in a variety of environments compared to the existing protection measures.

Compared with Dottax et al shown in FIG. 5, the present invention can be said to be safer against various error injection attacks and power analysis attacks. Dottax et al not only modifies the execution code but also affects resetting the data error attack. Because you receive.

The method of the present invention can also be embodied as computer readable code on a computer readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like, and also implemented in the form of a carrier wave (for example, transmission over a wired or wireless network) . The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

The present invention has been described above with reference to preferred embodiments thereof. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

Claims (13)

Two different prime numbers satisfying N = pq,

Bit length p and

In the method for protecting information (m) from power analysis attack and error injection attack using a CRT-RSA modular exponential algorithm using a bit length q,
The protected object information m, the two prime numbers p and q, d _p (= d mod (p-1)), a modular operation of p-1, and d _q (modular operation of q-1) = d mod (q-1)), I _p (= p ^-1 mod q) modulated by the inverse of p with q, T _{p as} the sum of p and d _p , T as the sum of q and d _{q q} , which is the sum of p and I _p

Receiving, and randomly selecting p and a number r smaller than q;
The first data pairs S ' _p , S _p , p' are generated using the m, d _p , p, r, and T _p , and the m, d _q , q, r, and T _q are generated. Generating two data pairs (S ' _q , S _q , q');
The product of S _p and S ' _q

Modulated value with

And the product of S ' _p and S _q

Modulated value with

;
The first intermediate value S ₁ of the encrypted information S of m is calculated using the S ′ _p and the S ′ _q , and the second intermediate value S of the S is calculated using the S _p and S _q . Calculating ₂ ;
Above in register C ₁

Storing a value calculated using the k ₁ and the k ₂ ;
Storing a value calculated using C ₁ , m, S ₁ , к ₂ , and N in a register (C ₂ ); And
Comparing the value recalculated using the p ', q', and к ₁ with a value stored in the register (C ₁ );
Information (m) from a power analysis attack and an error injection attack using the CRT-RSA comprising generating the S using the C ₂ , the S ₂ , the C ₁ , the к ₁ , and the к ₂ . ) How to protect. The method of claim 1,
Generation of the first data pair (S ' _p , S _p , p') is made by a modular exponentiation algorithm with m, d ' _p , p, r, and T _p as inputs,
CRT-RSA, characterized in that the generation of the second data pair (S ' _q , S _q , q') is made by a modular exponential algorithm that takes m, d ' _q , q, r, and T _q as inputs. To protect information (m) from power analysis attacks and fault injection attacks. The algorithm of claim 2, wherein the modular exponential algorithm
The protected information m, n binary numbers x, Z (the p or the q) having a bit length, or wherein r, p and d _p + step of receiving the q + d _q of t _z;
Initializing a predetermined number K using the x;
A value obtained by modularizing the m by the product of r and Z (m mod rZ), and registering the square of m by the product of r and Z (m mod rZ) ² mod rZ to register 1 (a [1]) and the difference between the initial value (m ² mod rZ) of a [1] and the initial value (m mod rZ) of a [0] (a [1]). -a [0]) into register 2 (a [2]) to initialize a [0], a [1], a [2];
Iteratively calculating the values of a [0] and a [1] by each bit unit except the most significant bit and least significant bit of x;
A [0] · a [0] mod of a [0] and a [0] obtained by the iterative operation and a value (a [0] mod rZ) modulated by a product of r and Z generating rZ) as the final value of a [1];
Updating the predetermined number K;
A [2] obtained through the iterative operation and a [0] obtained through the iterative operation as a result of a modular operation as a product of r and t _z -K (a [0] mod r ( t _z - K Generating a product (a [2] · a [0] mod r ( t _z - K )) as the final value of a [0]; And
Generating a final value of a [2] by using the final value of a [1] and the final value of a [0]; and a power analysis attack and error using a CRT-RSA. How to protect information (m) from injection attacks. The method of claim 3, wherein
Initializing the K is a method of protecting information (m) from a power analysis attack and error injection attack using a CRT-RSA, characterized in that by the following equation 1.

Equation (1)
Where x is a binary number having n-bit length, n is the bit length of x, and Z ^* is rZ. 5. The method of claim 4,
Iteratively calculating the values of a [0] and a [1] in units of bits except for the most significant bit and the least significant bit of x, using CRT-RSA, characterized in that How to protect information (m) from power analysis attacks and fault injection attacks.

Formula (2). The method of claim 5, wherein
The updating of the K is performed by Equation 3 below. The method of protecting information m from a power analysis attack and an error injection attack using the CRT-RSA.

Equation (3). The method according to claim 6,
The generating of the final value of a [2] is a method of protecting information (m) from a power analysis attack and an error injection attack using a CRT-RSA, characterized by the following equation 4.

(4). The calculation according to any one of claims 2 to 7, wherein the calculation of the first intermediate value S ₁ and the second intermediate value S ₂ for obtaining the encrypted information S of m is performed by the following equation (5). And protecting the information (m) from a power analysis attack and an error injection attack using a CRT-RSA.

(5).
In Equation (5), CRT _Our (S ' _p , S' _q ) means a function for performing Chinese Reminder Theorem (CRT) with S ' _p and S' _q as inputs. The method of claim 8,
In the register C ₁

, And storing the values calculated using the к ₁ and к ₂ ,
A method of protecting information (m) from a power analysis attack and an error injection attack using a CRT-RSA, characterized by the following equation 6.

(6).
here,

Denotes a bit length of k ₁ , and 2 ^x denotes a x bit shift-left operation. The method of claim 9,
The value recalculated using the p ', q', and к ₁ is obtained by the following equation (7) to obtain information (m) from the power analysis attack and error injection attack using the CRT-RSA How to protect.

(7).
In the above formula (7)

Means bitwise XOR operation. 11. The method of claim 10,
The storing of the value calculated using the C ₁ , the m, the S ₁ , the к ₂ , and the N in the register C ₂ may include:
A method of protecting information (m) from a power analysis attack and an error injection attack using a CRT-RSA, characterized by the following equation 8.

Equation (8).
In Equation (8), ∧ means a bitwise AND operation. The method of claim 11,
Generating the S using the C ₂ , the S ₂ , the C ₁ , the k ₁ , and the k ₂ , power analysis using a CRT-RSA, characterized in that How to protect information (m) from attacks and error injection attacks.

(9).
In the above formula (9)

C ₁

It means to perform a shift-right operation by a bit. A computer readable recording medium having recorded thereon a program for executing the method of claim 1 on a computer.

Images