EP1423786A2

EP1423786A2 - Device and method for calculating the result of a modular exponentiation

Info

Publication number: EP1423786A2
Application number: EP02797920A
Authority: EP
Inventors: Jean-Pierre Seifert; Joachim Velten
Original assignee: Infineon Technologies AG
Current assignee: Infineon Technologies AG
Priority date: 2001-09-06
Filing date: 2002-08-22
Publication date: 2004-06-02
Also published as: US7248700B2; DE10143728B4; WO2003023605A2; WO2003023605A3; US20040215685A1; CN1554047A; DE10143728A1

Abstract

The invention relates to a device for calculating the result of a modular exponentiation based on the Chinese Remainder Theorem (CRT), whereby two auxiliary exponentiations are calculated by using two auxiliary exponents and two sub-modules. The aim of the invention is to increase the security of the RSA-CRT-calculation against cryptographic attacks. As a result, a randomisation of the auxiliary exponents and/or an alteration of the sub-modules is carried out. The Chinese Remainder Theorem enables secure RSA-decoding or RSA-coding to take place by means of the calculation time efficiency.

Description

description

Device and method for calculating a result of a modular exponentiation

The present invention relates to modular exponentiation and in particular to modular exponentiation using the Chinese residual theorem (CRT; CRT = Chinese Residue Theorem).

Before going into the RSA cryptosystem in more detail, a few basic terms of cryptography are summarized. In general, a distinction is made between symmetrical encryption methods, which are also referred to as secret key encryption methods, and public key encryption methods, which are also referred to as encryption methods using public keys.

A two-party communication system using symmetric key encryption can be described as follows. The first party communicates its encryption key to the second party over a secure channel. The first party then encrypts the secret message using the key and transmits the encrypted message to the second party via a public or unsecured channel. The second party then decrypts the encrypted message using the symmetric key that has been communicated to the second party over the secure channel. A major problem with such encryption systems is an efficient method for exchanging the secret keys, i. H. to find a safe channel.

In contrast, asymmetrical encryption is carried out as follows. A party wishing to receive a secret message shares its public key with the other your party, that is, the party from which you want to receive a secret message. The public key is communicated via an unsecured channel, ie via a "public" channel.

The party wishing to send a secret message receives the public key of the other party, the message encrypted using the public key and sends the encrypted message again Ü ^"over a non-secure channel, ie via a public channel to the Party from which the public key originated: Only the party that generated the public key is able to provide a private key to decrypt the encrypted message, not even the party that uses the public key an encrypted message is able to decrypt the message. An advantage of this concept is that no secure channel, ie no secret key exchange, is required between the two parties. The party who encrypted the message must and may the recipient's private key t know.

A physical analogue to the asymmetrical encryption concept or public key encryption concept is as follows. Consider a metal box, the lid of which is secured by a combination lock. The combination only knows the party who wants to receive an encrypted message. If the lock is left open and made publicly available, anyone who wants to send a secret message can put this message in the metal box and close the lid. However, only the person from whom the box comes knows the combination of the combination lock. Only he is able to decrypt the message, ie to open the metal box again. Even the one who put the message in the box is no longer able to get it out.

Essential for asymmetrical or public key encryption concepts is the underlying mathematical problem, the solution of which is almost impossible to use using the public key for decryption, but whose solution is easily possible with knowledge of the private key. One of the best known public key cryptosystems is the RSA cryptosystem. The RSA cryptosystem is described in the "Handbook of Applied Cryptography", Menezes, van Oorschot, Vanstone, CRC Press 1997, pages 285-291.

Subsequently, reference is made to FIG. 3 in order to represent the RSA algorithm. The starting point is that one communication partner encrypts a message m, which the other communication partner must decrypt again. The encrypting entity must first receive the public key (s, e) in a step 200 in order to be able to send the other party an encrypted message at all. Subsequently, the encrypting entity must represent the message to be encrypted as an integer m in a step 210, where m must lie in the interval from 0 to n-1. In a step 220, which is the actual encryption step, the encrypting entity must calculate the following equation:

c = m ^e mod n.

c is the encrypted message. This is then output in a step 230 and transmitted to the recipient of the encrypted message via a public channel, which is labeled 240 in FIG. 2. The latter receives the encrypted message c in a step 250 and performs the following calculation in a step 260, which is the actual decryption step: mc ^d mod n.

From Fig. 3 it can be seen that only the public key (n, e) is required for encryption, but not the private key d, while the private key d is required for decryption.

It is now questionable how an attacker can break an RSA cryptosystem. He knows the public key, i.e. n and e. He could now factor the module n into a product of two prime numbers and then calculate the secret key d exactly as the key-generating authentic party did. To do this, the attacker would have to try out all possible pairs of prime numbers p ', q' in order to find the private key d at some point, taking e into account. With small prime numbers p and q, this problem is relatively easy to solve simply by trying it out. However, if p and q, i.e. the module n, which is the product of p and q, become larger and larger, the various possibilities for factorizing the module n increase to astronomical heights. The security of the RSA system is based on this. From this it can be seen that a secure RSA cryptosystem must use very long numbers, which can be, for example, 512, 1024 or even up to 2048 bits long.

From FIG. 3 it can be seen that both for RSA encryption, in order to generate an encrypted message c from an unencrypted message m, and for decryption, that is, in order to generate a decrypted message m from an encrypted message c, a modular exponentiation has to be calculated. This is made clear in FIG. 3 by steps 220 and 260. When calculating the modular exponentiation, the Chinese residual theorem (CRT) is particularly favorable when the integers used, and in particular the module n, are long numbers. Like it However, the security of the RSA algorithm is based on the fact that the integers are long.

The Chinese remainder of the sentence is described in the “Handbook of Applied Cryptography, which was mentioned earlier, on page 610 ff. The Chinese remainder theorem, and particularly in its form, which is known as Garner ^'s algorithm, is based on splitting the modular exponentiation with the module n into two modular exponentiations of second sub-modules p, q, the sub-modules p, q being prime numbers and the product of which gives the module n. A modular exponentiation with a long module is thus broken down into two modular exponentiations with shorter (typically half as long) sub-modules. This method is advantageous in that only half as long arithmetic units are required or that, with the same length of an arithmetic unit, twice as long numbers can be used, which results in a more favorable ratio of security to chip area, that is generally in a better ratio of Performance at price results.

The Chinese residual theorem applied to the modular exponentiation described is as follows. First, two prime numbers pq are determined, which should be as nearly as long as possible, and whose product p x q results in module n. A first auxiliary variable dp is then calculated as follows:

dp = d mod (p - 1).

A second auxiliary variable dq is then calculated:

dq = d mod (q - 1).

Then a third auxiliary variable Mp is calculated:

Mp = c ^dp mod p. Another auxiliary variable Mq is calculated as follows:

Mq = c ^dq mod q.

In a final summarizing step, the result of the modular exponentiation, i.e. H. In the present example, the plain text message m is calculated as follows if c is the encrypted message:

m = Mq + [(Mp - Mq) xq ^_1 mod p] xq

From the preceding representation of the Chinese remainder of the sentence it can be seen that a modular exponentiation with a long module n has been broken down into two modular exponentiations with half as long sub-modules p, q, and then, in the last step, to calculate the plain text message m , a summary operation is carried out in which the multiplicative inverse q ^_1 with respect to a submodule p is required. Since the submodule p is shorter than the original module n, the calculation of the ultimate inverse q ^-1 z is also possible. B. using the extended Euclidean algorithm, possible with reasonable computational effort.

Although the use of the Chinese remainder set reduces the computing time efficiency or the chip area consumption of a security IC, the Chinese remainder set poses problems due to attacks on the cryptography system, such as B. so-called side-channel attacks, performance analyzes or

Error attacks. An attacker could carry out such attacks on the algorithm in order to "crack" the private key d.

In the case of RSA encryption, that is, if an encrypted message c is to be calculated from the plain text message m, the security problem is not so evident because Encryption of a message anyway only the public key e is used. However, the problem arises when using RSA as a signature algorithm.

The object of the present invention is to provide a safe and efficient concept for calculating the modular exponentiation, which protects the RSA signature by means of CRT against error attacks.

This object is achieved by a device for calculating a result of a modular exponentiation according to patent claim 1 or 6 or by a device for calculating a result of a modular exponentiation according to patent claim 9 or 10.

The present invention is based on the knowledge that the security of the modular exponentiation, which is the basic operation for RSA encryption, can be increased even if the Chinese remainder theorem is used in order to be able to calculate the RSA exponentiation more efficiently.

This is achieved by randomizing the required auxiliary quantities for the Chinese remaining sentence or by introducing a safety parameter in the modular exponentiations for the sub-modules. The randomization of the exponents and / or the change in the module of the two “auxiliary exponentiations” of the Chinese remainder set caused by the security parameter provide increased security against side-channel attacks or error attacks.

Another advantage of the present invention is that existing crypto processors, with which the RSA exponentiation can be calculated using the CRT, do not have to be modified, but only the standard CRT parameters have to be modified, but not the central calculation steps for the calculation of the two modular exponents using the sub-modules. This means that all existing structures for key management of the RSA keys can continue to be used.

Preferred embodiments of the present invention are explained in detail below with reference to the accompanying drawings. Show it:

1 shows a device for calculating the modular exposure according to a first exemplary embodiment of the present invention, in which the exponents of the auxiliary exponentiations are randomized;

2a shows a section of a device for calculating the modular exponentiation according to a second

Embodiment of the present invention that can be used either alone or together with the first embodiment of the present invention, the sub-modules being randomized;

2b shows an error checking technique for checking the results of the auxiliary exponents before the results are summarized; and

Fig. 3 is a schematic flow diagram of the RSA algorithm for encryption and decryption.

1 shows a device according to the invention for reliably calculating the result of a modular exponentiation using the Chinese residual theorem. The input parameters are two prime numbers p, q, whose products result in the module n of the modular exponentiation. Another input parameter is the key d. In the following, the first exemplary embodiment of the present invention is illustrated using the decryption in the RSA algorithm. An encrypted message c becomes private using the Key d the decrypted message m calculated according to the following equation:

m = c mod n.

The device according to the invention comprises a device 100 for calculating the first auxiliary variable dp according to the following equation:

dp = d mod (p - 1).

Another device 102 for calculating a second auxiliary variable dq executes the following equation:

dq = d mod (q - 1).

The device according to the invention for calculating a result of a modular exponentiation further comprises a device 104 for generating a random number IRND 104. This device is in turn followed by a device 106 in order to calculate a third auxiliary variable dp 'according to the following equation:

dp 'IRND x (p - 1) + dp.

The third auxiliary variable dp 'is thus a randomized exponent of the first auxiliary exponentiation, which is calculated by means 110 for calculating the fifth auxiliary variable Mp, which is designed to carry out the following equation:

Mp = c ^dp mod p.

Analogously to this, a device 108 is provided to calculate a fourth auxiliary variable dq 'according to the following equation:

dq '= IRND (q - 1) + dq. A means 112 calculates the sixth auxiliary variable Mq using the fourth auxiliary variable, which represents the randomized exponent of the second auxiliary exponentiation:

Mq = c ^{dq '} mod q.

A device 114 finally calculates the result m, i.e. H. in the present example the decrypted message, according to the following equation:

m Mq + [(Mp - Mq) x q mod p] x q.

The modular exponentiation required for the RSA algorithm can also be made safer if the auxiliary module d or the auxiliary module q are changed. This is shown in Fig. 2a. A device according to a second exemplary embodiment of the present invention comprises a device 120 for generating a prime number T as a security parameter, which is preferably a relatively small prime number, so that the computing time advantage of the Chinese remaining sentence is not “sacrificed” too much in favor of security. The result The first auxiliary exponentiation Mp, like the result of the second auxiliary exponentiation Mq, is then not used by the devices using the original auxiliary sub-modules p, q, but instead using the auxiliary sub-modules px T or qx T with the safety parameter 110 'or 112', the change in sub-modules p, q alone, ie without randomizing the

Auxiliary exponents dp 'and dq' provide increased security against cryptographic attacks. However, the safest variant according to the present invention is to use both the randomization of the auxiliary exponents, as shown in FIG. 1, and the modified auxiliary modules, as shown in FIG. 2a. In this case, the device for calculating a result of a modular Exponentiation as shown in Fig. 1, but with the difference that the device 120 is provided, and the device 110 and 112 of Fig. 1 instead of the sub-modules p, q the sub-modules pT and qT to which the safety parameter is applied use.

The use of the sub-modules charged with the safety parameter together with the randomized exponents makes it possible, as shown in FIG. 2 b, to carry out an auxiliary calculation before calculating the result using the device 114 from FIG. 1, as is shown in FIG Block 140 of Figure 2b is shown. If this equation is satisfied, an output can be made that the Chinese Remainder Sentence (CRT) has been executed correctly (block 142).

If the equality condition represented by the device 140 is not fulfilled, an output 144 can take place. If a CRT error occurs, the calculation can be terminated here before the "summary" by the device 114. Furthermore, it is also ensured that the randomized auxiliary exponents dp 'and dq ^' refer to the sub-modules pT or qT are coordinated if, as is preferred, both the auxiliary exponents are randomized and the sub-modules are changed, the relatively small prime number 32771 is preferred as the security parameter T in the sense of a compromise between CRT computing savings and security due to the extended sub-modules ,

The intermediate result check by the device 140 ensures that the algorithm is terminated even before a result is output if, for example, an error attack has been carried out on the security IC during the calculation of M _p and / or M _q . This attack will fail because, in the event of such an attack, "CRT error" is generated by the device 140, so that no output is received and the error attack is therefore ineffective. It should also be pointed out that this protection by the intermediate result check is relatively inexpensive, since the parameter T is preferably a small prime number, so that the exponentiation in block 140 of FIG. 2b has a small exponent in comparison to the module.

LIST OF REFERENCE NUMBERS

100 means for calculating a first auxiliary variable dp 102 means for calculating a second auxiliary variable dq 104 means for generating a random number IRND 106 means for generating a third auxiliary variable dp '108 means for generating a fourth auxiliary variable dq' 110 means for calculating a fifth auxiliary variable Mp 110 'means for generating the fifth auxiliary variable Mp using a modified sub-module 112 means for calculating a sixth auxiliary variable Mq 112' means for generating the sixth auxiliary variable Mq using a modified sub-module 114 means for calculating the result of the modular exponentiation 120 means for generating the Safety parameters T 140 device for calculating a seventh auxiliary variable H7 and an eighth auxiliary variable H8 142 device for confirming the correspondence of the seventh and eighth auxiliary variables 144 device for indicating an error in the CRT 200 Obtaining the public key 210 representing the message as a number 220 computing c 230 output c 240 channel

250 receiving c 260 calculating m

Claims

claims

1. Device for calculating a result of a modular exponentiation, where n is a module, where d is an exponent, and where c is a variable to be subjected to the modular exponentiation, with the following features:

a device (100) for calculating a first auxiliary variable dp, dp being defined as follows:

dp = d mod (p - 1),

where p is a first prime number;

a device (102) for calculating a second auxiliary variable dq, dq being defined as follows:

dq = d mod (q - 1),

where q is a second prime number

where a product of p and q is equal to the module n;

means (104) for generating a random number (IRND);

a device (106) for generating a third auxiliary variable dp ', dp' being defined as follows:

dp '= IRND x (p - 1) + dp;

a device (108) for generating a fourth auxiliary variable dq ', dq' being defined as follows:

dq '= IRND x (q - 1) + dq; a device (110) for generating a fifth auxiliary variable Mp, the fifth auxiliary variable Mp being defined as follows:

Mp = c ^dp mod p;

a device (112) for generating a sixth auxiliary variable Mq, the sixth auxiliary variable Mq being defined as follows:

Mq = c ^dq 'mod q; and

a device (114) for calculating the result of the modular exponentiation m, the following defining in:

Mq + [(Mp - Mq) x q mod p] x q.

2. The apparatus of claim 1, further comprising means (120) for generating a safety parameter T,

wherein the device (110) for generating the fifth auxiliary variable Mp is designed to calculate the fifth auxiliary variable as follows:

Mp = ^ ^α P mod (pT); and

wherein the device (112) for generating the sixth auxiliary variable Mq is designed to calculate the sixth auxiliary variable Mq as follows:

Mq = c ^{dq '} mod (qx T).

3. The apparatus of claim 2, further comprising means for calculating a seventh auxiliary variable H7, the seventh auxiliary variable H7 being defined as follows: H7 = Mp x Mq mod T; and

in which a device for calculating an eighth auxiliary variable H8 is further provided, the eighth auxiliary variable H8 being defined as follows:

_H 8 = _C (' ⁺ dq') mod (Tl) _{mQd τ} . _and

means for comparing the seventh and eighth auxiliary variables, the means for comparing being arranged to indicate an error if the seventh and eighth auxiliary variables are different.

4. Device according to one of the preceding claims, which is provided for an RSA decryption or RSA signature, where m is a plain text message, where d is a secret key, and where c is an encrypted message.

5. Device for calculating a result of an odular exponentiation, where n is a module, where d is an exponent, and where c is a quantity to be subjected to the modular exponentiation, with the following features:

dp = d mod (p - 1),

where p is a first prime number;

dq = d mod (q - 1),

where q is a second prime number where a product of p and q is equal to the module n;

means (104) for providing a security parameter T;

a device for generating a third auxiliary variable p x T and a fourth auxiliary variable q x T;

a device (110) for generating a fifth auxiliary variable Mp, the fifth auxiliary variable Mp being defined as follows:

Mp = c ^dq mod (px T);

Mq = c ^dq mod (qx T); and

a device (114) for calculating the result of the modular exponentiation m, where m is defined as follows:

m = Mq + [(Mp - Mq) xq ^_1 mod p] x q.

6. The device according to claim 5, wherein the security parameter T is a prime number.

7. The device according to claim 3 or 5, wherein the security parameter T is small in comparison to the first prime number p or to the second prime number q.

8. A method for calculating a result of a modular exponentiation, where n is a module, where d is an exponent, and where c is a quantity to be subjected to the modular exponentiation, with the following steps: Calculate (100) a first auxiliary variable dp, where dp is defined as follows:

dp = d mod (p - 1),

where p is a first prime number;

Calculate (102) a second auxiliary variable dq, where dq is defined as follows:

dq = d mod (q - 1),

where q is a second prime number

where a product of p and q is equal to the module n;

Providing (104) a random number (IRND);

Generate (106) a third auxiliary variable dp ', where dp' is defined as follows:

dp '= IRND x (p - 1) + dp;

Generate (108) a fourth auxiliary variable dq ', dq' being defined as follows:

dq '= IRND x (q - 1) + dq;

Generating (110) a fifth auxiliary variable Mp, the fifth auxiliary variable Mp being defined as follows:

Mp = c ^dp mod p;

Generate (112) a sixth auxiliary variable Mq, the sixth auxiliary variable Mq being defined as follows: Mq = c ^{dq '} mod q; and

Calculate (114) the result of the modular exponentiation m, where m is defined as follows:

m = Mq + [(Mp - Mq) xq ^"1 mod p] x q.

9. A method of calculating a result of a modular exponentiation, where n is a module, where d is an exponent, and where c is a quantity to be subjected to the modular exponentiation, with the following steps:

Calculate (100) a first auxiliary variable dp, where dp is defined as follows:

dp = d mod (p - 1),

where p is a first prime number;

Calculate (102) a second auxiliary variable dq, where dq is defined as follows:

dq = d mod (q - 1),

where q is a second prime number

where a product of p and q is equal to the module n;

Generating (104) a security parameter T;

Generating a third auxiliary variable p x T and a fourth auxiliary variable q x T;

Mp = c ^dp mod (px T); Generate (112) a sixth auxiliary variable Mq, the sixth auxiliary variable Mq being defined as follows:

Mq = c ^dq mod (qx T); and

m = Mq + [(Mp - Mq) xq ^-1 mod p] x q.