m-ary 멱승 연산에 대한 새로운 단순 전력 분석 공격
A New Simple Power Analysis Attack on the m-ary Exponentiation Implementation
2
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
RSA와 같은 공개 키 암호시스템을 구현할 경우 멱승 연산이 사용되며 이를 고속화하기 위한 방법들이 연구되었다. 반면, 공격자들은 비밀 키를 얻기 위해 멱승 알고리듬의 연산 과정에서 발생하는 소비 전력이나 전자기파를 이용하는 부채널 공격을 시도해 왔다. 본 논문에서는 멱승의 고속화를 위해 사용되는 알고리듬 중 m-ary 멱승 알고리듬에 대한 새로운 전력 분석 공격을 제시하고자 한다. 제안 공격 방식의 핵심은 사전 계산을 사용하는 멱승 연산에서 비밀 키와 연관성을 가진 소비 전력 패턴을 구별해 낼 수 있도록 공격자가 입력 메시지를 조정하는 것이다. 논문에서는m-ary 알고리듬을 실제 실험용 보드에 구현한 후 제안된 단순 전력 분석 공격을 시도한 결과, 멱승에 사용된 비밀키가 노출되는 취약성이 있음을 확인하였다.
Abstract
There are many researches on fast exponentiation algorithm which is used to implement a public key cryptosystem such asRSA. On the other hand, the malicious attacker has tried various side-channel attacks to extract the secret key. In these attacks,an attacker uses the power consumption or electromagnetic radiation of cryptographic devices which is measured duringcomputation of exponentiation algorithm. In this paper, we propose a novel simple power analysis attack on m-aryexponentiation implementation. The core idea of our attack on m-ary exponentiation with pre-computation process is that anattacker controls the input message to identify the power consumption patterns which are related with secret key. Furthermore,we implement the m-ary exponentiation on evaluation board and apply our simple power analysis attack to it. As a result, weverify that the secret key can be revealed in experimental environment.
참고문헌 (21)
- R. Rivest, "A method for obtaining digital signature and public-key cryptosystems", Communications of the ACM, 21(2), pp.120~126 (1978)
- T. ElGamal, "A public key cryptosystem and a signature scheme based on discrete logarithms", IEEE Transactions on Information Theory, 31(4), pp.469~472 (1985)
- D. E. Knuth, "The art of computer programming : Seminumerical algorithms" (1981), Addison-Wesley
- C. K. Koc, "Analysis of sliding window techniques for exponentiation", Computers and Mathematics with Application, 30(10), pp.17~24 (1995)
- P. Kocher, ""Timing Attacks on Implementation of Diffie-Hellman, RSA, DSS, and other systems," CRYPTO'96", LNCS, 1109, pp.104~113 (1996), LNCS
- P. Kocher, "“Differential power analysis," CRYPTO'99", LNCS, 1666, pp.388~397 (1999)
- T. S. Messerges, "Sloan, "Power analysis attacks on modular exponentiation in smartcards,"CHES'99", LNCS, 1717, pp.144~157 (1999), LNCS
- S. Mangard, "Power analysis attacks - Revealing the secrets of smart cards" (2010), Springer-Verlag
- J. S. Coron, ""Resistance against differential power analysis for elliptic curve cryptosystems," CHES'99", LNCS, 1717, pp.292~302 (1999)
- D. Boneh, "“On the Importance of checking cryptographic protocols for faults," EUROCRYPTO'97", LNCS, 1233, pp.37~51 (1997)
- C. Aumüller, ""Fault attacks on RSA with CRT: Concrete results and practical countermeasures." CHES'02", LNCS, 2523, pp.260~275 (2003)
- A. Boscher, ""CRT-RSA algorithm protected against fault attacks," WISTP'07", LNCS, 4462, pp.237~252 (2007)
- F. Amiel, "Passive and active combined attacks:Combining fault attacks and side channel analysis", Proceedings of the 4th Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC'07), pp.92~102 (2007)
- 김형동, "BNP 멱승 알고리듬에 대한 물리적인 조합 공격 및 대응책", 정보보호학회논문지, 23(4), pp.585~591 (2013), 한국정보보호학회[DOI]
- S. M. Yen, "Checking before output may not be enough against fault-based cryptanalysis", IEEE Transactions on Computers, 49(9), pp.967~970 (2000)
- M. Joye, ""The Montgomery powering ladder," CHES'02", LNCS, 2523, pp.291~302 (2002)
- S. Yen, "Relative doubling attack against Montgomery ladder, ICISC'05", LNCS, 3935, pp.117~128 (2005)
- S. K. Jung, "Vulnerability of exponentiation algorithm for smartphone by simple power analysis Attack", Proceedings of Chungcheong Regional Conference on Korea Institute of Information Security, 17, pp.16~22 (2013)
- "SCARF evaluation board SCARF-ARM"[URL]
- RSA Laboratories, "PKCS #1 v2.2 : RSA Cryptography standard", ~ (2012)
- S. M. Yen, "Power analysis by exploiting chosen message and internal collisions – Vulnerability of checking mechanism for RSA-decryption", LNCS, 3715, pp.183~195 (2005)