4
$\begingroup$

Assume that there is a smartcard or other hardware token that exposes the raw RSA private key operation (modular exponentiation, with or without CRT parameters). Is there any possibility that raw RSA leaks information about the private key that would not otherwise become available?

Please clearly distinguish between attacks on the algorithm itself and side channel attacks. This question is not about the security of unpadded RSA signatures themselves.

Improve this question
$\endgroup$
8
  • $\begingroup$ I'm presuming that the RSA problem would disallow any information being leaked by the algorithm itself but presumptions are dangerous... $\endgroup$
    – Maarten Bodewes ♦
    Commented Mar 24, 2016 at 9:59
  • $\begingroup$ what do you mean by the "raw RSA private key operation"? $\endgroup$
    – gusto2
    Commented Mar 24, 2016 at 12:39
  • $\begingroup$ @GabrielVince Modular exponentiation or a CRT parameter. Everything except the padding basically. Edited question to make this clear, thanks. $\endgroup$
    – Maarten Bodewes ♦
    Commented Mar 24, 2016 at 12:41
  • $\begingroup$ Even in modern smart cards there are operations working with the private key (signing, decrypting, ..). Now disregarding obvious side-channel attacks (power consumption, failure state, ..) which modern cards should mitigate - exposing some direct private key operations could open options to other attacks, like using arbitrary / invalid group lengths, encrypt and sign with the same key, ... $\endgroup$
    – gusto2
    Commented Mar 24, 2016 at 13:04
  • 1
    $\begingroup$ As far as I know blind RSA signatures are secure (e.g. for untraceable money) and they expose the raw private key operation. $\endgroup$
    – CodesInChaos
    Commented Mar 24, 2016 at 13:15

1 Answer 1

Reset to default
2
$\begingroup$

As far as we know, no: from a mathematical standpoint, exposure of the raw RSA private key operation does not leak the private key, or anything allowing to perform the raw RSA private key operation (such as another private key, or a factorization of the public modulus). We have no proof; but this has been well studied, and any advance in that direction would make the headlines.

Things can be very different in practice, where you have to consider side channel and fault injection attacks. There are so many such attacks around, and they depend so much on the implementation (hardware, CRT or full modulus, Montgomery or straight arithmetic, blinding(s), randomized exponent scanning, other countermeasures..) that I pass on that part of the question.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.