3
$\begingroup$

I know that blinding can be used as a countermeasure against side-channel timing attacks on RSA-CRT: RSA Timing Attack and Prevention through blinding

My question is: can blinding also be used as a countermeasure against differential fault injection attacks on RSA with CRT as described by BellCoRe (see: https://hal.archives-ouvertes.fr/hal-00939473/document and here: https://www.limited-entropy.com/crypto-series-dfa/)

New contributor
Helmut Bierbaumer is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
$\endgroup$
3
$\begingroup$

In the original Bellcore attack, the attacker needs to obtain a valid signature and a signature where the computation of one of the coefficients is faulty. The exact nature of the fault does not matter, as long as it affects one of the exponentiations. Therefore it doesn't matter how the coefficients are calculated: blinding has no impact on this attack.

In any case, a cheap defense against single-fault Bellcore-style attacks against RSA is to perform the public-key operation after the private-key operation and compare against the input to the private-key operation.

Blinding may help with more advanced variants involving multiple faults. If the attack requires the faults to happen in a specific way, blinding might cause the result to be unusable for the attacker. I'm not familiar with the literature on those variants.

$\endgroup$
3
  • $\begingroup$ Thank you very much for your answer.I guess blinding could only help if randomization is done before exponentiation to ensure that the same message is never signed twice. But in case of message signing with RSA this makes no sense, because then the signature of a a a randomized message is computed. $\endgroup$ – Helmut Bierbaumer May 5 at 8:52
  • 1
    $\begingroup$ "The exact nature of the fault does not matter," provided that it's in (exactly) one of the modular exponentiation $y_p\gets x^{d_p}\bmod p$ or $y_q\gets x^{d_q}\bmod q$, rather than in the preparation of $x$ or the final $y\gets((y_p-y_q)\,q_\text{inv}\bmod p)\,q+y_q$. That does not change the answer's conclusion, even if the blinding was tweaking the moduli $p$ and $q$ (e.g. computing the exponentiations modulo $r\,p$ and $s\,q$ for some small random $r$ and $s$ ), as long as there is no self-check in the blinding. $\endgroup$ – fgrieu May 5 at 15:24
  • $\begingroup$ Many thanks for the detailed explanation and further clarification! $\endgroup$ – Helmut Bierbaumer May 5 at 16:59

Your Answer

Helmut Bierbaumer is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.