Timing Attacks to RSA Presented by Zhanxiang Agenda

Timing Attacks to RSA Presented by Zhanxiang

Agenda l Background of Timing Attack l Case study: David Brumley and Dan Boneh, “Remote Timing Attacks are Practical” (UC Berkeley)

What is Timing Attack? l Timing attacks: Expose private information, such as RSA keys, by measuring the amount of time required to perform private key operations (Decryptions). l Side-channel attacks: l Power analysis l Electromagnetic radiation analysis l Timing attacks

Some Timing Attacks on RSA l Kocher’s attack 1996 [2] l l l reported on page A 1 of Monday's New York Times ("Secure Digital Transactions Just Got a Little Less Secure" by John Markoff). Not apply to RSA-CRT. Schindler’s attack 2001 l Not work for implementation using (e. g. Open. SSL): l l l Sliding windows instead of square and multiply (exponentiation) Two multiplication algorithms. Brumley-Boneh’s attack 2003 [1] l l Attack on RSA of Open. SSL [1] won the best paper of Usenix. Secure’ 03.

Why people care? l Security of RSA depends on the difficulty to factor the public key N l Open. SSL applications are popular l Since it can hack simple devices, e. g. smartcards, how about complex environments, such network?

Implementation of Open. SSL l RSA with CRT speedup l Computation library l How are exponentiation, modular reduction and multiplication operations implemented

RSA quick review l l Multiple prime RSA key generating algorithm 1. Select k primes: p 1, p 2, …, pk 2. Let n=∏pi, i=1, 2, …, k 3. Let φ(n)=∏(pi-1) 4. Choose e, s. t. gcd(e, φ(n))=1 5. Calculate d=e-1(mod φ(n)) 6. Public Key = (e, n) and Private key = (d, n) Encryption: c=me mod n Decryption: m=cd mod n

Chinese Remainder Theorem n = n 1 n 2…nk with gcd (ni; nj ) = 1 when i != j l The system of congruencies x=x 1(mod n 1)=…=xk(mod nk) has a simultaneous solution x to all of the congruencies, and there exists exactly one solution x between 0 and n-1. l

Speedup RSA with CRT Any message M<N is uniquely represented by the tuple [MP; MQ ], where MP = M(mod P) and MQ = M(mod Q). CP = C(mod P) and CQ = C(mod Q). DP = D(mod (P-1)) and DQ = D(mod (Q-1)) RP = QP-1(mod N) and RQ = PQ-1(mod N) MP = CPDP(mod P) and MQ = CQDQ(mod Q) SP = MPRP(mod N) and SQ = MQRQ(mod N) M = SP + SQ. If M>=N then calc M=M-N. [3] l

Operations needed for Decryption l Computing cd(mod p) and xy(mod p) requires: l Multiplication routines Normal (unequal len) l Karatsuba (equal len): faster l l Exponentiation l l Sliding windows Modular reduction Montgomery l The key relevant fact is the extra reduction l

What causes time variance? l Montgomery reduction Given g calc g (mod q) l Probability for and extra reduction is: P[extra step] (g mod q)/2 q l l Choice of multiplication routine l l To calc x*g mod q, if x is the same length as (g mod q), use Karatsuba. O(nlog 23) Otherwise, use Normal. O(nm)

Summary of time variance g<q g>q Montgomer Longer y effect Shorter Multiplicati on effect Longer Shorter g is the decryption value. Each is dominant at a different phase.

Time Attack on Open. SSL(1/4) l Assume: N=pq with q<p. Goal: approximations approaching q l Idea: Make initial guess and refine it by learning bits one at a time, from the most significant.

Time Attack on Open. SSL(2/4) l Init guess g of q lying between 2512 (i. e. N/2) and 2511(i. e. N/4) l Try all the combinations of the top few bits Time the decryptions and pick the first peak for guess of q; (After all we at least know the first bit is 1)

Time Attack on Open. SSL(3/4) l Suppose from 1 to i-1 bits g=q, elsewhere g=0 l Recover i’th bit of q as follows: (1) ghi=g, but with i’th bit 1. If i’th bit of q is 1 then g<ghi<q, else g<q<ghi. (2) ug=g. R-1 mod N, ughi=ghi. R-1 mod N (3) t 1=Decrtypt. Time(ug), t 2=Decrypt. Time(ughi). (4) D=|t 1 -t 2|. If D is large then g<q<ghi and i’th bit of q is 1, otherwise the bit is 0.

Time Attack on Open. SSL(4/4) l We know what is “large” and “small” from attack on previous bits. l Decrypting just g does not work because of sliding windows l l Decrypt a neighborhood of values near g, and Tg=∑Tg+i Will increase difference between large and small values Thus larger 0 -1 gap l Only need to recover q/2 bits of q l Attack requires only 2 hours, about 1. 4 million queries

Real World Attack(1/2) l l l Discuss an attack on SSL applications such as an Apache web server with mod_SSL. During the handshake, SSL server performs RSA decryption of CLIENT-KEY-EXCHANGE message (sent by client) using its private key. The goal is getting this key. After decryption, the server checks PKCS 1 padded random bytes and sends an error message back to client in case of an error. The client can send another message to the server that will be decrypted there.

Real World Attack(2/2) Attack Client 1. Client. Hello 2. Server. Hello (send public key) 3. Record time t 1 Send guess Ug or Ughi 4. Alert 5. Record time t 2 Compute Decrypt. Time(Ughi)=t 2 –t 1 SSL Server

Experiments (1/5) [1] l Test the effects on increasing the number of decryption requests required to recover a single bit of q reliably. Two parameters: neighborhood size (n) and sample size (s). Total number of queries is s*n. Using sample size of 7 and neighborhood of 400, 1433600 total queries. Attack time (on 1024 -bit key) is about 2 hours.

Experiments (2/5) [1] l Architecture effects: compare two versions of a program making local calls to Open. SSL: “regular” and “extra-inst” with 6 additional nops before decryption. • Explanation: different cache hit rate: 0. 139% of load misses for “normal” and 0. 151% for “extra-inst”.

Experiments (3/5) [1] l Compile-time effects: l l l Optimized (-O 3 –fomit_frame_pointer –mcpu=pentium); No Pentium flag (-O 3 –fomit_frame_pointer); Unoptimized (-g).

Experiments (4/5) [1] l Source-based optimizations: implemented a minor patch that improves the efficiency of of CRT decryption check.

Experiments (5/5) [1] l Attacking SSL applications on the local network:

Preconditions & Defense l Preconditions: l l Open. SSL does not enable defend option Not fix response time … Defense: l l l Only one multiplication routine and always carry out extra reduction in Montgomery’s algorithm Quantize all RSA computations Blinding (Currently preferred)

Blinding Defenses [1] l Blinding: before decryption compute x=reg mod N, where r is random. Then decrypt x, then compute x/r. Incurs 2%-10% penalty.

Reference [1] David Brumley and Dan Boneh, “Remote Timing Attacks are Practical”, 2003 [2] Paul C. Kocher, “Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems” 2001 [3] Johann Gro. Bschadl, “The Chinese Remainder Theorem and its Application in a High-Speed RSA Crypto Chip” [4]http: //www. rsasecurity. com/rsalabs/challenges/f actoring/numbers. html