Hardware implementation of Montgomery's modular multiplication algorithm

1993 ◽  
Vol 42 (6) ◽  
pp. 693-699 ◽  
Author(s):  
S.E. Eldridge ◽  
C.D. Walter
Keyword(s):  
Hardware Implementation ◽  
Modular Multiplication ◽  
Multiplication Algorithm

scholarly journals Timing attacks and local timing attacks against Barrett’s modular multiplication algorithm

2021 ◽  
Author(s):  
Johannes Mittmann ◽  
Werner Schindler
Keyword(s):  
Side Channel ◽  
Modular Exponentiation ◽  
Modular Multiplication ◽  
Multiplication Algorithm ◽  
Diffie Hellman ◽  
Mathematical Difficulties ◽  
Execution Times ◽  
Stochastic Properties ◽  
Timing Attacks ◽  
Theoretical Results

AbstractMontgomery’s and Barrett’s modular multiplication algorithms are widely used in modular exponentiation algorithms, e.g. to compute RSA or ECC operations. While Montgomery’s multiplication algorithm has been studied extensively in the literature and many side-channel attacks have been detected, to our best knowledge no thorough analysis exists for Barrett’s multiplication algorithm. This article closes this gap. For both Montgomery’s and Barrett’s multiplication algorithm, differences of the execution times are caused by conditional integer subtractions, so-called extra reductions. Barrett’s multiplication algorithm allows even two extra reductions, and this feature increases the mathematical difficulties significantly. We formulate and analyse a two-dimensional Markov process, from which we deduce relevant stochastic properties of Barrett’s multiplication algorithm within modular exponentiation algorithms. This allows to transfer the timing attacks and local timing attacks (where a second side-channel attack exhibits the execution times of the particular modular squarings and multiplications) on Montgomery’s multiplication algorithm to attacks on Barrett’s algorithm. However, there are also differences. Barrett’s multiplication algorithm requires additional attack substeps, and the attack efficiency is much more sensitive to variations of the parameters. We treat timing attacks on RSA with CRT, on RSA without CRT, and on Diffie–Hellman, as well as local timing attacks against these algorithms in the presence of basis blinding. Experiments confirm our theoretical results.

Sign in / Sign up

Export Citation Format

Share Document