Design and implementation of a side-channel resistant and low power RSA processor
REN Yanting1,2, WU Liji1,2, LI Xiangyu1,2, WANG An1,2, ZHANG Xiangmin1,2
1. Institute of Microelectronics, Tsinghua University, Beijing 100084, China;
2. Tsinghua National Laboratory for Information Science and Technology, Beijing 100084, China
Abstract：RSA is the most widely used public-key algorithm, and is specified as the signature algorithm in bank IC cards. The unprotected RSA implementation is vulnerable to side-channel attacks as pointed out in several works. Due to the complexity of the algorithm, the power consumption of an RSA module is usually high. A side-channel resistant, efficient and low-power RSA processor was designed using countermeasures against side-channel attacks based on the Montgomery ladder with a modified Montgomery algorithm then proposed, which combines CIOS and Karatsuba algorithms. The computation time of modular multiplication can be reduced by 25% with the length of RSA being configurable and up to 2 048 bits. The proposed RSA module was verified with C*Core C0 in FPGA board. With SMIC 0.13 μm CMOS process, the EDA synthesis result indicates that the area is about 24 000 gates, and the throughput of 1024-bit RSA is 8.3 kb/s under the frequency of 30 MHz with the power consumption of 1.15 mW.
任燕婷, 乌力吉, 李翔宇, 王安, 张向民. 抗攻击低功耗RSA处理器设计与实现[J]. 清华大学学报（自然科学版）, 2016, 56(1): 1-6.
REN Yanting, WU Liji, LI Xiangyu, WANG An, ZHANG Xiangmin. Design and implementation of a side-channel resistant and low power RSA processor. Journal of Tsinghua University(Science and Technology), 2016, 56(1): 1-6.
[1] Rivest R L, Shamir A, Adleman L. A method for obtaining digital signatures and public-key cryptosystems [J]. Cmmunications of the ACM, 1978, 21(2): 120-126.
[2] Kocher P, Jaffe J, Jun B. Differential power analysis [C]//Advances in Cryptology—CRYPTO'99. Springer Berlin Heidelberg, 1999: 388-397.
[3] Marc J, Michael T. Fault Analysis in Cryptography [M]. Springer Berlin Heidelberg, 2012.
[4] Marc J, YEN Sungming. The Montgomery powering ladder [C]//Proc CHES. Springer, 2003: 291-302.
[5] Giraud C. An RSA implementation resistant to fault attacks and to simple power analysis [J]. Computers, IEEE Transactions on, 2006, 55(9): 1116-1120.
[6] Montgomery P L. Modular multiplication without trial division [J]. Mathematics of Computation, 1985, 44(1): 519-521.
[7] Koç C K, Acar T, Kaliski B S. Analyzing and comparing Montgomery multiplication algorithms [J]. IEEE Micro, 16(3), 1996: 26-33.
[8] 孔凡玉, 于佳, 李大兴. 一种改进的Montgomery模乘快速算法[J]. 计算机工程, 2005, 31(8): 1-3.KONG Fanyu, YU Jia, LI Daxing. An improved fast Montgomery multiplication algorithm [J]. Computer Engineering, 2005, 31(8): 1-3. (in Chinese)
[9] Karatsuba A, Ofman Y. Multiplication of many-digital numbers by automatic computers [J]. Proceedings of the USSR Academy of Science, 1962, 145: 293-294.
[10] WANG Deming, DING Yanyu, ZHANG Jun, et al. Area-efficient and ultra-low-power architecture of RSA processor for RFID [J]. Electronic Letters, 2012, 48(19): 1185-1187.
[11] HUANG Wei, YOU Kaidi, ZHANG Suiyu, et al. Unified low cost crypto architecture accelerating RSA/SHA-1 for security processor [C]//ASICON'09. 2009: 151-154.
2016, Vol. 56 
