CN106571916B - Decryption device, method and circuit - Google Patents

Abstract

A decryption method includes: receiving encrypted data, wherein the encrypted data is encrypted by an RSA public key; and performing at least one multiplication operation and at least one square operation according to the RSA private key and the encrypted data to obtain decrypted data; wherein a pseudo-square operation is performed according to the encrypted data while performing one of the at least one multiplication operations, or a pseudo-multiplication operation is performed according to the encrypted data while performing one of the at least one square operation.

Description

Decryption device, method and circuit

technical field

This case relates to a device, method and circuit. Specifically, this case relates to a decryption device, method and circuit.

Background technique

RSA encryption algorithm is an asymmetric encryption algorithm. The encryption device can use the RSA public key to encrypt the message, and after receiving the encrypted message, the decryption device can use the RSA private key to decrypt the encrypted message.

However, when the decryption device decrypts, the attacker can determine the operation performed by the decryption device by measuring the relevant signals (such as voltage or power) of the decryption device, and then know the RSA private key used by the decryption device.

Therefore, a decryption method that can defend against measurement attacks should be proposed.

SUMMARY OF THE INVENTION

In order to solve the above problem, an embodiment of the present case relates to a decryption method, comprising: receiving encrypted data, wherein the encrypted data is encrypted by an RSA public key; and performing at least a multiplication operation and at least a square operation according to the RSA private key and the encrypted data, to obtain decrypted data; wherein, at least one first pseudo-square operation is performed according to the encrypted data while one of the at least one multiplication operation is performed, or while one of the at least one square operation is performed, the first one is performed according to the encrypted data. Pseudo multiplication operation.

Another embodiment of the present application relates to a decryption device, which includes a communication module and a decryption element. The decryption element is used for: receiving encrypted data through the communication module, wherein the encrypted data is encrypted by the RSA public key; and performing at least one multiplication operation and at least one square operation according to the RSA private key and the encrypted data to obtain the decrypted data. When one of the at least one multiplication operation is performed, a first pseudo-square operation is performed according to the encrypted data, or when one of the at least one square operation is performed, the first pseudo-multiplication operation is performed according to the encrypted data.

Another embodiment of the present application relates to a decryption circuit including a squarer, a multiplier, a multiplexer and a scratchpad. The squarer is used for receiving an input value and performing a square operation on the input value to generate a squarer output. The multiplier is used for receiving the input value and the encrypted data, and performing a multiplication operation on the input value and the encrypted data to generate the multiplier output. The multiplexer is used for receiving the squarer output and the multiplier output, and is used for outputting one of the squarer output and the multiplier output as the multiplexer output according to the RSA private key. The scratchpad is used to temporarily store the multiplexer output and provide the multiplexer output to the squarer and multiplier as a new input value. The squaring operation and the multiplication operation are performed simultaneously.

By applying the above-mentioned embodiment, the decryption device can defend against measurement attacks when performing decryption operations.

Description of drawings

1 is a schematic diagram of a decryption system according to an embodiment of the present application;

2 is a flowchart of a decryption method according to an embodiment of the present application;

3 is a schematic diagram of a decryption method according to an embodiment of the present application;

4 is a schematic diagram of a decryption method according to another embodiment of the present application;

5 is a schematic diagram of a decryption method according to another embodiment of the present application;

FIG. 6 is a schematic diagram of a decryption circuit according to an embodiment of the present invention; and

FIG. 7 is a schematic diagram of a decryption circuit according to an embodiment of the present invention.

Symbol Description

10: Decryption system

20: Encryption device

100: Decryption device

110: Decryption components

112: Decryption circuit

114: Decryption circuit

120: Communication module

200: Decryption method

S1-S2: Steps

2, 4, 6, 8, 22, 24, 26: Sequence

SQ, MT, SQ', MT', SQ", MT": Operation

a1, a2: eigenvalues

MUX: Multiplexer

MTC: Multiplier

SQC: Squarer

REG: scratchpad

CTL: Controller

N: encrypted data

CS: Control signal

T1-T8, P1-P5, Q1-Q4: Period

Detailed ways

FIG. 1 is a schematic diagram of a decryption system 10 according to an embodiment of the present application. The decryption system 10 includes a decryption device 100 and an encryption device 20 . The encryption device 20 is used for encrypting the message by using the RSA public key to generate encrypted data N, and the decryption device 100 is used for receiving the encrypted data N and decrypting it.

The decryption device 100 includes a decryption element 110 and a communication module 120 that are electrically connected to each other. The communication module 120 is used to receive the encrypted data N from the encryption device 20 and transmit the encrypted data N to the decryption element 110 . The decryption element 110 is used for decrypting the encrypted data N.

Decryption element 110 may be implemented with a processor or other suitable computing element executing specific instructions or programs, or may be implemented with circuitry. In one embodiment, the communication module 120 can be implemented with wired or wireless communication elements.

Referring to FIG. 2 together, the decryption method 200 in FIG. 2 may be applied to the same or similar decryption apparatus 100 shown in FIG. 1 . The decryption method 200 will be described below by taking the decryption apparatus 100 in FIG. 1 as an example.

Step S1: The decryption element 110 receives the encrypted data N from the encryption device 20 through the communication module 120, and the encrypted data N is encrypted by the RSA public key.

Step S2: The decryption element 110 decrypts the encrypted data N. The decryption element 110 performs at least one multiplication operation and at least one square operation according to the RSA private key corresponding to the aforementioned RSA public key and the encrypted data N, so as to decrypt the encrypted data N and obtain the decrypted data.

For example, referring to Table 1, when the value of the aforementioned RSA private key is 123, its binary form is 2'b1111011. Therefore, when decrypting, the multiplication and/or squaring operation corresponding to each bit is performed in sequence. Taking the operation sequence 2 of FIG. 3 as an example, in the period T1, the decryption element 110 performs the square operation SQ. During periods T2 and T3, since the second digit from the left of the binary form of the RSA private key is 1, the decryption element 110 performs the multiplication operation MT and the squaring operation SQ in sequence. During the period T8, since the fifth bit from the left of the binary form of the RSA private key is 0, the decryption element 110 performs a square operation MT.

binary form 1 1 1 1 0 1 1 multiplication - ˇ ˇ ˇ - ˇ ˇ square operation ˇ ˇ ˇ ˇ ˇ ˇ -

Table I

In the decryption operation, the number of times the aforementioned multiplication is performed is the number corresponding to the value 1 in the binary form of the RSA private key. For example, in Table 1, except for the first bit from the left, the number of bits whose value is 1 is 5, so 5 multiplications are performed. Furthermore, the number of times the aforementioned squaring operation is performed corresponds to the bitlength of the aforementioned RSA private key. For example, the binary bit length of the aforementioned RSA private key is 7 bits, and the decryption element 110 needs to perform 7-1=6 square operations.

It is worth noting that while performing the multiplication operation, the decryption element 110 further performs the first pseudo-square operation according to the encrypted data N; while performing the squaring operation, the decryption element 110 further performs the first pseudo-multiplication operation according to the encrypted data N. The operation result of the first pseudo-square operation or the first pseudo-multiplication operation is not used to generate decrypted data. Since the corresponding first pseudo-square operation or the first pseudo-multiplication operation is performed at the same time when the multiplication operation or the square operation is performed, the attacker cannot measure the relevant signals of the decryption device 100 (such as power, current, voltage, temperature, etc.). frequency, etc.), to know the operations performed by the decryption device 100 during decryption and the corresponding RSA private key.

In one embodiment, the number of times the first pseudo-multiplication operation is performed may be the same as or less than the number of times that the aforementioned square operation is performed. Similarly, the number of times that the aforementioned first pseudo-square operation is performed may be the same as or less than the number of times that the aforementioned multiplication operations are performed.

An operation example will be provided below in conjunction with Figure 3. In this operation example, the value of the RSA private key is 123, and its binary form is 2'b1111011. When the decryption element 110 performs the square operation SQ, the corresponding waveform of the relevant signal of the decryption device 100 has a characteristic value (eg amplitude) a1, and when the decryption element 110 performs the multiplication operation MT, the corresponding waveform of the relevant signal of the decryption device 100 has the characteristic value value a2.

In addition, in the present operation example, while the decryption element 110 sequentially executes the operation sequence 2, the decryption element 110 sequentially executes the first pseudo-multiplication operation MT' and the first pseudo-square operation SQ' in the operation sequence 4, so that the Each squaring operation SQ is performed simultaneously with the first pseudo-multiplication operation MT', and each multiplication operation MT is performed simultaneously with the first pseudo-square operation SQ'. Wherein, when the decryption element 110 performs the first pseudo-square operation SQ′, the corresponding waveform of the correlation signal of the decryption device 100 has the characteristic value a1, and when the decryption element 110 performs the first pseudo-multiplication operation MT′, the correlation signal of the decryption device 100 The corresponding waveform of the signal has the characteristic value a2.

In this way, in the decryption operation, even if the attacker measures the relevant signals of the decryption device 100, the attacker can only obtain the sequence 6 of the corresponding signal of the summing operation sequence 2 and the operation sequence 4, and it is difficult to identify from the measurement results. Get the RSA private key.

Furthermore, in some embodiments of the present application, before or after performing the aforementioned multiplication operation or the aforementioned squaring operation, the decryption element 110 may further perform at least one second pseudo-square operation or at least one second pseudo-multiplication according to the encrypted data N. operation. Among them, the second pseudo-square operation and the second pseudo-multiplication operation are invalid operations, which are used to insert before, during, or after the original operation sequence (operation sequence 2 in FIG. 3 ) to mislead the attack using the measurement attack By.

In one embodiment, the decryption element 110 performs at least one squaring operation or a second Pseudo-square operation. In this way, it is possible to prevent an attacker from learning additional information due to an abnormal operation sequence after inserting the second pseudo-square operation or the second pseudo-multiplication operation.

An operation example will be provided below in conjunction with Figure 4. In this operation example, the value of the RSA private key is 123, and its binary form is 2'b1111011. In the decryption operation, the decryption element 110 sequentially performs the square operation SQ, the multiplication operation MT, the second pseudo-square operation SQ" and the second pseudo-multiplication operation MT" in the operation sequence 8. The operation results of the second pseudo-square operation SQ" and the second pseudo-multiplication operation MT" are not used to generate decrypted data. In this way, during the decryption operation, even if the attacker measures the relevant signals of the decryption device 100 to know that the decryption device 100 performs the operations in the operation sequence 8, the attacker cannot identify the RSA private key accordingly.

5, the decryption element 110 may perform an operation sequence 22 inserting a second pseudo-square operation SQ" and a second pseudo-multiplication operation MT". Wherein, while performing the operation sequence 22, the decryption element 110 can also perform the operation sequence 24, so as to perform the corresponding first operation while performing at least one of the square operation SQ and the second pseudo-square operation SQ″ in the operation sequence 22. A pseudo-multiplication operation MT', and at least one of the multiplication operation MT and the second pseudo-multiplication operation MT" in the operation sequence 22 is performed, and a corresponding first pseudo-square operation SQ' is performed. As a result, it is difficult for an attacker to identify the RSA private key from the measured sequence of operations 26 during the decryption operation.

In an embodiment of the present invention, the decryption element 110 may include a decryption circuit (such as the decryption circuit 112 in FIG. 6 ) for performing the aforementioned decryption operation. As shown in FIG. 6 , the decryption circuit 112 includes a squarer SQC, a multiplier MTC, a multiplexer MUX and a temporary register REG. The input end of the squarer SQC and the first input end of the multiplier MTC are electrically connected to the output end of the register REG and the source end of the encrypted data N. The second input terminal of the multiplier MTC receives the encrypted data N. The output terminal of the squarer SQC and the output terminal of the multiplier MTC are respectively electrically connected to the first and second input terminals of the multiplexer MUX. The control terminal of the multiplexer MUX receives the control signal CS, and the output terminal of the multiplexer MUX is electrically connected to the input terminal of the register REG, wherein the control signal CS corresponds to the RSA private key.

The squarer SQC performs a square operation on the input value to generate a squarer output, and the multiplier MTC performs a multiplication operation on the input value and the encrypted data N to generate a multiplier output, wherein the input value can be the encrypted data N or the register REG. Output. The multiplexer MUX outputs one of a squarer output and a multiplier output as a multiplexer output according to the control signal CS. The register REG receives and temporarily stores the multiplexer output, and outputs it to the squarer SQC and the multiplier MTC as a new input value.

In this embodiment, the squarer SQC and the multiplier MTC perform the square operation and the multiplication operation at the same time, so that the attacker cannot know the operation performed by the decryption device 100 during decryption by measuring the relevant signals of the decryption device 100 and its corresponding RSA private key.

For example, referring to FIG. 3 at the same time, in the period T1, the input values of the squarer SQC and the multiplier MTC are both N, so the squarer SQC performs a squaring operation and outputs N^2, and at the same time the multiplier MTC performs a multiplication operation and outputs N^2. The multiplexer MUX selects the squarer output as the first multiplexer output according to the control signal CS. The register REG temporarily stores the output of the first multiplexer, and provides the output of the first multiplexer to the squarer SQC and the multiplier MTC in the next round of operation.

During the period T2, the input values of the squarer SQC and the multiplier MTC are both N^2, so the squarer SQC performs a square operation and outputs N^4, and at the same time, the multiplier MTC performs a multiplication operation and outputs N^3. The multiplexer MUX selects the multiplier output (ie, N^3) as the second multiplexer output according to the control signal CS. The register REG temporarily stores the output of the second multiplexer, and provides the output of the second multiplexer to the squarer SQC and the multiplier MTC in the next round of operation. The rest of the operations are analogous.

Through the above operations, the attacker cannot know the operations performed by the decryption device 100 during decryption and the corresponding RSA private key by measuring the relevant signals of the decryption device 100 .

In one embodiment, the decryption circuit 112 may further include a controller CTL (dotted line), the controller CTL is electrically connected to the register REG to control whether the register REG provides a new multiplexer output to the squarer SQC and Multiplier MTC.

For example, in the first operating state, when the register REG receives a new multiplexer output, the controller CTL may control the register REG to save the original multiplexer output and provide the original multiplexer output to Squarer SQC and Multiplier MTC. In addition, in the second operating state, when the register REG receives a new multiplexer output, the controller CTL can control the register REG to temporarily store the new multiplexer output and provide a new multiplexer output Output to squarer SQC and multiplier MTC.

For example, referring to FIG. 5 at the same time, in the period Q1, the input values of the squarer SQC and the multiplier MTC are both N, so the output of the squarer SQC and the output of the multiplier MTC are both N^2. The multiplexer MUX selects the squarer output as the first multiplexer output according to the control signal CS. The controller CTL controls the register REG to temporarily store the output of the first multiplexer, and provides the output of the first multiplexer to the squarer SQC and the multiplier MTC in the next round of operation.

In the period Q2, the input values of the squarer SQC and the multiplier MTC are both N^2, so the squarer SQC outputs N^4, and the multiplier MTC outputs N^3 at the same time. The multiplexer MUX selects the multiplier output as the second multiplexer output according to the control signal CS. The controller CTL controls the register REG to store the output of the first multiplexer, and provides the output of the first multiplexer to the squarer SQC and the multiplier MTC in the next round of operation.

In the period Q3, the input values of the squarer SQC and the multiplier MTC are both N^2, the squarer SQC outputs N^4, and the multiplier MTC outputs N^3. The multiplexer MUX selects the squarer output as the third multiplexer output according to the control signal CS. The controller CTL controls the register REG to store the output of the first multiplexer, and provides the output of the first multiplexer to the squarer SQC and the multiplier MTC in the next round of operation.

In the period Q4, the input values of the squarer SQC and the multiplier MTC are both N^2, so the squarer SQC outputs N^4, and the multiplier MTC outputs N^3 at the same time. The multiplexer MUX selects the multiplier output (ie, N^3) as the fourth multiplexer output according to the control signal CS. The controller CTL controls the register REG to temporarily store the output of the fourth multiplexer, and provides the output of the fourth multiplexer to the squarer SQC and the multiplier MTC as a new input value in the next round of operation.

Through the above operations, the attacker cannot know the operations performed by the decryption device 100 during decryption and the corresponding RSA private key by measuring the relevant signals of the decryption device 100 .

FIG. 7 is a schematic diagram of the decryption circuit 114 according to an embodiment of the present invention. In this embodiment, the decryption circuit 114 includes a multiplier MTC, a multiplexer MUX, a temporary register REG, and a controller CTL. The first input end of the multiplexer MUX is electrically connected to the output end of the register REG and the source end of the encrypted data N, the second input end of the multiplexer MUX receives the encrypted data N, and the control end of the multiplexer MUX receives the control For the signal CS, the output terminal of the multiplexer MUX is electrically connected to the first input terminal of the multiplier MTC. The second input terminal of the multiplier MTC is electrically connected to the output terminal of the register REG and the source terminal of the encrypted data N, and the output terminal of the multiplier MTC is electrically connected to the register REG. The controller CTL is electrically connected to the register REG.

The multiplexer MUX is used for outputting the received input value or encrypted data N according to the RSA private key (eg, the control signal CS). The input value can be the encrypted data N or the output of the register REG. The multiplier MTC is used to multiply the input value and the multiplexer output to generate the multiplier output. The register REG is used to receive and temporarily store the multiplier output, and provide the multiplier output to the multiplexer MUX and the multiplier MTC as a new input value. The controller CTL is used to control whether the register REG provides a new multiplier output to the multiplexer MUX and the multiplier MTC, wherein the function of the controller CTL can be, for example, the controller CTL shown in FIG. 6 .

For example, referring to FIG. 4 at the same time, in the period P1, the input values of the multiplexer MUX and the multiplier MTC are both N. The multiplexer MUX selects the input value as the multiplexer output according to the control signal CS. The multiplier MTC outputs N^2 as the first multiplier output. The controller CTL controls the register REG to keep the original value (eg, NULL), and provides the original value to the multiplexer MUX and the multiplier MTC in the next round of operation (eg, period P2 ).

During the period P2, the input values of the multiplexer MUX and the multiplier MTC are both still N. The multiplexer MUX selects the encrypted data N as the multiplexer output according to the control signal CS. The multiplier MTC outputs N^2 as the second multiplier output. The controller CTL controls the register REG to keep the original value, and provides the original value to the multiplexer MUX and the multiplier MTC in the next round of operation.

The operations in the period P3 are similar to those in the period P1, and are not repeated here.

In the period P4, the input values of the multiplexer MUX and the multiplier MTC are both still N. The multiplexer MUX selects the input value as the multiplexer output according to the control signal CS. The multiplier MTC outputs N^2 as the fourth multiplier output. The controller CTL controls the register REG to temporarily store the output of the fourth multiplier, and provides the output of the fourth multiplier to the multiplexer MUX and the multiplier MTC in the next round of operation. The rest of the steps are analogous.

Through the above operations, the attacker cannot know the operations performed by the decryption device 100 during decryption and the corresponding RSA private key by measuring the relevant signals of the decryption device 100 .

Although the present invention has been disclosed by the above embodiments, it is not intended to limit the present invention. Anyone skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the present invention The scope of protection shall be determined by the scope of the appended patent application.

Claims (10)

1. A decryption method, comprising: receiving an encrypted data, wherein the encrypted data is encrypted with an RSA public key; and Perform at least one multiplication operation and at least one square operation on the encrypted data according to an RSA private key to obtain a decrypted data; Wherein, while performing one of the at least one multiplication operation, a first pseudo-square operation is performed according to the encrypted data to change the characteristic value of the waveform corresponding to the multiplication operation, or while performing one of the at least one square operation, A first pseudo-multiplication operation is performed according to the encrypted data to change the characteristic value of the waveform corresponding to the square operation. 2 . The decryption method according to claim 1 , wherein the operation result of performing the first pseudo-square operation or the operation result of performing the first pseudo-multiplication operation is not used to generate the decrypted data. 3 . 3. The decryption method according to claim 1, further comprising: Before or after performing one of the at least one multiplication operation or one of the at least one squaring operation, a second pseudo-squaring operation or a second pseudo-multiplication operation is performed according to the encrypted data. 4. The decryption method according to claim 3 , wherein the second pseudo-multiplication operation is performed twice, between the multiplication operations twice, or between the second pseudo-multiplication operation and the multiplication operation once. The squaring operation or the second pseudo-squaring operation. 5. A decryption device, comprising: a communication module; and A decryption element to: receiving, through the communication module, encrypted data, wherein the encrypted data is encrypted with an RSA public key; and Perform at least one multiplication operation and at least one square operation on the encrypted data according to an RSA private key to obtain a decrypted data; Wherein, while performing one of the at least one multiplication operation, a first pseudo-square operation is performed according to the encrypted data to change the characteristic value of the waveform corresponding to the multiplication operation, or while performing one of the at least one square operation, A first pseudo-multiplication operation is performed according to the encrypted data to change the characteristic value of the waveform corresponding to the square operation. 6. The decryption apparatus of claim 5, wherein the number of times the square operation is performed corresponds to a length of one binary bit of the RSA private key. 7. The decryption apparatus of claim 6, wherein the number of times the first pseudo-multiplication operation is performed is the same as or less than the number of times the square operation is performed. 8. The decryption apparatus of claim 5, wherein the number of times the first pseudo-square operation is performed is the same as or less than the number of times the multiplication operation is performed. 9. A decryption circuit, comprising: a squarer for receiving an input value and performing a square operation on the input value to generate a squarer output; a multiplier for receiving the input value and an encrypted data, and performing a multiplication operation on the input value and the encrypted data to generate a multiplier output; a multiplexer for receiving the squarer output and the multiplier output and for outputting one of the squarer output and the multiplier output as a multiplexer output according to an RSA private key; and a register for temporarily storing the multiplexer output and providing the multiplexer output to the squarer and the multiplier as a new input value; The squaring operation and the multiplication operation are performed simultaneously to change the characteristic value of the waveform corresponding to the one of the output of the squarer and the output of the multiplier. 10. The decryption circuit according to claim 9, further comprising: a controller, wherein in a first operating state, when the register receives a new multiplexer output, the controller controls the register to save the multiplexer output and provides the multiplexer output to the squarer and the multiplier; and in a second operating state, when the register receives the new multiplexer output, the controller controls the register to temporarily store the new multiplexer and provide the new multiplexer output to the squarer and the multiplier.

Images