Information security device, information security method, computer program, computer-readable recording medium, and integrated circuit
The present invention aims to provide an information security apparatus that counters a simple power analysis attack (SPA) on an information security apparatus such as an RSA cryptosystem. The information security apparatus uses a multiplication with 1 in a Montgomery domain. 1 in the Montgomery domain is determined depending on a modulus and an integer k, which is greater than a number of bits of a modulus p. Therefore, it is hard for attackers who do not know p or k to analyze. Also, even if an analyzer can predict the Hamming weight, it is possible to further improve the safety against the SPA by modifying k or the modulus at random.
1. An information security apparatus for processing an input value securely and reliably by operating a modular exponentiation that raises the input value to a power of an integer over a predetermined modulus, the modular exponentiation including repeated multiplications performed on each digit of the integer so as to obtain an exponential value, the information security apparatus comprising:
a modulus setting unit operable to set a first value for the modulus;
an integer setting unit operable to randomly select an integer k which is greater than a number of valid bits of the modulus;
a judgment unit operable to judge whether a value of a digit of the integer is 0 or not;
a Montgomery transform unit operable to perform a Montgomery transform on a numeral value of 1 using the integer k in accordance with the first value for the modulus so as to calculate a Montgomery transform value; and
a multiplication unit operable, when the value of the digit is judged to be 0, to operate a modular multiplication using the Montgomery transform value calculated by the Montgomery transform unit.
2. The information security apparatus of claim 1 ,
wherein the Montgomery transform unit calculates, as the Montgomery transform value, a numeral value of 2 to a k-th power over the modulus.
3. The information security apparatus of claim 1 ,
wherein the Montgomery transform unit calculates, as the Montgomery transform value, a numeral value of 2 to a k-th power over the first value multiplied by a random number as the modulus.
4. The information security apparatus of claim 3 ,
wherein the modulus setting unit further sets a second value, which is obtained by multiplying the first value by the random number, for the modulus, and
wherein the Montgomery transform unit calculates the numeral value of 2 to the k-th power over the second value, which has been set by the modulus setting unit, as the modulus.
5. The information security apparatus of claim 1 ,
wherein the integer setting unit randomly changes a value of the integer k at every acquisition of an input value.
6. The information security apparatus of claim 1 ,
wherein the modulus setting unit randomly changes, at every acquisition of an input value, the first value for the modulus to be used in the Montgomery transform unit.
7. The information security apparatus of claim 1 ,
wherein the integer setting unit randomly changes a value of the integer k part way through the repetition.
8. The information security apparatus of claim 1 ,
wherein the modulus setting unit randomly changes the first value for the modulus to be used in the Montgomery transform unit part way through the repetition.
9. The information security apparatus of claim 1 ,
wherein the integer setting unit randomly changes a value of the integer k according to an instruction from outside.
10. The information security apparatus of claim 1 ,
wherein the modulus setting unit randomly changes the first value for the modulus to be used in the Montgomery transform unit according to an instruction from outside.
11. An information security apparatus for processing an input value securely and reliably by operating a modular exponentiation that raises the input value to a power of an integer over a predetermined modulus, the modular exponentiation including repeated multiplications performed on each digit of the integer so as to obtain an exponential value, the information security apparatus comprising:
a modulus setting unit operable to set a first value for the modulus;
an integer setting unit operable to randomly select an integer k which is greater than a number of valid bits of the modulus;
a judgment unit operable to judge whether a value of a digit of the integer is 0 or not
a first Montgomery transform unit operable to perform a first Montgomery transform on a numeral value of 1 using the integer k in accordance with the first value for the modulus so as to calculate a first Montgomery transform value;
a second Montgomery transform unit operable to perform a second Montgomery transform on a numeral value of 1 using the integer k in accordance with the first value for the modulus so as to calculate a second Montgomery transform value; and
a multiplication unit operable to (i) perform the modular multiplication using the second Montgomery transform value calculated by the second Montgomery transform unit when the value of the digit is judged to be 0 and (ii) perform the modular multiplication using the first Montgomery transform value calculated by the first Montgomery transform unit when the value of the digit is judged to be a value other than 0.
12. The information security apparatus of claim 11 ,
wherein the first Montgomery transform unit (i) calculates a numeral value of 2 to the k-th power over the modulus and (ii) sets, as the first Montgomery transform value, a value obtained by multiplying the input value by the calculated value.
13. The information security apparatus of claim 11 ,
wherein the second Montgomery transform unit calculates, as the second Montgomery transform value, a numeral value of 2 to a k-th power over the first value multiplied by the random number as the modulus.
14. An information security method used for an information security apparatus for processing an input value securely and reliably by operating a modular exponentiation that raises the input value to a power of an integer over a predetermined modulus, the modular exponentiation including repeated multiplications performed on each digit of the integer so as to obtain an exponential value, the information security method comprising:
a modulus setting step of setting a value of the modulus;
an integer setting step of randomly selecting an integer k which is greater than a number of valid bits of the modulus;
a judgment step of judging whether a value of a digit of the integer is 0 or not;
a Montgomery transform step of performing, using a processor, a Montgomery transform on a numeral value of 1 using the integer k in accordance with the set value of the modulus so as to calculate a Montgomery transform value; and
a multiplying step of operating, when the value of the digit is judged to be 0, a modular multiplication using the Montgomery transform value calculated by the Montgomery transform unit.
15. A non-transitory computer readable recording medium having stored thereon a computer program for information security used for an information security apparatus for processing an input value securely and reliably by operating a modular exponentiation that raises the input value to a power of an integer over a predetermined modulus, the modular exponentiation including repeated multiplications performed on each digit of the integer so as to obtain an exponential value, wherein, when executed, the computer program causes the information security apparatus to perform a method comprising:
a modulus setting step of setting a value of the modulus;
an integer setting step of randomly selecting an integer k which is greater than a number of valid bits of the modulus;
a judgment step of judging whether a value of a digit of the integer is 0 or not;
a Montgomery transform step of performing a Montgomery transform on a numeral value of 1 using the integer k in accordance with the set value of the modulus so as to calculate a Montgomery transform value by; and
a multiplying step of operating, when the value of the digit is judged to be 0, a modular multiplication using the Montgomery transform value calculated by the Montgomery transform unit.
16. An integrated circuit for processing an input value securely and reliably by operating a modular exponentiation that raises the input value to a power of an integer over a predetermined modulus, the modular exponentiation including repeated multiplications performed on each digit of the integer so as to obtain an exponential value, the integrated circuit comprising:
a modulus setting unit operable to set a first value for the modulus;
an integer setting unit operable to randomly select an integer k which is greater than a number of valid bits of the modulus;
a judgment unit operable to judge whether a value of a digit of the integer is 0 or not;
a Montgomery transform unit operable to perform a Montgomery transform on a numeral value of 1 using the integer k in accordance with the first value for the modulus so as to calculate a Montgomery transform value; and
a multiplication unit operable, when the value of the digit is judged to be 0, to operate a modular multiplication using the Montgomery transform value calculated by the Montgomery transform unit.