RE: [PATCH v6 0/3] crypto: caam - add support for RSA algorithm
Hi Stephan, > > > as I am looking into the RSA countermeasures, I am wondering how much > of > > > countermeasures are actually applied inside hardware implementations. > > > > Please point me to the reference RSA countermeasures so that we have > > a common point of start. > > As the entire MPI logic is derived from libgcrypt, I am planning to use the > libgcrypt implementation as a basis to implement the blinding defined by > the > Handbook of Applied Cryptograpy 11.118/11.119. When using private key operation commands, our hardware provides 'timing equalization' to hide key information from timing attacks such that the modular exponentiation will take the same amount of time for a given byte length of N combined with a given byte length of the exponent. The other part of timing equalization causes each bit of exponent to take the same amount of time to process. In normal exponentiation, a one bit takes two multiplies, while a zero bit takes just one. In timing equalization, a zero bit causes an extra, but 'fake' multiply. Thanks, ta -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH v6 0/3] crypto: caam - add support for RSA algorithm
Am Dienstag, 24. Mai 2016, 16:13:48 schrieb Tudor-Dan Ambarus: Hi Tudor, > Hi Stephan, > > > > > as I am looking into the RSA countermeasures, I am wondering how much > > > > of > > > > > > countermeasures are actually applied inside hardware implementations. > > > > > > Please point me to the reference RSA countermeasures so that we have > > > a common point of start. > > > > As the entire MPI logic is derived from libgcrypt, I am planning to use > > the > > libgcrypt implementation as a basis to implement the blinding defined by > > the > > Handbook of Applied Cryptograpy 11.118/11.119. > > When using private key operation commands, our hardware provides > 'timing equalization' to hide key information from timing attacks such that > the modular exponentiation will take the same amount of time for a given > byte length of N combined with a given byte length of the exponent. Great, that is the other countermeasure option for RSA. So, your implementation would be covered. I guess it would make sense to implement countermeasures on an as-needed basis then. > > The other part of timing equalization causes each bit of exponent to take > the same amount of time to process. In normal exponentiation, a one bit > takes two multiplies, while a zero bit takes just one. In timing > equalization, a zero bit causes an extra, but 'fake' multiply. Good, so you have two types of countermeasures it seems. Again, you should be good then. Ciao Stephan -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
RE: [PATCH v6 0/3] crypto: caam - add support for RSA algorithm
Hi Stephan, > as I am looking into the RSA countermeasures, I am wondering how much of > countermeasures are actually applied inside hardware implementations. Please point me to the reference RSA countermeasures so that we have a common point of start. Thanks, ta -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH v6 0/3] crypto: caam - add support for RSA algorithm
Am Montag, 23. Mai 2016, 12:56:18 schrieb Tudor-Dan Ambarus:
Hi Tudor,
> Hi Stephan,
>
> > as I am looking into the RSA countermeasures, I am wondering how much of
> > countermeasures are actually applied inside hardware implementations.
>
> Please point me to the reference RSA countermeasures so that we have
> a common point of start.
As the entire MPI logic is derived from libgcrypt, I am planning to use the
libgcrypt implementation as a basis to implement the blinding defined by the
Handbook of Applied Cryptograpy 11.118/11.119.
This is the code from libgcrypt:
{
/* First, we need a random number r between 0 and n - 1, which
is relatively prime to n (i.e. it is neither p nor q). The
random number needs to be only unpredictable, thus we employ
the gcry_create_nonce function by using GCRY_WEAK_RANDOM with
gcry_mpi_randomize. */
r = mpi_snew (ctx.nbits);
ri = mpi_snew (ctx.nbits);
bldata = mpi_snew (ctx.nbits);
do
{
_gcry_mpi_randomize (r, ctx.nbits, GCRY_WEAK_RANDOM);
mpi_mod (r, r, sk.n);
}
while (!mpi_invm (ri, r, sk.n));
/* Do blinding. We calculate: y = (x * r^e) mod n, where r is
the random number, e is the public exponent, x is the
non-blinded data and n is the RSA modulus. */
mpi_powm (bldata, r, sk.e, sk.n);
mpi_mulm (bldata, bldata, data, sk.n);
/* Perform decryption. */
secret (plain, bldata, &sk);
_gcry_mpi_release (bldata); bldata = NULL;
/* Undo blinding. Here we calculate: y = (x * r^-1) mod n,
where x is the blinded decrypted data, ri is the modular
multiplicative inverse of r and n is the RSA modulus. */
mpi_mulm (plain, plain, ri, sk.n);
_gcry_mpi_release (r); r = NULL;
_gcry_mpi_release (ri); ri = NULL;
}
"All we need" in the kernel is mpi_invm and mpi_mulm.
>
> Thanks,
> ta
Ciao
Stephan
--
To unsubscribe from this list: send the line "unsubscribe linux-crypto" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH v6 0/3] crypto: caam - add support for RSA algorithm
Am Donnerstag, 19. Mai 2016, 15:15:15 schrieb Tudor Ambarus: Hi Tudor, as I am looking into the RSA countermeasures, I am wondering how much of countermeasures are actually applied inside hardware implementations. Can you please point me to or illustrate any countermeasures your implementation does? The goal for my question is to identify whether we need to have a generic implementation one that is enabled on a per-implementation basis. Ciao Stephan -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH v6 0/3] crypto: caam - add support for RSA algorithm
On 5/19/2016 3:15 PM, Tudor Ambarus wrote: > Depends on: > [PATCH v2] crypto: rsa - return raw integers for the ASN.1 parser > > Changes in v6: > - write descriptor PDB fields with inline append > - move Protocol Data Block (pdb) structures to pdb.h > - move setting of PDB fields in new functions > - unmap sec4_sg_dma on done callback > - remove redundant clean code on error path > - fix doc typos > > Changes in v5: > - sync with ASN.1 parser > > Changes in v4: > - sync with ASN.1 parser > > Changes in v3: > - sync with ASN.1 parser > > Changes in v2: > - fix memory leaks on error path > - rename struct akcipher_alg rsa to caam_rsa > > > Tudor Ambarus (3): > crypto: scatterwak - Add scatterwalk_sg_copychunks > crypto: scatterwalk - export scatterwalk_pagedone > crypto: caam - add support for RSA algorithm > > crypto/scatterwalk.c | 31 ++- > drivers/crypto/caam/Kconfig | 12 + > drivers/crypto/caam/Makefile | 4 + > drivers/crypto/caam/caampkc.c | 569 > ++ > drivers/crypto/caam/caampkc.h | 56 > drivers/crypto/caam/desc.h| 2 + > drivers/crypto/caam/desc_constr.h | 7 + > drivers/crypto/caam/pdb.h | 51 +++- > drivers/crypto/caam/pkc_desc.c| 35 +++ > include/crypto/scatterwalk.h | 4 + > 10 files changed, 768 insertions(+), 3 deletions(-) > create mode 100644 drivers/crypto/caam/caampkc.c > create mode 100644 drivers/crypto/caam/caampkc.h > create mode 100644 drivers/crypto/caam/pkc_desc.c > Checked that when adding on top the patch set from here: [PATCH v3 0/8] crypto: caam - add support for LS1043A SoC https://www.mail-archive.com/[email protected]/msg19096.html RSA works on LS1043A, so Tested-by: Horia Geantă Horia -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH v6 0/3] crypto: caam - add support for RSA algorithm
Depends on: [PATCH v2] crypto: rsa - return raw integers for the ASN.1 parser Changes in v6: - write descriptor PDB fields with inline append - move Protocol Data Block (pdb) structures to pdb.h - move setting of PDB fields in new functions - unmap sec4_sg_dma on done callback - remove redundant clean code on error path - fix doc typos Changes in v5: - sync with ASN.1 parser Changes in v4: - sync with ASN.1 parser Changes in v3: - sync with ASN.1 parser Changes in v2: - fix memory leaks on error path - rename struct akcipher_alg rsa to caam_rsa Tudor Ambarus (3): crypto: scatterwak - Add scatterwalk_sg_copychunks crypto: scatterwalk - export scatterwalk_pagedone crypto: caam - add support for RSA algorithm crypto/scatterwalk.c | 31 ++- drivers/crypto/caam/Kconfig | 12 + drivers/crypto/caam/Makefile | 4 + drivers/crypto/caam/caampkc.c | 569 ++ drivers/crypto/caam/caampkc.h | 56 drivers/crypto/caam/desc.h| 2 + drivers/crypto/caam/desc_constr.h | 7 + drivers/crypto/caam/pdb.h | 51 +++- drivers/crypto/caam/pkc_desc.c| 35 +++ include/crypto/scatterwalk.h | 4 + 10 files changed, 768 insertions(+), 3 deletions(-) create mode 100644 drivers/crypto/caam/caampkc.c create mode 100644 drivers/crypto/caam/caampkc.h create mode 100644 drivers/crypto/caam/pkc_desc.c -- 1.8.3.1 -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
